commit 2dde18cd1d8fac735875f2e4987f11817cc0bc2c Author: Linus Torvalds Date: Sun Aug 27 14:49:51 2023 -0700 Linux 6.5 commit 85eb043618bb17124050197d71c453d4a1f556e5 Merge: 28f20a19294da 1bd3a76880b2b Author: Linus Torvalds Date: Sun Aug 27 07:33:54 2023 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Three small driver fixes and one larger unused function set removal in the raid class (so no external impact)" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: snic: Fix double free in snic_tgt_create() scsi: core: raid_class: Remove raid_component_add() scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5 scsi: ufs: mcq: Fix the search/wrap around logic commit 28f20a19294da7df158dfca259d0e2b5866baaf9 Merge: 3b35375f19fe8 2c66ca3949dc7 Author: Linus Torvalds Date: Sat Aug 26 10:57:29 2023 -0700 Merge tag 'x86-urgent-2023-08-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Fix an FPU invalidation bug on exec(), and fix a performance regression due to a missing setting of X86_FEATURE_OSXSAVE" * tag 'x86-urgent-2023-08-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 x86/fpu: Invalidate FPU state correctly on exec() commit 3b35375f19fe87b5d8822ce01f917095d575ee28 Merge: c313761337fb8 9f5deb551655a Author: Linus Torvalds Date: Sat Aug 26 10:34:29 2023 -0700 Merge tag 'irq-urgent-2023-08-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Thomas Gleixner: "A last minute fix for a regression introduced in the v6.5 merge window. The conversion of the software based interrupt resend mechanism to hlist missed to add a check whether the descriptor is already enqueued and dropped the interrupt descriptor lookup for nested interrupts. The missing check whether the descriptor is already queued causes hlist corruption and can be observed in the wild. The dropped parent descriptor lookup has not yet caused problems, but it would result in stale interrupt line in the worst case. Add the missing enqueued check and bring the descriptor lookup back to cure this" * tag 'irq-urgent-2023-08-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: genirq: Fix software resend lockup and nested resend commit c313761337fb8fa7fc44296f0e10844505916208 Merge: 7d2f353b2682d 9730870b484e9 Author: Linus Torvalds Date: Sat Aug 26 10:28:52 2023 -0700 Merge tag 'loongarch-fixes-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Fix a ptrace bug, a hw_breakpoint bug, some build errors/warnings and some trivial cleanups" * tag 'loongarch-fixes-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: Fix hw_breakpoint_control() for watchpoints LoongArch: Ensure FP/SIMD registers in the core dump file is up to date LoongArch: Put the body of play_dead() into arch_cpu_idle_dead() LoongArch: Add identifier names to arguments of die() declaration LoongArch: Return earlier in die() if notify_die() returns NOTIFY_STOP LoongArch: Do not kill the task in die() if notify_die() returns NOTIFY_STOP LoongArch: Remove LoongArch: Replace #include with #include LoongArch: Remove unneeded #include LoongArch: Replace -ffreestanding with finer-grained -fno-builtin's LoongArch: Remove redundant "source drivers/firmware/Kconfig" commit 9f5deb551655a4cff04b21ecffdcdab75112da3a Author: Johan Hovold Date: Sat Aug 26 17:40:04 2023 +0200 genirq: Fix software resend lockup and nested resend The switch to using hlist for managing software resend of interrupts broke resend in at least two ways: First, unconditionally adding interrupt descriptors to the resend list can corrupt the list when the descriptor in question has already been added. This causes the resend tasklet to loop indefinitely with interrupts disabled as was recently reported with the Lenovo ThinkPad X13s after threaded NAPI was disabled in the ath11k WiFi driver. This bug is easily fixed by restoring the old semantics of irq_sw_resend() so that it can be called also for descriptors that have already been marked for resend. Second, the offending commit also broke software resend of nested interrupts by simply discarding the code that made sure that such interrupts are retriggered using the parent interrupt. Add back the corresponding code that adds the parent descriptor to the resend list. Fixes: bc06a9e08742 ("genirq: Use hlist for managing resend handlers") Signed-off-by: Johan Hovold Signed-off-by: Thomas Gleixner Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/lkml/20230809073432.4193-1-johan+linaro@kernel.org/ Link: https://lore.kernel.org/r/20230826154004.1417-1-johan+linaro@kernel.org commit 9730870b484e9de852b51df08a8b357b1129489e Author: Huacai Chen Date: Sat Aug 26 22:21:57 2023 +0800 LoongArch: Fix hw_breakpoint_control() for watchpoints In hw_breakpoint_control(), encode_ctrl_reg() has already encoded the MWPnCFG3_LoadEn/MWPnCFG3_StoreEn bits in info->ctrl. We don't need to add (1 << MWPnCFG3_LoadEn | 1 << MWPnCFG3_StoreEn) unconditionally. Otherwise we can't set read watchpoint and write watchpoint separately. Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen commit 656f9aec07dba7c61d469727494a5d1b18d0bef4 Author: Huacai Chen Date: Sat Aug 26 22:21:57 2023 +0800 LoongArch: Ensure FP/SIMD registers in the core dump file is up to date This is a port of commit 379eb01c21795edb4c ("riscv: Ensure the value of FP registers in the core dump file is up to date"). The values of FP/SIMD registers in the core dump file come from the thread.fpu. However, kernel saves the FP/SIMD registers only before scheduling out the process. If no process switch happens during the exception handling, kernel will not have a chance to save the latest values of FP/SIMD registers. So it may cause their values in the core dump file incorrect. To solve this problem, force fpr_get()/simd_get() to save the FP/SIMD registers into the thread.fpu if the target task equals the current task. Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen commit 7d2f353b2682dcfe5f9bc71e5b61d5b61770d98e Merge: 382d4cd184751 66fbfb35da47f Author: Linus Torvalds Date: Fri Aug 25 17:49:03 2023 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "One clk driver fix and two clk framework fixes: - Fix an OOB access when devm_get_clk_from_child() is used and devm_clk_release() casts the void pointer to the wrong type - Move clk_rate_exclusive_{get,put}() within the correct ifdefs in clk.h so that the stubs are used when CONFIG_COMMON_CLK=n - Register the proper clk provider function depending on the value of #clock-cells in the TI keystone driver" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: Fix slab-out-of-bounds error in devm_clk_release() clk: Fix undefined reference to `clk_rate_exclusive_{get,put}' clk: keystone: syscon-clk: Fix audio refclk commit 382d4cd1847517ffcb1800fd462b625db7b2ebea Author: Helge Deller Date: Fri Aug 25 21:50:33 2023 +0200 lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels The gcc compiler translates on some architectures the 64-bit __builtin_clzll() function to a call to the libgcc function __clzdi2(), which should take a 64-bit parameter on 32- and 64-bit platforms. But in the current kernel code, the built-in __clzdi2() function is defined to operate (wrongly) on 32-bit parameters if BITS_PER_LONG == 32, thus the return values on 32-bit kernels are in the range from [0..31] instead of the expected [0..63] range. This patch fixes the in-kernel functions __clzdi2() and __ctzdi2() to take a 64-bit parameter on 32-bit kernels as well, thus it makes the functions identical for 32- and 64-bit kernels. This bug went unnoticed since kernel 3.11 for over 10 years, and here are some possible reasons for that: a) Some architectures have assembly instructions to count the bits and which are used instead of calling __clzdi2(), e.g. on x86 the bsr instruction and on ppc cntlz is used. On such architectures the wrong __clzdi2() implementation isn't used and as such the bug has no effect and won't be noticed. b) Some architectures link to libgcc.a, and the in-kernel weak functions get replaced by the correct 64-bit variants from libgcc.a. c) __builtin_clzll() and __clzdi2() doesn't seem to be used in many places in the kernel, and most likely only in uncritical functions, e.g. when printing hex values via seq_put_hex_ll(). The wrong return value will still print the correct number, but just in a wrong formatting (e.g. with too many leading zeroes). d) 32-bit kernels aren't used that much any longer, so they are less tested. A trivial testcase to verify if the currently running 32-bit kernel is affected by the bug is to look at the output of /proc/self/maps: Here the kernel uses a correct implementation of __clzdi2(): root@debian:~# cat /proc/self/maps 00010000-00019000 r-xp 00000000 08:05 787324 /usr/bin/cat 00019000-0001a000 rwxp 00009000 08:05 787324 /usr/bin/cat 0001a000-0003b000 rwxp 00000000 00:00 0 [heap] f7551000-f770d000 r-xp 00000000 08:05 794765 /usr/lib/hppa-linux-gnu/libc.so.6 ... and this kernel uses the broken implementation of __clzdi2(): root@debian:~# cat /proc/self/maps 0000000010000-0000000019000 r-xp 00000000 000000008:000000005 787324 /usr/bin/cat 0000000019000-000000001a000 rwxp 000000009000 000000008:000000005 787324 /usr/bin/cat 000000001a000-000000003b000 rwxp 00000000 00:00 0 [heap] 00000000f73d1000-00000000f758d000 r-xp 00000000 000000008:000000005 794765 /usr/lib/hppa-linux-gnu/libc.so.6 ... Signed-off-by: Helge Deller Fixes: 4df87bb7b6a22 ("lib: add weak clz/ctz functions") Cc: Chanho Min Cc: Geert Uytterhoeven Cc: stable@vger.kernel.org # v3.11+ Signed-off-by: Linus Torvalds commit 6f0edbb833ec16ab2042073af4846152b455104d Merge: 4942fed84b98c e5548f85b4527 Author: Linus Torvalds Date: Fri Aug 25 11:44:43 2023 -0700 Merge tag 'mm-hotfixes-stable-2023-08-25-11-07' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "18 hotfixes. 13 are cc:stable and the remainder pertain to post-6.4 issues or aren't considered suitable for a -stable backport" * tag 'mm-hotfixes-stable-2023-08-25-11-07' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: shmem: fix smaps BUG sleeping while atomic selftests: cachestat: catch failing fsync test on tmpfs selftests: cachestat: test for cachestat availability maple_tree: disable mas_wr_append() when other readers are possible madvise:madvise_free_pte_range(): don't use mapcount() against large folio for sharing check madvise:madvise_free_huge_pmd(): don't use mapcount() against large folio for sharing check madvise:madvise_cold_or_pageout_pte_range(): don't use mapcount() against large folio for sharing check mm: multi-gen LRU: don't spin during memcg release mm: memory-failure: fix unexpected return value in soft_offline_page() radix tree: remove unused variable mm: add a call to flush_cache_vmap() in vmap_pfn() selftests/mm: FOLL_LONGTERM need to be updated to 0x100 nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() mm/gup: handle cont-PTE hugetlb pages correctly in gup_must_unshare() via GUP-fast selftests: cgroup: fix test_kmem_basic less than error mm: enable page walking API to lock vmas during the walk smaps: use vm_normal_page_pmd() instead of follow_trans_huge_pmd() mm/gup: reintroduce FOLL_NUMA as FOLL_HONOR_NUMA_FAULT commit 4942fed84b98cfb71d3cdff1a3df0072a57bbdfa Merge: 98c6b8a558d26 ef21fa7c198e0 Author: Linus Torvalds Date: Fri Aug 25 09:29:47 2023 -0700 Merge tag 'riscv-for-linus-6.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: "This is obviously not ideal, particularly for something this late in the cycle. Unfortunately we found some uABI issues in the vector support while reviewing the GDB port, which has triggered a revert -- probably a good sign we should have reviewed GDB before merging this, I guess I just dropped the ball because I was so worried about the context extension and libc suff I forgot. Hence the late revert. There's some risk here as we're still exposing the vector context for signal handlers, but changing that would have meant reverting all of the vector support. The issues we've found so far have been fixed already and they weren't absolute showstoppers, so we're essentially just playing it safe by holding ptrace support for another release (or until we get through a proper userspace code review). Summary: - The vector ucontext extension has been extended with vlenb - The vector registers ELF core dump note type has been changed to avoid aliasing with the CSR type used in embedded systems - Support for accessing vector registers via ptrace() has been reverted - Another build fix for the ISA spec changes around Zifencei/Zicsr that manifests on some systems built with binutils-2.37 and gcc-11.2" * tag 'riscv-for-linus-6.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Fix build errors using binutils2.37 toolchains RISC-V: vector: export VLENB csr in __sc_riscv_v_state RISC-V: Remove ptrace support for vectors commit 98c6b8a558d26d3c334986146d9d03ece5f25dec Merge: a87eaffbb26b8 6e39c1ac68816 Author: Linus Torvalds Date: Fri Aug 25 09:18:22 2023 -0700 Merge tag 'gpio-fixes-for-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix an irq mapping leak in gpio-sim - associate the GPIO device's software node with the irq domain in gpio-sim * tag 'gpio-fixes-for-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: sim: pass the GPIO device's software node to irq domain gpio: sim: dispose of irq mappings before destroying the irq_sim domain commit a87eaffbb26b810d50769272effbe6747e1e3ea4 Merge: ced5bf2493d42 6bc3462a0f5ec Author: Linus Torvalds Date: Fri Aug 25 09:10:16 2023 -0700 Merge tag 'pinctrl-v6.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Here are some Renesas and AMD driver fixes, the AMD fix affects important laptops in the wild so this one is pretty important. It seems a bit tough to get this right. - Fix DT parsing and related locking in the Renesas driver. - Fix wakeup IRQs in the AMD driver once again. Really tricky this one" * tag 'pinctrl-v6.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: amd: Mask wake bits on probe again pinctrl: renesas: rza2: Add lock around pinctrl_generic{{add,remove}_group,{add,remove}_function} pinctrl: renesas: rzv2m: Fix NULL pointer dereference in rzv2m_dt_subnode_to_map() pinctrl: renesas: rzg2l: Fix NULL pointer dereference in rzg2l_dt_subnode_to_map() commit ced5bf2493d42fe855c224b2ae2ac6545fd91517 Merge: beaa71d6e6410 37e44d60cb875 Author: Linus Torvalds Date: Fri Aug 25 08:48:14 2023 -0700 Merge tag 'sound-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Hopefully the last bits for 6.5. It's slightly higher LOCs than wished, but it doesn't look scary. The biggest change is MAINTAINERS update for TI; it's good to have the update before the final release, so that people can contact to the right persons for bug reports (which shouldn't happen of course!) The rest are all device-specific fixes and quirks, most for various ASoC platforms" * tag 'sound-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: amd: yc: Fix a non-functional mic on Lenovo 82SJ ALSA: ymfpci: Fix the missing snd_card_free() call at probe error ASoC: cs35l41: Correct amp_gain_tlv values ASoC: amd: yc: Add VivoBook Pro 15 to quirks list for acp6x ASoC: tas2781: fixed register access error when switching to other chips ASoC: cs35l56: Add an ACPI match table ASoC: cs35l56: Read firmware uuid from a device property instead of _SUB ASoC: SOF: ipc4-pcm: fix possible null pointer deference MAINTAINERS: Add entries for TEXAS INSTRUMENTS ASoC DRIVERS commit c337c849ab528241897ddfb6f334912ead0bfd66 Author: Tiezhu Yang Date: Fri Aug 25 23:40:38 2023 +0800 LoongArch: Put the body of play_dead() into arch_cpu_idle_dead() The initial aim is to silence the following objtool warning: arch/loongarch/kernel/process.o: warning: objtool: arch_cpu_idle_dead() falls through to next function start_thread() According to tools/objtool/Documentation/objtool.txt, this is because the last instruction of arch_cpu_idle_dead() is a call to a noreturn function play_dead(). In order to silence the warning, one simple way is to add the noreturn function play_dead() to objtool's hard-coded global_noreturns array, that is to say, just put "NORETURN(play_dead)" into tools/objtool/noreturns.h, it works well. But I noticed that play_dead() is only defined once and only called by arch_cpu_idle_dead(), so put the body of play_dead() into the caller arch_cpu_idle_dead(), then remove the noreturn function play_dead() is an alternative way which can reduce the overhead of the function call at the same time. Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 8879515e1219857df1f142e23840b91a37cbde88 Author: Tiezhu Yang Date: Fri Aug 25 23:40:26 2023 +0800 LoongArch: Add identifier names to arguments of die() declaration Add identifier names to arguments of die() declaration in ptrace.h to fix the following checkpatch warnings: WARNING: function definition argument 'const char *' should also have an identifier name WARNING: function definition argument 'struct pt_regs *' should also have an identifier name Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit a038ae7148469ab6cf4afadb155a15d9554a0b59 Author: Tiezhu Yang Date: Fri Aug 25 23:40:26 2023 +0800 LoongArch: Return earlier in die() if notify_die() returns NOTIFY_STOP After the call to oops_exit(), it should not panic or execute the crash kernel if the oops is to be suppressed. Suggested-by: Maciej W. Rozycki Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 6933c11fb501a40681d43336b3e0eee9df2abee0 Author: Tiezhu Yang Date: Fri Aug 25 23:40:26 2023 +0800 LoongArch: Do not kill the task in die() if notify_die() returns NOTIFY_STOP If notify_die() returns NOTIFY_STOP, honor the return value from the handler chain invocation in die() and return without killing the task as, through a debugger, the fault may have been fixed. It makes sense even if ignoring the event will make the system unstable: by allowing access through a debugger it has been compromised already anyway. It makes our port consistent with x86, arm64, riscv and csky. Commit 20c0d2d44029 ("[PATCH] i386: pass proper trap numbers to die chain handlers") may be the earliest of similar changes. Link: https://lore.kernel.org/r/43DDF02E.76F0.0078.0@novell.com/ Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit a746ceb1f32cc375e983c4bc40378a72ff26c766 Author: Masahiro Yamada Date: Fri Aug 25 23:40:26 2023 +0800 LoongArch: Remove All *.S files under arch/loongarch/ have been converted to include instead of . Remove . Signed-off-by: Masahiro Yamada Signed-off-by: Huacai Chen commit 55b46ff9396caca6ebb73a1d5a00f6f8698391cc Author: Masahiro Yamada Date: Fri Aug 25 23:40:26 2023 +0800 LoongArch: Replace #include with #include Commit ddb5cdbafaaad ("kbuild: generate KSYMTAB entries by modpost") deprecated , which is now a wrapper of . Replace #include with #include . After all the lines are converted, and will be removed. Signed-off-by: Masahiro Yamada Signed-off-by: Huacai Chen commit 347aa8dec220c7692981e1a175391ea7620abfeb Author: Masahiro Yamada Date: Fri Aug 25 23:40:26 2023 +0800 LoongArch: Remove unneeded #include There is no EXPORT_SYMBOL() line there, hence #include is unneeded. Signed-off-by: Masahiro Yamada Signed-off-by: Huacai Chen commit 3f301dc292eb122eff61b8b2906e519154b0327f Author: WANG Xuerui Date: Fri Aug 25 23:40:26 2023 +0800 LoongArch: Replace -ffreestanding with finer-grained -fno-builtin's As explained by Nick in the original issue: the kernel usually does a good job of providing library helpers that have similar semantics as their ordinary userspace libc equivalents, but -ffreestanding disables such libcall optimization and other related features in the compiler, which can lead to unexpected things such as CONFIG_FORTIFY_SOURCE not working (!). However, due to the desire for better control over unaligned accesses with respect to CONFIG_ARCH_STRICT_ALIGN, and also for avoiding the GCC bug https://gcc.gnu.org/PR109465, we do want to still disable optimizations for the memory libcalls (memcpy, memmove and memset for now). Use finer-grained -fno-builtin-* toggles to achieve this without losing source fortification and other libcall optimizations. Closes: https://github.com/ClangBuiltLinux/linux/issues/1897 Reported-by: Nathan Chancellor Suggested-by: Nick Desaulniers Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit b8e2771b7f880a0b899b380ef15476160c693b59 Author: Xi Ruoyao Date: Fri Aug 25 23:40:26 2023 +0800 LoongArch: Remove redundant "source drivers/firmware/Kconfig" In drivers/Kconfig, drivers/firmware/Kconfig is sourced for all ports so there is no need to source it in the port-specific Kconfig file. And sourcing it here also caused the "Firmware Drivers" menu appeared two times: one in the "Device Drivers" menu, another in the toplevel menu. This is really puzzling so remove it. Reviewed-by: Randy Dunlap Signed-off-by: Xi Ruoyao Signed-off-by: Huacai Chen commit beaa71d6e64103403a328bcc8cefa6e9b19544c1 Merge: 4f9e7fabf8643 59fe2029b9e05 Author: Linus Torvalds Date: Fri Aug 25 08:38:40 2023 -0700 Merge tag 'drm-fixes-2023-08-25' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "A bit bigger than I'd care for, but it's mostly a single vmwgfx fix and a fix for an i915 hotplug probing. Otherwise misc i915, bridge, panfrost and dma-buf fixes. core: - add a HPD poll helper i915: - fix regression in i915 polling - fix docs build warning - fix DG2 idle power consumption bridge: - samsung-dsim: init fix panfrost: - fix speed binning issue dma-buf: - fix recursive lock in fence signal vmwgfx: - fix shader stage validation - fix NULL ptr derefs in gem put" * tag 'drm-fixes-2023-08-25' of git://anongit.freedesktop.org/drm/drm: drm/i915: Fix HPD polling, reenabling the output poll work as needed drm: Add an HPD poll helper to reschedule the poll work drm/vmwgfx: Fix possible invalid drm gem put calls drm/vmwgfx: Fix shader stage validation dma-buf/sw_sync: Avoid recursive lock during fence signal drm/i915: fix Sphinx indentation warning drm/i915/dgfx: Enable d3cold at s2idle drm/display/dp: Fix the DP DSC Receiver cap size drm/panfrost: Skip speed binning on EOPNOTSUPP drm: bridge: samsung-dsim: Fix init during host transfer commit 37e44d60cb875862930359e16a1f4764cedb342b Merge: a4a6eed851bb6 c008323fe361b Author: Takashi Iwai Date: Fri Aug 25 09:43:49 2023 +0200 Merge tag 'asoc-fix-v6.5-rc7-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Quirk for v6.5 One additional fix for v6.5, an additional quirk. As with the other fixes this could wait for the merge window. commit 4f9e7fabf8643003afefc172e62dd276686f016e Merge: 14ddccc8a647f e332938e6fc81 Author: Linus Torvalds Date: Thu Aug 24 19:39:20 2023 -0700 Merge tag 'trace-v6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix ring buffer being permanently disabled due to missed record_disabled() Changing the trace cpu mask will disable the ring buffers for the CPUs no longer in the mask. But it fails to update the snapshot buffer. If a snapshot takes place, the accounting for the ring buffer being disabled is corrupted and this can lead to the ring buffer being permanently disabled. - Add test case for snapshot and cpu mask working together - Fix memleak by the function graph tracer not getting closed properly. The iterator is used to read the ring buffer. When it opens, it calls the open function of a tracer, and when it is closed, it calls the close iteration. While a trace is being read, it is still possible to change the tracer. If this happens between the function graph tracer and the wakeup tracer (which uses function graph tracing), the tracers are not closed properly during when the iterator sees the switch, and the wakeup function did not initialize its private pointer to NULL, which is used to know if the function graph tracer was the last tracer. It could be fooled in thinking it is, but then on exit it does not call the close function of the function graph tracer to clean up its data. - Fix synthetic events on big endian machines, by introducing a union that does the conversions properly. - Fix synthetic events from printing out the number of elements in the stacktrace when it shouldn't. - Fix synthetic events stacktrace to not print a bogus value at the end. - Introduce a pipe_cpumask that prevents the trace_pipe files from being opened by more than one task (file descriptor). There was a race found where if splice is called, the iter->ent could become stale and events could be missed. There's no point reading a producer/consumer file by more than one task as they will corrupt each other anyway. Add a cpumask that keeps track of the per_cpu trace_pipe files as well as the global trace_pipe file that prevents more than one open of a trace_pipe file that represents the same ring buffer. This prevents the race from happening. - Fix ftrace samples for arm64 to work with older compilers. * tag 'trace-v6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: samples: ftrace: Replace bti assembly with hint for older compiler tracing: Introduce pipe_cpumask to avoid race on trace_pipes tracing: Fix memleak due to race between current_tracer and trace tracing/synthetic: Allocate one additional element for size tracing/synthetic: Skip first entry for stack traces tracing/synthetic: Use union instead of casts selftests/ftrace: Add a basic testcase for snapshot tracing: Fix cpu buffers unavailable due to 'record_disabled' missed commit 1bd3a76880b2bce017987cf53780b372cf59528e Author: Zhu Wang Date: Sat Aug 19 08:39:41 2023 +0000 scsi: snic: Fix double free in snic_tgt_create() Commit 41320b18a0e0 ("scsi: snic: Fix possible memory leak if device_add() fails") fixed the memory leak caused by dev_set_name() when device_add() failed. However, it did not consider that 'tgt' has already been released when put_device(&tgt->dev) is called. Remove kfree(tgt) in the error path to avoid double free of 'tgt' and move put_device(&tgt->dev) after the removed kfree(tgt) to avoid a use-after-free. Fixes: 41320b18a0e0 ("scsi: snic: Fix possible memory leak if device_add() fails") Signed-off-by: Zhu Wang Link: https://lore.kernel.org/r/20230819083941.164365-1-wangzhu9@huawei.com Signed-off-by: Martin K. Petersen commit 14ddccc8a647f0e6b268858c4fe2804ae42aabb0 Merge: f8d6ff449094b e7f2e65699e22 Author: Linus Torvalds Date: Thu Aug 24 19:10:53 2023 -0700 Merge tag 'media/v6.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fix from Mauro Carvalho Chehab: "Fix a potential array out-of-bounds in the mediatek vcodec driver" * tag 'media/v6.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: vcodec: Fix potential array out-of-bounds in encoder queue_setup commit 60c5fd2e8f3c42a5abc565ba9876ead1da5ad2b7 Author: Zhu Wang Date: Tue Aug 22 01:52:54 2023 +0000 scsi: core: raid_class: Remove raid_component_add() The raid_component_add() function was added to the kernel tree via patch "[SCSI] embryonic RAID class" (2005). Remove this function since it never has had any callers in the Linux kernel. And also raid_component_release() is only used in raid_component_add(), so it is also removed. Signed-off-by: Zhu Wang Link: https://lore.kernel.org/r/20230822015254.184270-1-wangzhu9@huawei.com Reviewed-by: Bart Van Assche Fixes: 04b5b5cb0136 ("scsi: core: Fix possible memory leak if device_add() fails") Signed-off-by: Martin K. Petersen commit 59fe2029b9e05cd490eaf972053dd86f96f77869 Merge: ce22e89eb0f54 1dcc437427bbc Author: Dave Airlie Date: Fri Aug 25 07:35:23 2023 +1000 Merge tag 'drm-intel-fixes-2023-08-24' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix power consumption at s2idle on DG2 (Anshuman) - Fix documentation build warning (Jani) - Fix Display HPD (Imre) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/ZOdPRFSJpo0ErPX/@intel.com commit e5548f85b4527c4c803b7eae7887c10bf8f90c97 Author: Hugh Dickins Date: Tue Aug 22 22:14:47 2023 -0700 shmem: fix smaps BUG sleeping while atomic smaps_pte_hole_lookup() is calling shmem_partial_swap_usage() with page table lock held: but shmem_partial_swap_usage() does cond_resched_rcu() if need_resched(): "BUG: sleeping function called from invalid context". Since shmem_partial_swap_usage() is designed to count across a range, but smaps_pte_hole_lookup() only calls it for a single page slot, just break out of the loop on the last or only page, before checking need_resched(). Link: https://lkml.kernel.org/r/6fe3b3ec-abdf-332f-5c23-6a3b3a3b11a9@google.com Fixes: 230100321518 ("mm/smaps: simplify shmem handling of pte holes") Signed-off-by: Hugh Dickins Acked-by: Peter Xu Cc: [5.16+] Signed-off-by: Andrew Morton commit f84f62e69963d7742acec4340ec1c4c7ef22b887 Author: Andre Przywara Date: Mon Aug 21 17:05:34 2023 +0100 selftests: cachestat: catch failing fsync test on tmpfs The cachestat kselftest runs a test on a normal file, which is created temporarily in the current directory. Among the tests it runs there is a call to fsync(), which is expected to clean all dirty pages used by the file. However the tmpfs filesystem implements fsync() as noop_fsync(), so the call will not even attempt to clean anything when this test file happens to live on a tmpfs instance. This happens in an initramfs, or when the current directory is in /dev/shm or sometimes /tmp. To avoid this test failing wrongly, use statfs() to check which filesystem the test file lives on. If that is "tmpfs", we skip the fsync() test. Since the fsync test is only one part of the "normal file" test, we now execute this twice, skipping the fsync part on the first call. This way only the second test, including the fsync part, would be skipped. Link: https://lkml.kernel.org/r/20230821160534.3414911-3-andre.przywara@arm.com Signed-off-by: Andre Przywara Cc: Johannes Weiner Cc: Nhat Pham Cc: Shuah Khan Signed-off-by: Andrew Morton commit 5e56982dd0759d8b345fe1468297dd4f630db5d7 Author: Andre Przywara Date: Mon Aug 21 17:05:33 2023 +0100 selftests: cachestat: test for cachestat availability Patch series "selftests: cachestat: fix run on older kernels", v2. I ran all kernel selftests on some test machine, and stumbled upon cachestat failing (among others). These patches fix the run on older kernels and when the current directory is on a tmpfs instance. This patch (of 2): As cachestat is a new syscall, it won't be available on older kernels, for instance those running on a development machine. At the moment the test reports all tests as "not ok" in this case. Test for the cachestat syscall availability first, before doing further tests, and bail out early with a TAP SKIP comment. This also uses the opportunity to add the proper TAP headers, and add one check for proper error handling (illegal file descriptor). Link: https://lkml.kernel.org/r/20230821160534.3414911-1-andre.przywara@arm.com Link: https://lkml.kernel.org/r/20230821160534.3414911-2-andre.przywara@arm.com Signed-off-by: Andre Przywara Acked-by: Nhat Pham Cc: Johannes Weiner Cc: Shuah Khan Signed-off-by: Andrew Morton commit cfeb6ae8bcb96ccf674724f223661bbcef7b0d0b Author: Liam R. Howlett Date: Fri Aug 18 20:43:55 2023 -0400 maple_tree: disable mas_wr_append() when other readers are possible The current implementation of append may cause duplicate data and/or incorrect ranges to be returned to a reader during an update. Although this has not been reported or seen, disable the append write operation while the tree is in rcu mode out of an abundance of caution. During the analysis of the mas_next_slot() the following was artificially created by separating the writer and reader code: Writer: reader: mas_wr_append set end pivot updates end metata Detects write to last slot last slot write is to start of slot store current contents in slot overwrite old end pivot mas_next_slot(): read end metadata read old end pivot return with incorrect range store new value Alternatively: Writer: reader: mas_wr_append set end pivot updates end metata Detects write to last slot last lost write to end of slot store value mas_next_slot(): read end metadata read old end pivot read new end pivot return with incorrect range set old end pivot There may be other accesses that are not safe since we are now updating both metadata and pointers, so disabling append if there could be rcu readers is the safest action. Link: https://lkml.kernel.org/r/20230819004356.1454718-2-Liam.Howlett@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett Cc: Signed-off-by: Andrew Morton commit 0e0e9bd5f7b9d40fd03b70092367247d52da1db0 Author: Yin Fengwei Date: Tue Aug 8 10:09:17 2023 +0800 madvise:madvise_free_pte_range(): don't use mapcount() against large folio for sharing check Commit 98b211d6415f ("madvise: convert madvise_free_pte_range() to use a folio") replaced the page_mapcount() with folio_mapcount() to check whether the folio is shared by other mapping. It's not correct for large folios. folio_mapcount() returns the total mapcount of large folio which is not suitable to detect whether the folio is shared. Use folio_estimated_sharers() which returns a estimated number of shares. That means it's not 100% correct. It should be OK for madvise case here. User-visible effects is that the THP is skipped when user call madvise. But the correct behavior is THP should be split and processed then. NOTE: this change is a temporary fix to reduce the user-visible effects before the long term fix from David is ready. Link: https://lkml.kernel.org/r/20230808020917.2230692-4-fengwei.yin@intel.com Fixes: 98b211d6415f ("madvise: convert madvise_free_pte_range() to use a folio") Signed-off-by: Yin Fengwei Reviewed-by: Yu Zhao Reviewed-by: Ryan Roberts Cc: David Hildenbrand Cc: Kefeng Wang Cc: Matthew Wilcox Cc: Minchan Kim Cc: Vishal Moola (Oracle) Cc: Yang Shi Cc: Signed-off-by: Andrew Morton commit 20b18aada1856b2ce0512b087a8681342af73e60 Author: Yin Fengwei Date: Tue Aug 8 10:09:16 2023 +0800 madvise:madvise_free_huge_pmd(): don't use mapcount() against large folio for sharing check Commit fc986a38b670 ("mm: huge_memory: convert madvise_free_huge_pmd to use a folio") replaced the page_mapcount() with folio_mapcount() to check whether the folio is shared by other mapping. It's not correct for large folios. folio_mapcount() returns the total mapcount of large folio which is not suitable to detect whether the folio is shared. Use folio_estimated_sharers() which returns a estimated number of shares. That means it's not 100% correct. It should be OK for madvise case here. User-visible effects is that the THP is skipped when user call madvise. But the correct behavior is THP should be split and processed then. NOTE: this change is a temporary fix to reduce the user-visible effects before the long term fix from David is ready. Link: https://lkml.kernel.org/r/20230808020917.2230692-3-fengwei.yin@intel.com Fixes: fc986a38b670 ("mm: huge_memory: convert madvise_free_huge_pmd to use a folio") Signed-off-by: Yin Fengwei Reviewed-by: Yu Zhao Reviewed-by: Ryan Roberts Cc: David Hildenbrand Cc: Kefeng Wang Cc: Matthew Wilcox Cc: Minchan Kim Cc: Vishal Moola (Oracle) Cc: Yang Shi Signed-off-by: Andrew Morton commit 2f406263e3e954aa24c1248edcfa9be0c1bb30fa Author: Yin Fengwei Date: Tue Aug 8 10:09:15 2023 +0800 madvise:madvise_cold_or_pageout_pte_range(): don't use mapcount() against large folio for sharing check Patch series "don't use mapcount() to check large folio sharing", v2. In madvise_cold_or_pageout_pte_range() and madvise_free_pte_range(), folio_mapcount() is used to check whether the folio is shared. But it's not correct as folio_mapcount() returns total mapcount of large folio. Use folio_estimated_sharers() here as the estimated number is enough. This patchset will fix the cases: User space application call madvise() with MADV_FREE, MADV_COLD and MADV_PAGEOUT for specific address range. There are THP mapped to the range. Without the patchset, the THP is skipped. With the patch, the THP will be split and handled accordingly. David reported the cow self test skip some cases because of MADV_PAGEOUT skip THP: https://lore.kernel.org/linux-mm/9e92e42d-488f-47db-ac9d-75b24cd0d037@intel.com/T/#mbf0f2ec7fbe45da47526de1d7036183981691e81 and I confirmed this patchset make it work again. This patch (of 3): Commit 07e8c82b5eff ("madvise: convert madvise_cold_or_pageout_pte_range() to use folios") replaced the page_mapcount() with folio_mapcount() to check whether the folio is shared by other mapping. It's not correct for large folio. folio_mapcount() returns the total mapcount of large folio which is not suitable to detect whether the folio is shared. Use folio_estimated_sharers() which returns a estimated number of shares. That means it's not 100% correct. It should be OK for madvise case here. User-visible effects is that the THP is skipped when user call madvise. But the correct behavior is THP should be split and processed then. NOTE: this change is a temporary fix to reduce the user-visible effects before the long term fix from David is ready. Link: https://lkml.kernel.org/r/20230808020917.2230692-1-fengwei.yin@intel.com Link: https://lkml.kernel.org/r/20230808020917.2230692-2-fengwei.yin@intel.com Fixes: 07e8c82b5eff ("madvise: convert madvise_cold_or_pageout_pte_range() to use folios") Signed-off-by: Yin Fengwei Reviewed-by: Yu Zhao Reviewed-by: Ryan Roberts Cc: David Hildenbrand Cc: Kefeng Wang Cc: Matthew Wilcox Cc: Minchan Kim Cc: Vishal Moola (Oracle) Cc: Yang Shi Cc: Signed-off-by: Andrew Morton commit f8d6ff449094b4b5eff40d4af08e47c520b78bc5 Merge: 0de5ec446310d 8073a98e95323 Author: Linus Torvalds Date: Thu Aug 24 14:30:47 2023 -0700 Merge tag 'nfsd-6.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "Two last-minute one-liners for v6.5-rc. One got lost in the shuffle, and the other was reported just this morning" - Close race window when handling FREE_STATEID operations - Fix regression in /proc/fs/nfsd/v4_end_grace introduced in v6.5-rc" * tag 'nfsd-6.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: NFSD: Fix a thinko introduced by recent trace point changes nfsd: Fix race to FREE_STATEID and cl_revoked commit 0de5ec446310ddc2fc8d446c9bcd69313e0ce9d2 Merge: b5cc3833f13ac 627d05a41ca1f Author: Linus Torvalds Date: Thu Aug 24 13:55:35 2023 -0700 Merge tag 'spi-fix-v6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple more small driver specific fixes for v6.5. The device mode for Cadence had been broken by some recent updates done for host mode and large transfers for multi-byte words on stm32 had been broken by an API update in what I think was a rebasing incident" * tag 'spi-fix-v6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-cadence: Fix data corruption issues in slave mode spi: stm32: fix accidential revert to byte-sized transfer splitting commit ef21fa7c198e04f3d3053b1c5b5f2b4b225c3350 Author: Mingzheng Xing Date: Fri Aug 25 03:08:52 2023 +0800 riscv: Fix build errors using binutils2.37 toolchains When building the kernel with binutils 2.37 and GCC-11.1.0/GCC-11.2.0, the following error occurs: Assembler messages: Error: cannot find default versions of the ISA extension `zicsr' Error: cannot find default versions of the ISA extension `zifencei' The above error originated from this commit of binutils[0], which has been resolved and backported by GCC-12.1.0[1] and GCC-11.3.0[2]. So fix this by change the GCC version in CONFIG_TOOLCHAIN_NEEDS_OLD_ISA_SPEC to GCC-11.3.0. Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=f0bae2552db1dd4f1995608fbf6648fcee4e9e0c [0] Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=ca2bbb88f999f4d3cc40e89bc1aba712505dd598 [1] Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=d29f5d6ab513c52fd872f532c492e35ae9fd6671 [2] Fixes: ca09f772ccca ("riscv: Handle zicsr/zifencei issue between gcc and binutils") Reported-by: Conor Dooley Cc: Signed-off-by: Mingzheng Xing Link: https://lore.kernel.org/r/20230824190852.45470-1-xingmingzheng@iscas.ac.cn Closes: https://lore.kernel.org/all/20230823-captive-abdomen-befd942a4a73@wendy/ Reviewed-by: Conor Dooley Tested-by: Conor Dooley Signed-off-by: Palmer Dabbelt commit ce22e89eb0f541b9998f67bd51d311275a3ee51a Merge: 706a741595047 f9e96bf190547 Author: Dave Airlie Date: Fri Aug 25 05:15:54 2023 +1000 Merge tag 'drm-misc-fixes-2023-08-24' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes A samsung-dsim initialization fix, a devfreq fix for panfrost, a DP DSC define fix, a recursive lock fix for dma-buf, a shader validation fix and a reference counting fix for vmwgfx Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/amy26vu5xbeeikswpx7nt6rddwfocdidshrtt2qovipihx5poj@y45p3dtzrloc commit b5cc3833f13ace75e26e3f7b51cd7b6da5e9cf17 Merge: 93f5de5f648d2 8938fc0c7e16e Author: Linus Torvalds Date: Thu Aug 24 08:23:13 2023 -0700 Merge tag 'net-6.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from wifi, can and netfilter. Fixes to fixes: - nf_tables: - GC transaction race with abort path - defer gc run if previous batch is still pending Previous releases - regressions: - ipv4: fix data-races around inet->inet_id - phy: fix deadlocking in phy_error() invocation - mdio: fix C45 read/write protocol - ipvlan: fix a reference count leak warning in ipvlan_ns_exit() - ice: fix NULL pointer deref during VF reset - i40e: fix potential NULL pointer dereferencing of pf->vf in i40e_sync_vsi_filters() - tg3: use slab_build_skb() when needed - mtk_eth_soc: fix NULL pointer on hw reset Previous releases - always broken: - core: validate veth and vxcan peer ifindexes - sched: fix a qdisc modification with ambiguous command request - devlink: add missing unregister linecard notification - wifi: mac80211: limit reorder_buf_filtered to avoid UBSAN warning - batman: - do not get eth header before batadv_check_management_packet - fix batadv_v_ogm_aggr_send memory leak - bonding: fix macvlan over alb bond support - mlxsw: set time stamp fields also when its type is MIRROR_UTC" * tag 'net-6.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (54 commits) selftests: bonding: add macvlan over bond testing selftest: bond: add new topo bond_topo_2d1c.sh bonding: fix macvlan over alb bond support rtnetlink: Reject negative ifindexes in RTM_NEWLINK netfilter: nf_tables: defer gc run if previous batch is still pending netfilter: nf_tables: fix out of memory error handling netfilter: nf_tables: use correct lock to protect gc_list netfilter: nf_tables: GC transaction race with abort path netfilter: nf_tables: flush pending destroy work before netlink notifier netfilter: nf_tables: validate all pending tables ibmveth: Use dcbf rather than dcbfl i40e: fix potential NULL pointer dereferencing of pf->vf i40e_sync_vsi_filters() net/sched: fix a qdisc modification with ambiguous command request igc: Fix the typo in the PTM Control macro batman-adv: Hold rtnl lock during MTU update via netlink igb: Avoid starting unnecessary workqueues can: raw: add missing refcount for memory leak fix can: isotp: fix support for transmission of SF without flow control bnx2x: new flag for track HW resource allocation sfc: allocate a big enough SKB for loopback selftest packet ... commit 8073a98e95323abdea5491533bf5cb51e0ba18d9 Author: Chuck Lever Date: Thu Aug 24 10:30:27 2023 -0400 NFSD: Fix a thinko introduced by recent trace point changes The fixed commit erroneously removed a call to nfsd_end_grace(), which makes calls to write_v4_end_grace() a no-op. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202308241229.68396422-oliver.sang@intel.com Fixes: 39d432fc7630 ("NFSD: trace nfsctl operations") Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit c008323fe361bd62a43d9fb29737dacd5c067fb7 Author: Mario Limonciello Date: Wed Aug 23 20:11:49 2023 -0500 ASoC: amd: yc: Fix a non-functional mic on Lenovo 82SJ Lenovo 82SJ doesn't have DMIC connected like 82V2 does. Narrow the match down to only cover 82V2. Reported-by: prosenfeld@Yuhsbstudents.org Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217063 Fixes: 2232b2dd8cd4 ("ASoC: amd: yc: Add Lenovo Yoga Slim 7 Pro X to quirks table") Signed-off-by: Mario Limonciello Date: Wed Aug 23 14:57:47 2023 +0800 x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 0-Day found a 34.6% regression in stress-ng's 'af-alg' test case, and bisected it to commit b81fac906a8f ("x86/fpu: Move FPU initialization into arch_cpu_finalize_init()"), which optimizes the FPU init order, and moves the CR4_OSXSAVE enabling into a later place: arch_cpu_finalize_init identify_boot_cpu identify_cpu generic_identify get_cpu_cap --> setup cpu capability ... fpu__init_cpu fpu__init_cpu_xstate cr4_set_bits(X86_CR4_OSXSAVE); As the FPU is not yet initialized the CPU capability setup fails to set X86_FEATURE_OSXSAVE. Many security module like 'camellia_aesni_avx_x86_64' depend on this feature and therefore fail to load, causing the regression. Cure this by setting X86_FEATURE_OSXSAVE feature right after OSXSAVE enabling. [ tglx: Moved it into the actual BSP FPU initialization code and added a comment ] Fixes: b81fac906a8f ("x86/fpu: Move FPU initialization into arch_cpu_finalize_init()") Reported-by: kernel test robot Signed-off-by: Feng Tang Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/lkml/202307192135.203ac24e-oliver.sang@intel.com Link: https://lore.kernel.org/lkml/20230823065747.92257-1-feng.tang@intel.com commit 1f69383b203e28cf8a4ca9570e572da1699f76cd Author: Rick Edgecombe Date: Fri Aug 18 10:03:05 2023 -0700 x86/fpu: Invalidate FPU state correctly on exec() The thread flag TIF_NEED_FPU_LOAD indicates that the FPU saved state is valid and should be reloaded when returning to userspace. However, the kernel will skip doing this if the FPU registers are already valid as determined by fpregs_state_valid(). The logic embedded there considers the state valid if two cases are both true: 1: fpu_fpregs_owner_ctx points to the current tasks FPU state 2: the last CPU the registers were live in was the current CPU. This is usually correct logic. A CPU’s fpu_fpregs_owner_ctx is set to the current FPU during the fpregs_restore_userregs() operation, so it indicates that the registers have been restored on this CPU. But this alone doesn’t preclude that the task hasn’t been rescheduled to a different CPU, where the registers were modified, and then back to the current CPU. To verify that this was not the case the logic relies on the second condition. So the assumption is that if the registers have been restored, AND they haven’t had the chance to be modified (by being loaded on another CPU), then they MUST be valid on the current CPU. Besides the lazy FPU optimizations, the other cases where the FPU registers might not be valid are when the kernel modifies the FPU register state or the FPU saved buffer. In this case the operation modifying the FPU state needs to let the kernel know the correspondence has been broken. The comment in “arch/x86/kernel/fpu/context.h” has: /* ... * If the FPU register state is valid, the kernel can skip restoring the * FPU state from memory. * * Any code that clobbers the FPU registers or updates the in-memory * FPU state for a task MUST let the rest of the kernel know that the * FPU registers are no longer valid for this task. * * Either one of these invalidation functions is enough. Invalidate * a resource you control: CPU if using the CPU for something else * (with preemption disabled), FPU for the current task, or a task that * is prevented from running by the current task. */ However, this is not completely true. When the kernel modifies the registers or saved FPU state, it can only rely on __fpu_invalidate_fpregs_state(), which wipes the FPU’s last_cpu tracking. The exec path instead relies on fpregs_deactivate(), which sets the CPU’s FPU context to NULL. This was observed to fail to restore the reset FPU state to the registers when returning to userspace in the following scenario: 1. A task is executing in userspace on CPU0 - CPU0’s FPU context points to tasks - fpu->last_cpu=CPU0 2. The task exec()’s 3. While in the kernel the task is preempted - CPU0 gets a thread executing in the kernel (such that no other FPU context is activated) - Scheduler sets task’s fpu->last_cpu=CPU0 when scheduling out 4. Task is migrated to CPU1 5. Continuing the exec(), the task gets to fpu_flush_thread()->fpu_reset_fpregs() - Sets CPU1’s fpu context to NULL - Copies the init state to the task’s FPU buffer - Sets TIF_NEED_FPU_LOAD on the task 6. The task reschedules back to CPU0 before completing the exec() and returning to userspace - During the reschedule, scheduler finds TIF_NEED_FPU_LOAD is set - Skips saving the registers and updating task’s fpu→last_cpu, because TIF_NEED_FPU_LOAD is the canonical source. 7. Now CPU0’s FPU context is still pointing to the task’s, and fpu->last_cpu is still CPU0. So fpregs_state_valid() returns true even though the reset FPU state has not been restored. So the root cause is that exec() is doing the wrong kind of invalidate. It should reset fpu->last_cpu via __fpu_invalidate_fpregs_state(). Further, fpu__drop() doesn't really seem appropriate as the task (and FPU) are not going away, they are just getting reset as part of an exec. So switch to __fpu_invalidate_fpregs_state(). Also, delete the misleading comment that says that either kind of invalidate will be enough, because it’s not always the case. Fixes: 33344368cb08 ("x86/fpu: Clean up the fpu__clear() variants") Reported-by: Lei Wang Signed-off-by: Rick Edgecombe Signed-off-by: Thomas Gleixner Tested-by: Lijun Pan Reviewed-by: Sohil Mehta Acked-by: Lijun Pan Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230818170305.502891-1-rick.p.edgecombe@intel.com commit 8938fc0c7e16e0868a1083deadc91b95b72ca0da Merge: b251610c676c9 8e51830e29e12 Author: Paolo Abeni Date: Thu Aug 24 10:33:22 2023 +0200 Merge tag 'nf-23-08-23' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter updates for net This PR contains nf_tables updates for your *net* tree. First patch fixes table validation, I broke this in 6.4 when tracking validation state per table, reported by Pablo, fixup from myself. Second patch makes sure objects waiting for memory release have been released, this was broken in 6.1, patch from Pablo Neira Ayuso. Patch three is a fix-for-fix from previous PR: In case a transaction gets aborted, gc sequence counter needs to be incremented so pending gc requests are invalidated, from Pablo. Same for patch 4: gc list needs to use gc list lock, not destroy lock, also from Pablo. Patch 5 fixes a UaF in a set backend, but this should only occur when failslab is enabled for GFP_KERNEL allocations, broken since feature was added in 5.6, from myself. Patch 6 fixes a double-free bug that was also added via previous PR: We must not schedule gc work if the previous batch is still queued. netfilter pull request 2023-08-23 * tag 'nf-23-08-23' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: defer gc run if previous batch is still pending netfilter: nf_tables: fix out of memory error handling netfilter: nf_tables: use correct lock to protect gc_list netfilter: nf_tables: GC transaction race with abort path netfilter: nf_tables: flush pending destroy work before netlink notifier netfilter: nf_tables: validate all pending tables ==================== Link: https://lore.kernel.org/r/20230823152711.15279-1-fw@strlen.de Signed-off-by: Paolo Abeni commit b251610c676c93f99aff86bcaf1e8ef86650579e Merge: 30188bd7838c1 246af950b9404 Author: Paolo Abeni Date: Thu Aug 24 10:07:16 2023 +0200 Merge branch 'fix-macvlan-over-alb-bond-support' Hangbin Liu says: ==================== fix macvlan over alb bond support Currently, the macvlan over alb bond is broken after commit 14af9963ba1e ("bonding: Support macvlans on top of tlb/rlb mode bonds"). Fix this and add relate tests. ==================== Link: https://lore.kernel.org/r/20230823071907.3027782-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 246af950b9404da3cb1fed0dc85c7a637be0aff6 Author: Hangbin Liu Date: Wed Aug 23 15:19:06 2023 +0800 selftests: bonding: add macvlan over bond testing Add a macvlan over bonding test with mode active-backup, balance-tlb and balance-alb. ]# ./bond_macvlan.sh TEST: active-backup: IPv4: client->server [ OK ] TEST: active-backup: IPv6: client->server [ OK ] TEST: active-backup: IPv4: client->macvlan_1 [ OK ] TEST: active-backup: IPv6: client->macvlan_1 [ OK ] TEST: active-backup: IPv4: client->macvlan_2 [ OK ] TEST: active-backup: IPv6: client->macvlan_2 [ OK ] TEST: active-backup: IPv4: macvlan_1->macvlan_2 [ OK ] TEST: active-backup: IPv6: macvlan_1->macvlan_2 [ OK ] TEST: active-backup: IPv4: server->client [ OK ] TEST: active-backup: IPv6: server->client [ OK ] TEST: active-backup: IPv4: macvlan_1->client [ OK ] TEST: active-backup: IPv6: macvlan_1->client [ OK ] TEST: active-backup: IPv4: macvlan_2->client [ OK ] TEST: active-backup: IPv6: macvlan_2->client [ OK ] TEST: active-backup: IPv4: macvlan_2->macvlan_2 [ OK ] TEST: active-backup: IPv6: macvlan_2->macvlan_2 [ OK ] [...] TEST: balance-alb: IPv4: client->server [ OK ] TEST: balance-alb: IPv6: client->server [ OK ] TEST: balance-alb: IPv4: client->macvlan_1 [ OK ] TEST: balance-alb: IPv6: client->macvlan_1 [ OK ] TEST: balance-alb: IPv4: client->macvlan_2 [ OK ] TEST: balance-alb: IPv6: client->macvlan_2 [ OK ] TEST: balance-alb: IPv4: macvlan_1->macvlan_2 [ OK ] TEST: balance-alb: IPv6: macvlan_1->macvlan_2 [ OK ] TEST: balance-alb: IPv4: server->client [ OK ] TEST: balance-alb: IPv6: server->client [ OK ] TEST: balance-alb: IPv4: macvlan_1->client [ OK ] TEST: balance-alb: IPv6: macvlan_1->client [ OK ] TEST: balance-alb: IPv4: macvlan_2->client [ OK ] TEST: balance-alb: IPv6: macvlan_2->client [ OK ] TEST: balance-alb: IPv4: macvlan_2->macvlan_2 [ OK ] TEST: balance-alb: IPv6: macvlan_2->macvlan_2 [ OK ] Signed-off-by: Hangbin Liu Acked-by: Jay Vosburgh Signed-off-by: Paolo Abeni commit 27aa43f83c83e9243c6959426f6e36cb32aeb2d5 Author: Hangbin Liu Date: Wed Aug 23 15:19:05 2023 +0800 selftest: bond: add new topo bond_topo_2d1c.sh Add a new testing topo bond_topo_2d1c.sh which is used more commonly. Make bond_topo_3d1c.sh just source bond_topo_2d1c.sh and add the extra link. Signed-off-by: Hangbin Liu Acked-by: Jay Vosburgh Signed-off-by: Paolo Abeni commit e74216b8def3803e98ae536de78733e9d7f3b109 Author: Hangbin Liu Date: Wed Aug 23 15:19:04 2023 +0800 bonding: fix macvlan over alb bond support The commit 14af9963ba1e ("bonding: Support macvlans on top of tlb/rlb mode bonds") aims to enable the use of macvlans on top of rlb bond mode. However, the current rlb bond mode only handles ARP packets to update remote neighbor entries. This causes an issue when a macvlan is on top of the bond, and remote devices send packets to the macvlan using the bond's MAC address as the destination. After delivering the packets to the macvlan, the macvlan will rejects them as the MAC address is incorrect. Consequently, this commit makes macvlan over bond non-functional. To address this problem, one potential solution is to check for the presence of a macvlan port on the bond device using netif_is_macvlan_port(bond->dev) and return NULL in the rlb_arp_xmit() function. However, this approach doesn't fully resolve the situation when a VLAN exists between the bond and macvlan. So let's just do a partial revert for commit 14af9963ba1e in rlb_arp_xmit(). As the comment said, Don't modify or load balance ARPs that do not originate locally. Fixes: 14af9963ba1e ("bonding: Support macvlans on top of tlb/rlb mode bonds") Reported-by: susan.zheng@veritas.com Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2117816 Signed-off-by: Hangbin Liu Acked-by: Jay Vosburgh Signed-off-by: Paolo Abeni commit 30188bd7838c16a98a520db1fe9df01ffc6ed368 Author: Ido Schimmel Date: Wed Aug 23 09:43:48 2023 +0300 rtnetlink: Reject negative ifindexes in RTM_NEWLINK Negative ifindexes are illegal, but the kernel does not validate the ifindex in the ancillary header of RTM_NEWLINK messages, resulting in the kernel generating a warning [1] when such an ifindex is specified. Fix by rejecting negative ifindexes. [1] WARNING: CPU: 0 PID: 5031 at net/core/dev.c:9593 dev_index_reserve+0x1a2/0x1c0 net/core/dev.c:9593 [...] Call Trace: register_netdevice+0x69a/0x1490 net/core/dev.c:10081 br_dev_newlink+0x27/0x110 net/bridge/br_netlink.c:1552 rtnl_newlink_create net/core/rtnetlink.c:3471 [inline] __rtnl_newlink+0x115e/0x18c0 net/core/rtnetlink.c:3688 rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3701 rtnetlink_rcv_msg+0x439/0xd30 net/core/rtnetlink.c:6427 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0x536/0x810 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:728 [inline] sock_sendmsg+0xd9/0x180 net/socket.c:751 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2538 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2592 __sys_sendmsg+0x117/0x1e0 net/socket.c:2621 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 38f7b870d4a6 ("[RTNETLINK]: Link creation API") Reported-by: syzbot+5ba06978f34abb058571@syzkaller.appspotmail.com Signed-off-by: Ido Schimmel Reviewed-by: Jiri Pirko Reviewed-by: Jakub Kicinski Link: https://lore.kernel.org/r/20230823064348.2252280-1-idosch@nvidia.com Signed-off-by: Paolo Abeni commit a4a6eed851bb661477654d772807d0e5aee5629c Merge: 1d0eb6143c1e8 1613781d7e8a9 Author: Takashi Iwai Date: Thu Aug 24 09:20:36 2023 +0200 Merge tag 'asoc-fix-v6.5-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.5 A relatively large but generally not super urgent set of fixes for ASoC, including some quirks and a MAINTAINERS update. There's also an update to cs35l56 to change the firmware ABI, there are no current shipping systems which use the current interface and the sooner we get the new interface in the less likely it is that something will start. It'd be nice if these landed for v6.5 but not the end of the world if they wait till v6.6. commit 93f5de5f648d2b1ce3540a4ac71756d4a852dc23 Merge: a5e505a99ca74 453b014e2c294 Author: Linus Torvalds Date: Wed Aug 23 14:28:19 2023 -0700 Merge tag 'acpi-6.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Make an existing ACPI IRQ override quirk for PCSpecialist Elimina Pro 16 M work as intended (Hans de Goede)" * tag 'acpi-6.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: resource: Fix IRQ override quirk for PCSpecialist Elimina Pro 16 M commit 1dcc437427bbcebc8381226352f7ade08a271191 Author: Imre Deak Date: Tue Aug 22 14:30:15 2023 +0300 drm/i915: Fix HPD polling, reenabling the output poll work as needed After the commit in the Fixes: line below, HPD polling stopped working on i915, since after that change calling drm_kms_helper_poll_enable() doesn't restart drm_mode_config::output_poll_work if the work was stopped (no connectors needing polling) and enabling polling for a connector (during runtime suspend or detecting an HPD IRQ storm). After the above change calling drm_kms_helper_poll_enable() is a nop after it's been called already and polling for some connectors was disabled/re-enabled. Fix this by calling drm_kms_helper_poll_reschedule() added in the previous patch instead, which reschedules the work whenever expected. Fixes: d33a54e3991d ("drm/probe_helper: sort out poll_running vs poll_enabled") CC: stable@vger.kernel.org # 6.4+ Cc: Dmitry Baryshkov Cc: dri-devel@lists.freedesktop.org Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20230822113015.41224-2-imre.deak@intel.com (cherry picked from commit 50452f2f76852322620b63e62922b85e955abe94) Signed-off-by: Rodrigo Vivi commit a94e7ccfc400c024976f3c2f31689ed843498b7c Author: Imre Deak Date: Tue Aug 22 14:30:14 2023 +0300 drm: Add an HPD poll helper to reschedule the poll work Add a helper to reschedule drm_mode_config::output_poll_work after polling has been enabled for a connector (and needing a reschedule, since previously polling was disabled for all connectors and hence output_poll_work was not running). This is needed by the next patch fixing HPD polling on i915. CC: stable@vger.kernel.org # 6.4+ Cc: Dmitry Baryshkov Cc: dri-devel@lists.freedesktop.org Reviewed-by: Jouni Högander Reviewed-by: Dmitry Baryshkov Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20230822113015.41224-1-imre.deak@intel.com (cherry picked from commit fe2352fd64029918174de4b460dfe6df0c6911cd) Signed-off-by: Rodrigo Vivi commit e2de1646f79632ca19980ed6a13a7779ae086088 Merge: ca09f772cccae c35f3aa345090 Author: Palmer Dabbelt Date: Tue Aug 22 13:55:14 2023 -0700 Merge patch series "riscv: fix ptrace and export VLENB" Andy Chiu says: We add a vlenb field in Vector context and save it with the riscv_vstate_save() macro. It should not cause performance regression as VLENB is a design-time constant and is frequently used by hardware. Also, adding this field into the __sc_riscv_v_state may benifit us on a future compatibility issue becuse a hardware may have writable VLENB. Adding and saving VLENB have an immediate benifit as it gives ptrace a better view of the Vector extension and makes it possible to reconstruct Vector register files from the dump without doing an additional csr read. This patchset also sync the number of note types between us and gdb for riscv to solve a conflicting note. This is not an ABI break given that 6.5 has not been released yet. * b4-shazam-merge: RISC-V: vector: export VLENB csr in __sc_riscv_v_state RISC-V: Remove ptrace support for vectors Link: https://lore.kernel.org/r/20230816155450.26200-1-andy.chiu@sifive.com Signed-off-by: Palmer Dabbelt commit 6e39c1ac688161b4db3617aabbca589b395242bc Author: Bartosz Golaszewski Date: Tue Aug 22 21:29:43 2023 +0200 gpio: sim: pass the GPIO device's software node to irq domain Associate the swnode of the GPIO device's (which is the interrupt controller here) with the irq domain. Otherwise the interrupt-controller device attribute is a no-op. Fixes: cb8c474e79be ("gpio: sim: new testing module") Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko commit ab4109f91b328ff5cb5e1279f64d443241add2d1 Author: Bartosz Golaszewski Date: Tue Aug 22 21:29:42 2023 +0200 gpio: sim: dispose of irq mappings before destroying the irq_sim domain If a GPIO simulator device is unbound with interrupts still requested, we will hit a use-after-free issue in __irq_domain_deactivate_irq(). The owner of the irq domain must dispose of all mappings before destroying the domain object. Fixes: cb8c474e79be ("gpio: sim: new testing module") Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko commit f9e96bf1905479f18e83a3a4c314a8dfa56ede2c Author: Zack Rusin Date: Fri Aug 18 00:13:01 2023 -0400 drm/vmwgfx: Fix possible invalid drm gem put calls vmw_bo_unreference sets the input buffer to null on exit, resulting in null ptr deref's on the subsequent drm gem put calls. This went unnoticed because only very old userspace would be exercising those paths but it wouldn't be hard to hit on old distros with brand new kernels. Introduce a new function that abstracts unrefing of user bo's to make the code cleaner and more explicit. Signed-off-by: Zack Rusin Reported-by: Ian Forbes Fixes: 9ef8d83e8e25 ("drm/vmwgfx: Do not drop the reference to the handle too soon") Cc: # v6.4+ Reviewed-by: Maaz Mombasawala Link: https://patchwork.freedesktop.org/patch/msgid/20230818041301.407636-1-zack@kde.org commit 14abdfae508228a7307f7491b5c4215ae70c6542 Author: Zack Rusin Date: Fri Jun 16 15:09:34 2023 -0400 drm/vmwgfx: Fix shader stage validation For multiple commands the driver was not correctly validating the shader stages resulting in possible kernel oopses. The validation code was only. if ever, checking the upper bound on the shader stages but never a lower bound (valid shader stages start at 1 not 0). Fixes kernel oopses ending up in vmw_binding_add, e.g.: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 2443 Comm: testcase Not tainted 6.3.0-rc4-vmwgfx #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 RIP: 0010:vmw_binding_add+0x4c/0x140 [vmwgfx] Code: 7e 30 49 83 ff 0e 0f 87 ea 00 00 00 4b 8d 04 7f 89 d2 89 cb 48 c1 e0 03 4c 8b b0 40 3d 93 c0 48 8b 80 48 3d 93 c0 49 0f af de <48> 03 1c d0 4c 01 e3 49 8> RSP: 0018:ffffb8014416b968 EFLAGS: 00010206 RAX: ffffffffc0933ec0 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 00000000ffffffff RSI: ffffb8014416b9c0 RDI: ffffb8014316f000 RBP: ffffb8014416b998 R08: 0000000000000003 R09: 746f6c735f726564 R10: ffffffffaaf2bda0 R11: 732e676e69646e69 R12: ffffb8014316f000 R13: ffffb8014416b9c0 R14: 0000000000000040 R15: 0000000000000006 FS: 00007fba8c0af740(0000) GS:ffff8a1277c80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000007c0933eb8 CR3: 0000000118244001 CR4: 00000000003706e0 Call Trace: vmw_view_bindings_add+0xf5/0x1b0 [vmwgfx] ? ___drm_dbg+0x8a/0xb0 [drm] vmw_cmd_dx_set_shader_res+0x8f/0xc0 [vmwgfx] vmw_execbuf_process+0x590/0x1360 [vmwgfx] vmw_execbuf_ioctl+0x173/0x370 [vmwgfx] ? __drm_dev_dbg+0xb4/0xe0 [drm] ? __pfx_vmw_execbuf_ioctl+0x10/0x10 [vmwgfx] drm_ioctl_kernel+0xbc/0x160 [drm] drm_ioctl+0x2d2/0x580 [drm] ? __pfx_vmw_execbuf_ioctl+0x10/0x10 [vmwgfx] ? do_fault+0x1a6/0x420 vmw_generic_ioctl+0xbd/0x180 [vmwgfx] vmw_unlocked_ioctl+0x19/0x20 [vmwgfx] __x64_sys_ioctl+0x96/0xd0 do_syscall_64+0x5d/0x90 ? handle_mm_fault+0xe4/0x2f0 ? debug_smp_processor_id+0x1b/0x30 ? fpregs_assert_state_consistent+0x2e/0x50 ? exit_to_user_mode_prepare+0x40/0x180 ? irqentry_exit_to_user_mode+0xd/0x20 ? irqentry_exit+0x3f/0x50 ? exc_page_fault+0x8b/0x180 entry_SYSCALL_64_after_hwframe+0x72/0xdc Signed-off-by: Zack Rusin Cc: security@openanolis.org Reported-by: Ziming Zhang Testcase-found-by: Niels De Graef Fixes: d80efd5cb3de ("drm/vmwgfx: Initial DX support") Cc: # v4.3+ Reviewed-by: Maaz Mombasawala Reviewed-by: Martin Krastev Link: https://patchwork.freedesktop.org/patch/msgid/20230616190934.54828-1-zack@kde.org commit 1d0eb6143c1e85d3f9a3f5a616ee7e5dc351d33b Author: Takashi Iwai Date: Wed Aug 23 18:16:25 2023 +0200 ALSA: ymfpci: Fix the missing snd_card_free() call at probe error Like a few other drivers, YMFPCI driver needs to clean up with snd_card_free() call at an error path of the probe; otherwise the other devres resources are released before the card and it results in the UAF. This patch uses the helper for handling the probe error gracefully. Fixes: f33fc1576757 ("ALSA: ymfpci: Create card with device-managed snd_devm_card_new()") Cc: Reported-and-tested-by: Takashi Yano Closes: https://lore.kernel.org/r/20230823135846.1812-1-takashi.yano@nifty.ne.jp Link: https://lore.kernel.org/r/20230823161625.5807-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit a5e505a99ca748583dbe558b691be1b26f05d678 Merge: 89bf6209cad66 0848cab765c63 Author: Linus Torvalds Date: Wed Aug 23 08:32:52 2023 -0700 Merge tag 'platform-drivers-x86-v6.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: "Final set of three small fixes for 6.5" * tag 'platform-drivers-x86-v6.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE notifications platform/x86: ideapad-laptop: Add support for new hotkeys found on ThinkBook 14s Yoga ITL platform/x86: lenovo-ymc: Add Lenovo Yoga 7 14ACN6 to ec_trigger_quirk_dmi_table commit 0848cab765c634597636810bf76d0934003cce28 Author: Shih-Yi Chen Date: Mon Aug 21 11:06:27 2023 -0400 platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE notifications rshim console does not show all entries of dmesg. Fixed by setting MLXBF_TM_TX_LWM_IRQ for every CONSOLE notification. Signed-off-by: Shih-Yi Chen Reviewed-by: Liming Sung Reviewed-by: David Thompson Link: https://lore.kernel.org/r/20230821150627.26075-1-shihyic@nvidia.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 8e51830e29e12670b4c10df070a4ea4c9593e961 Author: Florian Westphal Date: Tue Aug 22 22:03:57 2023 +0200 netfilter: nf_tables: defer gc run if previous batch is still pending Don't queue more gc work, else we may queue the same elements multiple times. If an element is flagged as dead, this can mean that either the previous gc request was invalidated/discarded by a transaction or that the previous request is still pending in the system work queue. The latter will happen if the gc interval is set to a very low value, e.g. 1ms, and system work queue is backlogged. The sets refcount is 1 if no previous gc requeusts are queued, so add a helper for this and skip gc run if old requests are pending. Add a helper for this and skip the gc run in this case. Fixes: f6c383b8c31a ("netfilter: nf_tables: adapt set backend to use GC transaction API") Signed-off-by: Florian Westphal Reviewed-by: Pablo Neira Ayuso commit 5e1be4cdc98c989d5387ce94ff15b5ad06a5b681 Author: Florian Westphal Date: Tue Aug 22 19:49:52 2023 +0200 netfilter: nf_tables: fix out of memory error handling Several instances of pipapo_resize() don't propagate allocation failures, this causes a crash when fault injection is enabled for gfp_kernel slabs. Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio commit 8357bc946a2abc2a10ca40e5a2105d2b4c57515e Author: Pablo Neira Ayuso Date: Mon Aug 21 14:33:32 2023 +0200 netfilter: nf_tables: use correct lock to protect gc_list Use nf_tables_gc_list_lock spinlock, not nf_tables_destroy_list_lock to protect the gc list. Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 720344340fb9be2765bbaab7b292ece0a4570eae Author: Pablo Neira Ayuso Date: Fri Aug 18 01:13:52 2023 +0200 netfilter: nf_tables: GC transaction race with abort path Abort path is missing a synchronization point with GC transactions. Add GC sequence number hence any GC transaction losing race will be discarded. Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 2c9f0293280e258606e54ed2b96fa71498432eae Author: Pablo Neira Ayuso Date: Fri Aug 18 01:13:31 2023 +0200 netfilter: nf_tables: flush pending destroy work before netlink notifier Destroy work waits for the RCU grace period then it releases the objects with no mutex held. All releases objects follow this path for transactions, therefore, order is guaranteed and references to top-level objects in the hierarchy remain valid. However, netlink notifier might interfer with pending destroy work. rcu_barrier() is not correct because objects are not release via RCU callback. Flush destroy work before releasing objects from netlink notifier path. Fixes: d4bc8271db21 ("netfilter: nf_tables: netlink notifier might race to release objects") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 4b80ced971b0d118f9a11dd503a5833a5016de92 Author: Florian Westphal Date: Thu Aug 17 20:28:32 2023 +0200 netfilter: nf_tables: validate all pending tables We have to validate all tables in the transaction that are in VALIDATE_DO state, the blamed commit below did not move the break statement to its right location so we only validate one table. Moreover, we can't init table->validate to _SKIP when a table object is allocated. If we do, then if a transcaction creates a new table and then fails the transaction, nfnetlink will loop and nft will hang until user cancels the command. Add back the pernet state as a place to stash the last state encountered. This is either _DO (we hit an error during commit validation) or _SKIP (transaction passed all checks). Fixes: 00c320f9b755 ("netfilter: nf_tables: make validation state per table") Reported-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 1613781d7e8a93618ff3a6b37f81f06769b53717 Author: Charles Keepax Date: Wed Aug 23 09:53:08 2023 +0100 ASoC: cs35l41: Correct amp_gain_tlv values The current analog gain TLV seems to have completely incorrect values in it. The gain starts at 0.5dB, proceeds in 1dB steps, and has no mute value, correct the control to match. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20230823085308.753572-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit bfedba3b2c7793ce127680bc8f70711e05ec7a17 Author: Michael Ellerman Date: Wed Aug 23 14:51:39 2023 +1000 ibmveth: Use dcbf rather than dcbfl When building for power4, newer binutils don't recognise the "dcbfl" extended mnemonic. dcbfl RA, RB is equivalent to dcbf RA, RB, 1. Switch to "dcbf" to avoid the build error. Signed-off-by: Michael Ellerman Signed-off-by: David S. Miller commit 9525a3c38accd2e186f52443e35e633e296cc7f5 Author: Andrii Staikov Date: Tue Aug 22 15:16:53 2023 -0700 i40e: fix potential NULL pointer dereferencing of pf->vf i40e_sync_vsi_filters() Add check for pf->vf not being NULL before dereferencing pf->vf[vsi->vf_id] in updating VSI filter sync. Add a similar check before dereferencing !pf->vf[vsi->vf_id].trusted in the condition for clearing promisc mode bit. Fixes: c87c938f62d8 ("i40e: Add VF VLAN pruning") Signed-off-by: Andrii Staikov Signed-off-by: Aleksandr Loktionov Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen Signed-off-by: David S. Miller commit da71714e359b64bd7aab3bd56ec53f307f058133 Author: Jamal Hadi Salim Date: Tue Aug 22 06:12:31 2023 -0400 net/sched: fix a qdisc modification with ambiguous command request When replacing an existing root qdisc, with one that is of the same kind, the request boils down to essentially a parameterization change i.e not one that requires allocation and grafting of a new qdisc. syzbot was able to create a scenario which resulted in a taprio qdisc replacing an existing taprio qdisc with a combination of NLM_F_CREATE, NLM_F_REPLACE and NLM_F_EXCL leading to create and graft scenario. The fix ensures that only when the qdisc kinds are different that we should allow a create and graft, otherwise it goes into the "change" codepath. While at it, fix the code and comments to improve readability. While syzbot was able to create the issue, it did not zone on the root cause. Analysis from Vladimir Oltean helped narrow it down. v1->V2 changes: - remove "inline" function definition (Vladmir) - remove extrenous braces in branches (Vladmir) - change inline function names (Pedro) - Run tdc tests (Victor) v2->v3 changes: - dont break else/if (Simon) Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+a3618a167af2021433cd@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/20230816225759.g25x76kmgzya2gei@skbuf/T/ Tested-by: Vladimir Oltean Tested-by: Victor Nogueira Reviewed-by: Pedro Tammela Reviewed-by: Victor Nogueira Signed-off-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit e531fdb5cd5ee2564b7fe10c8a9219e2b2fac61e Author: Rob Clark Date: Fri Aug 18 07:59:38 2023 -0700 dma-buf/sw_sync: Avoid recursive lock during fence signal If a signal callback releases the sw_sync fence, that will trigger a deadlock as the timeline_fence_release recurses onto the fence->lock (used both for signaling and the the timeline tree). To avoid that, temporarily hold an extra reference to the signalled fences until after we drop the lock. (This is an alternative implementation of https://patchwork.kernel.org/patch/11664717/ which avoids some potential UAF issues with the original patch.) v2: Remove now obsolete comment, use list_move_tail() and list_del_init() Reported-by: Bas Nieuwenhuizen Fixes: d3c6dd1fb30d ("dma-buf/sw_sync: Synchronize signal vs syncpt free") Signed-off-by: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/20230818145939.39697-1-robdclark@gmail.com Reviewed-by: Christian König Signed-off-by: Christian König commit e7f2e65699e2290fd547ec12a17008764e5d9620 Author: Wei Chen Date: Thu Aug 10 08:23:33 2023 +0000 media: vcodec: Fix potential array out-of-bounds in encoder queue_setup variable *nplanes is provided by user via system call argument. The possible value of q_data->fmt->num_planes is 1-3, while the value of *nplanes can be 1-8. The array access by index i can cause array out-of-bounds. Fix this bug by checking *nplanes against the array size. Fixes: 4e855a6efa54 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver") Signed-off-by: Wei Chen Cc: stable@vger.kernel.org Reviewed-by: Chen-Yu Tsai Signed-off-by: Hans Verkuil commit de43975721b97283d5f17eea4228faddf08f2681 Author: Sasha Neftin Date: Mon Aug 21 10:17:21 2023 -0700 igc: Fix the typo in the PTM Control macro The IGC_PTM_CTRL_SHRT_CYC defines the time between two consecutive PTM requests. The bit resolution of this field is six bits. That bit five was missing in the mask. This patch comes to correct the typo in the IGC_PTM_CTRL_SHRT_CYC macro. Fixes: a90ec8483732 ("igc: Add support for PTP getcrosststamp()") Signed-off-by: Sasha Neftin Tested-by: Naama Meir Signed-off-by: Tony Nguyen Reviewed-by: Simon Horman Reviewed-by: Kalesh AP Link: https://lore.kernel.org/r/20230821171721.2203572-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 987aae75fc1041072941ffb622b45ce2359a99b9 Author: Sven Eckelmann Date: Mon Aug 21 21:48:48 2023 +0200 batman-adv: Hold rtnl lock during MTU update via netlink The automatic recalculation of the maximum allowed MTU is usually triggered by code sections which are already rtnl lock protected by callers outside of batman-adv. But when the fragmentation setting is changed via batman-adv's own batadv genl family, then the rtnl lock is not yet taken. But dev_set_mtu requires that the caller holds the rtnl lock because it uses netdevice notifiers. And this code will then fail the check for this lock: RTNL: assertion failed at net/core/dev.c (1953) Cc: stable@vger.kernel.org Reported-by: syzbot+f8812454d9b3ac00d282@syzkaller.appspotmail.com Fixes: c6a953cce8d0 ("batman-adv: Trigger events for auto adjusted MTU") Signed-off-by: Sven Eckelmann Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230821-batadv-missing-mtu-rtnl-lock-v1-1-1c5a7bfe861e@narfation.org Signed-off-by: Jakub Kicinski commit b888c510f7b3d64ca75fc0f43b4a4bd1a611312f Author: Alessio Igor Bogani Date: Mon Aug 21 10:19:27 2023 -0700 igb: Avoid starting unnecessary workqueues If ptp_clock_register() fails or CONFIG_PTP isn't enabled, avoid starting PTP related workqueues. In this way we can fix this: BUG: unable to handle page fault for address: ffffc9000440b6f8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 100000067 P4D 100000067 PUD 1001e0067 PMD 107dc5067 PTE 0 Oops: 0000 [#1] PREEMPT SMP [...] Workqueue: events igb_ptp_overflow_check RIP: 0010:igb_rd32+0x1f/0x60 [...] Call Trace: igb_ptp_read_82580+0x20/0x50 timecounter_read+0x15/0x60 igb_ptp_overflow_check+0x1a/0x50 process_one_work+0x1cb/0x3c0 worker_thread+0x53/0x3f0 ? rescuer_thread+0x370/0x370 kthread+0x142/0x160 ? kthread_associate_blkcg+0xc0/0xc0 ret_from_fork+0x1f/0x30 Fixes: 1f6e8178d685 ("igb: Prevent dropped Tx timestamps via work items and interrupts.") Fixes: d339b1331616 ("igb: add PTP Hardware Clock code") Signed-off-by: Alessio Igor Bogani Tested-by: Arpana Arland (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230821171927.2203644-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 9536c2f51f146daf849185c9bc00c3f94ef6f886 Merge: c8777fa6f3c6e 67f6317dfa609 Author: Jakub Kicinski Date: Tue Aug 22 17:22:32 2023 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-08-21 (ice) This series contains updates to ice driver only. Jesse fixes an issue on calculating buffer size. Petr Oros reverts a commit that does not fully resolve VF reset issues and implements one that provides a fuller fix. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: Fix NULL pointer deref during VF reset Revert "ice: Fix ice VF reset during iavf initialization" ice: fix receive buffer size miscalculation ==================== Link: https://lore.kernel.org/r/20230821171633.2203505-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit c8777fa6f3c6e0cfa4ef7e7028df83d35a586671 Merge: bf23ffc8a9a77 c275a176e4b69 Author: Jakub Kicinski Date: Tue Aug 22 17:18:56 2023 -0700 Merge branch 'can-fixes-for-6-5-rc7' Oliver Hartkopp says: ==================== CAN fixes for 6.5-rc7 The isotp fix removes an unnecessary check which leads to delays and/or a wrong error notification. The fix for the CAN_RAW socket solves the last issue that has been introduced with commit ee8b94c8510c ("can: raw: fix receiver memory leak") in this upstream cycle (detected by Eric Dumazet). ==================== Link: https://lore.kernel.org/r/20230821144547.6658-1-socketcan@hartkopp.net Signed-off-by: Jakub Kicinski commit c275a176e4b69868576e543409927ae75e3a3288 Author: Oliver Hartkopp Date: Mon Aug 21 16:45:47 2023 +0200 can: raw: add missing refcount for memory leak fix Commit ee8b94c8510c ("can: raw: fix receiver memory leak") introduced a new reference to the CAN netdevice that has assigned CAN filters. But this new ro->dev reference did not maintain its own refcount which lead to another KASAN use-after-free splat found by Eric Dumazet. This patch ensures a proper refcount for the CAN nedevice. Fixes: ee8b94c8510c ("can: raw: fix receiver memory leak") Reported-by: Eric Dumazet Cc: Ziyang Xuan Signed-off-by: Oliver Hartkopp Link: https://lore.kernel.org/r/20230821144547.6658-3-socketcan@hartkopp.net Signed-off-by: Jakub Kicinski commit 0bfe71159230bab79ee230225ae12ffecbb69f3e Author: Oliver Hartkopp Date: Mon Aug 21 16:45:46 2023 +0200 can: isotp: fix support for transmission of SF without flow control The original implementation had a very simple handling for single frame transmissions as it just sent the single frame without a timeout handling. With the new echo frame handling the echo frame was also introduced for single frames but the former exception ('simple without timers') has been maintained by accident. This leads to a 1 second timeout when closing the socket and to an -ECOMM error when CAN_ISOTP_WAIT_TX_DONE is selected. As the echo handling is always active (also for single frames) remove the wrong extra condition for single frames. Fixes: 9f39d36530e5 ("can: isotp: add support for transmission without flow control") Signed-off-by: Oliver Hartkopp Link: https://lore.kernel.org/r/20230821144547.6658-2-socketcan@hartkopp.net Signed-off-by: Jakub Kicinski commit bf23ffc8a9a777dfdeb04232e0946b803adbb6a9 Author: Thinh Tran Date: Fri Aug 18 11:14:40 2023 -0500 bnx2x: new flag for track HW resource allocation While injecting PCIe errors to the upstream PCIe switch of a BCM57810 NIC, system hangs/crashes were observed. After several calls to bnx2x_tx_timout() complete, bnx2x_nic_unload() is called to free up HW resources and bnx2x_napi_disable() is called to release NAPI objects. Later, when the EEH driver calls bnx2x_io_slot_reset() to complete the recovery process, bnx2x attempts to disable NAPI again by calling bnx2x_napi_disable() and freeing resources which have already been freed, resulting in a hang or crash. Introduce a new flag to track the HW resource and NAPI allocation state, refactor duplicated code into a single function, check page pool allocation status before freeing, and reduces debug output when a TX timeout event occurs. Reviewed-by: Manish Chopra Tested-by: Abdul Haleem Tested-by: David Christensen Reviewed-by: Simon Horman Tested-by: Venkata Sai Duggi Signed-off-by: Thinh Tran Link: https://lore.kernel.org/r/20230818161443.708785-2-thinhtr@linux.vnet.ibm.com Signed-off-by: Jakub Kicinski commit 66fbfb35da47f391bdadf9fa7ceb88af4faa9022 Author: Andrey Skvortsov Date: Sat Aug 5 11:48:47 2023 +0300 clk: Fix slab-out-of-bounds error in devm_clk_release() Problem can be reproduced by unloading snd_soc_simple_card, because in devm_get_clk_from_child() devres data is allocated as `struct clk`, but devm_clk_release() expects devres data to be `struct devm_clk_state`. KASAN report: ================================================================== BUG: KASAN: slab-out-of-bounds in devm_clk_release+0x20/0x54 Read of size 8 at addr ffffff800ee09688 by task (udev-worker)/287 Call trace: dump_backtrace+0xe8/0x11c show_stack+0x1c/0x30 dump_stack_lvl+0x60/0x78 print_report+0x150/0x450 kasan_report+0xa8/0xf0 __asan_load8+0x78/0xa0 devm_clk_release+0x20/0x54 release_nodes+0x84/0x120 devres_release_all+0x144/0x210 device_unbind_cleanup+0x1c/0xac really_probe+0x2f0/0x5b0 __driver_probe_device+0xc0/0x1f0 driver_probe_device+0x68/0x120 __driver_attach+0x140/0x294 bus_for_each_dev+0xec/0x160 driver_attach+0x38/0x44 bus_add_driver+0x24c/0x300 driver_register+0xf0/0x210 __platform_driver_register+0x48/0x54 asoc_simple_card_init+0x24/0x1000 [snd_soc_simple_card] do_one_initcall+0xac/0x340 do_init_module+0xd0/0x300 load_module+0x2ba4/0x3100 __do_sys_init_module+0x2c8/0x300 __arm64_sys_init_module+0x48/0x5c invoke_syscall+0x64/0x190 el0_svc_common.constprop.0+0x124/0x154 do_el0_svc+0x44/0xdc el0_svc+0x14/0x50 el0t_64_sync_handler+0xec/0x11c el0t_64_sync+0x14c/0x150 Allocated by task 287: kasan_save_stack+0x38/0x60 kasan_set_track+0x28/0x40 kasan_save_alloc_info+0x20/0x30 __kasan_kmalloc+0xac/0xb0 __kmalloc_node_track_caller+0x6c/0x1c4 __devres_alloc_node+0x44/0xb4 devm_get_clk_from_child+0x44/0xa0 asoc_simple_parse_clk+0x1b8/0x1dc [snd_soc_simple_card_utils] simple_parse_node.isra.0+0x1ec/0x230 [snd_soc_simple_card] simple_dai_link_of+0x1bc/0x334 [snd_soc_simple_card] __simple_for_each_link+0x2ec/0x320 [snd_soc_simple_card] asoc_simple_probe+0x468/0x4dc [snd_soc_simple_card] platform_probe+0x90/0xf0 really_probe+0x118/0x5b0 __driver_probe_device+0xc0/0x1f0 driver_probe_device+0x68/0x120 __driver_attach+0x140/0x294 bus_for_each_dev+0xec/0x160 driver_attach+0x38/0x44 bus_add_driver+0x24c/0x300 driver_register+0xf0/0x210 __platform_driver_register+0x48/0x54 asoc_simple_card_init+0x24/0x1000 [snd_soc_simple_card] do_one_initcall+0xac/0x340 do_init_module+0xd0/0x300 load_module+0x2ba4/0x3100 __do_sys_init_module+0x2c8/0x300 __arm64_sys_init_module+0x48/0x5c invoke_syscall+0x64/0x190 el0_svc_common.constprop.0+0x124/0x154 do_el0_svc+0x44/0xdc el0_svc+0x14/0x50 el0t_64_sync_handler+0xec/0x11c el0t_64_sync+0x14c/0x150 The buggy address belongs to the object at ffffff800ee09600 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 136 bytes inside of 256-byte region [ffffff800ee09600, ffffff800ee09700) The buggy address belongs to the physical page: page:000000002d97303b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4ee08 head:000000002d97303b order:1 compound_mapcount:0 compound_pincount:0 flags: 0x10200(slab|head|zone=0) raw: 0000000000010200 0000000000000000 dead000000000122 ffffff8002c02480 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffff800ee09580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff800ee09600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffff800ee09680: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffff800ee09700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff800ee09780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Fixes: abae8e57e49a ("clk: generalize devm_clk_get() a bit") Signed-off-by: Andrey Skvortsov Link: https://lore.kernel.org/r/20230805084847.3110586-1-andrej.skvortzov@gmail.com Signed-off-by: Stephen Boyd commit e0d25c591ac676ece0e1ad6bbd72a159b9355598 Author: Jani Nikula Date: Wed Jun 21 15:31:56 2023 +0300 drm/i915: fix Sphinx indentation warning Fix Sphinx warning about unexpected indent. Signed-off-by: Jani Nikula Reviewed-by: Luca Coelho Link: https://patchwork.freedesktop.org/patch/msgid/20230621123156.14907-2-jani.nikula@intel.com (cherry picked from commit 175b036472f678948b03baabce4a008b7ba91ce7) Signed-off-by: Rodrigo Vivi commit c35f3aa34509085bfc9800c86bc9998f8954933d Author: Andy Chiu Date: Wed Aug 16 15:54:49 2023 +0000 RISC-V: vector: export VLENB csr in __sc_riscv_v_state VLENB is critical for callers of ptrace to reconstruct Vector register files from the register dump of NT_RISCV_VECTOR. Also, future systems may will have a writable VLENB, so add it now to potentially save future compatibility issue. Fixes: 0c59922c769a ("riscv: Add ptrace vector support") Signed-off-by: Andy Chiu Link: https://lore.kernel.org/r/20230816155450.26200-3-andy.chiu@sifive.com Signed-off-by: Palmer Dabbelt commit e3f9324b231aba1dc707572bfe80be210c2d4cbd Author: Palmer Dabbelt Date: Wed Aug 16 15:54:48 2023 +0000 RISC-V: Remove ptrace support for vectors We've found two bugs here: NT_RISCV_VECTOR steps on NT_RISCV_CSR (which is only for embedded), and we don't have vlenb in the core dumps. Given that we've have a pair of bugs croup up as part of the GDB review we've probably got other issues, so let's just cut this for 6.5 and get it right. Fixes: 0c59922c769a ("riscv: Add ptrace vector support") Reviewed-by: Maciej W. Rozycki Signed-off-by: Andy Chiu Link: https://lore.kernel.org/r/20230816155450.26200-2-andy.chiu@sifive.com Signed-off-by: Palmer Dabbelt commit 89bf6209cad66214d3774dac86b6bbf2aec6a30d Merge: 53663f4103ff6 7882541ca06d5 Author: Linus Torvalds Date: Tue Aug 22 11:16:23 2023 -0700 Merge tag 'devicetree-fixes-for-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix DT node refcount when creating platform devices - Fix deadlock in changeset code due to printing with devtree_lock held - Fix unittest EXPECT strings for parse_phandle_with_args_map() test - Fix IMA kexec memblock freeing * tag 'devicetree-fixes-for-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of/platform: increase refcount of fwnode of: dynamic: Refactor action prints to not use "%pOF" inside devtree_lock of: unittest: Fix EXPECT for parse_phandle_with_args_map() test mm,ima,kexec,of: use memblock_free_late from ima_free_kexec_buffer commit 6dc5774deefe38d9ab385a5dafbe6614ae63d166 Author: Edward Cree Date: Mon Aug 21 19:01:53 2023 +0100 sfc: allocate a big enough SKB for loopback selftest packet Cited commits passed a size to alloc_skb that was only big enough for the actual packet contents, but the following skb_put + memcpy writes the whole struct efx_loopback_payload including leading and trailing padding bytes (which are then stripped off with skb_pull/skb_trim). This could cause an skb_over_panic, although in practice we get saved by kmalloc_size_roundup. Pass the entire size we use, instead of the size of the final packet. Reported-by: Andy Moreton Fixes: cf60ed469629 ("sfc: use padding to fix alignment in loopback test") Fixes: 30c24dd87f3f ("sfc: siena: use padding to fix alignment in loopback test") Fixes: 1186c6b31ee1 ("sfc: falcon: use padding to fix alignment in loopback test") Signed-off-by: Edward Cree Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230821180153.18652-1-edward.cree@amd.com Signed-off-by: Jakub Kicinski commit 1a8660546b31b6696e6634f529efe021c8360141 Merge: 44f0fb8dfe263 b98c16107cc16 Author: Jakub Kicinski Date: Tue Aug 22 11:04:01 2023 -0700 Merge tag 'wireless-2023-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Two fixes: - reorder buffer filter checks can cause bad shift/UBSAN warning with newer HW, avoid the check (mac80211) - add Kconfig dependency for iwlwifi for PTP clock usage * tag 'wireless-2023-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: mac80211: limit reorder_buf_filtered to avoid UBSAN warning wifi: iwlwifi: mvm: add dependency for PTP clock ==================== Link: https://lore.kernel.org/r/20230822124206.43926-2-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 44f0fb8dfe263e27ac95d502a58586fe95fd5958 Author: Marek Behún Date: Mon Aug 21 14:14:53 2023 +0200 leds: trigger: netdev: rename 'hw_control' sysfs entry to 'offloaded' Commit b655892ffd6d ("leds: trigger: netdev: expose hw_control status via sysfs") exposed to sysfs the flag that tells whether the LED trigger is offloaded to hardware, under the name "hw_control", since that is the name under which this setting is called in the code. Everywhere else in kernel when some work that is normally done in software can be made to be done by hardware instead, we use the word "offloading" to describe this, e.g. "LED blinking is offloaded to hardware". Normally renaming sysfs entries is a no-go because of backwards compatibility. But since this patch was not yet released in a stable kernel, I think it is still possible to rename it, if there is consensus. Fixes: b655892ffd6d ("leds: trigger: netdev: expose hw_control status via sysfs") Signed-off-by: Marek Behún Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230821121453.30203-1-kabel@kernel.org Signed-off-by: Jakub Kicinski commit 604204fcb321abe81238551936ecda5269e81076 Author: Daniel Golle Date: Mon Aug 21 17:12:44 2023 +0100 net: ethernet: mtk_eth_soc: fix NULL pointer on hw reset When a hardware reset is triggered on devices not initializing WED the calls to mtk_wed_fe_reset and mtk_wed_fe_reset_complete dereference a pointer on uninitialized stack memory. Break out of both functions in case a hw_list entry is 0. Fixes: 08a764a7c51b ("net: ethernet: mtk_wed: add reset/reset_complete callbacks") Signed-off-by: Daniel Golle Reviewed-by: Simon Horman Acked-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/5465c1609b464cc7407ae1530c40821dcdf9d3e6.1692634266.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 53663f4103ff6738e4697004d6f84864d052333d Merge: e4311f7c0508d 895cedc179191 Author: Linus Torvalds Date: Tue Aug 22 10:50:17 2023 -0700 Merge tag 'nfs-for-6.5-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client fixes from Trond Myklebust: - fix a use after free in nfs_direct_join_group() (Cc: stable) - fix sysfs server name memory leak - fix lock recovery hang in NFSv4.0 - fix page free in the error path for nfs42_proc_getxattr() and __nfs4_get_acl_uncached() - SUNRPC/rdma: fix receive buffer dma-mapping after a server disconnect * tag 'nfs-for-6.5-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: xprtrdma: Remap Receive buffers after a reconnect NFSv4: fix out path in __nfs4_get_acl_uncached NFSv4.2: fix error handling in nfs42_proc_getxattr NFS: Fix sysfs server name memory leak NFS: Fix a use after free in nfs_direct_join_group() NFSv4: Fix dropped lock for racing OPEN and delegation return commit e4311f7c0508d6d0d1176a0d7b7ef3ab4a24be1e Merge: f7757129e3dea 70d91dc9b2ac9 Author: Linus Torvalds Date: Tue Aug 22 10:38:29 2023 -0700 Merge tag 'selinux-pr-20230821' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux fix from Paul Moore: "A small fix for a potential problem when cleaning up after a failed SELinux policy load (list next pointer not being properly initialized to NULL early enough)" * tag 'selinux-pr-20230821' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: set next pointer before attaching to list commit 2872144aec04baa7e43ecd2a60f7f0be3aa843fd Author: Anshuman Gupta Date: Wed Aug 16 18:22:16 2023 +0530 drm/i915/dgfx: Enable d3cold at s2idle System wide suspend already has support for lmem save/restore during suspend therefore enabling d3cold for s2idle and keepng it disable for runtime PM.(Refer below commit for d3cold runtime PM disable justification) 'commit 66eb93e71a7a ("drm/i915/dgfx: Keep PCI autosuspend control 'on' by default on all dGPU")' It will reduce the DG2 Card power consumption to ~0 Watt for s2idle power KPI. v2: - Added "Cc: stable@vger.kernel.org". Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8755 Cc: stable@vger.kernel.org Cc: Rodrigo Vivi Signed-off-by: Anshuman Gupta Reviewed-by: Rodrigo Vivi Tested-by: Aaron Ma Tested-by: Jianshui Yu Link: https://patchwork.freedesktop.org/patch/msgid/20230816125216.1722002-1-anshuman.gupta@intel.com (cherry picked from commit 2643e6d1f2a5e51877be24042d53cf956589be10) Signed-off-by: Rodrigo Vivi commit 5ad1ab30ac0809d2963ddcf39ac34317a24a2f17 Author: Ankit Nautiyal Date: Fri Aug 18 10:14:36 2023 +0530 drm/display/dp: Fix the DP DSC Receiver cap size DP DSC Receiver Capabilities are exposed via DPCD 60h-6Fh. Fix the DSC RECEIVER CAP SIZE accordingly. Fixes: ffddc4363c28 ("drm/dp: Add DP DSC DPCD receiver capability size define and missing SHIFT") Cc: Anusha Srivatsa Cc: Manasi Navare Cc: # v5.0+ Signed-off-by: Ankit Nautiyal Reviewed-by: Stanislav Lisovskiy Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20230818044436.177806-1-ankit.k.nautiyal@intel.com commit 99b415fe8986803ba0eaf6b8897b16edc8fe7ec2 Author: Kees Cook Date: Fri Aug 18 10:54:21 2023 -0700 tg3: Use slab_build_skb() when needed The tg3 driver will use kmalloc() under some conditions. Check the frag_size and use slab_build_skb() when frag_size is 0. Silences the warning introduced by commit ce098da1497c ("skbuff: Introduce slab_build_skb()"): Use slab_build_skb() instead ... tg3_poll_work+0x638/0xf90 [tg3] Fixes: ce098da1497c ("skbuff: Introduce slab_build_skb()") Reported-by: Fiona Ebner Closes: https://lore.kernel.org/all/1bd4cb9c-4eb8-3bdb-3e05-8689817242d1@proxmox.com Cc: Siva Reddy Kallam Cc: Prashant Sreedharan Cc: Michael Chan Cc: Bagas Sanjaya Signed-off-by: Kees Cook Reviewed-by: Pavan Chebbi Link: https://lore.kernel.org/r/20230818175417.never.273-kees@kernel.org Signed-off-by: Jakub Kicinski commit be809424659c2844a2d7ab653aacca4898538023 Author: Hangbin Liu Date: Thu Aug 17 16:24:59 2023 +0800 selftests: bonding: do not set port down before adding to bond Before adding a port to bond, it need to be set down first. In the lacpdu test the author set the port down specifically. But commit a4abfa627c38 ("net: rtnetlink: Enslave device before bringing it up") changed the operation order, the kernel will set the port down _after_ adding to bond. So all the ports will be down at last and the test failed. In fact, the veth interfaces are already inactive when added. This means there's no need to set them down again before adding to the bond. Let's just remove the link down operation. Fixes: a4abfa627c38 ("net: rtnetlink: Enslave device before bringing it up") Reported-by: Zhengchao Shao Closes: https://lore.kernel.org/netdev/a0ef07c7-91b0-94bd-240d-944a330fcabd@huawei.com/ Signed-off-by: Hangbin Liu Link: https://lore.kernel.org/r/20230817082459.1685972-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit e332938e6fc8117fb9bb1374339cea879b3972d9 Author: GONG, Ruiqi Date: Sun Aug 20 19:15:09 2023 +0800 samples: ftrace: Replace bti assembly with hint for older compiler When cross-building the arm64 kernel with allmodconfig using GCC 9.4, the following error occurs on multiple files under samples/ftrace/: /tmp/ccPC1ODs.s: Assembler messages: /tmp/ccPC1ODs.s:8: Error: selected processor does not support `bti c' Fix this issue by replacing `bti c` with `hint 34`, which is compatible for the older compiler. Link: https://lore.kernel.org/linux-trace-kernel/20230820111509.1470826-1-gongruiqi@huaweicloud.com Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Florent Revest Fixes: 8c3526fb86060cb5 ("arm64: ftrace: Add direct call trampoline samples support") Acked-by: Mark Rutland Signed-off-by: GONG, Ruiqi Signed-off-by: Steven Rostedt (Google) commit c422fbd5cb58c9a078172ae1e9750971b738a197 Author: Neil Armstrong Date: Mon Aug 21 14:11:21 2023 +0200 scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW major version > 5 The qunipro_g4_sel clear is also needed for new platforms with major version > 5. Fix the version check to take this into account. Fixes: 9c02aa24bf40 ("scsi: ufs: ufs-qcom: Clear qunipro_g4_sel for HW version major 5") Acked-by: Manivannan Sadhasivam Reviewed-by: Nitin Rawat Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20230821-topic-sm8x50-upstream-ufs-major-5-plus-v2-1-f42a4b712e58@linaro.org Reviewed-by: "Bao D. Nguyen" Signed-off-by: Martin K. Petersen commit d0c89af3130eb4ff962266bb7597690a696f1cbc Author: Bao D. Nguyen Date: Tue Aug 15 18:38:29 2023 -0700 scsi: ufs: mcq: Fix the search/wrap around logic The search and wrap around logic in the ufshcd_mcq_sqe_search() function does not work correctly when the hwq's queue depth is not a power of two number. Correct it so that any queue depth with a positive integer value within the supported range would work. Signed-off-by: "Bao D. Nguyen" Link: https://lore.kernel.org/r/ff49c15be205135ed3ec186f3086694c02867dbd.1692149603.git.quic_nguyenb@quicinc.com Reviewed-by: Bart Van Assche Fixes: 8d7290348992 ("scsi: ufs: mcq: Add supporting functions for MCQ abort") Signed-off-by: Martin K. Petersen commit 7882541ca06d51a6c12d687827176c16d5e05f65 Author: Peng Fan Date: Mon Aug 21 10:39:28 2023 +0800 of/platform: increase refcount of fwnode commit 0f8e5651095b ("of/platform: Propagate firmware node by calling device_set_node()") use of_fwnode_handle to replace of_node_get, which introduces a side effect that the refcount is not increased. Then the out of tree jailhouse hypervisor enable/disable test will trigger kernel dump in of_overlay_remove, with the following sequence " of_changeset_revert(&overlay_changeset); of_changeset_destroy(&overlay_changeset); of_overlay_remove(&overlay_id); " So increase the refcount to avoid issues. This patch also release the refcount when releasing amba device to avoid refcount leakage. Fixes: 0f8e5651095b ("of/platform: Propagate firmware node by calling device_set_node()") Reviewed-by: Andy Shevchenko Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20230821023928.3324283-2-peng.fan@oss.nxp.com Signed-off-by: Rob Herring commit 6867c7a3320669cbe44b905a3eb35db725c6d470 Author: T.J. Mercier Date: Mon Aug 14 15:16:36 2023 +0000 mm: multi-gen LRU: don't spin during memcg release When a memcg is in the process of being released mem_cgroup_tryget will fail because its reference count has already reached 0. This can happen during reclaim if the memcg has already been offlined, and we reclaim all remaining pages attributed to the offlined memcg. shrink_many attempts to skip the empty memcg in this case, and continue reclaiming from the remaining memcgs in the old generation. If there is only one memcg remaining, or if all remaining memcgs are in the process of being released then shrink_many will spin until all memcgs have finished being released. The release occurs through a workqueue, so it can take a while before kswapd is able to make any further progress. This fix results in reductions in kswapd activity and direct reclaim in a test where 28 apps (working set size > total memory) are repeatedly launched in a random sequence: A B delta ratio(%) allocstall_movable 5962 3539 -2423 -40.64 allocstall_normal 2661 2417 -244 -9.17 kswapd_high_wmark_hit_quickly 53152 7594 -45558 -85.71 pageoutrun 57365 11750 -45615 -79.52 Link: https://lkml.kernel.org/r/20230814151636.1639123-1-tjmercier@google.com Fixes: e4dde56cd208 ("mm: multi-gen LRU: per-node lru_gen_folio lists") Signed-off-by: T.J. Mercier Acked-by: Yu Zhao Cc: Signed-off-by: Andrew Morton commit e2c1ab070fdc81010ec44634838d24fce9ff9e53 Author: Miaohe Lin Date: Tue Jun 27 19:28:08 2023 +0800 mm: memory-failure: fix unexpected return value in soft_offline_page() When page_handle_poison() fails to handle the hugepage or free page in retry path, soft_offline_page() will return 0 while -EBUSY is expected in this case. Consequently the user will think soft_offline_page succeeds while it in fact failed. So the user will not try again later in this case. Link: https://lkml.kernel.org/r/20230627112808.1275241-1-linmiaohe@huawei.com Fixes: b94e02822deb ("mm,hwpoison: try to narrow window race for free pages") Signed-off-by: Miaohe Lin Acked-by: Naoya Horiguchi Cc: Signed-off-by: Andrew Morton commit d59070d1076ec5114edb67c87658aeb1d691d381 Author: Arnd Bergmann Date: Fri Aug 11 15:10:13 2023 +0200 radix tree: remove unused variable Recent versions of clang warn about an unused variable, though older versions saw the 'slot++' as a use and did not warn: radix-tree.c:1136:50: error: parameter 'slot' set but not used [-Werror,-Wunused-but-set-parameter] It's clearly not needed any more, so just remove it. Link: https://lkml.kernel.org/r/20230811131023.2226509-1-arnd@kernel.org Fixes: 3a08cd52c37c7 ("radix tree: Remove multiorder support") Signed-off-by: Arnd Bergmann Cc: Matthew Wilcox Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Peng Zhang Cc: Rong Tao Cc: Tom Rix Cc: Signed-off-by: Andrew Morton commit a50420c79731fc5cf27ad43719c1091e842a2606 Author: Alexandre Ghiti Date: Wed Aug 9 18:46:33 2023 +0200 mm: add a call to flush_cache_vmap() in vmap_pfn() flush_cache_vmap() must be called after new vmalloc mappings are installed in the page table in order to allow architectures to make sure the new mapping is visible. It could lead to a panic since on some architectures (like powerpc), the page table walker could see the wrong pte value and trigger a spurious page fault that can not be resolved (see commit f1cb8f9beba8 ("powerpc/64s/radix: avoid ptesync after set_pte and ptep_set_access_flags")). But actually the patch is aiming at riscv: the riscv specification allows the caching of invalid entries in the TLB, and since we recently removed the vmalloc page fault handling, we now need to emit a tlb shootdown whenever a new vmalloc mapping is emitted (https://lore.kernel.org/linux-riscv/20230725132246.817726-1-alexghiti@rivosinc.com/). That's a temporary solution, there are ways to avoid that :) Link: https://lkml.kernel.org/r/20230809164633.1556126-1-alexghiti@rivosinc.com Fixes: 3e9a9e256b1e ("mm: add a vmap_pfn function") Reported-by: Dylan Jhong Closes: https://lore.kernel.org/linux-riscv/ZMytNY2J8iyjbPPy@atctrx.andestech.com/ Signed-off-by: Alexandre Ghiti Reviewed-by: Christoph Hellwig Reviewed-by: Palmer Dabbelt Acked-by: Palmer Dabbelt Reviewed-by: Dylan Jhong Cc: Signed-off-by: Andrew Morton commit 1738b949625c7e17a454b25de33f1f415da3db69 Author: Ayush Jain Date: Tue Aug 8 07:43:47 2023 -0500 selftests/mm: FOLL_LONGTERM need to be updated to 0x100 After commit 2c2241081f7d ("mm/gup: move private gup FOLL_ flags to internal.h") FOLL_LONGTERM flag value got updated from 0x10000 to 0x100 at include/linux/mm_types.h. As hmm.hmm_device_private.hmm_gup_test uses FOLL_LONGTERM Updating same here as well. Before this change test goes in an infinite assert loop in hmm.hmm_device_private.hmm_gup_test ========================================================== RUN hmm.hmm_device_private.hmm_gup_test ... hmm-tests.c:1962:hmm_gup_test:Expected HMM_DMIRROR_PROT_WRITE.. ..(2) == m[2] (34) hmm-tests.c:157:hmm_gup_test:Expected ret (-1) == 0 (0) hmm-tests.c:157:hmm_gup_test:Expected ret (-1) == 0 (0) ... ========================================================== Call Trace: ? sched_clock+0xd/0x20 ? __lock_acquire.constprop.0+0x120/0x6c0 ? ktime_get+0x2c/0xd0 ? sched_clock+0xd/0x20 ? local_clock+0x12/0xd0 ? lock_release+0x26e/0x3b0 pin_user_pages_fast+0x4c/0x70 gup_test_ioctl+0x4ff/0xbb0 ? gup_test_ioctl+0x68c/0xbb0 __x64_sys_ioctl+0x99/0xd0 do_syscall_64+0x60/0x90 ? syscall_exit_to_user_mode+0x2a/0x50 ? do_syscall_64+0x6d/0x90 ? syscall_exit_to_user_mode+0x2a/0x50 ? do_syscall_64+0x6d/0x90 ? irqentry_exit_to_user_mode+0xd/0x20 ? irqentry_exit+0x3f/0x50 ? exc_page_fault+0x96/0x200 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f6aaa31aaff After this change test is able to pass successfully. Link: https://lkml.kernel.org/r/20230808124347.79163-1-ayush.jain3@amd.com Fixes: 2c2241081f7d ("mm/gup: move private gup FOLL_ flags to internal.h") Signed-off-by: Ayush Jain Reviewed-by: Raghavendra K T Reviewed-by: John Hubbard Acked-by: David Hildenbrand Cc: Jason Gunthorpe Cc: Signed-off-by: Andrew Morton commit f83913f8c5b882a312e72b7669762f8a5c9385e4 Author: Ryusuke Konishi Date: Sat Aug 5 22:20:38 2023 +0900 nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() A syzbot stress test reported that create_empty_buffers() called from nilfs_lookup_dirty_data_buffers() can cause a general protection fault. Analysis using its reproducer revealed that the back reference "mapping" from a page/folio has been changed to NULL after dirty page/folio gang lookup in nilfs_lookup_dirty_data_buffers(). Fix this issue by excluding pages/folios from being collected if, after acquiring a lock on each page/folio, its back reference "mapping" differs from the pointer to the address space struct that held the page/folio. Link: https://lkml.kernel.org/r/20230805132038.6435-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+0ad741797f4565e7e2d2@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/0000000000002930a705fc32b231@google.com Tested-by: Ryusuke Konishi Cc: Signed-off-by: Andrew Morton commit 5805192c7b7257d290474cb1a3897d0567281bbc Author: David Hildenbrand Date: Sat Aug 5 12:12:56 2023 +0200 mm/gup: handle cont-PTE hugetlb pages correctly in gup_must_unshare() via GUP-fast In contrast to most other GUP code, GUP-fast common page table walking code like gup_pte_range() also handles hugetlb pages. But in contrast to other hugetlb page table walking code, it does not look at the hugetlb PTE abstraction whereby we have only a single logical hugetlb PTE per hugetlb page, even when using multiple cont-PTEs underneath -- which is for example what huge_ptep_get() abstracts. So when we have a hugetlb page that is mapped via cont-PTEs, GUP-fast might stumble over a PTE that does not map the head page of a hugetlb page -- not the first "head" PTE of such a cont mapping. Logically, the whole hugetlb page is mapped (entire_mapcount == 1), but we might end up calling gup_must_unshare() with a tail page of a hugetlb page. We only maintain a single PageAnonExclusive flag per hugetlb page (as hugetlb pages cannot get partially COW-shared), stored for the head page. That flag is clear for all tail pages. So when gup_must_unshare() ends up calling PageAnonExclusive() with a tail page of a hugetlb page: 1) With CONFIG_DEBUG_VM_PGFLAGS Stumbles over the: VM_BUG_ON_PGFLAGS(PageHuge(page) && !PageHead(page), page); For example, when executing the COW selftests with 64k hugetlb pages on arm64: [ 61.082187] page:00000000829819ff refcount:3 mapcount:1 mapping:0000000000000000 index:0x1 pfn:0x11ee11 [ 61.082842] head:0000000080f79bf7 order:4 entire_mapcount:1 nr_pages_mapped:0 pincount:2 [ 61.083384] anon flags: 0x17ffff80003000e(referenced|uptodate|dirty|head|mappedtodisk|node=0|zone=2|lastcpupid=0xfffff) [ 61.084101] page_type: 0xffffffff() [ 61.084332] raw: 017ffff800000000 fffffc00037b8401 0000000000000402 0000000200000000 [ 61.084840] raw: 0000000000000010 0000000000000000 00000000ffffffff 0000000000000000 [ 61.085359] head: 017ffff80003000e ffffd9e95b09b788 ffffd9e95b09b788 ffff0007ff63cf71 [ 61.085885] head: 0000000000000000 0000000000000002 00000003ffffffff 0000000000000000 [ 61.086415] page dumped because: VM_BUG_ON_PAGE(PageHuge(page) && !PageHead(page)) [ 61.086914] ------------[ cut here ]------------ [ 61.087220] kernel BUG at include/linux/page-flags.h:990! [ 61.087591] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 61.087999] Modules linked in: ... [ 61.089404] CPU: 0 PID: 4612 Comm: cow Kdump: loaded Not tainted 6.5.0-rc4+ #3 [ 61.089917] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 61.090409] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 61.090897] pc : gup_must_unshare.part.0+0x64/0x98 [ 61.091242] lr : gup_must_unshare.part.0+0x64/0x98 [ 61.091592] sp : ffff8000825eb940 [ 61.091826] x29: ffff8000825eb940 x28: 0000000000000000 x27: fffffc00037b8440 [ 61.092329] x26: 0400000000000001 x25: 0000000000080101 x24: 0000000000080000 [ 61.092835] x23: 0000000000080100 x22: ffff0000cffb9588 x21: ffff0000c8ec6b58 [ 61.093341] x20: 0000ffffad6b1000 x19: fffffc00037b8440 x18: ffffffffffffffff [ 61.093850] x17: 2864616548656761 x16: 5021202626202965 x15: 6761702865677548 [ 61.094358] x14: 6567615028454741 x13: 2929656761702864 x12: 6165486567615021 [ 61.094858] x11: 00000000ffff7fff x10: 00000000ffff7fff x9 : ffffd9e958b7a1c0 [ 61.095359] x8 : 00000000000bffe8 x7 : c0000000ffff7fff x6 : 00000000002bffa8 [ 61.095873] x5 : ffff0008bb19e708 x4 : 0000000000000000 x3 : 0000000000000000 [ 61.096380] x2 : 0000000000000000 x1 : ffff0000cf6636c0 x0 : 0000000000000046 [ 61.096894] Call trace: [ 61.097080] gup_must_unshare.part.0+0x64/0x98 [ 61.097392] gup_pte_range+0x3a8/0x3f0 [ 61.097662] gup_pgd_range+0x1ec/0x280 [ 61.097942] lockless_pages_from_mm+0x64/0x1a0 [ 61.098258] internal_get_user_pages_fast+0xe4/0x1d0 [ 61.098612] pin_user_pages_fast+0x58/0x78 [ 61.098917] pin_longterm_test_start+0xf4/0x2b8 [ 61.099243] gup_test_ioctl+0x170/0x3b0 [ 61.099528] __arm64_sys_ioctl+0xa8/0xf0 [ 61.099822] invoke_syscall.constprop.0+0x7c/0xd0 [ 61.100160] el0_svc_common.constprop.0+0xe8/0x100 [ 61.100500] do_el0_svc+0x38/0xa0 [ 61.100736] el0_svc+0x3c/0x198 [ 61.100971] el0t_64_sync_handler+0x134/0x150 [ 61.101280] el0t_64_sync+0x17c/0x180 [ 61.101543] Code: aa1303e0 f00074c1 912b0021 97fffeb2 (d4210000) 2) Without CONFIG_DEBUG_VM_PGFLAGS Always detects "not exclusive" for passed tail pages and refuses to PIN the tail pages R/O, as gup_must_unshare() == true. GUP-fast will fallback to ordinary GUP. As ordinary GUP properly considers the logical hugetlb PTE abstraction in hugetlb_follow_page_mask(), pinning the page will succeed when looking at the PageAnonExclusive on the head page only. So the only real effect of this is that with cont-PTE hugetlb pages, we'll always fallback from GUP-fast to ordinary GUP when not working on the head page, which ends up checking the head page and do the right thing. Consequently, the cow selftests pass with cont-PTE hugetlb pages as well without CONFIG_DEBUG_VM_PGFLAGS. Note that this only applies to anon hugetlb pages that are mapped using cont-PTEs: for example 64k hugetlb pages on a 4k arm64 kernel. ... and only when R/O-pinning (FOLL_PIN) such pages that are mapped into the page table R/O using GUP-fast. On production kernels (and even most debug kernels, that don't set CONFIG_DEBUG_VM_PGFLAGS) this patch should theoretically not be required to be backported. But of course, it does not hurt. Link: https://lkml.kernel.org/r/20230805101256.87306-1-david@redhat.com Fixes: a7f226604170 ("mm/gup: trigger FAULT_FLAG_UNSHARE when R/O-pinning a possibly shared anonymous page") Signed-off-by: David Hildenbrand Reported-by: Ryan Roberts Reviewed-by: Ryan Roberts Tested-by: Ryan Roberts Cc: Vlastimil Babka Cc: John Hubbard Cc: Jason Gunthorpe Cc: Peter Xu Cc: Mike Kravetz Cc: Signed-off-by: Andrew Morton commit 60439471f30be00dc4f6648322ab1a3a3f89777f Author: Lucas Karpinski Date: Fri Aug 4 15:35:29 2023 -0400 selftests: cgroup: fix test_kmem_basic less than error test_kmem_basic creates 100,000 negative dentries, with each one mapping to a slab object. After memory.high is set, these are reclaimed through the shrink_slab function call which reclaims all 100,000 entries. The test passes the majority of the time because when slab1 or current is calculated, it is often above 0, however, 0 is also an acceptable value. Link: https://lkml.kernel.org/r/7d6gcuyzdjcice6qbphrmpmv5skr5jtglg375unnjxqhstvhxc@qkn6dw6bao6v Signed-off-by: Lucas Karpinski Cc: Johannes Weiner Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Cc: Shakeel Butt Cc: Shuah Khan Cc: Tejun Heo Cc: Zefan Li Signed-off-by: Andrew Morton commit 49b0638502da097c15d46cd4e871dbaa022caf7c Author: Suren Baghdasaryan Date: Fri Aug 4 08:27:19 2023 -0700 mm: enable page walking API to lock vmas during the walk walk_page_range() and friends often operate under write-locked mmap_lock. With introduction of vma locks, the vmas have to be locked as well during such walks to prevent concurrent page faults in these areas. Add an additional member to mm_walk_ops to indicate locking requirements for the walk. The change ensures that page walks which prevent concurrent page faults by write-locking mmap_lock, operate correctly after introduction of per-vma locks. With per-vma locks page faults can be handled under vma lock without taking mmap_lock at all, so write locking mmap_lock would not stop them. The change ensures vmas are properly locked during such walks. A sample issue this solves is do_mbind() performing queue_pages_range() to queue pages for migration. Without this change a concurrent page can be faulted into the area and be left out of migration. Link: https://lkml.kernel.org/r/20230804152724.3090321-2-surenb@google.com Signed-off-by: Suren Baghdasaryan Suggested-by: Linus Torvalds Suggested-by: Jann Horn Cc: David Hildenbrand Cc: Davidlohr Bueso Cc: Hugh Dickins Cc: Johannes Weiner Cc: Laurent Dufour Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Michel Lespinasse Cc: Peter Xu Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 8b9c1cc0418a43196477083e7082568e7a4c9418 Author: David Hildenbrand Date: Thu Aug 3 16:32:03 2023 +0200 smaps: use vm_normal_page_pmd() instead of follow_trans_huge_pmd() We shouldn't be using a GUP-internal helper if it can be avoided. Similar to smaps_pte_entry() that uses vm_normal_page(), let's use vm_normal_page_pmd() that similarly refuses to return the huge zeropage. In contrast to follow_trans_huge_pmd(), vm_normal_page_pmd(): (1) Will always return the head page, not a tail page of a THP. If we'd ever call smaps_account with a tail page while setting "compound = true", we could be in trouble, because smaps_account() would look at the memmap of unrelated pages. If we're unlucky, that memmap does not exist at all. Before we removed PG_doublemap, we could have triggered something similar as in commit 24d7275ce279 ("fs/proc: task_mmu.c: don't read mapcount for migration entry"). This can theoretically happen ever since commit ff9f47f6f00c ("mm: proc: smaps_rollup: do not stall write attempts on mmap_lock"): (a) We're in show_smaps_rollup() and processed a VMA (b) We release the mmap lock in show_smaps_rollup() because it is contended (c) We merged that VMA with another VMA (d) We collapsed a THP in that merged VMA at that position If the end address of the original VMA falls into the middle of a THP area, we would call smap_gather_stats() with a start address that falls into a PMD-mapped THP. It's probably very rare to trigger when not really forced. (2) Will succeed on a is_pci_p2pdma_page(), like vm_normal_page() Treat such PMDs here just like smaps_pte_entry() would treat such PTEs. If such pages would be anonymous, we most certainly would want to account them. (3) Will skip over pmd_devmap(), like vm_normal_page() for pte_devmap() As noted in vm_normal_page(), that is only for handling legacy ZONE_DEVICE pages. So just like smaps_pte_entry(), we'll now also ignore such PMD entries. Especially, follow_pmd_mask() never ends up calling follow_trans_huge_pmd() on pmd_devmap(). Instead it calls follow_devmap_pmd() -- which will fail if neither FOLL_GET nor FOLL_PIN is set. So skipping pmd_devmap() pages seems to be the right thing to do. (4) Will properly handle VM_MIXEDMAP/VM_PFNMAP, like vm_normal_page() We won't be returning a memmap that should be ignored by core-mm, or worse, a memmap that does not even exist. Note that while walk_page_range() will skip VM_PFNMAP mappings, walk_page_vma() won't. Most probably this case doesn't currently really happen on the PMD level, otherwise we'd already be able to trigger kernel crashes when reading smaps / smaps_rollup. So most probably only (1) is relevant in practice as of now, but could only cause trouble in extreme corner cases. Let's move follow_trans_huge_pmd() to mm/internal.h to discourage future reuse in wrong context. Link: https://lkml.kernel.org/r/20230803143208.383663-3-david@redhat.com Fixes: ff9f47f6f00c ("mm: proc: smaps_rollup: do not stall write attempts on mmap_lock") Signed-off-by: David Hildenbrand Acked-by: Mel Gorman Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: John Hubbard Cc: Linus Torvalds Cc: liubo Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Paolo Bonzini Cc: Peter Xu Cc: Shuah Khan Signed-off-by: Andrew Morton commit d74943a2f3cdade34e471b36f55f7979be656867 Author: David Hildenbrand Date: Thu Aug 3 16:32:02 2023 +0200 mm/gup: reintroduce FOLL_NUMA as FOLL_HONOR_NUMA_FAULT Unfortunately commit 474098edac26 ("mm/gup: replace FOLL_NUMA by gup_can_follow_protnone()") missed that follow_page() and follow_trans_huge_pmd() never implicitly set FOLL_NUMA because they really don't want to fail on PROT_NONE-mapped pages -- either due to NUMA hinting or due to inaccessible (PROT_NONE) VMAs. As spelled out in commit 0b9d705297b2 ("mm: numa: Support NUMA hinting page faults from gup/gup_fast"): "Other follow_page callers like KSM should not use FOLL_NUMA, or they would fail to get the pages if they use follow_page instead of get_user_pages." liubo reported [1] that smaps_rollup results are imprecise, because they miss accounting of pages that are mapped PROT_NONE. Further, it's easy to reproduce that KSM no longer works on inaccessible VMAs on x86-64, because pte_protnone()/pmd_protnone() also indictaes "true" in inaccessible VMAs, and follow_page() refuses to return such pages right now. As KVM really depends on these NUMA hinting faults, removing the pte_protnone()/pmd_protnone() handling in GUP code completely is not really an option. To fix the issues at hand, let's revive FOLL_NUMA as FOLL_HONOR_NUMA_FAULT to restore the original behavior for now and add better comments. Set FOLL_HONOR_NUMA_FAULT independent of FOLL_FORCE in is_valid_gup_args(), to add that flag for all external GUP users. Note that there are three GUP-internal __get_user_pages() users that don't end up calling is_valid_gup_args() and consequently won't get FOLL_HONOR_NUMA_FAULT set. 1) get_dump_page(): we really don't want to handle NUMA hinting faults. It specifies FOLL_FORCE and wouldn't have honored NUMA hinting faults already. 2) populate_vma_page_range(): we really don't want to handle NUMA hinting faults. It specifies FOLL_FORCE on accessible VMAs, so it wouldn't have honored NUMA hinting faults already. 3) faultin_vma_page_range(): we similarly don't want to handle NUMA hinting faults. To make the combination of FOLL_FORCE and FOLL_HONOR_NUMA_FAULT work in inaccessible VMAs properly, we have to perform VMA accessibility checks in gup_can_follow_protnone(). As GUP-fast should reject such pages either way in pte_access_permitted()/pmd_access_permitted() -- for example on x86-64 and arm64 that both implement pte_protnone() -- let's just always fallback to ordinary GUP when stumbling over pte_protnone()/pmd_protnone(). As Linus notes [2], honoring NUMA faults might only make sense for selected GUP users. So we should really see if we can instead let relevant GUP callers specify it manually, and not trigger NUMA hinting faults from GUP as default. Prepare for that by making FOLL_HONOR_NUMA_FAULT an external GUP flag and adding appropriate documenation. While at it, remove a stale comment from follow_trans_huge_pmd(): That comment for pmd_protnone() was added in commit 2b4847e73004 ("mm: numa: serialise parallel get_user_page against THP migration"), which noted: THP does not unmap pages due to a lack of support for migration entries at a PMD level. This allows races with get_user_pages Nowadays, we do have PMD migration entries, so the comment no longer applies. Let's drop it. [1] https://lore.kernel.org/r/20230726073409.631838-1-liubo254@huawei.com [2] https://lore.kernel.org/r/CAHk-=wgRiP_9X0rRdZKT8nhemZGNateMtb366t37d8-x7VRs=g@mail.gmail.com Link: https://lkml.kernel.org/r/20230803143208.383663-2-david@redhat.com Fixes: 474098edac26 ("mm/gup: replace FOLL_NUMA by gup_can_follow_protnone()") Signed-off-by: David Hildenbrand Reported-by: liubo Closes: https://lore.kernel.org/r/20230726073409.631838-1-liubo254@huawei.com Reported-by: Peter Xu Closes: https://lore.kernel.org/all/ZMKJjDaqZ7FW0jfe@x1n/ Acked-by: Mel Gorman Acked-by: Peter Xu Cc: Hugh Dickins Cc: Jason Gunthorpe Cc: John Hubbard Cc: Linus Torvalds Cc: Matthew Wilcox (Oracle) Cc: Mel Gorman Cc: Paolo Bonzini Cc: Shuah Khan Cc: Signed-off-by: Andrew Morton commit 67f6317dfa609846a227a706532439a22828c24b Author: Petr Oros Date: Fri Aug 11 10:07:02 2023 +0200 ice: Fix NULL pointer deref during VF reset During stress test with attaching and detaching VF from KVM and simultaneously changing VFs spoofcheck and trust there was a NULL pointer dereference in ice_reset_vf that VF's VSI is null. More than one instance of ice_reset_vf() can be running at a given time. When we rebuild the VSI in ice_reset_vf, another reset can be triaged from ice_service_task. In this case we can access the currently uninitialized VSI and cause panic. The window for this racing condition has been around for a long time but it's much worse after commit 227bf4500aaa ("ice: move VSI delete outside deconfig") because the reset runs faster. ice_reset_vf() using vf->cfg_lock and when we move this lock before accessing to the VF VSI, we can fix BUG for all cases. Panic occurs sometimes in ice_vsi_is_rx_queue_active() and sometimes in ice_vsi_stop_all_rx_rings() With our reproducer, we can hit BUG: ~8h before commit 227bf4500aaa ("ice: move VSI delete outside deconfig"). ~20m after commit 227bf4500aaa ("ice: move VSI delete outside deconfig"). After this fix we are not able to reproduce it after ~48h There was commit cf90b74341ee ("ice: Fix call trace with null VSI during VF reset") which also tried to fix this issue, but it was only partially resolved and the bug still exists. [ 6420.658415] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 6420.665382] #PF: supervisor read access in kernel mode [ 6420.670521] #PF: error_code(0x0000) - not-present page [ 6420.675659] PGD 0 [ 6420.677679] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 6420.682038] CPU: 53 PID: 326472 Comm: kworker/53:0 Kdump: loaded Not tainted 5.14.0-317.el9.x86_64 #1 [ 6420.691250] Hardware name: Dell Inc. PowerEdge R750/04V528, BIOS 1.6.5 04/15/2022 [ 6420.698729] Workqueue: ice ice_service_task [ice] [ 6420.703462] RIP: 0010:ice_vsi_is_rx_queue_active+0x2d/0x60 [ice] [ 6420.705860] ice 0000:ca:00.0: VF 0 is now untrusted [ 6420.709494] Code: 00 00 66 83 bf 76 04 00 00 00 48 8b 77 10 74 3e 31 c0 eb 0f 0f b7 97 76 04 00 00 48 83 c0 01 39 c2 7e 2b 48 8b 97 68 04 00 00 <0f> b7 0c 42 48 8b 96 20 13 00 00 48 8d 94 8a 00 00 12 00 8b 12 83 [ 6420.714426] ice 0000:ca:00.0 ens7f0: Setting MAC 22:22:22:22:22:00 on VF 0. VF driver will be reinitialized [ 6420.733120] RSP: 0018:ff778d2ff383fdd8 EFLAGS: 00010246 [ 6420.733123] RAX: 0000000000000000 RBX: ff2acf1916294000 RCX: 0000000000000000 [ 6420.733125] RDX: 0000000000000000 RSI: ff2acf1f2c6401a0 RDI: ff2acf1a27301828 [ 6420.762346] RBP: ff2acf1a27301828 R08: 0000000000000010 R09: 0000000000001000 [ 6420.769476] R10: ff2acf1916286000 R11: 00000000019eba3f R12: ff2acf19066460d0 [ 6420.776611] R13: ff2acf1f2c6401a0 R14: ff2acf1f2c6401a0 R15: 00000000ffffffff [ 6420.783742] FS: 0000000000000000(0000) GS:ff2acf28ffa80000(0000) knlGS:0000000000000000 [ 6420.791829] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6420.797575] CR2: 0000000000000000 CR3: 00000016ad410003 CR4: 0000000000773ee0 [ 6420.804708] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 6420.811034] vfio-pci 0000:ca:01.0: enabling device (0000 -> 0002) [ 6420.811840] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 6420.811841] PKRU: 55555554 [ 6420.811842] Call Trace: [ 6420.811843] [ 6420.811844] ice_reset_vf+0x9a/0x450 [ice] [ 6420.811876] ice_process_vflr_event+0x8f/0xc0 [ice] [ 6420.841343] ice_service_task+0x23b/0x600 [ice] [ 6420.845884] ? __schedule+0x212/0x550 [ 6420.849550] process_one_work+0x1e2/0x3b0 [ 6420.853563] ? rescuer_thread+0x390/0x390 [ 6420.857577] worker_thread+0x50/0x3a0 [ 6420.861242] ? rescuer_thread+0x390/0x390 [ 6420.865253] kthread+0xdd/0x100 [ 6420.868400] ? kthread_complete_and_exit+0x20/0x20 [ 6420.873194] ret_from_fork+0x1f/0x30 [ 6420.876774] [ 6420.878967] Modules linked in: vfio_pci vfio_pci_core vfio_iommu_type1 vfio iavf vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_counter nf_tables bridge stp llc sctp ip6_udp_tunnel udp_tunnel nfp tls nfnetlink bluetooth mlx4_en mlx4_core rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs rfkill sunrpc intel_rapl_msr intel_rapl_common i10nm_edac nfit libnvdimm ipmi_ssif x86_pkg_temp_thermal intel_powerclamp coretemp irdma kvm_intel i40e kvm iTCO_wdt dcdbas ib_uverbs irqbypass iTCO_vendor_support mgag200 mei_me ib_core dell_smbios isst_if_mmio isst_if_mbox_pci rapl i2c_algo_bit drm_shmem_helper intel_cstate drm_kms_helper syscopyarea sysfillrect isst_if_common sysimgblt intel_uncore fb_sys_fops dell_wmi_descriptor wmi_bmof intel_vsec mei i2c_i801 acpi_ipmi ipmi_si i2c_smbus ipmi_devintf intel_pch_thermal acpi_power_meter pcspk r Fixes: efe41860008e ("ice: Fix memory corruption in VF driver") Fixes: f23df5220d2b ("ice: Fix spurious interrupt during removal of trusted VF") Signed-off-by: Petr Oros Reviewed-by: Simon Horman Reviewed-by: Przemek Kitszel Reviewed-by: Jacob Keller Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 0ecff05e6c59dd82dbcb9706db911f7fd9f40fb8 Author: Petr Oros Date: Fri Aug 11 10:07:01 2023 +0200 Revert "ice: Fix ice VF reset during iavf initialization" This reverts commit 7255355a0636b4eff08d5e8139c77d98f151c4fc. After this commit we are not able to attach VF to VM: virsh attach-interface v0 hostdev --managed 0000:41:01.0 --mac 52:52:52:52:52:52 error: Failed to attach interface error: Cannot set interface MAC to 52:52:52:52:52:52 for ifname enp65s0f0np0 vf 0: Resource temporarily unavailable ice_check_vf_ready_for_cfg() already contain waiting for reset. New condition in ice_check_vf_ready_for_reset() causing only problems. Fixes: 7255355a0636 ("ice: Fix ice VF reset during iavf initialization") Signed-off-by: Petr Oros Reviewed-by: Simon Horman Reviewed-by: Przemek Kitszel Reviewed-by: Jacob Keller Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 10083aef784031fa9f06c19a1b182e6fad5338d9 Author: Jesse Brandeburg Date: Thu Aug 10 16:51:10 2023 -0700 ice: fix receive buffer size miscalculation The driver is misconfiguring the hardware for some values of MTU such that it could use multiple descriptors to receive a packet when it could have simply used one. Change the driver to use a round-up instead of the result of a shift, as the shift can truncate the lower bits of the size, and result in the problem noted above. It also aligns this driver with similar code in i40e. The insidiousness of this problem is that everything works with the wrong size, it's just not working as well as it could, as some MTU sizes end up using two or more descriptors, and there is no way to tell that is happening without looking at ice_trace or a bus analyzer. Fixes: efc2214b6047 ("ice: Add support for XDP") Reviewed-by: Przemek Kitszel Signed-off-by: Jesse Brandeburg Reviewed-by: Leon Romanovsky Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit c2489bb7e6be2e8cdced12c16c42fa128403ac03 Author: Zheng Yejian Date: Fri Aug 18 10:26:45 2023 +0800 tracing: Introduce pipe_cpumask to avoid race on trace_pipes There is race issue when concurrently splice_read main trace_pipe and per_cpu trace_pipes which will result in data read out being different from what actually writen. As suggested by Steven: > I believe we should add a ref count to trace_pipe and the per_cpu > trace_pipes, where if they are opened, nothing else can read it. > > Opening trace_pipe locks all per_cpu ref counts, if any of them are > open, then the trace_pipe open will fail (and releases any ref counts > it had taken). > > Opening a per_cpu trace_pipe will up the ref count for just that > CPU buffer. This will allow multiple tasks to read different per_cpu > trace_pipe files, but will prevent the main trace_pipe file from > being opened. But because we only need to know whether per_cpu trace_pipe is open or not, using a cpumask instead of using ref count may be easier. After this patch, users will find that: - Main trace_pipe can be opened by only one user, and if it is opened, all per_cpu trace_pipes cannot be opened; - Per_cpu trace_pipes can be opened by multiple users, but each per_cpu trace_pipe can only be opened by one user. And if one of them is opened, main trace_pipe cannot be opened. Link: https://lore.kernel.org/linux-trace-kernel/20230818022645.1948314-1-zhengyejian1@huawei.com Suggested-by: Steven Rostedt (Google) Signed-off-by: Zheng Yejian Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit f19df6e4de64b7fc6d71f192aa9ff3b701e4bade Author: David Michael Date: Tue Aug 15 21:42:41 2023 -0400 drm/panfrost: Skip speed binning on EOPNOTSUPP Encountered on an ARM Mali-T760 MP4, attempting to read the nvmem variable can also return EOPNOTSUPP instead of ENOENT when speed binning is unsupported. Cc: Fixes: 7d690f936e9b ("drm/panfrost: Add basic support for speed binning") Signed-off-by: David Michael Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://patchwork.freedesktop.org/patch/msgid/87msyryd7y.fsf@gmail.com commit 914d9d831e6126a6e7a92e27fcfaa250671be42c Author: Rob Herring Date: Fri Aug 18 15:40:57 2023 -0500 of: dynamic: Refactor action prints to not use "%pOF" inside devtree_lock While originally it was fine to format strings using "%pOF" while holding devtree_lock, this now causes a deadlock. Lockdep reports: of_get_parent from of_fwnode_get_parent+0x18/0x24 ^^^^^^^^^^^^^ of_fwnode_get_parent from fwnode_count_parents+0xc/0x28 fwnode_count_parents from fwnode_full_name_string+0x18/0xac fwnode_full_name_string from device_node_string+0x1a0/0x404 device_node_string from pointer+0x3c0/0x534 pointer from vsnprintf+0x248/0x36c vsnprintf from vprintk_store+0x130/0x3b4 Fix this by moving the printing in __of_changeset_entry_apply() outside the lock. As the only difference in the multiple prints is the action name, use the existing "action_names" to refactor the prints into a single print. Fixes: a92eb7621b9fb2c2 ("lib/vsprintf: Make use of fwnode API to obtain node names and separators") Cc: stable@vger.kernel.org Reported-by: Geert Uytterhoeven Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230801-dt-changeset-fixes-v3-2-5f0410e007dd@kernel.org Signed-off-by: Rob Herring commit 0aeae3788e28f64ccb95405d4dc8cd80637ffaea Author: Rob Herring Date: Fri Aug 18 15:40:56 2023 -0500 of: unittest: Fix EXPECT for parse_phandle_with_args_map() test Commit 12e17243d8a1 ("of: base: improve error msg in of_phandle_iterator_next()") added printing of the phandle value on error, but failed to update the unittest. Fixes: 12e17243d8a1 ("of: base: improve error msg in of_phandle_iterator_next()") Cc: stable@vger.kernel.org Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230801-dt-changeset-fixes-v3-1-5f0410e007dd@kernel.org Signed-off-by: Rob Herring commit 627d05a41ca1fbb9d390f9513af262f001f261f7 Author: Srinivas Goud Date: Mon Aug 21 15:00:16 2023 +0530 spi: spi-cadence: Fix data corruption issues in slave mode Remove 10us delay in cdns_spi_process_fifo() (called from cdns_spi_irq()) to fix data corruption issue on Master side when this driver configured in Slave mode, as Slave is failed to prepare the date on time due to above delay. Add 10us delay before processing the RX FIFO as TX empty doesn't guarantee valid data in RX FIFO. Signed-off-by: Srinivas Goud Reviewed-by: Charles Keepax Tested-by: Charles Keepax Link: https://lore.kernel.org/r/1692610216-217644-1-git-send-email-srinivas.goud@amd.com Signed-off-by: Mark Brown commit 715dc9a1f0c8ae0bbd4e5b37f9a165ea39e47fe9 Author: Leonard Göhrs Date: Wed Aug 16 16:52:37 2023 +0200 spi: stm32: fix accidential revert to byte-sized transfer splitting Commit 6f486556abe35 ("spi: stm32: renaming of spi_master into spi_controller") included an accidential reverted of a change added in commit 1e4929112507f ("spi: stm32: split large transfers based on word size instead of bytes"). This breaks large SPI transfers with word sizes > 8 bits, which are e.g. common when driving MIPI DBI displays. Fix this by using `spi_split_transfers_maxwords()` instead of `spi_split_transfers_maxsize()`. Fixes: 6f486556abe35 ("spi: stm32: renaming of spi_master into spi_controller") Signed-off-by: Leonard Göhrs Link: https://lore.kernel.org/r/20230816145237.3159817-1-l.goehrs@pengutronix.de Signed-off-by: Mark Brown commit a260f7d726fde52c0278bd3fa085a758639bcee2 Author: André Apitzsch Date: Sat Aug 19 09:12:15 2023 +0200 platform/x86: ideapad-laptop: Add support for new hotkeys found on ThinkBook 14s Yoga ITL The Lenovo Thinkbook 14s Yoga ITL has 4 new symbols/shortcuts on their F9-F11 and PrtSc keys: F9: Has a symbol of a head with a headset, the manual says "Service key" F10: Has a symbol of a telephone horn which has been picked up from the receiver, the manual says: "Answer incoming calls" F11: Has a symbol of a telephone horn which is resting on the receiver, the manual says: "Reject incoming calls" PrtSc: Has a symbol of a siccor and a dashed ellipse, the manual says: "Open the Windows 'Snipping' Tool app" This commit adds support for these 4 new hkey events. Signed-off-by: André Apitzsch Link: https://lore.kernel.org/r/20230819-lenovo_keys-v1-1-9d34eac88e0a@apitzsch.eu Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit db35610a181c18f7a521a2e157f7acdef7ce425f Author: Swapnil Devesh Date: Fri Aug 18 18:09:47 2023 +0530 platform/x86: lenovo-ymc: Add Lenovo Yoga 7 14ACN6 to ec_trigger_quirk_dmi_table This adds my laptop Lenovo Yoga 7 14ACN6, with Product Name: 82N7 (from `dmidecode -t1 | grep "Product Name"`) to the ec_trigger_quirk_dmi_table, have tested that this is required for the YMC driver to work correctly on this model. Signed-off-by: Swapnil Devesh Reviewed-by: Gergő Köteles Link: https://lore.kernel.org/r/18a08a8b173.895ef3b250414.1213194126082324071@sidevesh.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 453b014e2c294abf762d3bce12e91ce4b34055e6 Author: Hans de Goede Date: Mon Aug 21 11:09:27 2023 +0200 ACPI: resource: Fix IRQ override quirk for PCSpecialist Elimina Pro 16 M It turns out that some PCSpecialist Elimina Pro 16 M models have "GM6BGEQ" as DMI product-name instead of "Elimina Pro 16 M", causing the existing DMI quirk to not work on these models. The DMI board-name is always "GM6BGEQ", so match on that instead. Fixes: 56fec0051a69 ("ACPI: resource: Add IRQ override quirk for PCSpecialist Elimina Pro 16 M") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217394#c36 Cc: All applicable Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 6bc3462a0f5ecaa376a0b3d76dafc55796799e17 Author: Mario Limonciello Date: Fri Aug 18 09:48:50 2023 -0500 pinctrl: amd: Mask wake bits on probe again Shubhra reports that their laptop is heating up over s2idle. Even though it's getting into the deepest state, it appears to be having spurious wakeup events. While debugging a tangential issue with the RTC Carsten reports that recent 6.1.y based kernel face a similar problem. Looking at acpidump and GPIO register comparisons these spurious wakeup events are from the GPIO associated with the I2C touchpad on both laptops and occur even when the touchpad is not marked as a wake source by the kernel. This means that the boot firmware has programmed these bits and because Linux didn't touch them lead to spurious wakeup events from that GPIO. To fix this issue, restore most of the code that previously would clear all the bits associated with wakeup sources. This will allow the kernel to only program the wake up sources that are necessary. This is similar to what was done previously; but only the wake bits are cleared by default instead of interrupts and wake bits. If any other problems are reported then it may make sense to clear interrupts again too. Cc: Sachi King Cc: stable@vger.kernel.org Cc: Thorsten Leemhuis Fixes: 65f6c7c91cb2 ("pinctrl: amd: Revert "pinctrl: amd: disable and mask interrupts on probe"") Reported-by: Shubhra Prakash Nandi Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217754 Reported-by: Carsten Hatger Link: https://bugzilla.kernel.org/show_bug.cgi?id=217626#c28 Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20230818144850.1439-1-mario.limonciello@amd.com Signed-off-by: Linus Walleij commit 6046c356ada95f390d7f27e12cddd06fc794ed1c Merge: 706a741595047 8fcc1c40b7470 Author: Linus Walleij Date: Mon Aug 21 12:24:33 2023 +0200 Merge tag 'renesas-pinctrl-fixes-for-v6.5-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into fixes pinctrl: renesas: Fixes for v6.5 (take two) - Fix race conditions in pinctrl group and function creation/remove calls on the RZ/G2L, RZ/V2M, and RZ/A2 SoC families. Signed-off-by: Linus Walleij commit b98c16107cc1647242abbd11f234c05a3a5864f6 Author: Ping-Ke Shih Date: Fri Aug 18 09:40:04 2023 +0800 wifi: mac80211: limit reorder_buf_filtered to avoid UBSAN warning The commit 06470f7468c8 ("mac80211: add API to allow filtering frames in BA sessions") added reorder_buf_filtered to mark frames filtered by firmware, and it can only work correctly if hw.max_rx_aggregation_subframes <= 64 since it stores the bitmap in a u64 variable. However, new HE or EHT devices can support BlockAck number up to 256 or 1024, and then using a higher subframe index leads UBSAN warning: UBSAN: shift-out-of-bounds in net/mac80211/rx.c:1129:39 shift exponent 215 is too large for 64-bit type 'long long unsigned int' Call Trace: dump_stack_lvl+0x48/0x70 dump_stack+0x10/0x20 __ubsan_handle_shift_out_of_bounds+0x1ac/0x360 ieee80211_release_reorder_frame.constprop.0.cold+0x64/0x69 [mac80211] ieee80211_sta_reorder_release+0x9c/0x400 [mac80211] ieee80211_prepare_and_rx_handle+0x1234/0x1420 [mac80211] ieee80211_rx_list+0xaef/0xf60 [mac80211] ieee80211_rx_napi+0x53/0xd0 [mac80211] Since only old hardware that supports <=64 BlockAck uses ieee80211_mark_rx_ba_filtered_frames(), limit the use as it is, so add a WARN_ONCE() and comment to note to avoid using this function if hardware capability is not suitable. Signed-off-by: Ping-Ke Shih Link: https://lore.kernel.org/r/20230818014004.16177-1-pkshih@realtek.com [edit commit message] Signed-off-by: Johannes Berg commit d1cdbf66e18cd39dd749937221240ab97c06d9e6 Author: Sabrina Dubroca Date: Fri Aug 18 22:57:49 2023 +0200 MAINTAINERS: add entry for macsec Jakub asked if I'd be willing to be the maintainer of the macsec code and review the driver code adding macsec offload, so let's add the corresponding entry. The keyword lines are meant to catch selftests and patches adding HW offload support to other drivers. Suggested-by: Jakub Kicinski Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit f7757129e3dea336c407551c98f50057c22bb266 Merge: 4542057e18cae 080aa61e370b9 Author: Linus Torvalds Date: Mon Aug 21 07:02:21 2023 +0200 Merge tag 'v6.5-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "Fix a regression in the caam driver and af_alg" * tag 'v6.5-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: fix uninit-value in af_alg_free_resources Revert "crypto: caam - adjust RNG timing to support more devices" commit 4542057e18caebe5ebaee28f0438878098674504 Author: Linus Torvalds Date: Mon Aug 21 06:11:33 2023 +0200 mm: avoid 'might_sleep()' in get_mmap_lock_carefully() This might_sleep() goes back a long time: it was originally introduced way back when by commit 010060741ad3 ("x86: add might_sleep() to do_page_fault()"), and made it into the generic VM code when the x86 fault path got re-organized and generalized in commit c2508ec5a58d ("mm: introduce new 'lock_mm_and_find_vma()' page fault helper"). However, it turns out that the placement of that might_sleep() has always been rather questionable simply because it's not only a debug statement to warn about sleeping in contexts that shouldn't sleep (which was the original reason for adding it), but it also implies a voluntary scheduling point. That, in turn, is less than desirable for two reasons: (a) it ends up being done after we successfully got the mmap_lock, so just as we got the lock we will now eagerly schedule away and increase lock contention and (b) this is all very possibly part of the "oops, things went horribly wrong" path and we just haven't figured that out yet After all, the whole _reason_ for having that get_mmap_lock_carefully() rather than just doing the obvious mmap_read_lock() is because this code wants to deal somewhat gracefully with potential kernel wild pointer bugs. So then a voluntary scheduling point here is simply not a good idea. We could certainly turn the 'might_sleep()' into a '__might_sleep()' and make it be just the debug check that it was originally intended to be. But even that seems questionable in the wild kernel pointer case - which again is part of the whole point of this code. The problem wouldn't be about the _sleeping_ part of the page fault, but about a bad kernel access. The fact that that bad kernel access might happen in a section that you shouldn't sleep in is secondary. So it really ends up being the case that this is simply entirely the wrong place to do this debug check and related scheduling point at all. So let's just remove the check entirely. It's been around for over a decade, it has served its purpose. The re-schedule will happen at return to user space anyway for the normal case, and the warning - if we even need it - might be better off done as a special case for "page fault from kernel mode" once we've dealt with any potential kernel oopses where the oops is the relevant thing, not some artificial "scheduling while atomic" test. Reported-by: Mateusz Guzik Link: https://lore.kernel.org/lkml/20230820104303.2083444-1-mjguzik@gmail.com/ Cc: Matthew Wilcox Signed-off-by: Linus Torvalds commit 144e22e7569ad78f09f354016683776e0b75e573 Author: Anh Tuan Phan Date: Sat Aug 19 00:37:02 2023 +0700 selftests/net: Add log.txt and tools to .gitignore Update .gitignore to untrack tools directory and log.txt. "tools" is generated in "selftests/net/Makefile" and log.txt is generated in "selftests/net/gro.sh" when executing run_all_tests. Signed-off-by: Anh Tuan Phan Signed-off-by: David S. Miller commit 706a741595047797872e669b3101429ab8d378ef Author: Linus Torvalds Date: Sun Aug 20 15:02:52 2023 +0200 Linux 6.5-rc7 commit f866fbc842de5976e41ba874b76ce31710b634b5 Author: Eric Dumazet Date: Sat Aug 19 03:17:07 2023 +0000 ipv4: fix data-races around inet->inet_id UDP sendmsg() is lockless, so ip_select_ident_segs() can very well be run from multiple cpus [1] Convert inet->inet_id to an atomic_t, but implement a dedicated path for TCP, avoiding cost of a locked instruction (atomic_add_return()) Note that this patch will cause a trivial merge conflict because we added inet->flags in net-next tree. v2: added missing change in drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c (David Ahern) [1] BUG: KCSAN: data-race in __ip_make_skb / __ip_make_skb read-write to 0xffff888145af952a of 2 bytes by task 7803 on cpu 1: ip_select_ident_segs include/net/ip.h:542 [inline] ip_select_ident include/net/ip.h:556 [inline] __ip_make_skb+0x844/0xc70 net/ipv4/ip_output.c:1446 ip_make_skb+0x233/0x2c0 net/ipv4/ip_output.c:1560 udp_sendmsg+0x1199/0x1250 net/ipv4/udp.c:1260 inet_sendmsg+0x63/0x80 net/ipv4/af_inet.c:830 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg net/socket.c:748 [inline] ____sys_sendmsg+0x37c/0x4d0 net/socket.c:2494 ___sys_sendmsg net/socket.c:2548 [inline] __sys_sendmmsg+0x269/0x500 net/socket.c:2634 __do_sys_sendmmsg net/socket.c:2663 [inline] __se_sys_sendmmsg net/socket.c:2660 [inline] __x64_sys_sendmmsg+0x57/0x60 net/socket.c:2660 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff888145af952a of 2 bytes by task 7804 on cpu 0: ip_select_ident_segs include/net/ip.h:541 [inline] ip_select_ident include/net/ip.h:556 [inline] __ip_make_skb+0x817/0xc70 net/ipv4/ip_output.c:1446 ip_make_skb+0x233/0x2c0 net/ipv4/ip_output.c:1560 udp_sendmsg+0x1199/0x1250 net/ipv4/udp.c:1260 inet_sendmsg+0x63/0x80 net/ipv4/af_inet.c:830 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg net/socket.c:748 [inline] ____sys_sendmsg+0x37c/0x4d0 net/socket.c:2494 ___sys_sendmsg net/socket.c:2548 [inline] __sys_sendmmsg+0x269/0x500 net/socket.c:2634 __do_sys_sendmmsg net/socket.c:2663 [inline] __se_sys_sendmmsg net/socket.c:2660 [inline] __x64_sys_sendmmsg+0x57/0x60 net/socket.c:2660 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x184d -> 0x184e Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 7804 Comm: syz-executor.1 Not tainted 6.5.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 ================================================================== Fixes: 23f57406b82d ("ipv4: avoid using shared IP generator for connected sockets") Reported-by: syzbot Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Signed-off-by: David S. Miller commit f534f6581ec084fe94d6759f7672bd009794b07e Author: Jakub Kicinski Date: Fri Aug 18 18:26:02 2023 -0700 net: validate veth and vxcan peer ifindexes veth and vxcan need to make sure the ifindexes of the peer are not negative, core does not validate this. Using iproute2 with user-space-level checking removed: Before: # ./ip link add index 10 type veth peer index -1 # ip link show 1: lo: mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: enp1s0: mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:74:b2:03 brd ff:ff:ff:ff:ff:ff 10: veth1@veth0: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether 8a:90:ff:57:6d:5d brd ff:ff:ff:ff:ff:ff -1: veth0@veth1: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether ae:ed:18:e6:fa:7f brd ff:ff:ff:ff:ff:ff Now: $ ./ip link add index 10 type veth peer index -1 Error: ifindex can't be negative. This problem surfaced in net-next because an explicit WARN() was added, the root cause is older. Fixes: e6f8f1a739b6 ("veth: Allow to create peer link with given ifindex") Fixes: a8f820a380a2 ("can: add Virtual CAN Tunnel driver (vxcan)") Reported-by: syzbot+5ba06978f34abb058571@syzkaller.appspotmail.com Signed-off-by: Jakub Kicinski Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit c727c6f788e673add829e4b54e7894fb2907df1c Merge: a0e026e7b37e9 32bbe64a13860 Author: David S. Miller Date: Sun Aug 20 10:58:28 2023 +0100 Merge branch 'fixed_phy_register-return-value' Ruan Jinjie says: ==================== net: Fix return value check for fixed_phy_register() The fixed_phy_register() function returns error pointers and never returns NULL. Update the checks accordingly. Changes in v3: - Drop the error fix patch for fixed_phy_get_gpiod(). - Split the error code update code into another patch set as suggested. - Update the commit title and message. ==================== Signed-off-by: David S. Miller commit 32bbe64a1386065ab2aef8ce8cae7c689d0add6e Author: Ruan Jinjie Date: Fri Aug 18 13:12:21 2023 +0800 net: bcmgenet: Fix return value check for fixed_phy_register() The fixed_phy_register() function returns error pointers and never returns NULL. Update the checks accordingly. Fixes: b0ba512e25d7 ("net: bcmgenet: enable driver to work without a device tree") Signed-off-by: Ruan Jinjie Reviewed-by: Leon Romanovsky Acked-by: Doug Berger Signed-off-by: David S. Miller commit 23a14488ea5882dea5851b65c9fce2127ee8fcad Author: Ruan Jinjie Date: Fri Aug 18 13:12:20 2023 +0800 net: bgmac: Fix return value check for fixed_phy_register() The fixed_phy_register() function returns error pointers and never returns NULL. Update the checks accordingly. Fixes: c25b23b8a387 ("bgmac: register fixed PHY for ARM BCM470X / BCM5301X chipsets") Signed-off-by: Ruan Jinjie Reviewed-by: Andrew Lunn Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit b320441c04c9bea76cbee1196ae55c20288fd7a6 Merge: ec27a636d7e1a 04c7f60ca477f Author: Linus Torvalds Date: Sun Aug 20 08:26:51 2023 +0200 Merge tag 'tty-6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are some small tty and serial core fixes for 6.5-rc7 that resolve a lot of reported issues. Primarily in here are the fixes for the serial bus code from Tony that came in -rc1, as it hit wider testing with the huge number of different types of systems and serial ports. All of the reported issues with duplicate names and other issues with this code are now resolved. Other than that included in here is: - n_gsm fix for a previous fix - 8250 lockdep annotation fix - fsl_lpuart serial driver fix - TIOCSTI documentation update for previous CAP_SYS_ADMIN change All of these have been in linux-next for a while with no reported problems" * tag 'tty-6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: core: Fix serial core port id, including multiport devices serial: 8250: drop lockdep annotation from serial8250_clear_IER() tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux serial: core: Revert port_id use TIOCSTI: Document CAP_SYS_ADMIN behaviour in Kconfig serial: 8250: Fix oops for port->pm on uart_change_pm() serial: 8250: Reinit port_id when adding back serial8250_isa_devs serial: core: Fix kmemleak issue for serial core device remove MAINTAINERS: Merge TTY layer and serial drivers serial: core: Fix serial_base_match() after fixing controller port name serial: core: Fix serial core controller port name to show controller id serial: core: Fix serial core port id to not use port->line serial: core: Controller id cannot be negative tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms commit ec27a636d7e1aa05e64ef0b1bd848f27f8105a39 Merge: 9e6c269de404b 3fa7187eceee1 Author: Linus Torvalds Date: Sun Aug 20 08:18:58 2023 +0200 Merge tag 'rust-fixes-6.5-rc7' of https://github.com/Rust-for-Linux/linux Pull rust fix from Miguel Ojeda: - Macros: fix 'HAS_*' redefinition by the '#[vtable]' macro under conditional compilation * tag 'rust-fixes-6.5-rc7' of https://github.com/Rust-for-Linux/linux: rust: macros: vtable: fix `HAS_*` redefinition (`gen_const_name`) commit a0e026e7b37e997f4fa3fcaa714e5484f3ce9e75 Author: Serge Semin Date: Fri Aug 18 15:54:45 2023 +0300 net: phy: Fix deadlocking in phy_error() invocation Since commit 91a7cda1f4b8 ("net: phy: Fix race condition on link status change") all the phy_error() method invocations have been causing the nested-mutex-lock deadlock because it's normally done in the PHY-driver threaded IRQ handlers which since that change have been called with the phydev->lock mutex held. Here is the calls thread: IRQ: phy_interrupt() +-> mutex_lock(&phydev->lock); <--------------------+ drv->handle_interrupt() | Deadlock due +-> ERROR: phy_error() + to the nested +-> phy_process_error() | mutex lock +-> mutex_lock(&phydev->lock); <-+ phydev->state = PHY_ERROR; mutex_unlock(&phydev->lock); mutex_unlock(&phydev->lock); The problem can be easily reproduced just by calling phy_error() from any PHY-device threaded interrupt handler. Fix it by dropping the phydev->lock mutex lock from the phy_process_error() method and printing a nasty error message to the system log if the mutex isn't held in the caller execution context. Note for the fix to work correctly in the PHY-subsystem itself the phydev->lock mutex locking must be added to the phy_error_precise() function. Link: https://lore.kernel.org/netdev/20230816180944.19262-1-fancer.lancer@gmail.com Fixes: 91a7cda1f4b8 ("net: phy: Fix race condition on link status change") Suggested-by: Andrew Lunn Signed-off-by: Serge Semin Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit db1a6ad77c180efc7242d7204b9a0c72c8a5a1bb Author: Josua Mayer Date: Fri Aug 18 13:05:56 2023 +0200 net: sfp: handle 100G/25G active optical cables in sfp_parse_support Handle extended compliance code 0x1 (SFF8024_ECC_100G_25GAUI_C2M_AOC) for active optical cables supporting 25G and 100G speeds. Since the specification makes no statement about transmitter range, and as the specific sfp module that had been tested features only 2m fiber - short-range (SR) modes are selected. The 100G speed is irrelevant because it would require multiple fibers / multiple SFP28 modules combined under one netdev. sfp-bus.c only handles a single module per netdev, so only 25Gbps modes are selected. sfp_parse_support already handles SFF8024_ECC_100GBASE_SR4_25GBASE_SR with compatible properties, however that entry is a contradiction in itself since with SFP(28) 100GBASE_SR4 is impossible - that would likely be a mode for qsfp modules only. Add a case for SFF8024_ECC_100G_25GAUI_C2M_AOC selecting 25gbase-r interface mode and 25000baseSR link mode. Also enforce SFP28 bitrate limits on the values read from sfp eeprom as requested by Russell King. Tested with fs.com S28-AO02 AOC SFP28 module. Signed-off-by: Josua Mayer Reviewed-by: Russell King (Oracle) Signed-off-by: David S. Miller commit 9e6c269de404bef2fb50b9407e988083a0805e3b Merge: 12e6ccedb311b 4caf4cb1eaed4 Author: Linus Torvalds Date: Sat Aug 19 19:22:41 2023 +0200 Merge tag 'i2c-for-6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Usual set of driver fixes. A bit more than usual because I was unavailable for a while" * tag 'i2c-for-6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue i2c: Update documentation to use .probe() again i2c: sun6i-p2wi: Fix an error message in probe() i2c: hisi: Only handle the interrupt of the driver's transfer i2c: tegra: Fix i2c-tegra DMA config option processing i2c: tegra: Fix failure during probe deferral cleanup i2c: designware: Handle invalid SMBus block data response length value i2c: designware: Correct length byte validation logic i2c: imx-lpi2c: return -EINVAL when i2c peripheral clk doesn't work commit 12e6ccedb311b32b16f767fdd606cc84630e45ae Merge: b5cab28be6ccf c962098ca4af1 Author: Linus Torvalds Date: Sat Aug 19 17:57:07 2023 +0200 Merge tag 'for-6.5-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix infinite loop in readdir(), could happen in a big directory when files get renamed during enumeration - fix extent map handling of skipped pinned ranges - fix a corner case when handling ordered extent length - fix a potential crash when balance cancel races with pause - verify correct uuid when starting scrub or device replace * tag 'for-6.5-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix incorrect splitting in btrfs_drop_extent_map_range btrfs: fix BUG_ON condition in btrfs_cancel_balance btrfs: only subtract from len_to_oe_boundary when it is tracking an extent btrfs: fix replace/scrub failure with metadata_uuid btrfs: fix infinite directory reads commit b5cab28be6ccf08237078b675fc1d446679779ba Merge: 2383ffc41a7c7 0650d5098f8b6 Author: Linus Torvalds Date: Sat Aug 19 17:43:55 2023 +0200 Merge tag 'fbdev-for-6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes and cleanups from Helge Deller: - various code cleanups in amifb, atmel_lcdfb, ssd1307fb, kyro and goldfishfb * tag 'fbdev-for-6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: goldfishfb: Do not check 0 for platform_get_irq() fbdev: atmel_lcdfb: Remove redundant of_match_ptr() fbdev: kyro: Remove unused declarations fbdev: ssd1307fb: Print the PWM's label instead of its number fbdev: mmp: fix value check in mmphw_probe() fbdev: amifb: Replace zero-length arrays with DECLARE_FLEX_ARRAY() helper commit 2383ffc41a7c701c058f6bb18030cd569aecd541 Merge: aa9ea98cca3a5 e5c0ca13659e9 Author: Linus Torvalds Date: Sat Aug 19 17:31:46 2023 +0200 Merge tag 'block-6.5-2023-08-19' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "Main thing here is the fix for the regression in flush handling which caused IO hangs/stalls for a few reporters. Hopefully that should all be sorted out now. Outside of that, just a few minor fixes for issues that were introduced in this cycle" * tag 'block-6.5-2023-08-19' of git://git.kernel.dk/linux: blk-mq: release scheduler resource when request completes blk-crypto: dynamically allocate fallback profile blk-cgroup: hold queue_lock when removing blkg->q_node drivers/rnbd: restore sysfs interface to rnbd-client commit 895cedc1791916e8a98864f12b656702fad0bb67 Author: Chuck Lever Date: Mon Jul 3 14:18:29 2023 -0400 xprtrdma: Remap Receive buffers after a reconnect On server-initiated disconnect, rpcrdma_xprt_disconnect() was DMA- unmapping the Receive buffers, but rpcrdma_post_recvs() neglected to remap them after a new connection had been established. The result was immediate failure of the new connection with the Receives flushing with LOCAL_PROT_ERR. Fixes: 671c450b6fe0 ("xprtrdma: Fix oops in Receive handler after device removal") Signed-off-by: Chuck Lever Signed-off-by: Trond Myklebust commit f4e89f1a6dab4c063fc1e823cc9dddc408ff40cf Author: Fedor Pchelkin Date: Tue Jul 25 14:59:30 2023 +0300 NFSv4: fix out path in __nfs4_get_acl_uncached Another highly rare error case when a page allocating loop (inside __nfs4_get_acl_uncached, this time) is not properly unwound on error. Since pages array is allocated being uninitialized, need to free only lower array indices. NULL checks were useful before commit 62a1573fcf84 ("NFSv4 fix acl retrieval over krb5i/krb5p mounts") when the array had been initialized to zero on stack. Found by Linux Verification Center (linuxtesting.org). Fixes: 62a1573fcf84 ("NFSv4 fix acl retrieval over krb5i/krb5p mounts") Signed-off-by: Fedor Pchelkin Reviewed-by: Benjamin Coddington Signed-off-by: Trond Myklebust commit 4e3733fd2b0f677faae21cf838a43faf317986d3 Author: Fedor Pchelkin Date: Tue Jul 25 14:58:58 2023 +0300 NFSv4.2: fix error handling in nfs42_proc_getxattr There is a slight issue with error handling code inside nfs42_proc_getxattr(). If page allocating loop fails then we free the failing page array element which is NULL but __free_page() can't deal with NULL args. Found by Linux Verification Center (linuxtesting.org). Fixes: a1f26739ccdc ("NFSv4.2: improve page handling for GETXATTR") Signed-off-by: Fedor Pchelkin Reviewed-by: Benjamin Coddington Signed-off-by: Trond Myklebust commit c3dd7de2a3137d84161dcfb522c19f8b2884e502 Author: Benjamin Coddington Date: Mon Jul 10 14:41:58 2023 -0400 NFS: Fix sysfs server name memory leak Free the formatted server index string after it has been duplicated by kobject_rename(). Fixes: 1c7251187dc0 ("NFS: add superblock sysfs entries") Reported-by: Alexander Aring Signed-off-by: Benjamin Coddington Tested-by: Ido Schimmel Signed-off-by: Trond Myklebust commit e5c0ca13659e9d18f53368d651ed7e6e433ec1cf Author: Chengming Zhou Date: Sun Aug 13 23:23:25 2023 +0800 blk-mq: release scheduler resource when request completes Chuck reported [1] an IO hang problem on NFS exports that reside on SATA devices and bisected to commit 615939a2ae73 ("blk-mq: defer to the normal submission path for post-flush requests"). We analysed the IO hang problem, found there are two postflush requests waiting for each other. The first postflush request completed the REQ_FSEQ_DATA sequence, so go to the REQ_FSEQ_POSTFLUSH sequence and added in the flush pending list, but failed to blk_kick_flush() because of the second postflush request which is inflight waiting in scheduler queue. The second postflush waiting in scheduler queue can't be dispatched because the first postflush hasn't released scheduler resource even though it has completed by itself. Fix it by releasing scheduler resource when the first postflush request completed, so the second postflush can be dispatched and completed, then make blk_kick_flush() succeed. While at it, remove the check for e->ops.finish_request, as all schedulers set that. Reaffirm this requirement by adding a WARN_ON_ONCE() at scheduler registration time, just like we do for insert_requests and dispatch_request. [1] https://lore.kernel.org/all/7A57C7AE-A51A-4254-888B-FE15CA21F9E9@oracle.com/ Link: https://lore.kernel.org/linux-block/20230819031206.2744005-1-chengming.zhou@linux.dev/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202308172100.8ce4b853-oliver.sang@intel.com Fixes: 615939a2ae73 ("blk-mq: defer to the normal submission path for post-flush requests") Reported-by: Chuck Lever Signed-off-by: Chengming Zhou Tested-by: Chuck Lever Link: https://lore.kernel.org/r/20230813152325.3017343-1-chengming.zhou@linux.dev [axboe: folded in incremental fix and added tags] Signed-off-by: Jens Axboe commit 2572ce62415cf3b632391091447252e2661ed520 Author: Serge Semin Date: Wed Aug 16 21:06:52 2023 +0300 net: mdio: mdio-bitbang: Fix C45 read/write protocol Based on the original code semantic in case of Clause 45 MDIO, the address command is supposed to be followed by the command sending the MMD address, not the CSR address. The commit 002dd3de097c ("net: mdio: mdio-bitbang: Separate C22 and C45 transactions") has erroneously broken that. So most likely due to an unfortunate variable name it switched the code to sending the CSR address. In our case it caused the protocol malfunction so the read operation always failed with the turnaround bit always been driven to one by PHY instead of zero. Fix that by getting back the correct behaviour: sending MMD address command right after the regular address command. Fixes: 002dd3de097c ("net: mdio: mdio-bitbang: Separate C22 and C45 transactions") Signed-off-by: Serge Semin Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit e94b590abfff2cdbf0bdaa7d9904364c8d480af5 Author: Arınç ÜNAL Date: Sun Aug 13 13:59:17 2023 +0300 net: dsa: mt7530: fix handling of 802.1X PAE frames 802.1X PAE frames are link-local frames, therefore they must be trapped to the CPU port. Currently, the MT753X switches treat 802.1X PAE frames as regular multicast frames, therefore flooding them to user ports. To fix this, set 802.1X PAE frames to be trapped to the CPU port(s). Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") Signed-off-by: Arınç ÜNAL Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit aa9ea98cca3a56869df1dc6347f3e3bfe0c01f44 Merge: bf98bae3d8a18 2908042a37b56 Author: Linus Torvalds Date: Sat Aug 19 13:13:55 2023 +0200 Merge tag 'media/v6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "Three driver fixes" * tag 'media/v6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: imx: imx7-media-csi: Fix applying format constraints media: uvcvideo: Fix menu count handling for userspace XU mappings media: mtk-jpeg: Set platform driver data earlier commit bf98bae3d8a18745e54fef9fd71fd129f6e9f7e5 Merge: 4e7ffde6984a7 6405b72e8d17b Author: Linus Torvalds Date: Sat Aug 19 10:46:02 2023 +0200 Merge tag 'x86_urgent_for_v6.5_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: "Extraordinary embargoed times call for extraordinary measures. That's why this week's x86/urgent branch is larger than usual, containing all the known fallout fixes after the SRSO mitigation got merged. I know, it is a bit late in the game but everyone who has reported a bug stemming from the SRSO pile, has tested that branch and has confirmed that it fixes their bug. Also, I've run it on every possible hardware I have and it is looking good. It is running on this very machine while I'm typing, for 2 days now without an issue. Famous last words... - Use LEA ...%rsp instead of ADD %rsp in the Zen1/2 SRSO return sequence as latter clobbers flags which interferes with fastop emulation in KVM, leading to guests freezing during boot - A fix for the DIV(0) quotient data leak on Zen1 to clear the divider buffers at the right time - Disable the SRSO mitigation on unaffected configurations as it got enabled there unnecessarily - Change .text section name to fix CONFIG_LTO_CLANG builds - Improve the optprobe indirect jmp check so that certain configurations can still be able to use optprobes at all - A serious and good scrubbing of the untraining routines by PeterZ: - Add proper speculation stopping traps so that objtool is happy - Adjust objtool to handle the new thunks - Make the thunk pointer assignable to the different untraining sequences at runtime, thus avoiding the alternative at the return thunk. It simplifies the code a bit too. - Add a entry_untrain_ret() main entry point which selects the respective untraining sequence - Rename things so that they're more clear - Fix stack validation with FRAME_POINTER=y builds - Fix static call patching to handle when a JMP to the return thunk is the last insn on the very last module memory page - Add more documentation about what each untraining routine does and why" * tag 'x86_urgent_for_v6.5_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/srso: Correct the mitigation status when SMT is disabled x86/static_call: Fix __static_call_fixup() objtool/x86: Fixup frame-pointer vs rethunk x86/srso: Explain the untraining sequences a bit more x86/cpu/kvm: Provide UNTRAIN_RET_VM x86/cpu: Cleanup the untrain mess x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 x86/cpu: Rename original retbleed methods x86/cpu: Clean up SRSO return thunk mess x86/alternative: Make custom return thunk unconditional objtool/x86: Fix SRSO mess x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() x86/cpu: Fix __x86_return_thunk symbol type x86/retpoline,kprobes: Skip optprobe check for indirect jumps with retpolines and IBT x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG x86/srso: Disable the mitigation on unaffected configurations x86/CPU/AMD: Fix the DIV(0) initial fix attempt x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() commit 4e7ffde6984a7fa842489be7055570e5f5a4f0b5 Merge: d4ddefee5160d 4f3175979e62d Author: Linus Torvalds Date: Sat Aug 19 08:32:16 2023 +0200 Merge tag 'powerpc-6.5-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fix from Michael Ellerman: - Fix hardened usercopy BUG when using /proc based firmware update interface Thanks to Nathan Lynch and Kees Cook. * tag 'powerpc-6.5-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/rtas_flash: allow user copy to flash block cache objects commit cfceccca0157307318905907fd7a4d4231494de7 Merge: 043d5f68d0ccd f520489e99a35 Author: Jakub Kicinski Date: Fri Aug 18 19:41:10 2023 -0700 Merge branch 'mlxsw-fixes-for-spectrum-4' Petr Machata says: ==================== mlxsw: Fixes for Spectrum-4 This patchset contains an assortment of fixes for mlxsw Spectrum-4 support. ==================== Link: https://lore.kernel.org/r/cover.1692268427.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit f520489e99a35b0a5257667274fbe9afd2d8c50b Author: Ido Schimmel Date: Thu Aug 17 15:58:25 2023 +0200 selftests: mlxsw: Fix test failure on Spectrum-4 Remove assumptions about shared buffer cell size and instead query the cell size from devlink. Adjust the test to send small packets that fit inside a single cell. Tested on Spectrum-{1,2,3,4}. Fixes: 4735402173e6 ("mlxsw: spectrum: Extend to support Spectrum-4 ASIC") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/f7dfbf3c4d1cb23838d9eb99bab09afaa320c4ca.1692268427.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 348c976be0a599918b88729def198a843701c9fe Author: Amit Cohen Date: Thu Aug 17 15:58:24 2023 +0200 mlxsw: Fix the size of 'VIRT_ROUTER_MSB' The field 'virtual router' was extended to 12 bits in Spectrum-4. Therefore, the element 'MLXSW_AFK_ELEMENT_VIRT_ROUTER_MSB' needs 3 bits for Spectrum < 4 and 4 bits for Spectrum >= 4. The elements are stored in an internal storage scratchpad. Currently, the MSB is defined there as 3 bits. It means that for Spectrum-4, only 2K VRFs can be used for multicast routing, as the highest bit is not really used by the driver. Fix the definition of 'VIRT_ROUTER_MSB' to use 4 bits. Adjust the definitions of 'virtual router' field in the blocks accordingly - use '_avoid_size_check' for Spectrum-2 instead of for Spectrum-4. Fix the mask in parse function to use 4 bits. Fixes: 6d5d8ebb881c ("mlxsw: Rename virtual router flex key element") Signed-off-by: Amit Cohen Reviewed-by: Ido Schimmel Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/79bed2b70f6b9ed58d4df02e9798a23da648015b.1692268427.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 0dc63b9cfd4c5666ced52c829fdd65dcaeb9f0f1 Author: Ido Schimmel Date: Thu Aug 17 15:58:23 2023 +0200 mlxsw: reg: Fix SSPR register layout The two most significant bits of the "local_port" field in the SSPR register are always cleared since they are overwritten by the deprecated and overlapping "sub_port" field. On systems with more than 255 local ports (e.g., Spectrum-4), this results in the firmware maintaining invalid mappings between system port and local port. Specifically, two different systems ports (0x1 and 0x101) point to the same local port (0x1), which eventually leads to firmware errors. Fix by removing the deprecated "sub_port" field. Fixes: fd24b29a1b74 ("mlxsw: reg: Align existing registers to use extended local_port field") Signed-off-by: Ido Schimmel Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/9b909a3033c8d3d6f67f237306bef4411c5e6ae4.1692268427.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit bc2de151ab6ad0762a04563527ec42e54dde572a Author: Danielle Ratson Date: Thu Aug 17 15:58:22 2023 +0200 mlxsw: pci: Set time stamp fields also when its type is MIRROR_UTC Currently, in Spectrum-2 and above, time stamps are extracted from the CQE into the time stamp fields in 'struct mlxsw_skb_cb', only when the CQE time stamp type is UTC. The time stamps are read directly from the CQE and software can get the time stamp in UTC format using CQEv2. From Spectrum-4, the time stamps that are read from the CQE are allowed to be also from MIRROR_UTC type. Therefore, we get a warning [1] from the driver that the time stamp fields were not set, when LLDP control packet is sent. Allow the time stamp type to be MIRROR_UTC and set the time stamp in this case as well. [1] WARNING: CPU: 11 PID: 0 at drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c:1409 mlxsw_sp2_ptp_hwtstamp_fill+0x1f/0x70 [mlxsw_spectrum] [...] Call Trace: mlxsw_sp2_ptp_receive+0x3c/0x80 [mlxsw_spectrum] mlxsw_core_skb_receive+0x119/0x190 [mlxsw_core] mlxsw_pci_cq_tasklet+0x3c9/0x780 [mlxsw_pci] tasklet_action_common.constprop.0+0x9f/0x110 __do_softirq+0xbb/0x296 irq_exit_rcu+0x79/0xa0 common_interrupt+0x86/0xa0 Fixes: 4735402173e6 ("mlxsw: spectrum: Extend to support Spectrum-4 ASIC") Signed-off-by: Danielle Ratson Reviewed-by: Ido Schimmel Signed-off-by: Petr Machata Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/bcef4d044ef608a4e258d33a7ec0ecd91f480db5.1692268427.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 043d5f68d0ccdda91029b4b6dce7eeffdcfad281 Author: Lu Wei Date: Thu Aug 17 22:54:49 2023 +0800 ipvlan: Fix a reference count leak warning in ipvlan_ns_exit() There are two network devices(veth1 and veth3) in ns1, and ipvlan1 with L3S mode and ipvlan2 with L2 mode are created based on them as figure (1). In this case, ipvlan_register_nf_hook() will be called to register nf hook which is needed by ipvlans in L3S mode in ns1 and value of ipvl_nf_hook_refcnt is set to 1. (1) ns1 ns2 ------------ ------------ veth1--ipvlan1 (L3S) veth3--ipvlan2 (L2) (2) ns1 ns2 ------------ ------------ veth1--ipvlan1 (L3S) ipvlan2 (L2) veth3 | | |------->-------->--------->-------- migrate When veth3 migrates from ns1 to ns2 as figure (2), veth3 will register in ns2 and calls call_netdevice_notifiers with NETDEV_REGISTER event: dev_change_net_namespace call_netdevice_notifiers ipvlan_device_event ipvlan_migrate_l3s_hook ipvlan_register_nf_hook(newnet) (I) ipvlan_unregister_nf_hook(oldnet) (II) In function ipvlan_migrate_l3s_hook(), ipvl_nf_hook_refcnt in ns1 is not 0 since veth1 with ipvlan1 still in ns1, (I) and (II) will be called to register nf_hook in ns2 and unregister nf_hook in ns1. As a result, ipvl_nf_hook_refcnt in ns1 is decreased incorrectly and this in ns2 is increased incorrectly. When the second net namespace is removed, a reference count leak warning in ipvlan_ns_exit() will be triggered. This patch add a check before ipvlan_migrate_l3s_hook() is called. The warning can be triggered as follows: $ ip netns add ns1 $ ip netns add ns2 $ ip netns exec ns1 ip link add veth1 type veth peer name veth2 $ ip netns exec ns1 ip link add veth3 type veth peer name veth4 $ ip netns exec ns1 ip link add ipv1 link veth1 type ipvlan mode l3s $ ip netns exec ns1 ip link add ipv2 link veth3 type ipvlan mode l2 $ ip netns exec ns1 ip link set veth3 netns ns2 $ ip net del ns2 Fixes: 3133822f5ac1 ("ipvlan: use pernet operations and restrict l3s hooks to master netns") Signed-off-by: Lu Wei Reviewed-by: Florian Westphal Link: https://lore.kernel.org/r/20230817145449.141827-1-luwei32@huawei.com Signed-off-by: Jakub Kicinski commit cba3f1786916063261e3e5ccbb803abc325b24ef Author: Eric Dumazet Date: Fri Aug 18 01:58:20 2023 +0000 dccp: annotate data-races in dccp_poll() We changed tcp_poll() over time, bug never updated dccp. Note that we also could remove dccp instead of maintaining it. Fixes: 7c657876b63c ("[DCCP]: Initial implementation") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230818015820.2701595-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 76f33296d2e09f63118db78125c95ef56df438e9 Author: Eric Dumazet Date: Fri Aug 18 01:51:32 2023 +0000 sock: annotate data-races around prot->memory_pressure *prot->memory_pressure is read/writen locklessly, we need to add proper annotations. A recent commit added a new race, it is time to audit all accesses. Fixes: 2d0c88e84e48 ("sock: Fix misuse of sk_under_memory_pressure()") Fixes: 4d93df0abd50 ("[SCTP]: Rewrite of sctp buffer management code") Signed-off-by: Eric Dumazet Cc: Abel Wu Reviewed-by: Shakeel Butt Link: https://lore.kernel.org/r/20230818015132.2699348-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d44036cad31170da0cb9c728e80743f84267da6e Author: Vladimir Oltean Date: Thu Aug 17 15:01:11 2023 +0300 net: dsa: felix: fix oversize frame dropping for always closed tc-taprio gates The blamed commit resolved a bug where frames would still get stuck at egress, even though they're smaller than the maxSDU[tc], because the driver did not take into account the extra 33 ns that the queue system needs for scheduling the frame. It now takes that into account, but the arithmetic that we perform in vsc9959_tas_remaining_gate_len_ps() is buggy, because we operate on 64-bit unsigned integers, so gate_len_ns - VSC9959_TAS_MIN_GATE_LEN_NS may become a very large integer if gate_len_ns < 33 ns. In practice, this means that we've introduced a regression where all traffic class gates which are permanently closed will not get detected by the driver, and we won't enable oversize frame dropping for them. Before: mscc_felix 0000:00:00.5: port 0: max frame size 1526 needs 12400000 ps, 1152000 ps for mPackets at speed 1000 mscc_felix 0000:00:00.5: port 0 tc 0 min gate len 1000000, sending all frames mscc_felix 0000:00:00.5: port 0 tc 1 min gate len 0, sending all frames mscc_felix 0000:00:00.5: port 0 tc 2 min gate len 0, sending all frames mscc_felix 0000:00:00.5: port 0 tc 3 min gate len 0, sending all frames mscc_felix 0000:00:00.5: port 0 tc 4 min gate len 0, sending all frames mscc_felix 0000:00:00.5: port 0 tc 5 min gate len 0, sending all frames mscc_felix 0000:00:00.5: port 0 tc 6 min gate len 0, sending all frames mscc_felix 0000:00:00.5: port 0 tc 7 min gate length 5120 ns not enough for max frame size 1526 at 1000 Mbps, dropping frames over 615 octets including FCS After: mscc_felix 0000:00:00.5: port 0: max frame size 1526 needs 12400000 ps, 1152000 ps for mPackets at speed 1000 mscc_felix 0000:00:00.5: port 0 tc 0 min gate len 1000000, sending all frames mscc_felix 0000:00:00.5: port 0 tc 1 min gate length 0 ns not enough for max frame size 1526 at 1000 Mbps, dropping frames over 1 octets including FCS mscc_felix 0000:00:00.5: port 0 tc 2 min gate length 0 ns not enough for max frame size 1526 at 1000 Mbps, dropping frames over 1 octets including FCS mscc_felix 0000:00:00.5: port 0 tc 3 min gate length 0 ns not enough for max frame size 1526 at 1000 Mbps, dropping frames over 1 octets including FCS mscc_felix 0000:00:00.5: port 0 tc 4 min gate length 0 ns not enough for max frame size 1526 at 1000 Mbps, dropping frames over 1 octets including FCS mscc_felix 0000:00:00.5: port 0 tc 5 min gate length 0 ns not enough for max frame size 1526 at 1000 Mbps, dropping frames over 1 octets including FCS mscc_felix 0000:00:00.5: port 0 tc 6 min gate length 0 ns not enough for max frame size 1526 at 1000 Mbps, dropping frames over 1 octets including FCS mscc_felix 0000:00:00.5: port 0 tc 7 min gate length 5120 ns not enough for max frame size 1526 at 1000 Mbps, dropping frames over 615 octets including FCS Fixes: 11afdc6526de ("net: dsa: felix: tc-taprio intervals smaller than MTU should send at least one packet") Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230817120111.3522827-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 2ebbc9752d06bb1d01201fe632cb6da033b0248d Author: Jiri Pirko Date: Thu Aug 17 14:52:40 2023 +0200 devlink: add missing unregister linecard notification Cited fixes commit introduced linecard notifications for register, however it didn't add them for unregister. Fix that by adding them. Fixes: c246f9b5fd61 ("devlink: add support to create line card and expose to user") Signed-off-by: Jiri Pirko Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230817125240.2144794-1-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 3b1f08833c45d0167741e4097b0150e7cf086102 Author: BrenoRCBrito Date: Fri Aug 18 18:14:16 2023 -0300 ASoC: amd: yc: Add VivoBook Pro 15 to quirks list for acp6x VivoBook Pro 15 Ryzen Edition uses Ryzen 6800H processor, and adding to quirks list for acp6x will enable internal mic. Signed-off-by: BrenoRCBrito Link: https://lore.kernel.org/r/20230818211417.32167-1-brenorcbrito@gmail.com Signed-off-by: Mark Brown commit 05f3d5bc23524bed6f043dfe6b44da687584f9fb Author: Hariprasad Kelam Date: Thu Aug 17 12:00:06 2023 +0530 octeontx2-af: SDP: fix receive link config On SDP interfaces, frame oversize and undersize errors are observed as driver is not considering packet sizes of all subscribers of the link before updating the link config. This patch fixes the same. Fixes: 9b7dd87ac071 ("octeontx2-af: Support to modify min/max allowed packet lengths") Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Goutham Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230817063006.10366-1-hkelam@marvell.com Signed-off-by: Jakub Kicinski commit 7793a88e881ffd4cde6d14eadc6485931d12a4cc Merge: 0e8860d2125f5 421d467dc2d48 Author: Jakub Kicinski Date: Fri Aug 18 15:16:04 2023 -0700 Merge tag 'batadv-net-pullrequest-20230816' of git://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here are some batman-adv bugfixes: - Fix issues with adjusted MTUs (2 patches), by Sven Eckelmann - Fix header access for memory reallocation case, by Remi Pommarel - Fix two memory leaks (2 patches), by Remi Pommarel * tag 'batadv-net-pullrequest-20230816' of git://git.open-mesh.org/linux-merge: batman-adv: Fix batadv_v_ogm_aggr_send memory leak batman-adv: Fix TT global entry leak when client roamed back batman-adv: Do not get eth header before batadv_check_management_packet batman-adv: Don't increase MTU when set by user batman-adv: Trigger events for auto adjusted MTU ==================== Link: https://lore.kernel.org/r/20230816163318.189996-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski commit c984ff1423ae9f70b1f28ce811856db0d9c99021 Author: Sweet Tea Dorminy Date: Thu Aug 17 10:15:56 2023 -0400 blk-crypto: dynamically allocate fallback profile blk_crypto_profile_init() calls lockdep_register_key(), which warns and does not register if the provided memory is a static object. blk-crypto-fallback currently has a static blk_crypto_profile and calls blk_crypto_profile_init() thereupon, resulting in the warning and failure to register. Fortunately it is simple enough to use a dynamically allocated profile and make lockdep function correctly. Fixes: 2fb48d88e77f ("blk-crypto: use dynamic lock class for blk_crypto_profile::lock") Cc: stable@vger.kernel.org Signed-off-by: Sweet Tea Dorminy Reviewed-by: Eric Biggers Link: https://lore.kernel.org/r/20230817141615.15387-1-sweettea-kernel@dorminy.me Signed-off-by: Jens Axboe commit c164c7bc9775be7bcc68754bb3431fce5823822e Author: Ming Lei Date: Thu Aug 17 22:17:51 2023 +0800 blk-cgroup: hold queue_lock when removing blkg->q_node When blkg is removed from q->blkg_list from blkg_free_workfn(), queue_lock has to be held, otherwise, all kinds of bugs(list corruption, hard lockup, ..) can be triggered from blkg_destroy_all(). Fixes: f1c006f1c685 ("blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()") Cc: Yu Kuai Cc: xiaoli feng Cc: Chunyu Hu Cc: Mike Snitzer Cc: Tejun Heo Signed-off-by: Ming Lei Acked-by: Tejun Heo Link: https://lore.kernel.org/r/20230817141751.1128970-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 6548fce05803262ab43241b61dee3e2982486e4b Author: Li Zhijian Date: Wed Aug 16 10:22:10 2023 +0800 drivers/rnbd: restore sysfs interface to rnbd-client Commit 137380c0ec40 renamed 'rnbd-client' to 'rnbd_client', this changed sysfs interface to /sys/devices/virtual/rnbd_client/ctl/map_device from /sys/devices/virtual/rnbd-client/ctl/map_device. CC: Ivan Orlov CC: "Md. Haris Iqbal" CC: Jack Wang Fixes: 137380c0ec40 ("block/rnbd: make all 'class' structures const") Signed-off-by: Li Zhijian Acked-by: Jack Wang Link: https://lore.kernel.org/r/20230816022210.2501228-1-lizhijian@fujitsu.com Signed-off-by: Jens Axboe commit 70d91dc9b2ac91327d0eefd86163abc3548effa6 Author: Christian Göttsche Date: Fri Aug 18 17:33:58 2023 +0200 selinux: set next pointer before attaching to list Set the next pointer in filename_trans_read_helper() before attaching the new node under construction to the list, otherwise garbage would be dereferenced on subsequent failure during cleanup in the out goto label. Cc: Fixes: 430059024389 ("selinux: implement new format of filename transitions") Signed-off-by: Christian Göttsche Signed-off-by: Paul Moore commit d4ddefee5160dc477d0e30c9d7a10ce8861c3007 Merge: 3e13eee10521b 2f43f549cd0b3 Author: Linus Torvalds Date: Fri Aug 18 20:52:25 2023 +0200 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: "Two more SME fixes related to ptrace(): ensure that the SME is properly set up for the target thread and that the thread sees the ZT registers set via ptrace" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/ptrace: Ensure that the task sees ZT writes on first use arm64/ptrace: Ensure that SME is set up for target when writing SSVE state commit 3e13eee10521b236b6b96a0e1d7f29c6bf2fd989 Merge: 8abd7287db923 3386fb86ecdef Author: Linus Torvalds Date: Fri Aug 18 20:36:49 2023 +0200 Merge tag 'gpio-fixes-for-v6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix a regression in the sysfs interface - fix a reference counting bug that's been around for years - MAINTAINERS update * tag 'gpio-fixes-for-v6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: fix reference leaks when removing GPIO chips still in use gpiolib: sysfs: Do unexport GPIO when user asks for it MAINTAINERS: add content regex for gpio-regmap commit 8abd7287db9231485261d36c17d77f044de32d20 Merge: cd479d9c72681 270d73e6507f9 Author: Linus Torvalds Date: Fri Aug 18 19:41:12 2023 +0200 Merge tag '6.5-rc6-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fix from Steve French: "A small SMB mount option fix, also for stable" * tag '6.5-rc6-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix null auth commit cd479d9c72681606cbfaf1b77629187fe904cbee Merge: ce03e1807c1f7 ca09f772cccae Author: Linus Torvalds Date: Fri Aug 18 19:26:53 2023 +0200 Merge tag 'riscv-for-linus-6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - avoid excessive rejections from seccomp RET_ERRNO rules - compressed jal/jalr decoding fix - fixes for independent irq/softirq stacks on kernels built with CONFIG_FRAME_POINTER=n - avoid a hang handling uaccess fixups - another build fix for toolchain ISA strings, this time for Zicsr and Zifenci on old GNU toolchains * tag 'riscv-for-linus-6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Handle zicsr/zifencei issue between gcc and binutils riscv: uaccess: Return the number of bytes effectively not copied riscv: stack: Fixup independent softirq stack for CONFIG_FRAME_POINTER=n riscv: stack: Fixup independent irq stack for CONFIG_FRAME_POINTER=n riscv: correct riscv_insn_is_c_jr() and riscv_insn_is_c_jalr() riscv: entry: set a0 = -ENOSYS only when syscall != -1 commit ce03e1807c1f71abcba185e6052cbef250600514 Merge: 88d4a1643afca 46cdff2369cbd Author: Linus Torvalds Date: Fri Aug 18 19:17:01 2023 +0200 Merge tag 'sound-6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Slightly bigger than I wished, but here we go, a collection of fixes for 6.5. The only change in the core side is the ease for repeated ASoC error messages, and the rest are all pretty device-specific small fixes (including regression fixes) for ASoC Intel and HD-audio / USB-audio quirks" * tag 'sound-6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek - Remodified 3k pull low procedure ASoC: rt1308-sdw: fix random louder sound ALSA: hda/cs8409: Support new Dell Dolphin Variants ALSA: hda/realtek: Switch Dell Oasis models to use SPI ALSA: hda/realtek: Add quirks for HP G11 Laptops ASoC: meson: axg-tdm-formatter: fix channel slot allocation ASoC: SOF: ipc4-topology: Update the basecfg for copier earlier ASoC: SOF: intel: hda: Clean up link DMA for IPC3 during stop ASoC: Intel: sof-sdw-cs42142: fix for codec button mapping ASoC: Intel: sof-sdw: update jack detection quirk for LunarLake RVP ASoC: SOF: Fix incorrect use of sizeof in sof_ipc3_do_rx_work() ASoC: lower "no backend DAIs enabled for ... Port" log severity ASoC: rt5665: add missed regulator_bulk_disable ASoC: max98363: don't return on success reading revision ID ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. ASoC: fsl: micfil: Use dual license micfil code commit 88d4a1643afca63a3832eefad5c00775ea20c117 Merge: f33fd7eb209ac 58abdd80b93b0 Author: Linus Torvalds Date: Fri Aug 18 19:10:41 2023 +0200 Merge tag 'mmc-v6.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC core: - Fix in_flight[issue_type] value error to properly manage requests MMC host: - wbsd: Fix double free in the probe error path - sunplus: Fix error path in probe - sdhci_f_sdh30: Fix order of function calls in sdhci_f_sdh30_remove" * tag 'mmc-v6.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove mmc: sunplus: Fix error handling in spmmc_drv_probe() mmc: sunplus: fix return value check of mmc_add_host() mmc: wbsd: fix double mmc_free_host() in wbsd_init() mmc: block: Fix in_flight[issue_type] value error commit f0362a253606e2031f8d61c74195d4d6556e12a4 Author: Rik van Riel Date: Thu Aug 17 13:57:59 2023 -0400 mm,ima,kexec,of: use memblock_free_late from ima_free_kexec_buffer The code calling ima_free_kexec_buffer runs long after the memblock allocator has already been torn down, potentially resulting in a use after free in memblock_isolate_range. With KASAN or KFENCE, this use after free will result in a BUG from the idle task, and a subsequent kernel panic. Switch ima_free_kexec_buffer over to memblock_free_late to avoid that issue. Fixes: fee3ff99bc67 ("powerpc: Move arch independent ima kexec functions to drivers/of/kexec.c") Cc: stable@kernel.org Signed-off-by: Rik van Riel Suggested-by: Mike Rappoport Link: https://lore.kernel.org/r/20230817135759.0888e5ef@imladris.surriel.com Signed-off-by: Rob Herring commit f33fd7eb209acf8f6d698fc7979af9e5815271c3 Merge: 80706f552983a 9757300d2750e Author: Linus Torvalds Date: Fri Aug 18 18:37:40 2023 +0200 Merge tag 'pinctrl-v6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Fixes two issues with the Qualcomm SA8775P platform: - Some minor device tree binding flunky that is nice to iron out but more importantly: - Support the increased interrupt targets mask from 3 to 4 bits, making interrupts with higher (hardware) numbers work" * tag 'pinctrl-v6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: qcom: Add intr_target_width field to support increased number of interrupt targets dt-bindings: pinctrl: qcom,sa8775p-tlmm: add gpio function constant commit 80706f552983ae62ef21f6c50303bad51ab7592c Merge: eabeef9054fdd 3c78dbf251350 Author: Linus Torvalds Date: Fri Aug 18 18:24:41 2023 +0200 Merge tag 'soc-fixes-6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "As usual, mostly DT fixes for the major Arm platforms from Qualcomm and NXP, plus a bit for Rockchips and others: The qualcomm fixes mainly deal with their higher-end arm64 devices trees, fixing issues in L3 interconnect, crypto, thermal, UFS and a regression for the DSI phy. NXP i.MX has two correctness fixes for the 64-bit chips, dealing with the imx93 "anatop" module and the CSI interface. On the 32-bit side, there are functional fixes for RTC, display and SD card intefaces. Rockchip fixes are for wifi support on certain boards, a eMMC stability and DT build warnings. On TI OMAP, a regulator is described in DT to avoid problems with the ethernet phy initialization. The code changes include a missing MMIO serialization on OMAP, plus a few minor fixes on ASpeed and AMD/Zynq chips" * tag 'soc-fixes-6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (30 commits) ARM: dts: am335x-bone-common: Add vcc-supply for on-board eeprom ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board soc: aspeed: socinfo: Add kfree for kstrdup soc: aspeed: uart-routing: Use __sysfs_match_string ARM: dts: integrator: fix PCI bus dtc warnings arm64: dts: imx93: Fix anatop node size arm64: dts: qcom: sc7180: Fix DSI0_PHY reg-names ARM: dts: imx: Set default tuning step for imx6sx usdhc arm64: dts: imx8mm: Drop CSI1 PHY reference clock configuration arm64: dts: imx8mn: Drop CSI1 PHY reference clock configuration ARM: dts: imx: Set default tuning step for imx7d usdhc ARM: dts: imx6: phytec: fix RTC interrupt level ARM: dts: imx6sx: Remove LDB endpoint arm64: dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boards ARM: zynq: Explicitly include correct DT includes arm64: dts: qcom: sa8775p-ride: Update L4C parameters arm64: dts: rockchip: minor whitespace cleanup around '=' arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+ arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4 arm64: dts: rockchip: add missing space before { on indiedroid nova ... commit eabeef9054fdd317e58387ed0ab1a32fe9eb5909 Merge: 0e8860d2125f5 6e8d96909a23c Author: Linus Torvalds Date: Fri Aug 18 18:13:36 2023 +0200 Merge tag 'asm-generic-fix-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic regression fix from Arnd Bergmann: "Just one partial revert for a commit from the merge window that caused annoying behavior when building old kernels on arm64 hosts" * tag 'asm-generic-fix-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: asm-generic: partially revert "Unify uapi bitsperlong.h for arm64, riscv and loongarch" commit c962098ca4af146f2625ed64399926a098752c9c Author: Josef Bacik Date: Thu Aug 17 16:57:30 2023 -0400 btrfs: fix incorrect splitting in btrfs_drop_extent_map_range In production we were seeing a variety of WARN_ON()'s in the extent_map code, specifically in btrfs_drop_extent_map_range() when we have to call add_extent_mapping() for our second split. Consider the following extent map layout PINNED [0 16K) [32K, 48K) and then we call btrfs_drop_extent_map_range for [0, 36K), with skip_pinned == true. The initial loop will have start = 0 end = 36K len = 36K we will find the [0, 16k) extent, but since we are pinned we will skip it, which has this code start = em_end; if (end != (u64)-1) len = start + len - em_end; em_end here is 16K, so now the values are start = 16K len = 16K + 36K - 16K = 36K len should instead be 20K. This is a problem when we find the next extent at [32K, 48K), we need to split this extent to leave [36K, 48k), however the code for the split looks like this split->start = start + len; split->len = em_end - (start + len); In this case we have em_end = 48K split->start = 16K + 36K // this should be 16K + 20K split->len = 48K - (16K + 36K) // this overflows as 16K + 36K is 52K and now we have an invalid extent_map in the tree that potentially overlaps other entries in the extent map. Even in the non-overlapping case we will have split->start set improperly, which will cause problems with any block related calculations. We don't actually need len in this loop, we can simply use end as our end point, and only adjust start up when we find a pinned extent we need to skip. Adjust the logic to do this, which keeps us from inserting an invalid extent map. We only skip_pinned in the relocation case, so this is relatively rare, except in the case where you are running relocation a lot, which can happen with auto relocation on. Fixes: 55ef68990029 ("Btrfs: Fix btrfs_drop_extent_cache for skip pinned case") CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 8fcc1c40b747069644db6102c1d84c942c9d4d86 Author: Biju Das Date: Tue Aug 15 14:15:58 2023 +0100 pinctrl: renesas: rza2: Add lock around pinctrl_generic{{add,remove}_group,{add,remove}_function} The pinctrl group and function creation/remove calls expect caller to take care of locking. Add lock around these functions. Fixes: b59d0e782706 ("pinctrl: Add RZ/A2 pin and gpio controller") Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230815131558.33787-4-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit f982b9d57e7f834138fc908804fe66f646f2b108 Author: Biju Das Date: Tue Aug 15 14:15:57 2023 +0100 pinctrl: renesas: rzv2m: Fix NULL pointer dereference in rzv2m_dt_subnode_to_map() Fix the below random NULL pointer crash during boot by serializing pinctrl group and function creation/remove calls in rzv2m_dt_subnode_to_map() with mutex lock. Crash logs: pc : __pi_strcmp+0x20/0x140 lr : pinmux_func_name_to_selector+0x68/0xa4 Call trace: __pi_strcmp+0x20/0x140 pinmux_generic_add_function+0x34/0xcc rzv2m_dt_subnode_to_map+0x2e4/0x418 rzv2m_dt_node_to_map+0x15c/0x18c pinctrl_dt_to_map+0x218/0x37c create_pinctrl+0x70/0x3d8 While at it, add a comment for lock. Fixes: 92a9b8252576 ("pinctrl: renesas: Add RZ/V2M pin and gpio controller driver") Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230815131558.33787-3-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 661efa2284bbc2338da0424e219603f034072c74 Author: Biju Das Date: Tue Aug 15 14:15:56 2023 +0100 pinctrl: renesas: rzg2l: Fix NULL pointer dereference in rzg2l_dt_subnode_to_map() Fix the below random NULL pointer crash during boot by serializing pinctrl group and function creation/remove calls in rzg2l_dt_subnode_to_map() with mutex lock. Crash log: pc : __pi_strcmp+0x20/0x140 lr : pinmux_func_name_to_selector+0x68/0xa4 Call trace: __pi_strcmp+0x20/0x140 pinmux_generic_add_function+0x34/0xcc rzg2l_dt_subnode_to_map+0x314/0x44c rzg2l_dt_node_to_map+0x164/0x194 pinctrl_dt_to_map+0x218/0x37c create_pinctrl+0x70/0x3d8 While at it, add comments for bitmap_lock and lock. Fixes: c4c4637eb57f ("pinctrl: renesas: Add RZ/G2L pin and gpio controller driver") Tested-by: Chris Paterson Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230815131558.33787-2-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 6405b72e8d17bd1875a56ae52d23ec3cd51b9d66 Author: Borislav Petkov (AMD) Date: Tue Aug 15 11:53:13 2023 +0200 x86/srso: Correct the mitigation status when SMT is disabled Specify how is SRSO mitigated when SMT is disabled. Also, correct the SMT check for that. Fixes: e9fbc47b818b ("x86/srso: Disable the mitigation on unaffected configurations") Suggested-by: Josh Poimboeuf Signed-off-by: Borislav Petkov (AMD) Acked-by: Josh Poimboeuf Link: https://lore.kernel.org/r/20230814200813.p5czl47zssuej7nv@treble commit 080aa61e370b9c5cafe71cacadbfe0e72db4d6df Author: Pavel Skripkin Date: Mon Aug 14 21:03:41 2023 +0300 crypto: fix uninit-value in af_alg_free_resources Syzbot was able to trigger use of uninitialized memory in af_alg_free_resources. Bug is caused by missing initialization of rsgl->sgl.need_unpin before adding to rsgl_list. Then in case of extract_iter_to_sg() failure, rsgl is left with uninitialized need_unpin which is read during clean up BUG: KMSAN: uninit-value in af_alg_free_sg crypto/af_alg.c:545 [inline] BUG: KMSAN: uninit-value in af_alg_free_areq_sgls crypto/af_alg.c:778 [inline] BUG: KMSAN: uninit-value in af_alg_free_resources+0x3d1/0xf60 crypto/af_alg.c:1117 af_alg_free_sg crypto/af_alg.c:545 [inline] af_alg_free_areq_sgls crypto/af_alg.c:778 [inline] af_alg_free_resources+0x3d1/0xf60 crypto/af_alg.c:1117 _skcipher_recvmsg crypto/algif_skcipher.c:144 [inline] ... Uninit was created at: slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3470 [inline] __kmem_cache_alloc_node+0x536/0x8d0 mm/slub.c:3509 __do_kmalloc_node mm/slab_common.c:984 [inline] __kmalloc+0x121/0x3c0 mm/slab_common.c:998 kmalloc include/linux/slab.h:586 [inline] sock_kmalloc+0x128/0x1c0 net/core/sock.c:2683 af_alg_alloc_areq+0x41/0x2a0 crypto/af_alg.c:1188 _skcipher_recvmsg crypto/algif_skcipher.c:71 [inline] Fixes: c1abe6f570af ("crypto: af_alg: Use extract_iter_to_sg() to create scatterlists") Reported-and-tested-by: syzbot+cba21d50095623218389@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cba21d50095623218389 Signed-off-by: Pavel Skripkin Signed-off-by: Herbert Xu commit 83874b8e97f895e62d9ab03223318176d5e78203 Author: Herbert Xu Date: Fri Aug 18 16:47:02 2023 +0800 Revert "crypto: caam - adjust RNG timing to support more devices" This reverts commit ef492d080302913e85122a2d92efa2ca174930f8. This patch breaks the RNG on i.MX8MM. Reported-by: Bastian Krause Link: https://lore.kernel.org/all/e1f3f073-9d5e-1bae-f4f8-08dc48adad62@pengutronix.de/ Signed-off-by: Herbert Xu commit 20c827683de05a6c7e7ae7fae586899690693251 Author: Frieder Schrempf Date: Mon Jul 24 17:16:32 2023 +0200 drm: bridge: samsung-dsim: Fix init during host transfer In case the downstream bridge or panel uses DSI transfers before the DSI host was actually initialized through samsung_dsim_atomic_enable() which clears the stop state (LP11) mode, all transfers will fail. This happens with downstream bridges that are controlled by DSI commands such as the tc358762. As documented in [1] DSI hosts are expected to allow transfers outside the normal bridge enable/disable flow. To fix this make sure that stop state is cleared in samsung_dsim_host_transfer() which restores the previous behavior. We also factor out the common code to enable/disable stop state to samsung_dsim_set_stop_state(). [1] https://docs.kernel.org/gpu/drm-kms-helpers.html#mipi-dsi-bridge-operation Fixes: 0c14d3130654 ("drm: bridge: samsung-dsim: Fix i.MX8M enable flow to meet spec") Reported-by: Tim Harvey Signed-off-by: Frieder Schrempf Reviewed-by: Neil Armstrong Tested-by: Tim Harvey Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20230724151640.555490-1-frieder@fris.de commit 0e8860d2125f51ba9bca67a520d826cb8f66cf42 Merge: 1ada9c07407d6 820a38d8f2cb3 Author: Linus Torvalds Date: Fri Aug 18 06:52:23 2023 +0200 Merge tag 'net-6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from ipsec and netfilter. No known outstanding regressions. Fixes to fixes: - virtio-net: set queues after driver_ok, avoid a potential race added by recent fix - Revert "vlan: Fix VLAN 0 memory leak", it may lead to a warning when VLAN 0 is registered explicitly - nf_tables: - fix false-positive lockdep splat in recent fixes - don't fail inserts if duplicate has expired (fix test failures) - fix races between garbage collection and netns dismantle Current release - new code bugs: - mlx5: Fix mlx5_cmd_update_root_ft() error flow Previous releases - regressions: - phy: fix IRQ-based wake-on-lan over hibernate / power off Previous releases - always broken: - sock: fix misuse of sk_under_memory_pressure() preventing system from exiting global TCP memory pressure if a single cgroup is under pressure - fix the RTO timer retransmitting skb every 1ms if linear option is enabled - af_key: fix sadb_x_filter validation, amment netlink policy - ipsec: fix slab-use-after-free in decode_session6() - macb: in ZynqMP resume always configure PS GTR for non-wakeup source Misc: - netfilter: set default timeout to 3 secs for sctp shutdown send and recv state (from 300ms), align with protocol timers" * tag 'net-6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (49 commits) ice: Block switchdev mode when ADQ is active and vice versa qede: fix firmware halt over suspend and resume net: do not allow gso_size to be set to GSO_BY_FRAGS sock: Fix misuse of sk_under_memory_pressure() sfc: don't fail probe if MAE/TC setup fails sfc: don't unregister flow_indr if it was never registered net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset net/mlx5: Fix mlx5_cmd_update_root_ft() error flow net/mlx5e: XDP, Fix fifo overrun on XDP_REDIRECT i40e: fix misleading debug logs iavf: fix FDIR rule fields masks validation ipv6: fix indentation of a config attribute mailmap: add entries for Simon Horman broadcom: b44: Use b44_writephy() return value net: openvswitch: reject negative ifindex team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves net: phy: broadcom: stub c45 read/write for 54810 netfilter: nft_dynset: disallow object maps netfilter: nf_tables: GC transaction race with netns dismantle netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path ... commit 1ada9c07407d66679967fe5c2cbb7eda2e0addbf Merge: 16931859a6500 c611589b4259e Author: Linus Torvalds Date: Fri Aug 18 06:37:34 2023 +0200 Merge tag 'drm-fixes-2023-08-18-1' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Regular enough week, mostly the usual amdgpu and i915 fixes. Also qaic, nouveau, qxl and a revert for an EDID patch that had some side effects, along with a couple of panel fixes. edid: - revert mode parsing fix that had side effects. i915: - Fix the flow for ignoring GuC SLPC efficient frequency selection - Fix SDVO panel_type initialization - Fix display probe for IVB Q and IVB D GT2 server nouveau: - fix use-after-free in connector code qaic: - integer overflow check fix - fix slicing memory leak panel: - fix JDI LT070ME05000 probing - fix AUO G121EAN01 timings amdgpu: - SMU 13.x fixes - Fix mcbp parameter for gfx9 - SMU 11.x fixes - Temporary fix for large numbers of XCP partitions - S0ix fixes - DCN 2.0 fix qxl: - fix use after free race in dumb object allocation" * tag 'drm-fixes-2023-08-18-1' of git://anongit.freedesktop.org/drm/drm: drm/qxl: fix UAF on handle creation Revert "drm/edid: Fix csync detailed mode parsing" drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create Revert "Revert "drm/amdgpu/display: change pipe policy for DCN 2.0"" drm/amd: flush any delayed gfxoff on suspend entry drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix drm/amdgpu: skip xcp drm device allocation when out of drm resource drm/amd/pm: Update pci link width for smu v13.0.6 drm/amd/pm: Fix temperature unit of SMU v13.0.6 drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7 drm/amdgpu: disable mcbp if parameter zero is set drm/amd/pm: disallow the fan setting if there is no fan on smu 13.0.0 accel/qaic: Clean up integer overflow checking in map_user_pages() accel/qaic: Fix slicing memory leak drm/i915: fix display probe for IVB Q and IVB D GT2 server drm/i915/sdvo: fix panel_type initialization drm/i915/guc/slpc: Restore efficient freq earlier drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs drm/panel: JDI LT070ME05000 simplify with dev_err_probe() commit 820a38d8f2cb3a749ffb7bbde206acec9a387411 Merge: e9bbd6016947c 2f2beb8874cb0 Author: Jakub Kicinski Date: Thu Aug 17 14:35:34 2023 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-08-16 (iavf, i40e) This series contains updates to iavf and i40e drivers. Piotr adds checks for unsupported Flow Director rules on iavf. Andrii replaces incorrect 'write' messaging on read operations for i40e. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: i40e: fix misleading debug logs iavf: fix FDIR rule fields masks validation ==================== Link: https://lore.kernel.org/r/20230816193308.1307535-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit c611589b4259ed63b9b77be6872b1ce07ec0ac16 Author: Wander Lairson Costa Date: Mon Aug 14 13:51:19 2023 -0300 drm/qxl: fix UAF on handle creation qxl_mode_dumb_create() dereferences the qobj returned by qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. A potential attacker could guess the returned handle value and closes it between the return of qxl_gem_object_create_with_handle() and the qobj usage, triggering a use-after-free scenario. Reproducer: int dri_fd =-1; struct drm_mode_create_dumb arg = {0}; void gem_close(int handle); void* trigger(void* ptr) { int ret; arg.width = arg.height = 0x20; arg.bpp = 32; ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &arg); if(ret) { perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed"); exit(-1); } gem_close(arg.handle); while(1) { struct drm_mode_create_dumb args = {0}; args.width = args.height = 0x20; args.bpp = 32; ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &args); if (ret) { perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed"); exit(-1); } printf("[*] DRM_IOCTL_MODE_CREATE_DUMB created, %d\n", args.handle); gem_close(args.handle); } return NULL; } void gem_close(int handle) { struct drm_gem_close args; args.handle = handle; int ret = ioctl(dri_fd, DRM_IOCTL_GEM_CLOSE, &args); // gem close handle if (!ret) printf("gem close handle %d\n", args.handle); } int main(void) { dri_fd= open("/dev/dri/card0", O_RDWR); printf("fd:%d\n", dri_fd); if(dri_fd == -1) return -1; pthread_t tid1; if(pthread_create(&tid1,NULL,trigger,NULL)){ perror("[*] thread_create tid1\n"); return -1; } while (1) { gem_close(arg.handle); } return 0; } This is a KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69 Write of size 1 at addr ffff88801136c240 by task poc/515 CPU: 1 PID: 515 Comm: poc Not tainted 6.3.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014 Call Trace: __dump_stack linux/lib/dump_stack.c:88 dump_stack_lvl+0x48/0x70 linux/lib/dump_stack.c:106 print_address_description linux/mm/kasan/report.c:319 print_report+0xd2/0x660 linux/mm/kasan/report.c:430 kasan_report+0xd2/0x110 linux/mm/kasan/report.c:536 __asan_report_store1_noabort+0x17/0x30 linux/mm/kasan/report_generic.c:383 qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69 drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 vfs_ioctl linux/fs/ioctl.c:51 __do_sys_ioctl linux/fs/ioctl.c:870 __se_sys_ioctl linux/fs/ioctl.c:856 __x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 do_syscall_x64 linux/arch/x86/entry/common.c:50 do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 RIP: 0033:0x7ff5004ff5f7 Code: 00 00 00 48 8b 05 99 c8 0d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 69 c8 0d 00 f7 d8 64 89 01 48 RSP: 002b:00007ff500408ea8 EFLAGS: 00000286 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff5004ff5f7 RDX: 00007ff500408ec0 RSI: 00000000c02064b2 RDI: 0000000000000003 RBP: 00007ff500408ef0 R08: 0000000000000000 R09: 000000000000002a R10: 0000000000000000 R11: 0000000000000286 R12: 00007fff1c6cdafe R13: 00007fff1c6cdaff R14: 00007ff500408fc0 R15: 0000000000802000 Allocated by task 515: kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45 kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52 kasan_save_alloc_info+0x1e/0x40 linux/mm/kasan/generic.c:510 ____kasan_kmalloc linux/mm/kasan/common.c:374 __kasan_kmalloc+0xc3/0xd0 linux/mm/kasan/common.c:383 kasan_kmalloc linux/./include/linux/kasan.h:196 kmalloc_trace+0x48/0xc0 linux/mm/slab_common.c:1066 kmalloc linux/./include/linux/slab.h:580 kzalloc linux/./include/linux/slab.h:720 qxl_bo_create+0x11a/0x610 linux/drivers/gpu/drm/qxl/qxl_object.c:124 qxl_gem_object_create+0xd9/0x360 linux/drivers/gpu/drm/qxl/qxl_gem.c:58 qxl_gem_object_create_with_handle+0xa1/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:89 qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63 drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 vfs_ioctl linux/fs/ioctl.c:51 __do_sys_ioctl linux/fs/ioctl.c:870 __se_sys_ioctl linux/fs/ioctl.c:856 __x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 do_syscall_x64 linux/arch/x86/entry/common.c:50 do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 Freed by task 515: kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45 kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x60 linux/mm/kasan/generic.c:521 ____kasan_slab_free linux/mm/kasan/common.c:236 ____kasan_slab_free+0x180/0x1f0 linux/mm/kasan/common.c:200 __kasan_slab_free+0x12/0x30 linux/mm/kasan/common.c:244 kasan_slab_free linux/./include/linux/kasan.h:162 slab_free_hook linux/mm/slub.c:1781 slab_free_freelist_hook+0xd2/0x1a0 linux/mm/slub.c:1807 slab_free linux/mm/slub.c:3787 __kmem_cache_free+0x196/0x2d0 linux/mm/slub.c:3800 kfree+0x78/0x120 linux/mm/slab_common.c:1019 qxl_ttm_bo_destroy+0x140/0x1a0 linux/drivers/gpu/drm/qxl/qxl_object.c:49 ttm_bo_release+0x678/0xa30 linux/drivers/gpu/drm/ttm/ttm_bo.c:381 kref_put linux/./include/linux/kref.h:65 ttm_bo_put+0x50/0x80 linux/drivers/gpu/drm/ttm/ttm_bo.c:393 qxl_gem_object_free+0x3e/0x60 linux/drivers/gpu/drm/qxl/qxl_gem.c:42 drm_gem_object_free+0x5c/0x90 linux/drivers/gpu/drm/drm_gem.c:974 kref_put linux/./include/linux/kref.h:65 __drm_gem_object_put linux/./include/drm/drm_gem.h:431 drm_gem_object_put linux/./include/drm/drm_gem.h:444 qxl_gem_object_create_with_handle+0x151/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:100 qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63 drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 vfs_ioctl linux/fs/ioctl.c:51 __do_sys_ioctl linux/fs/ioctl.c:870 __se_sys_ioctl linux/fs/ioctl.c:856 __x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 do_syscall_x64 linux/arch/x86/entry/common.c:50 do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 The buggy address belongs to the object at ffff88801136c000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 576 bytes inside of freed 1024-byte region [ffff88801136c000, ffff88801136c400) The buggy address belongs to the physical page: page:0000000089fc329b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11368 head:0000000089fc329b order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0010200 ffff888007841dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88801136c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801136c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88801136c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801136c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801136c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Disabling lock debugging due to kernel taint Instead of returning a weak reference to the qxl_bo object, return the created drm_gem_object and let the caller decrement the reference count when it no longer needs it. As a convenience, if the caller is not interested in the gobj object, it can pass NULL to the parameter and the reference counting is descremented internally. The bug and the reproducer were originally found by the Zero Day Initiative project (ZDI-CAN-20940). Link: https://www.zerodayinitiative.com/ Signed-off-by: Wander Lairson Costa Cc: stable@vger.kernel.org Reviewed-by: Dave Airlie Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230814165119.90847-1-wander@redhat.com commit 68c60b343301c5a150e6da4c0c9e4123b2b9c017 Merge: be48306f764dc 6ecc10295abb2 Author: Dave Airlie Date: Fri Aug 18 06:09:21 2023 +1000 Merge tag 'amd-drm-fixes-6.5-2023-08-16' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.5-2023-08-16: amdgpu: - SMU 13.x fixes - Fix mcbp parameter for gfx9 - SMU 11.x fixes - Temporary fix for large numbers of XCP partitions - S0ix fixes - DCN 2.0 fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230816200226.10771-1-alexander.deucher@amd.com commit be48306f764dc84906a5054e60e6cfa9889fb44d Merge: dd64d8ae0f8f2 50b6f2c829779 Author: Dave Airlie Date: Fri Aug 18 06:08:54 2023 +1000 Merge tag 'drm-misc-fixes-2023-08-17' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes One EPROBE_DEFER handling fix for the JDI LT070ME05000, a timing fix for the AUO G121EAN01 panel, an integer overflow and a memory leak fixes for the qaic accel, a use-after-free fix for nouveau and a revert for an alleged fix in EDID parsing. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/3olqt33em5uhxzjbqghwcwnvmw73h7bxkbdxookmnkecymd4vc@7ogm6gewpprq commit dd64d8ae0f8f271e8629e9d2ba9971081583c394 Merge: 2ccdd1b13c591 423ffe62c06ae Author: Dave Airlie Date: Fri Aug 18 06:07:59 2023 +1000 Merge tag 'drm-intel-fixes-2023-08-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix the flow for ignoring GuC SLPC efficient frequency selection (Vinay) - Fix SDVO panel_type initialization (Jani) - Fix display probe for IVB Q and IVB D GT2 server (Jani) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/ZN4yduyBU1Ev9dc7@intel.com commit e9bbd6016947c40728558b7b921c1e77e6193e8b Merge: 43d00e102d9ec 0fd23db0cc74c Author: Jakub Kicinski Date: Thu Aug 17 11:56:44 2023 -0700 Merge tag 'mlx5-fixes-2023-08-16' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2023-08-16 This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2023-08-16' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5: Fix mlx5_cmd_update_root_ft() error flow net/mlx5e: XDP, Fix fifo overrun on XDP_REDIRECT ==================== Link: https://lore.kernel.org/r/20230816204108.53819-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 43d00e102d9ecbe2635d7e3f2e14d2e90183d6af Author: Marcin Szycik Date: Wed Aug 16 12:34:05 2023 -0700 ice: Block switchdev mode when ADQ is active and vice versa ADQ and switchdev are not supported simultaneously. Enabling both at the same time can result in nullptr dereference. To prevent this, check if ADQ is active when changing devlink mode to switchdev mode, and check if switchdev is active when enabling ADQ. Fixes: fbc7b27af0f9 ("ice: enable ndo_setup_tc support for mqprio_qdisc") Signed-off-by: Marcin Szycik Reviewed-by: Przemek Kitszel Tested-by: Sujai Buvaneswaran Signed-off-by: Tony Nguyen Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230816193405.1307580-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 2eb9625a3a32251ecea470cd576659a3a03b4e59 Author: Manish Chopra Date: Wed Aug 16 20:37:11 2023 +0530 qede: fix firmware halt over suspend and resume While performing certain power-off sequences, PCI drivers are called to suspend and resume their underlying devices through PCI PM (power management) interface. However this NIC hardware does not support PCI PM suspend/resume operations so system wide suspend/resume leads to bad MFW (management firmware) state which causes various follow-up errors in driver when communicating with the device/firmware afterwards. To fix this driver implements PCI PM suspend handler to indicate unsupported operation to the PCI subsystem explicitly, thus avoiding system to go into suspended/standby mode. Without this fix device/firmware does not recover unless system is power cycled. Fixes: 2950219d87b0 ("qede: Add basic network device support") Signed-off-by: Manish Chopra Signed-off-by: Alok Prasad Reviewed-by: John Meneghini Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230816150711.59035-1-manishc@marvell.com Signed-off-by: Jakub Kicinski commit b616be6b97688f2f2bd7c4a47ab32f27f94fb2a9 Author: Eric Dumazet Date: Wed Aug 16 14:21:58 2023 +0000 net: do not allow gso_size to be set to GSO_BY_FRAGS One missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again [1] Do not allow gso_size to be set to GSO_BY_FRAGS (0xffff), because this magic value is used by the kernel. [1] general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 0 PID: 5039 Comm: syz-executor401 Not tainted 6.5.0-rc5-next-20230809-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 RIP: 0010:skb_segment+0x1a52/0x3ef0 net/core/skbuff.c:4500 Code: 00 00 00 e9 ab eb ff ff e8 6b 96 5d f9 48 8b 84 24 00 01 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e ea 21 00 00 48 8b 84 24 00 01 RSP: 0018:ffffc90003d3f1c8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 000000000001fffe RCX: 0000000000000000 RDX: 000000000000000e RSI: ffffffff882a3115 RDI: 0000000000000070 RBP: ffffc90003d3f378 R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 5ee4a93e456187d6 R12: 000000000001ffc6 R13: dffffc0000000000 R14: 0000000000000008 R15: 000000000000ffff FS: 00005555563f2380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020020000 CR3: 000000001626d000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: udp6_ufo_fragment+0x9d2/0xd50 net/ipv6/udp_offload.c:109 ipv6_gso_segment+0x5c4/0x17b0 net/ipv6/ip6_offload.c:120 skb_mac_gso_segment+0x292/0x610 net/core/gso.c:53 __skb_gso_segment+0x339/0x710 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x3a5/0xf10 net/core/dev.c:3625 __dev_queue_xmit+0x8f0/0x3d60 net/core/dev.c:4329 dev_queue_xmit include/linux/netdevice.h:3082 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24c7/0x5570 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:727 [inline] sock_sendmsg+0xd9/0x180 net/socket.c:750 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2496 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2550 __sys_sendmsg+0x117/0x1e0 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7ff27cdb34d9 Fixes: 3953c46c3ac7 ("sk_buff: allow segmenting based on frag sizes") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Xin Long Cc: "Michael S. Tsirkin" Cc: Jason Wang Reviewed-by: Willem de Bruijn Reviewed-by: Marcelo Ricardo Leitner Reviewed-by: Xuan Zhuo Link: https://lore.kernel.org/r/20230816142158.1779798-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2d0c88e84e483982067a82073f6125490ddf3614 Author: Abel Wu Date: Wed Aug 16 17:12:22 2023 +0800 sock: Fix misuse of sk_under_memory_pressure() The status of global socket memory pressure is updated when: a) __sk_mem_raise_allocated(): enter: sk_memory_allocated(sk) > sysctl_mem[1] leave: sk_memory_allocated(sk) <= sysctl_mem[0] b) __sk_mem_reduce_allocated(): leave: sk_under_memory_pressure(sk) && sk_memory_allocated(sk) < sysctl_mem[0] So the conditions of leaving global pressure are inconstant, which may lead to the situation that one pressured net-memcg prevents the global pressure from being cleared when there is indeed no global pressure, thus the global constrains are still in effect unexpectedly on the other sockets. This patch fixes this by ignoring the net-memcg's pressure when deciding whether should leave global memory pressure. Fixes: e1aab161e013 ("socket: initial cgroup code.") Signed-off-by: Abel Wu Acked-by: Shakeel Butt Link: https://lore.kernel.org/r/20230816091226.1542-1-wuyun.abel@bytedance.com Signed-off-by: Jakub Kicinski commit 54c9016eb8eda55952a195b071359cd13f50ed9b Author: Edward Cree Date: Tue Aug 15 16:57:28 2023 +0100 sfc: don't fail probe if MAE/TC setup fails Existing comment in the source explains why we don't want efx_init_tc() failure to be fatal. Cited commit erroneously consolidated failure paths causing the probe to be failed in this case. Fixes: 7e056e2360d9 ("sfc: obtain device mac address based on firmware handle for ef100") Reviewed-by: Martin Habets Signed-off-by: Edward Cree Link: https://lore.kernel.org/r/aa7f589dd6028bd1ad49f0a85f37ab33c09b2b45.1692114888.git.ecree.xilinx@gmail.com Signed-off-by: Jakub Kicinski commit fa165e1949976704500a442faeef8d9596faee76 Author: Edward Cree Date: Tue Aug 15 16:57:27 2023 +0100 sfc: don't unregister flow_indr if it was never registered In efx_init_tc(), move the setting of efx->tc->up after the flow_indr_dev_register() call, so that if it fails, efx_fini_tc() won't call flow_indr_dev_unregister(). Fixes: 5b2e12d51bd8 ("sfc: bind indirect blocks for TC offload on EF100") Suggested-by: Pieter Jansen van Vuuren Reviewed-by: Martin Habets Signed-off-by: Edward Cree Link: https://lore.kernel.org/r/a81284d7013aba74005277bd81104e4cfbea3f6f.1692114888.git.ecree.xilinx@gmail.com Signed-off-by: Jakub Kicinski commit 2f43f549cd0b3164ea0345e59aa3958c0d243383 Author: Mark Brown Date: Wed Aug 16 19:40:07 2023 +0100 arm64/ptrace: Ensure that the task sees ZT writes on first use When the value of ZT is set via ptrace we don't disable traps for SME. This means that when a the task has never used SME before then the value set via ptrace will never be seen by the target task since it will trigger a SME access trap which will flush the register state. Disable SME traps when setting ZT, this means we also need to allocate storage for SVE if it is not already allocated, for the benefit of streaming SVE. Fixes: f90b529bcbe5 ("arm64/sme: Implement ZT0 ptrace support") Signed-off-by: Mark Brown Cc: # 6.3.x Link: https://lore.kernel.org/r/20230816-arm64-zt-ptrace-first-use-v2-1-00aa82847e28@kernel.org Signed-off-by: Catalin Marinas commit 5d0a8d2fba50e9c07cde4aad7fba28c008b07a5b Author: Mark Brown Date: Thu Aug 10 12:28:19 2023 +0100 arm64/ptrace: Ensure that SME is set up for target when writing SSVE state When we use NT_ARM_SSVE to either enable streaming mode or change the vector length for a process we do not currently do anything to ensure that there is storage allocated for the SME specific register state. If the task had not previously used SME or we changed the vector length then the task will not have had TIF_SME set or backing storage for ZA/ZT allocated, resulting in inconsistent register sizes when saving state and spurious traps which flush the newly set register state. We should set TIF_SME to disable traps and ensure that storage is allocated for ZA and ZT if it is not already allocated. This requires modifying sme_alloc() to make the flush of any existing register state optional so we don't disturb existing state for ZA and ZT. Fixes: e12310a0d30f ("arm64/sme: Implement ptrace support for streaming mode SVE registers") Reported-by: David Spickett Signed-off-by: Mark Brown Cc: # 5.19.x Link: https://lore.kernel.org/r/20230810-arm64-fix-ptrace-race-v1-1-a5361fad2bd6@kernel.org Signed-off-by: Catalin Marinas commit eecb91b9f98d6427d4af5fdb8f108f52572a39e7 Author: Zheng Yejian Date: Thu Aug 17 20:55:39 2023 +0800 tracing: Fix memleak due to race between current_tracer and trace Kmemleak report a leak in graph_trace_open(): unreferenced object 0xffff0040b95f4a00 (size 128): comm "cat", pid 204981, jiffies 4301155872 (age 99771.964s) hex dump (first 32 bytes): e0 05 e7 b4 ab 7d 00 00 0b 00 01 00 00 00 00 00 .....}.......... f4 00 01 10 00 a0 ff ff 00 00 00 00 65 00 10 00 ............e... backtrace: [<000000005db27c8b>] kmem_cache_alloc_trace+0x348/0x5f0 [<000000007df90faa>] graph_trace_open+0xb0/0x344 [<00000000737524cd>] __tracing_open+0x450/0xb10 [<0000000098043327>] tracing_open+0x1a0/0x2a0 [<00000000291c3876>] do_dentry_open+0x3c0/0xdc0 [<000000004015bcd6>] vfs_open+0x98/0xd0 [<000000002b5f60c9>] do_open+0x520/0x8d0 [<00000000376c7820>] path_openat+0x1c0/0x3e0 [<00000000336a54b5>] do_filp_open+0x14c/0x324 [<000000002802df13>] do_sys_openat2+0x2c4/0x530 [<0000000094eea458>] __arm64_sys_openat+0x130/0x1c4 [<00000000a71d7881>] el0_svc_common.constprop.0+0xfc/0x394 [<00000000313647bf>] do_el0_svc+0xac/0xec [<000000002ef1c651>] el0_svc+0x20/0x30 [<000000002fd4692a>] el0_sync_handler+0xb0/0xb4 [<000000000c309c35>] el0_sync+0x160/0x180 The root cause is descripted as follows: __tracing_open() { // 1. File 'trace' is being opened; ... *iter->trace = *tr->current_trace; // 2. Tracer 'function_graph' is // currently set; ... iter->trace->open(iter); // 3. Call graph_trace_open() here, // and memory are allocated in it; ... } s_start() { // 4. The opened file is being read; ... *iter->trace = *tr->current_trace; // 5. If tracer is switched to // 'nop' or others, then memory // in step 3 are leaked!!! ... } To fix it, in s_start(), close tracer before switching then reopen the new tracer after switching. And some tracers like 'wakeup' may not update 'iter->private' in some cases when reopen, then it should be cleared to avoid being mistakenly closed again. Link: https://lore.kernel.org/linux-trace-kernel/20230817125539.1646321-1-zhengyejian1@huawei.com Fixes: d7350c3f4569 ("tracing/core: make the read callbacks reentrants") Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit ab0b5072d184bdb013c9c2419cb21c593fa3802a Merge: 3d521f9f3663b e8500a7027033 Author: Mark Brown Date: Thu Aug 17 18:36:28 2023 +0100 ASoC: cs35l56: Update ACPI HID and property Merge series from Richard Fitzgerald : These two patches add an ACPI HID and update the way the platform- specific firmware identifier is extracted from the ACPI. commit 16931859a6500d360b90aeacab3b505a3560a3ed Merge: 4853c74bd7ab7 c96e2a695e00b Author: Linus Torvalds Date: Thu Aug 17 16:38:48 2023 +0200 Merge tag 'nfsd-6.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fix from Chuck Lever: - Fix new MSG_SPLICE_PAGES support in server's TCP sendmsg helper * tag 'nfsd-6.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: sunrpc: set the bv_offset of first bvec in svc_tcp_sendmsg commit be2fd1560eb57b7298aa3c258ddcca0d53ecdea3 Author: Trond Myklebust Date: Tue Aug 8 21:17:11 2023 -0400 NFS: Fix a use after free in nfs_direct_join_group() Be more careful when tearing down the subrequests of an O_DIRECT write as part of a retransmission. Reported-by: Chris Mason Fixes: ed5d588fe47f ("NFS: Try to join page groups before an O_DIRECT retransmission") Cc: stable@vger.kernel.org Signed-off-by: Trond Myklebust commit 29eefa6d0d07e185f7bfe9576f91e6dba98189c2 Author: xiaoshoukui Date: Tue Aug 15 02:55:59 2023 -0400 btrfs: fix BUG_ON condition in btrfs_cancel_balance Pausing and canceling balance can race to interrupt balance lead to BUG_ON panic in btrfs_cancel_balance. The BUG_ON condition in btrfs_cancel_balance does not take this race scenario into account. However, the race condition has no other side effects. We can fix that. Reproducing it with panic trace like this: kernel BUG at fs/btrfs/volumes.c:4618! RIP: 0010:btrfs_cancel_balance+0x5cf/0x6a0 Call Trace: ? do_nanosleep+0x60/0x120 ? hrtimer_nanosleep+0xb7/0x1a0 ? sched_core_clone_cookie+0x70/0x70 btrfs_ioctl_balance_ctl+0x55/0x70 btrfs_ioctl+0xa46/0xd20 __x64_sys_ioctl+0x7d/0xa0 do_syscall_64+0x38/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Race scenario as follows: > mutex_unlock(&fs_info->balance_mutex); > -------------------- > .......issue pause and cancel req in another thread > -------------------- > ret = __btrfs_balance(fs_info); > > mutex_lock(&fs_info->balance_mutex); > if (ret == -ECANCELED && atomic_read(&fs_info->balance_pause_req)) { > btrfs_info(fs_info, "balance: paused"); > btrfs_exclop_balance(fs_info, BTRFS_EXCLOP_BALANCE_PAUSED); > } CC: stable@vger.kernel.org # 4.19+ Signed-off-by: xiaoshoukui Reviewed-by: David Sterba Signed-off-by: David Sterba commit 09c3717c3a60e3ef599bc17c70cd3ae2b979ad41 Author: Chris Mason Date: Tue Aug 1 09:28:28 2023 -0700 btrfs: only subtract from len_to_oe_boundary when it is tracking an extent bio_ctrl->len_to_oe_boundary is used to make sure we stay inside a zone as we submit bios for writes. Every time we add a page to the bio, we decrement those bytes from len_to_oe_boundary, and then we submit the bio if we happen to hit zero. Most of the time, len_to_oe_boundary gets set to U32_MAX. submit_extent_page() adds pages into our bio, and the size of the bio ends up limited by: - Are we contiguous on disk? - Does bio_add_page() allow us to stuff more in? - is len_to_oe_boundary > 0? The len_to_oe_boundary math starts with U32_MAX, which isn't page or sector aligned, and subtracts from it until it hits zero. In the non-zoned case, the last IO we submit before we hit zero is going to be unaligned, triggering BUGs. This is hard to trigger because bio_add_page() isn't going to make a bio of U32_MAX size unless you give it a perfect set of pages and fully contiguous extents on disk. We can hit it pretty reliably while making large swapfiles during provisioning because the machine is freshly booted, mostly idle, and the disk is freshly formatted. It's also possible to trigger with reads when read_ahead_kb is set to 4GB. The code has been clean up and shifted around a few times, but this flaw has been lurking since the counter was added. I think the commit 24e6c8082208 ("btrfs: simplify main loop in submit_extent_page") ended up exposing the bug. The fix used here is to skip doing math on len_to_oe_boundary unless we've changed it from the default U32_MAX value. bio_add_page() is the real limit we want, and there's no reason to do extra math when block layer is doing it for us. Sample reproducer, note you'll need to change the path to the bdi and device: SUBVOL=/btrfs/swapvol SWAPFILE=$SUBVOL/swapfile SZMB=8192 mkfs.btrfs -f /dev/vdb mount /dev/vdb /btrfs btrfs subvol create $SUBVOL chattr +C $SUBVOL dd if=/dev/zero of=$SWAPFILE bs=1M count=$SZMB sync echo 4 > /proc/sys/vm/drop_caches echo 4194304 > /sys/class/bdi/btrfs-2/read_ahead_kb while true; do echo 1 > /proc/sys/vm/drop_caches echo 1 > /proc/sys/vm/drop_caches dd of=/dev/zero if=$SWAPFILE bs=4096M count=2 iflag=fullblock done Fixes: 24e6c8082208 ("btrfs: simplify main loop in submit_extent_page") CC: stable@vger.kernel.org # 6.4+ Reviewed-by: Sweet Tea Dorminy Reviewed-by: Christoph Hellwig Reviewed-by: Qu Wenruo Signed-off-by: Chris Mason Signed-off-by: David Sterba commit b471965fdb2daa225850e5972d86600992fa398e Author: Anand Jain Date: Fri Jul 28 14:48:13 2023 +0800 btrfs: fix replace/scrub failure with metadata_uuid Fstests with POST_MKFS_CMD="btrfstune -m" (as in the mailing list) reported a few of the test cases failing. The failure scenario can be summarized and simplified as follows: $ mkfs.btrfs -fq -draid1 -mraid1 /dev/sdb1 /dev/sdb2 :0 $ btrfstune -m /dev/sdb1 :0 $ wipefs -a /dev/sdb1 :0 $ mount -o degraded /dev/sdb2 /btrfs :0 $ btrfs replace start -B -f -r 1 /dev/sdb1 /btrfs :1 STDERR: ERROR: ioctl(DEV_REPLACE_START) failed on "/btrfs": Input/output error [11290.583502] BTRFS warning (device sdb2): tree block 22036480 mirror 2 has bad fsid, has 99835c32-49f0-4668-9e66-dc277a96b4a6 want da40350c-33ac-4872-92a8-4948ed8c04d0 [11290.586580] BTRFS error (device sdb2): unable to fix up (regular) error at logical 22020096 on dev /dev/sdb8 physical 1048576 As above, the replace is failing because we are verifying the header with fs_devices::fsid instead of fs_devices::metadata_uuid, despite the metadata_uuid actually being present. To fix this, use fs_devices::metadata_uuid. We copy fsid into fs_devices::metadata_uuid if there is no metadata_uuid, so its fine. Fixes: a3ddbaebc7c9 ("btrfs: scrub: introduce a helper to verify one metadata block") CC: stable@vger.kernel.org # 6.4+ Signed-off-by: Anand Jain Signed-off-by: David Sterba commit 6e8d96909a23c8078ee965bd48bb31cbef2de943 Author: Arnd Bergmann Date: Fri Aug 11 22:36:58 2023 +0200 asm-generic: partially revert "Unify uapi bitsperlong.h for arm64, riscv and loongarch" Unifying the asm-generic headers across 32-bit and 64-bit architectures based on the compiler provided macros was a good idea and appears to work with all user space, but it caused a regression when building old kernels on systems that have the new headers installed in /usr/include, as this combination trips an inconsistency in the kernel's own tools/include headers that are a mix of userspace and kernel-internal headers. This affects kernel builds on arm64, riscv64 and loongarch64 systems that might end up using the "#define __BITS_PER_LONG 32" default from the old tools headers. Backporting the commit into stable kernels would address this, but it would still break building kernels without that backport, and waste time for developers trying to understand the problem. arm64 build machines are rather common, and on riscv64 this can also happen in practice, but loongarch64 is probably new enough to not be used much for building old kernels, so only revert the bits for arm64 and riscv. Link: https://lore.kernel.org/all/20230731160402.GB1823389@dev-arch.thelio-3990X/ Reported-by: Nathan Chancellor Fixes: 8386f58f8deda ("asm-generic: Unify uapi bitsperlong.h for arm64, riscv and loongarch") Acked-by: Catalin Marinas Acked-by: Palmer Dabbelt Tested-by: Nathan Chancellor Signed-off-by: Arnd Bergmann commit 3c78dbf251350fdf3a9dab3b9c3391fb89df208d Merge: 17fd01a243b4a 6d4cc57630a86 Author: Arnd Bergmann Date: Thu Aug 17 14:39:38 2023 +0200 Merge tag 'qcom-arm64-fixes-for-6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm ARM64 fixes for v6.5 This corrects the invalid path specifier for L3 interconnects in the CPU nodes of SM8150 and SM8250. It corrects the compatible of the SC8180X L3 node, to pass the binding check. The crypto core, and its DMA controller, is disabled on SM8350 to avoid the system from crashing at boot while the issue is diagnosed. A thermal zone node name conflict is resolved for PM8150L, on the RB5 board. The UFS vccq voltage is corrected on the SA877P Ride platform, to address observed stability issues. The reg-names of the DSI phy on SC7180 are restored after an accidental search-and-replace update. * tag 'qcom-arm64-fixes-for-6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: sc7180: Fix DSI0_PHY reg-names arm64: dts: qcom: sa8775p-ride: Update L4C parameters arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict arm64: dts: qcom: sm8350: fix BAM DMA crash and reboot arm64: dts: qcom: sc8180x: Fix OSM L3 compatible arm64: dts: qcom: sm8250: Fix EPSS L3 interconnect cells arm64: dts: qcom: sm8150: Fix OSM L3 interconnect cells Link: https://lore.kernel.org/r/20230815142042.2459048-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 17fd01a243b4a45239e0e325ff18dd46b33a7661 Merge: e7c12167a2948 7aff940ec8865 Author: Arnd Bergmann Date: Thu Aug 17 14:18:57 2023 +0200 Merge tag 'omap-for-v6.5/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Fixes for omaps A fix external abort on non-linefetch for am335x that is fixed with a flush of posted write. And two networking fixes for beaglebone mostly for revision c3 to do phy reset with a gpio and to fix a boot time warning. * tag 'omap-for-v6.5/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: am335x-bone-common: Add vcc-supply for on-board eeprom ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board bus: ti-sysc: Flush posted write on enable before reset Link: https://lore.kernel.org/r/pull-1692158536-457318@atomide.com Signed-off-by: Arnd Bergmann commit e7c12167a2948f4b638785e236a29e76208f8e83 Merge: 6e6d847a8ce18 ebceec271e552 Author: Arnd Bergmann Date: Thu Aug 17 14:16:45 2023 +0200 Merge tag 'v6.5-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Correct wifi interrupt flags for some boards, fixed wifi on Rock PI4, disabled hs400 speeds for some boards having problems with data intergrity and some dt property/styling fixes. * tag 'v6.5-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boards arm64: dts: rockchip: minor whitespace cleanup around '=' arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+ arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4 arm64: dts: rockchip: add missing space before { on indiedroid nova arm64: dts: rockchip: correct wifi interrupt flag in Box Demo arm64: dts: rockchip: correct wifi interrupt flag in Rock Pi 4B arm64: dts: rockchip: correct wifi interrupt flag in eaidk-610 arm64: dts: rockchip: Drop invalid regulator-init-microvolt property Link: https://lore.kernel.org/r/4519945.8hzESeGDPO@phil Signed-off-by: Arnd Bergmann commit 3d521f9f3663ba7a22e56d339c6632f0ca787371 Author: Shenghao Ding Date: Thu Aug 17 17:32:56 2023 +0800 ASoC: tas2781: fixed register access error when switching to other chips fixed register access error when switching to other tas2781 -- refresh the page inside regmap on the switched tas2781 Signed-off-by: Shenghao Ding Link: https://lore.kernel.org/r/20230817093257.951-1-shenghao-ding@ti.com Signed-off-by: Mark Brown commit e8500a70270334b9abad72fea504ef38a2952274 Author: Simon Trimmer Date: Thu Aug 17 12:27:12 2023 +0100 ASoC: cs35l56: Add an ACPI match table An ACPI ID has been allocated for CS35L56 ASoC devices so that they can be instantiated from ACPI Device entries. Signed-off-by: Simon Trimmer Signed-off-by: Richard Fitzgerald Link: https://lore.kernel.org/r/20230817112712.16637-3-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 897a6b5a030e62c21566551c870d81740f82ca13 Author: Maciej Strozek Date: Thu Aug 17 12:27:11 2023 +0100 ASoC: cs35l56: Read firmware uuid from a device property instead of _SUB Use a device property "cirrus,firmware-uid" to get the unique firmware identifier instead of using ACPI _SUB. There aren't any products that use _SUB. There will not usually be a _SUB in Soundwire nodes. The ACPI can use a _DSD section for custom properties. There is also a need to support instantiating this driver using software nodes. This is for systems where the CS35L56 is a back-end device and the ACPI refers only to the front-end audio device - there will not be any ACPI references to CS35L56. Fixes: e49611252900 ("ASoC: cs35l56: Add driver for Cirrus Logic CS35L56") Signed-off-by: Maciej Strozek Signed-off-by: Richard Fitzgerald Link: https://lore.kernel.org/r/20230817112712.16637-2-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit 50b6f2c8297793f7f3315623db78dcff85158e96 Author: Jani Nikula Date: Tue Aug 15 13:19:07 2023 +0300 Revert "drm/edid: Fix csync detailed mode parsing" This reverts commit ca62297b2085b5b3168bd891ca24862242c635a1. Commit ca62297b2085 ("drm/edid: Fix csync detailed mode parsing") fixed EDID detailed mode sync parsing. Unfortunately, there are quite a few displays out there that have bogus (zero) sync field that are broken by the change. Zero means analog composite sync, which is not right for digital displays, and the modes get rejected. Regardless, it used to work, and it needs to continue to work. Revert the change. Rejecting modes with analog composite sync was the part that fixed the gitlab issue 8146 [1]. We'll need to get back to the drawing board with that. [1] https://gitlab.freedesktop.org/drm/intel/-/issues/8146 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8789 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8930 Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9044 Fixes: ca62297b2085 ("drm/edid: Fix csync detailed mode parsing") Cc: Ville Syrjälä Cc: dri-devel@lists.freedesktop.org Cc: # v6.4+ Signed-off-by: Jani Nikula Acked-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230815101907.2900768-1-jani.nikula@intel.com commit 54097309620ef0dc2d7083783dc521c6a5fef957 Author: Peter Zijlstra Date: Wed Aug 16 12:44:19 2023 +0200 x86/static_call: Fix __static_call_fixup() Christian reported spurious module load crashes after some of Song's module memory layout patches. Turns out that if the very last instruction on the very last page of the module is a 'JMP __x86_return_thunk' then __static_call_fixup() will trip a fault and die. And while the module rework made this slightly more likely to happen, it's always been possible. Fixes: ee88d363d156 ("x86,static_call: Use alternative RET encoding") Reported-by: Christian Bricart Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://lkml.kernel.org/r/20230816104419.GA982867@hirez.programming.kicks-ass.net commit 23d775f12dcd23d052a4927195f15e970e27ab26 Author: Alfred Lee Date: Mon Aug 14 17:13:23 2023 -0700 net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset If the switch is reset during active EEPROM transactions, as in just after an SoC reset after power up, the I2C bus transaction may be cut short leaving the EEPROM internal I2C state machine in the wrong state. When the switch is reset again, the bad state machine state may result in data being read from the wrong memory location causing the switch to enter unexpected mode rendering it inoperational. Fixes: a3dcb3e7e70c ("net: dsa: mv88e6xxx: Wait for EEPROM done after HW reset") Signed-off-by: Alfred Lee Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230815001323.24739-1-l00g33k@gmail.com Signed-off-by: Jakub Kicinski commit 4f3175979e62de3b929bfa54a0db4b87d36257a7 Author: Nathan Lynch Date: Thu Aug 10 22:37:55 2023 -0500 powerpc/rtas_flash: allow user copy to flash block cache objects With hardened usercopy enabled (CONFIG_HARDENED_USERCOPY=y), using the /proc/powerpc/rtas/firmware_update interface to prepare a system firmware update yields a BUG(): kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: CPU: 0 PID: 2232 Comm: dd Not tainted 6.5.0-rc3+ #2 Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.50 (SV860_146) hv:phyp pSeries NIP: c0000000005991d0 LR: c0000000005991cc CTR: 0000000000000000 REGS: c0000000148c76a0 TRAP: 0700 Not tainted (6.5.0-rc3+) MSR: 8000000000029033 CR: 24002242 XER: 0000000c CFAR: c0000000001fbd34 IRQMASK: 0 [ ... GPRs omitted ... ] NIP usercopy_abort+0xa0/0xb0 LR usercopy_abort+0x9c/0xb0 Call Trace: usercopy_abort+0x9c/0xb0 (unreliable) __check_heap_object+0x1b4/0x1d0 __check_object_size+0x2d0/0x380 rtas_flash_write+0xe4/0x250 proc_reg_write+0xfc/0x160 vfs_write+0xfc/0x4e0 ksys_write+0x90/0x160 system_call_exception+0x178/0x320 system_call_common+0x160/0x2c4 The blocks of the firmware image are copied directly from user memory to objects allocated from flash_block_cache, so flash_block_cache must be created using kmem_cache_create_usercopy() to mark it safe for user access. Fixes: 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0") Signed-off-by: Nathan Lynch Reviewed-by: Kees Cook [mpe: Trim and indent oops] Signed-off-by: Michael Ellerman Link: https://msgid.link/20230810-rtas-flash-vs-hardened-usercopy-v2-1-dcf63793a938@linux.ibm.com commit dbf46008775516f7f25c95b7760041c286299783 Author: Peter Zijlstra Date: Wed Aug 16 13:59:21 2023 +0200 objtool/x86: Fixup frame-pointer vs rethunk For stack-validation of a frame-pointer build, objtool validates that every CALL instruction is preceded by a frame-setup. The new SRSO return thunks violate this with their RSB stuffing trickery. Extend the __fentry__ exception to also cover the embedded_insn case used for this. This cures: vmlinux.o: warning: objtool: srso_untrain_ret+0xd: call without frame pointer save/setup Fixes: 4ae68b26c3ab ("objtool/x86: Fix SRSO mess") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov (AMD) Acked-by: Josh Poimboeuf Link: https://lore.kernel.org/r/20230816115921.GH980931@hirez.programming.kicks-ass.net commit 1b254b791d7b7dea6e8adc887fbbd51746d8bb27 Author: Karol Herbst Date: Mon Aug 14 16:49:32 2023 +0200 drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create We can't simply free the connector after calling drm_connector_init on it. We need to clean up the drm side first. It might not fix all regressions from commit 2b5d1c29f6c4 ("drm/nouveau/disp: PIOR DP uses GPIO for HPD, not PMGR AUX interrupts"), but at least it fixes a memory corruption in error handling related to that commit. Link: https://lore.kernel.org/lkml/20230806213107.GFZNARG6moWpFuSJ9W@fat_crate.local/ Fixes: 95983aea8003 ("drm/nouveau/disp: add connector class") Signed-off-by: Karol Herbst Reviewed-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20230814144933.3956959-1-kherbst@redhat.com commit 0fd23db0cc74cf6d28d26ce5e7802e982608d830 Author: Shay Drory Date: Sun Jun 25 10:43:03 2023 +0300 net/mlx5: Fix mlx5_cmd_update_root_ft() error flow The cited patch change mlx5_cmd_update_root_ft() to work with multiple peer devices. However, it didn't align the error flow as well. Hence, Fix the error code to work with multiple peer devices. Fixes: 222dd185833e ("{net/RDMA}/mlx5: introduce lag_for_each_peer") Signed-off-by: Shay Drory Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 34a79876d9f77e971115236bcf7b5d14a8ecf542 Author: Dragos Tatulea Date: Tue Aug 1 20:41:03 2023 +0300 net/mlx5e: XDP, Fix fifo overrun on XDP_REDIRECT Before this fix, running high rate traffic through XDP_REDIRECT with multibuf could overrun the fifo used to release the xdp frames after tx completion. This resulted in corrupted data being consumed on the free side. The culplirt was a miscalculation of the fifo size: the maximum ratio between fifo entries / data segments was incorrect. This ratio serves to calculate the max fifo size for a full sq where each packet uses the worst case number of entries in the fifo. This patch fixes the formula and names the constant. It also makes sure that future values will use a power of 2 number of entries for the fifo mask to work. Signed-off-by: Dragos Tatulea Fixes: 3f734b8c594b ("net/mlx5e: XDP, Use multiple single-entry objects in xdpi_fifo") Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit c4d6b5438116c184027b2e911c0f2c7c406fb47c Author: Sven Schnelle Date: Wed Aug 16 17:49:28 2023 +0200 tracing/synthetic: Allocate one additional element for size While debugging another issue I noticed that the stack trace contains one invalid entry at the end: -0 [008] d..4. 26.484201: wake_lat: pid=0 delta=2629976084 000000009cc24024 stack=STACK: => __schedule+0xac6/0x1a98 => schedule+0x126/0x2c0 => schedule_timeout+0x150/0x2c0 => kcompactd+0x9ca/0xc20 => kthread+0x2f6/0x3d8 => __ret_from_fork+0x8a/0xe8 => 0x6b6b6b6b6b6b6b6b This is because the code failed to add the one element containing the number of entries to field_size. Link: https://lkml.kernel.org/r/20230816154928.4171614-4-svens@linux.ibm.com Cc: Masami Hiramatsu Fixes: 00cf3d672a9d ("tracing: Allow synthetic events to pass around stacktraces") Signed-off-by: Sven Schnelle Signed-off-by: Steven Rostedt (Google) commit 887f92e09ef34a949745ad26ce82be69e2dabcf6 Author: Sven Schnelle Date: Wed Aug 16 17:49:27 2023 +0200 tracing/synthetic: Skip first entry for stack traces While debugging another issue I noticed that the stack trace output contains the number of entries on top: -0 [000] d..4. 203.322502: wake_lat: pid=0 delta=2268270616 stack=STACK: => 0x10 => __schedule+0xac6/0x1a98 => schedule+0x126/0x2c0 => schedule_timeout+0x242/0x2c0 => __wait_for_common+0x434/0x680 => __wait_rcu_gp+0x198/0x3e0 => synchronize_rcu+0x112/0x138 => ring_buffer_reset_online_cpus+0x140/0x2e0 => tracing_reset_online_cpus+0x15c/0x1d0 => tracing_set_clock+0x180/0x1d8 => hist_register_trigger+0x486/0x670 => event_hist_trigger_parse+0x494/0x1318 => trigger_process_regex+0x1d4/0x258 => event_trigger_write+0xb4/0x170 => vfs_write+0x210/0xad0 => ksys_write+0x122/0x208 Fix this by skipping the first element. Also replace the pointer logic with an index variable which is easier to read. Link: https://lkml.kernel.org/r/20230816154928.4171614-3-svens@linux.ibm.com Cc: Masami Hiramatsu Fixes: 00cf3d672a9d ("tracing: Allow synthetic events to pass around stacktraces") Signed-off-by: Sven Schnelle Signed-off-by: Steven Rostedt (Google) commit ddeea494a16f32522bce16ee65f191d05d4b8282 Author: Sven Schnelle Date: Wed Aug 16 17:49:26 2023 +0200 tracing/synthetic: Use union instead of casts The current code uses a lot of casts to access the fields member in struct synth_trace_events with different sizes. This makes the code hard to read, and had already introduced an endianness bug. Use a union and struct instead. Link: https://lkml.kernel.org/r/20230816154928.4171614-2-svens@linux.ibm.com Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Fixes: 00cf3d672a9dd ("tracing: Allow synthetic events to pass around stacktraces") Signed-off-by: Sven Schnelle Signed-off-by: Steven Rostedt (Google) commit 9dbd23e42ff0b10c9b02c9e649c76e5228241a8e Author: Borislav Petkov (AMD) Date: Mon Aug 14 21:29:50 2023 +0200 x86/srso: Explain the untraining sequences a bit more The goal is to eventually have a proper documentation about all this. Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230814164447.GFZNpZ/64H4lENIe94@fat_crate.local commit 864bcaa38ee44ec6c0e43f79c2d2997b977e26b2 Author: Peter Zijlstra Date: Mon Aug 14 13:44:35 2023 +0200 x86/cpu/kvm: Provide UNTRAIN_RET_VM Similar to how it doesn't make sense to have UNTRAIN_RET have two untrain calls, it also doesn't make sense for VMEXIT to have an extra IBPB call. This cures VMEXIT doing potentially unret+IBPB or double IBPB. Also, the (SEV) VMEXIT case seems to have been overlooked. Redefine the meaning of the synthetic IBPB flags to: - ENTRY_IBPB -- issue IBPB on entry (was: entry + VMEXIT) - IBPB_ON_VMEXIT -- issue IBPB on VMEXIT And have 'retbleed=ibpb' set *BOTH* feature flags to ensure it retains the previous behaviour and issues IBPB on entry+VMEXIT. The new 'srso=ibpb_vmexit' option only sets IBPB_ON_VMEXIT. Create UNTRAIN_RET_VM specifically for the VMEXIT case, and have that check IBPB_ON_VMEXIT. All this avoids having the VMEXIT case having to check both ENTRY_IBPB and IBPB_ON_VMEXIT and simplifies the alternatives. Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230814121149.109557833@infradead.org commit e7c25c441e9e0fa75b4c83e0b26306b702cfe90d Author: Peter Zijlstra Date: Mon Aug 14 13:44:34 2023 +0200 x86/cpu: Cleanup the untrain mess Since there can only be one active return_thunk, there only needs be one (matching) untrain_ret. It fundamentally doesn't make sense to allow multiple untrain_ret at the same time. Fold all the 3 different untrain methods into a single (temporary) helper stub. Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230814121149.042774962@infradead.org commit 42be649dd1f2eee6b1fb185f1a231b9494cf095f Author: Peter Zijlstra Date: Mon Aug 14 13:44:33 2023 +0200 x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 For a more consistent namespace. [ bp: Fixup names in the doc too. ] Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230814121148.976236447@infradead.org commit d025b7bac07a6e90b6b98b487f88854ad9247c39 Author: Peter Zijlstra Date: Mon Aug 14 13:44:32 2023 +0200 x86/cpu: Rename original retbleed methods Rename the original retbleed return thunk and untrain_ret to retbleed_return_thunk() and retbleed_untrain_ret(). No functional changes. Suggested-by: Josh Poimboeuf Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230814121148.909378169@infradead.org commit d43490d0ab824023e11d0b57d0aeec17a6e0ca13 Author: Peter Zijlstra Date: Mon Aug 14 13:44:31 2023 +0200 x86/cpu: Clean up SRSO return thunk mess Use the existing configurable return thunk. There is absolute no justification for having created this __x86_return_thunk alternative. To clarify, the whole thing looks like: Zen3/4 does: srso_alias_untrain_ret: nop2 lfence jmp srso_alias_return_thunk int3 srso_alias_safe_ret: // aliasses srso_alias_untrain_ret just so add $8, %rsp ret int3 srso_alias_return_thunk: call srso_alias_safe_ret ud2 While Zen1/2 does: srso_untrain_ret: movabs $foo, %rax lfence call srso_safe_ret (jmp srso_return_thunk ?) int3 srso_safe_ret: // embedded in movabs instruction add $8,%rsp ret int3 srso_return_thunk: call srso_safe_ret ud2 While retbleed does: zen_untrain_ret: test $0xcc, %bl lfence jmp zen_return_thunk int3 zen_return_thunk: // embedded in the test instruction ret int3 Where Zen1/2 flush the BTB entry using the instruction decoder trick (test,movabs) Zen3/4 use BTB aliasing. SRSO adds a return sequence (srso_safe_ret()) which forces the function return instruction to speculate into a trap (UD2). This RET will then mispredict and execution will continue at the return site read from the top of the stack. Pick one of three options at boot (evey function can only ever return once). [ bp: Fixup commit message uarch details and add them in a comment in the code too. Add a comment about the srso_select_mitigation() dependency on retbleed_select_mitigation(). Add moar ifdeffery for 32-bit builds. Add a dummy srso_untrain_ret_alias() definition for 32-bit alternatives needing the symbol. ] Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230814121148.842775684@infradead.org commit 6ecc10295abb2fdd9c21dd17b34e4cacfd829cd4 Author: Alex Deucher Date: Tue Aug 15 17:25:37 2023 -0400 Revert "Revert "drm/amdgpu/display: change pipe policy for DCN 2.0"" This reverts commit 27dd79c00aeab36cd7542c7a4481a32549038659. It appears MPC_SPLIT_DYNAMIC still causes problems with multiple displays on DCN2.0 hardware. Switch back to MPC_SPLIT_AVOID_MULT_DISP. This increases power usage with multiple displays, but avoids hangs. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2475 Cc: Rodrigo Siqueira Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.4.x commit a7b7d9e8aee4f71b4c7151702fd74237b8cef989 Author: Mario Limonciello Date: Thu May 18 11:52:51 2023 -0500 drm/amd: flush any delayed gfxoff on suspend entry DCN 3.1.4 is reported to hang on s2idle entry if graphics activity is happening during entry. This is because GFXOFF was scheduled as delayed but RLC gets disabled in s2idle entry sequence which will hang GFX IP if not already in GFXOFF. To help this problem, flush any delayed work for GFXOFF early in s2idle entry sequence to ensure that it's off when RLC is changed. commit 4b31b92b143f ("drm/amdgpu: complete gfxoff allow signal during suspend without delay") modified power gating flow so that if called in s0ix that it ensured that GFXOFF wasn't put in work queue but instead processed immediately. This is dead code due to commit 10cb67eb8a1b ("drm/amdgpu: skip CG/PG for gfx during S0ix") because GFXOFF will now not be explicitly called as part of the suspend entry code. Remove that dead code. Signed-off-by: Mario Limonciello Signed-off-by: Tim Huang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit f1740b1ab2703b2a057da7cf33b03297e0381aa0 Author: Tim Huang Date: Mon Aug 14 15:13:04 2023 +0800 drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix GFX v11.0.1 reported fence fallback timer expired issue on SDMA and GFX rings after S0ix resume. This is generated by EOP interrupts are disabled when S0ix suspend but fails to re-enable when resume because of the GFX is in GFXOFF. [ 203.349571] [drm] Fence fallback timer expired on ring sdma0 [ 203.349572] [drm] Fence fallback timer expired on ring gfx_0.0.0 [ 203.861635] [drm] Fence fallback timer expired on ring gfx_0.0.0 For S0ix, GFX is in GFXOFF state, avoid to touch the GFX registers to configure the fence driver interrupts for rings that belong to GFX. The interrupts configuration will be restored by GFXOFF exit. Signed-off-by: Tim Huang Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit b25fdc048cb2250c7e859184f54d3261b55ad099 Author: James Zhu Date: Wed Aug 9 16:45:04 2023 -0400 drm/amdgpu: skip xcp drm device allocation when out of drm resource Return 0 when drm device alloc failed with -ENOSPC in order to allow amdgpu drive loading. But the xcp without drm device node assigned won't be visiable in user space. This helps amdgpu driver loading on system which has more than 64 nodes, the current limitation. The proposal to add more drm nodes is discussed in public, which will support up to 2^20 nodes totally. kernel drm: https://lore.kernel.org/lkml/20230724211428.3831636-1-michal.winiarski@intel.com/T/ libdrm: https://gitlab.freedesktop.org/mesa/drm/-/merge_requests/305 Signed-off-by: James Zhu Acked-by: Christian König Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit d621114ffba56b032e91ee82d6469b2f9f0b2427 Author: Asad Kamal Date: Thu Aug 10 20:44:54 2023 +0800 drm/amd/pm: Update pci link width for smu v13.0.6 Update addresses of PCIE link width registers, & link width format used to populate gpu metrics table for smu v13.0.6 v2: Removed ESM register update v3: Updated patch subject and message Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 8d036427f0042a91136e6f19a39542eedec4e96c Author: Lijo Lazar Date: Thu Aug 10 16:10:03 2023 +0530 drm/amd/pm: Fix temperature unit of SMU v13.0.6 Temperature needs to be reported in millidegree Celsius. Signed-off-by: Lijo Lazar Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 6a92761a86817ad15c9a562e2a809386237fae3e Author: Umio Yasuno Date: Tue Aug 8 06:40:42 2023 +0000 drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7 Use the right metrics table version based on the firmware. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2720 Reviewed-by: Evan Quan Signed-off-by: Umio Yasuno Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 0d6f374c0c66e8ecc2897f0837d2cb4bd169bb42 Author: Jiadong Zhu Date: Tue Aug 8 10:59:25 2023 +0800 drm/amdgpu: disable mcbp if parameter zero is set The parameter amdgpu_mcbp shall have priority against the default value calculated from the chip version. User could disable mcbp by setting the parameter mcbp as zero. v2: do not trigger preemption in sw ring muxer when mcbp is disabled. Signed-off-by: Jiadong Zhu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 5450be6befc63670f2c05aa6773a8e437b39a3fe Author: Zheng Yejian Date: Sat Aug 5 11:38:16 2023 +0800 selftests/ftrace: Add a basic testcase for snapshot This testcase is constrived to reproduce a problem that the cpu buffers become unavailable which is due to 'record_disabled' of array_buffer and max_buffer being messed up. Local test result after bugfix: # ./ftracetest test.d/00basic/snapshot1.tc === Ftrace unit tests === [1] Snapshot and tracing_cpumask [PASS] [2] (instance) Snapshot and tracing_cpumask [PASS] # of passed: 2 # of failed: 0 # of unresolved: 0 # of untested: 0 # of unsupported: 0 # of xfailed: 0 # of undefined(test bug): 0 Link: https://lkml.kernel.org/r/20230805033816.3284594-3-zhengyejian1@huawei.com Cc: Cc: Cc: Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit b71645d6af10196c46cbe3732de2ea7d36b3ff6d Author: Zheng Yejian Date: Sat Aug 5 11:38:15 2023 +0800 tracing: Fix cpu buffers unavailable due to 'record_disabled' missed Trace ring buffer can no longer record anything after executing following commands at the shell prompt: # cd /sys/kernel/tracing # cat tracing_cpumask fff # echo 0 > tracing_cpumask # echo 1 > snapshot # echo fff > tracing_cpumask # echo 1 > tracing_on # echo "hello world" > trace_marker -bash: echo: write error: Bad file descriptor The root cause is that: 1. After `echo 0 > tracing_cpumask`, 'record_disabled' of cpu buffers in 'tr->array_buffer.buffer' became 1 (see tracing_set_cpumask()); 2. After `echo 1 > snapshot`, 'tr->array_buffer.buffer' is swapped with 'tr->max_buffer.buffer', then the 'record_disabled' became 0 (see update_max_tr()); 3. After `echo fff > tracing_cpumask`, the 'record_disabled' become -1; Then array_buffer and max_buffer are both unavailable due to value of 'record_disabled' is not 0. To fix it, enable or disable both array_buffer and max_buffer at the same time in tracing_set_cpumask(). Link: https://lkml.kernel.org/r/20230805033816.3284594-2-zhengyejian1@huawei.com Cc: Cc: Cc: Fixes: 71babb2705e2 ("tracing: change CPU ring buffer state from tracing_cpumask") Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit b6360a5ec31d160d58c1a64387b323b556cedca8 Author: Kenneth Feng Date: Wed Aug 9 18:06:05 2023 +0800 drm/amd/pm: disallow the fan setting if there is no fan on smu 13.0.0 drm/amd/pm: disallow the fan setting if there is no fan on smu 13.0.0 V2: depend on pm.no_fan to check Signed-off-by: Kenneth Feng Reviewed-by: Alex Deucher Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 2f2beb8874cb0844e84ad26e990f05f4f13ff63f Author: Andrii Staikov Date: Wed Aug 2 09:47:32 2023 +0200 i40e: fix misleading debug logs Change "write" into the actual "read" word. Change parameters description. Fixes: 7073f46e443e ("i40e: Add AQ commands for NVM Update for X722") Signed-off-by: Aleksandr Loktionov Signed-off-by: Andrii Staikov Signed-off-by: Tony Nguyen commit 751969e5b1196821ef78f0aa664a8a97c92c9057 Author: Piotr Gardocki Date: Mon Aug 7 16:46:04 2023 +0200 iavf: fix FDIR rule fields masks validation Return an error if a field's mask is neither full nor empty. When a mask is only partial the field is not being used for rule programming but it gives a wrong impression it is used. Fix by returning an error on any partial mask to make it clear they are not supported. The ip_ver assignment is moved earlier in code to allow using it in iavf_validate_fdir_fltr_masks. Fixes: 527691bf0682 ("iavf: Support IPv4 Flow Director filters") Fixes: e90cbc257a6f ("iavf: Support IPv6 Flow Director filters") Signed-off-by: Piotr Gardocki Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit ca09f772cccaeec4cd05a21528c37a260aa2dd2c Author: Mingzheng Xing Date: Thu Aug 10 00:56:48 2023 +0800 riscv: Handle zicsr/zifencei issue between gcc and binutils Binutils-2.38 and GCC-12.1.0 bumped[0][1] the default ISA spec to the newer 20191213 version which moves some instructions from the I extension to the Zicsr and Zifencei extensions. So if one of the binutils and GCC exceeds that version, we should explicitly specifying Zicsr and Zifencei via -march to cope with the new changes. but this only occurs when binutils >= 2.36 and GCC >= 11.1.0. It's a different story when binutils < 2.36. binutils-2.36 supports the Zifencei extension[2] and splits Zifencei and Zicsr from I[3]. GCC-11.1.0 is particular[4] because it add support Zicsr and Zifencei extension for -march. binutils-2.35 does not support the Zifencei extension, and does not need to specify Zicsr and Zifencei when working with GCC >= 12.1.0. To make our lives easier, let's relax the check to binutils >= 2.36 in CONFIG_TOOLCHAIN_NEEDS_EXPLICIT_ZICSR_ZIFENCEI. For the other two cases, where clang < 17 or GCC < 11.1.0, we will deal with them in CONFIG_TOOLCHAIN_NEEDS_OLD_ISA_SPEC. For more information, please refer to: commit 6df2a016c0c8 ("riscv: fix build with binutils 2.38") commit e89c2e815e76 ("riscv: Handle zicsr/zifencei issues between clang and binutils") Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=aed44286efa8ae8717a77d94b51ac3614e2ca6dc [0] Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=98416dbb0a62579d4a7a4a76bab51b5b52fec2cd [1] Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=5a1b31e1e1cee6e9f1c92abff59cdcfff0dddf30 [2] Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=729a53530e86972d1143553a415db34e6e01d5d2 [3] Link: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=b03be74bad08c382da47e048007a78fa3fb4ef49 [4] Link: https://lore.kernel.org/all/20230308220842.1231003-1-conor@kernel.org Link: https://lore.kernel.org/all/20230223220546.52879-1-conor@kernel.org Reviewed-by: Conor Dooley Acked-by: Guo Ren Cc: Signed-off-by: Mingzheng Xing Link: https://lore.kernel.org/r/20230809165648.21071-1-xingmingzheng@iscas.ac.cn Signed-off-by: Palmer Dabbelt commit 4b05b993900dd3eba0fc83ef5c5ddc7d65d786c6 Author: Alexandre Ghiti Date: Fri Aug 11 17:06:04 2023 +0200 riscv: uaccess: Return the number of bytes effectively not copied It was reported that the riscv kernel hangs while executing the test in [1]. Indeed, the test hangs when trying to write a buffer to a file. The problem is that the riscv implementation of raw_copy_from_user() does not return the correct number of bytes not written when an exception happens and is fixed up, instead it always returns the initial size to copy, even if some bytes were actually copied. generic_perform_write() pre-faults the user pages and bails out if nothing can be written, otherwise it will access the userspace buffer: here the riscv implementation keeps returning it was not able to copy any byte though the pre-faulting indicates otherwise. So generic_perform_write() keeps retrying to access the user memory and ends up in an infinite loop. Note that before the commit mentioned in [1] that introduced this regression, it worked because generic_perform_write() would bail out if only one byte could not be written. So fix this by returning the number of bytes effectively not written in __asm_copy_[to|from]_user() and __clear_user(), as it is expected. Link: https://lore.kernel.org/linux-riscv/20230309151841.bomov6hq3ybyp42a@debian/ [1] Fixes: ebcbd75e3962 ("riscv: Fix the bug in memory access fixup code") Reported-by: Bo YU Closes: https://lore.kernel.org/linux-riscv/20230309151841.bomov6hq3ybyp42a@debian/#t Reported-by: Aurelien Jarno Closes: https://lore.kernel.org/linux-riscv/ZNOnCakhwIeue3yr@aurel32.net/ Signed-off-by: Alexandre Ghiti Reviewed-by: Björn Töpel Tested-by: Aurelien Jarno Reviewed-by: Aurelien Jarno Link: https://lore.kernel.org/r/20230811150604.1621784-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt commit ebc9cb03b21e263db607a7604134a195aa314ebb Author: Guo Ren Date: Sat Jul 15 20:15:06 2023 -0400 riscv: stack: Fixup independent softirq stack for CONFIG_FRAME_POINTER=n The independent softirq stack uses s0 to save & restore sp, but s0 would be corrupted when CONFIG_FRAME_POINTER=n. So add s0 in the clobber list to fix the problem. Fixes: dd69d07a5a6c ("riscv: stack: Support HAVE_SOFTIRQ_ON_OWN_STACK") Cc: stable@vger.kernel.org Reported-by: Zhangjin Wu Signed-off-by: Guo Ren Signed-off-by: Guo Ren Tested-by: Drew Fustini Link: https://lore.kernel.org/r/20230716001506.3506041-3-guoren@kernel.org Signed-off-by: Palmer Dabbelt commit 8d0be64154cf24660a947b84340e8d5bb1af855a Author: Guo Ren Date: Sat Jul 15 20:15:05 2023 -0400 riscv: stack: Fixup independent irq stack for CONFIG_FRAME_POINTER=n The independent irq stack uses s0 to save & restore sp, but s0 would be corrupted when CONFIG_FRAME_POINTER=n. So add s0 in the clobber list to fix the problem. Fixes: 163e76cc6ef4 ("riscv: stack: Support HAVE_IRQ_EXIT_ON_IRQ_STACK") Cc: stable@vger.kernel.org Reported-by: Zhangjin Wu Signed-off-by: Guo Ren Signed-off-by: Guo Ren Tested-by: Drew Fustini Link: https://lore.kernel.org/r/20230716001506.3506041-2-guoren@kernel.org Signed-off-by: Palmer Dabbelt commit 79bc3f85c51fc352f8e684ba6b626f677a3aa230 Author: Nam Cao Date: Mon Jul 31 20:39:25 2023 +0200 riscv: correct riscv_insn_is_c_jr() and riscv_insn_is_c_jalr() The instructions c.jr and c.jalr must have rs1 != 0, but riscv_insn_is_c_jr() and riscv_insn_is_c_jalr() do not check for this. So, riscv_insn_is_c_jr() can match a reserved encoding, while riscv_insn_is_c_jalr() can match the c.ebreak instruction. Rewrite them with check for rs1 != 0. Signed-off-by: Nam Cao Reviewed-by: Charlie Jenkins Fixes: ec5f90877516 ("RISC-V: Move riscv_insn_is_* macros into a common header") Link: https://lore.kernel.org/r/20230731183925.152145-1-namcaov@gmail.com Signed-off-by: Palmer Dabbelt commit 52449c17bdd1540940e21511612b58acebc49c06 Author: Celeste Liu Date: Tue Aug 1 22:15:16 2023 +0800 riscv: entry: set a0 = -ENOSYS only when syscall != -1 When we test seccomp with 6.4 kernel, we found errno has wrong value. If we deny NETLINK_AUDIT with EAFNOSUPPORT, after f0bddf50586d, we will get ENOSYS instead. We got same result with commit 9c2598d43510 ("riscv: entry: Save a0 prior syscall_enter_from_user_mode()"). After analysing code, we think that regs->a0 = -ENOSYS should only be executed when syscall != -1. In __seccomp_filter, when seccomp rejected this syscall with specified errno, they will set a0 to return number as syscall ABI, and then return -1. This return number is finally pass as return number of syscall_enter_from_user_mode, and then is compared with NR_syscalls after converted to ulong (so it will be ULONG_MAX). The condition syscall < NR_syscalls will always be false, so regs->a0 = -ENOSYS is always executed. It covered a0 set by seccomp, so we always get ENOSYS when match seccomp RET_ERRNO rule. Fixes: f0bddf50586d ("riscv: entry: Convert to generic entry") Reported-by: Felix Yan Co-developed-by: Ruizhe Pan Signed-off-by: Ruizhe Pan Co-developed-by: Shiqi Zhang Signed-off-by: Shiqi Zhang Signed-off-by: Celeste Liu Tested-by: Felix Yan Tested-by: Emil Renner Berthing Reviewed-by: Björn Töpel Reviewed-by: Guo Ren Link: https://lore.kernel.org/r/20230801141607.435192-1-CoelacanthusHex@gmail.com Signed-off-by: Palmer Dabbelt commit 2d218b45848b92b03b220bf4d9bef29f058f866f Author: Chao Song Date: Wed Aug 16 16:33:11 2023 +0300 ASoC: SOF: ipc4-pcm: fix possible null pointer deference The call to snd_sof_find_spcm_dai() could return NULL, add nullable check for the return value to avoid null pointer defenrece. Fixes: 7cb19007baba ("ASoC: SOF: ipc4-pcm: add hw_params") Signed-off-by: Chao Song Reviewed-by: Bard Liao Reviewed-by: Pierre-Louis Bossart Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230816133311.7523-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 46cdff2369cbdf8d78081a22526e77bd1323f563 Author: Kailang Yang Date: Tue Aug 15 15:54:23 2023 +0800 ALSA: hda/realtek - Remodified 3k pull low procedure Set spec->en_3kpull_low default to true. Then fillback ALC236 and ALC257 to false. Additional note: this addresses a regression caused by the previous fix 69ea4c9d02b7 ("ALSA: hda/realtek - remove 3k pull low procedure"). The previous workaround was applied too widely without necessity, which resulted in the pop noise at PM again. This patch corrects the condition and restores the old behavior for the devices that don't suffer from the original problem. Fixes: 69ea4c9d02b7 ("ALSA: hda/realtek - remove 3k pull low procedure") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217732 Link: https://lore.kernel.org/r/01e212a538fc407ca6edd10b81ff7b05@realtek.com Signed-off-by: Kailang Yang Signed-off-by: Takashi Iwai commit 3386fb86ecdef0d39ee3306aea8ec290e61b934f Author: Bartosz Golaszewski Date: Fri Aug 11 21:30:34 2023 +0200 gpiolib: fix reference leaks when removing GPIO chips still in use After we remove a GPIO chip that still has some requested descriptors, gpiod_free_commit() will fail and we will never put the references to the GPIO device and the owning module in gpiod_free(). Rework this function to: - not warn on desc == NULL as this is a use-case on which most free functions silently return - put the references to desc->gdev and desc->gdev->owner unconditionally so that the release callback actually gets called when the remaining references are dropped by external GPIO users Signed-off-by: Bartosz Golaszewski Reviewed-by: Linus Walleij commit 20d9b3b5f2749673e1b5e9c8b0846ff6deff4032 Author: Andy Shevchenko Date: Mon Aug 14 14:26:15 2023 +0300 gpiolib: sysfs: Do unexport GPIO when user asks for it It seems that sysfs interface implicitly relied on the gpiod_free() to unexport the line. This is logically incorrect as core gpiolib should not deal with sysfs so instead of restoring it, let's call gpiod_unexport() from sysfs code. Fixes: b0ce9ce408b6 ("gpiolib: Do not unexport GPIO on freeing") Reported-by: Marek Behún Closes: https://lore.kernel.org/r/20230808102828.4a9eac09@dellmb Signed-off-by: Andy Shevchenko Tested-by: Marek Behún [Bartosz: tweaked the commit message] Signed-off-by: Bartosz Golaszewski commit de4c5efeeca7172306bdc2e3efc0c6c3953bb338 Merge: b35c968363c03 23185c6aed1ff Author: David S. Miller Date: Wed Aug 16 11:11:24 2023 +0100 Merge tag 'nf-23-08-16' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florisn Westphal says: ==================== These are netfilter fixes for the *net* tree. First patch resolves a false-positive lockdep splat: rcu_dereference is used outside of rcu read lock. Let lockdep validate that the transaction mutex is locked. Second patch fixes a kdoc warning added in previous PR. Third patch fixes a memory leak: The catchall element isn't disabled correctly, this allows userspace to deactivate the element again. This results in refcount underflow which in turn prevents memory release. This was always broken since the feature was added in 5.13. Patch 4 fixes an incorrect change in the previous pull request: Adding a duplicate key to a set should work if the duplicate key has expired, restore this behaviour. All from myself. Patch #5 resolves an old historic artifact in sctp conntrack: a 300ms timeout for shutdown_ack. Increase this to 3s. From Xin Long. Patch #6 fixes a sysctl data race in ipvs, two threads can clobber the sysctl value, from Sishuai Gong. This is a day-0 bug that predates git history. Patches 7, 8 and 9, from Pablo Neira Ayuso, are also followups for the previous GC rework in nf_tables: The netlink notifier and the netns exit path must both increment the gc worker seqcount, else worker may encounter stale (free'd) pointers. ================ Signed-off-by: David S. Miller commit b35c968363c036e93f95cb233182f2d1c44605c2 Author: Prasad Pandit Date: Wed Aug 16 13:26:06 2023 +0530 ipv6: fix indentation of a config attribute Fix indentation of a type attribute of IPV6_VTI config entry. Signed-off-by: Prasad Pandit Signed-off-by: David S. Miller commit 0b70f1950e79b37df5617c83ed1ad1a4cc7fc89c Author: Simon Horman Date: Tue Aug 15 17:27:49 2023 +0200 mailmap: add entries for Simon Horman Retire some of my email addresses from Kernel activities. Signed-off-by: Simon Horman Signed-off-by: David S. Miller commit 5fc43ce03bc3e50d16a94ec31fba3318ff1cbcd0 Merge: 9944d203fa637 f3ec2b5d879ef Author: David S. Miller Date: Wed Aug 16 08:57:41 2023 +0100 Merge tag 'ipsec-2023-08-15' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== 1) Fix a slab-out-of-bounds read in xfrm_address_filter. From Lin Ma. 2) Fix the pfkey sadb_x_filter validation. From Lin Ma. 3) Use the correct nla_policy structure for XFRMA_SEC_CTX. From Lin Ma. 4) Fix warnings triggerable by bad packets in the encap functions. From Herbert Xu. 5) Fix some slab-use-after-free in decode_session6. From Zhengchao Shao. 6) Fix a possible NULL piointer dereference in xfrm_update_ae_params. Lin Ma. 7) Add a forgotten nla_policy for XFRMA_MTIMER_THRESH. From Lin Ma. 8) Don't leak offloaded policies. From Leon Romanovsky. 9) Delete also the offloading part of an acquire state. From Leon Romanovsky. Please pull or let me know if there are problems. commit 095b8303f3835c68ac4a8b6d754ca1c3b6230711 Author: Peter Zijlstra Date: Mon Aug 14 13:44:30 2023 +0200 x86/alternative: Make custom return thunk unconditional There is infrastructure to rewrite return thunks to point to any random thunk one desires, unwrap that from CALL_THUNKS, which up to now was the sole user of that. [ bp: Make the thunks visible on 32-bit and add ifdeffery for the 32-bit builds. ] Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230814121148.775293785@infradead.org commit 4ae68b26c3ab5a82aa271e6e9fc9b1a06e1d6b40 Author: Peter Zijlstra Date: Mon Aug 14 13:44:29 2023 +0200 objtool/x86: Fix SRSO mess Objtool --rethunk does two things: - it collects all (tail) call's of __x86_return_thunk and places them into .return_sites. These are typically compiler generated, but RET also emits this same. - it fudges the validation of the __x86_return_thunk symbol; because this symbol is inside another instruction, it can't actually find the instruction pointed to by the symbol offset and gets upset. Because these two things pertained to the same symbol, there was no pressing need to separate these two separate things. However, alas, along comes SRSO and more crazy things to deal with appeared. The SRSO patch itself added the following symbol names to identify as rethunk: 'srso_untrain_ret', 'srso_safe_ret' and '__ret' Where '__ret' is the old retbleed return thunk, 'srso_safe_ret' is a new similarly embedded return thunk, and 'srso_untrain_ret' is completely unrelated to anything the above does (and was only included because of that INT3 vs UD2 issue fixed previous). Clear things up by adding a second category for the embedded instruction thing. Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230814121148.704502245@infradead.org commit af023ef335f13c8b579298fc432daeef609a9e60 Author: Peter Zijlstra Date: Mon Aug 14 13:44:28 2023 +0200 x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() vmlinux.o: warning: objtool: srso_untrain_ret() falls through to next function __x86_return_skl() vmlinux.o: warning: objtool: __x86_return_thunk() falls through to next function __x86_return_skl() This is because these functions (can) end with CALL, which objtool does not consider a terminating instruction. Therefore, replace the INT3 instruction (which is a non-fatal trap) with UD2 (which is a fatal-trap). This indicates execution will not continue past this point. Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230814121148.637802730@infradead.org commit 77f67119004296a9b2503b377d610e08b08afc2a Author: Peter Zijlstra Date: Mon Aug 14 13:44:27 2023 +0200 x86/cpu: Fix __x86_return_thunk symbol type Commit fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation") reimplemented __x86_return_thunk with a mix of SYM_FUNC_START and SYM_CODE_END, this is not a sane combination. Since nothing should ever actually 'CALL' this, make it consistently CODE. Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation") Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230814121148.571027074@infradead.org commit 9944d203fa63721b87eee84a89f7275dc3d25c05 Author: Artem Chernyshev Date: Tue Aug 15 00:00:30 2023 +0300 broadcom: b44: Use b44_writephy() return value Return result of b44_writephy() instead of zero to deal with possible error. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Artem Chernyshev Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller commit 270d73e6507f9c7fff43844d74f86365df000b36 Author: Scott Mayhew Date: Wed Aug 16 00:23:56 2023 -0500 smb: client: fix null auth Commit abdb1742a312 removed code that clears ctx->username when sec=none, so attempting to mount with '-o sec=none' now fails with -EACCES. Fix it by adding that logic to the parsing of the 'sec' option, as well as checking if the mount is using null auth before setting the username when parsing the 'user' option. Fixes: abdb1742a312 ("cifs: get rid of mount options string parsing") Cc: stable@vger.kernel.org Signed-off-by: Scott Mayhew Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit a552bfa16bab4ce901ee721346a28c4e483f4066 Author: Jakub Kicinski Date: Mon Aug 14 13:38:40 2023 -0700 net: openvswitch: reject negative ifindex Recent changes in net-next (commit 759ab1edb56c ("net: store netdevs in an xarray")) refactored the handling of pre-assigned ifindexes and let syzbot surface a latent problem in ovs. ovs does not validate ifindex, making it possible to create netdev ports with negative ifindex values. It's easy to repro with YNL: $ ./cli.py --spec netlink/specs/ovs_datapath.yaml \ --do new \ --json '{"upcall-pid": 1, "name":"my-dp"}' $ ./cli.py --spec netlink/specs/ovs_vport.yaml \ --do new \ --json '{"upcall-pid": "00000001", "name": "some-port0", "dp-ifindex":3,"ifindex":4294901760,"type":2}' $ ip link show -65536: some-port0: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether 7a:48:21:ad:0b:fb brd ff:ff:ff:ff:ff:ff ... Validate the inputs. Now the second command correctly returns: $ ./cli.py --spec netlink/specs/ovs_vport.yaml \ --do new \ --json '{"upcall-pid": "00000001", "name": "some-port0", "dp-ifindex":3,"ifindex":4294901760,"type":2}' lib.ynl.NlError: Netlink error: Numerical result out of range nl_len = 108 (92) nl_flags = 0x300 nl_type = 2 error: -34 extack: {'msg': 'integer out of range', 'unknown': [[type:4 len:36] b'\x0c\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x03\x00\xff\xff\xff\x7f\x00\x00\x00\x00\x08\x00\x01\x00\x08\x00\x00\x00'], 'bad-attr': '.ifindex'} Accept 0 since it used to be silently ignored. Fixes: 54c4ef34c4b6 ("openvswitch: allow specifying ifindex of new interfaces") Reported-by: syzbot+7456b5dcf65111553320@syzkaller.appspotmail.com Reviewed-by: Leon Romanovsky Reviewed-by: Aaron Conole Link: https://lore.kernel.org/r/20230814203840.2908710-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit dafcbce07136d799edc4c67f04f9fd69ff1eac1f Author: Ziyang Xuan Date: Mon Aug 14 11:23:01 2023 +0800 team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves Similar to commit 01f4fd270870 ("bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves"), we can trigger BUG_ON(!vlan_info) in unregister_vlan_dev() with the following testcase: # ip netns add ns1 # ip netns exec ns1 ip link add team1 type team # ip netns exec ns1 ip link add team_slave type veth peer veth2 # ip netns exec ns1 ip link set team_slave master team1 # ip netns exec ns1 ip link add link team_slave name team_slave.10 type vlan id 10 protocol 802.1ad # ip netns exec ns1 ip link add link team1 name team1.10 type vlan id 10 protocol 802.1ad # ip netns exec ns1 ip link set team_slave nomaster # ip netns del ns1 Add S-VLAN tag related features support to team driver. So the team driver will always propagate the VLAN info to its slaves. Fixes: 8ad227ff89a7 ("net: vlan: add 802.1ad support") Suggested-by: Ido Schimmel Signed-off-by: Ziyang Xuan Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230814032301.2804971-1-william.xuanziyang@huawei.com Signed-off-by: Jakub Kicinski commit 096516d092d54604d590827d05b1022c8f326639 Author: Justin Chen Date: Sat Aug 12 21:41:47 2023 -0700 net: phy: broadcom: stub c45 read/write for 54810 The 54810 does not support c45. The mmd_phy_indirect accesses return arbirtary values leading to odd behavior like saying it supports EEE when it doesn't. We also see that reading/writing these non-existent MMD registers leads to phy instability in some cases. Fixes: b14995ac2527 ("net: phy: broadcom: Add BCM54810 PHY entry") Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/1691901708-28650-1-git-send-email-justin.chen@broadcom.com Signed-off-by: Jakub Kicinski commit 23185c6aed1ffb8fc44087880ba2767aba493779 Author: Pablo Neira Ayuso Date: Tue Aug 15 15:39:02 2023 +0200 netfilter: nft_dynset: disallow object maps Do not allow to insert elements from datapath to objects maps. Fixes: 8aeff920dcc9 ("netfilter: nf_tables: add stateful object reference to set elements") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 02c6c24402bf1c1e986899c14ba22a10b510916b Author: Pablo Neira Ayuso Date: Tue Aug 15 15:39:01 2023 +0200 netfilter: nf_tables: GC transaction race with netns dismantle Use maybe_get_net() since GC workqueue might race with netns exit path. Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 6a33d8b73dfac0a41f3877894b38082bd0c9a5bc Author: Pablo Neira Ayuso Date: Tue Aug 15 15:39:00 2023 +0200 netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path Netlink event path is missing a synchronization point with GC transactions. Add GC sequence number update to netns release path and netlink event path, any GC transaction losing race will be discarded. Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 5310760af1d4fbea1452bfc77db5f9a680f7ae47 Author: Sishuai Gong Date: Thu Aug 10 15:12:42 2023 -0400 ipvs: fix racy memcpy in proc_do_sync_threshold When two threads run proc_do_sync_threshold() in parallel, data races could happen between the two memcpy(): Thread-1 Thread-2 memcpy(val, valp, sizeof(val)); memcpy(valp, val, sizeof(val)); This race might mess up the (struct ctl_table *) table->data, so we add a mutex lock to serialize them. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Link: https://lore.kernel.org/netdev/B6988E90-0A1E-4B85-BF26-2DAF6D482433@gmail.com/ Signed-off-by: Sishuai Gong Acked-by: Simon Horman Acked-by: Julian Anastasov Signed-off-by: Florian Westphal commit 9bfab6d23a2865966a4f89a96536fbf23f83bc8c Author: Xin Long Date: Tue Aug 15 14:08:47 2023 -0400 netfilter: set default timeout to 3 secs for sctp shutdown send and recv state In SCTP protocol, it is using the same timer (T2 timer) for SHUTDOWN and SHUTDOWN_ACK retransmission. However in sctp conntrack the default timeout value for SCTP_CONNTRACK_SHUTDOWN_ACK_SENT state is 3 secs while it's 300 msecs for SCTP_CONNTRACK_SHUTDOWN_SEND/RECV state. As Paolo Valerio noticed, this might cause unwanted expiration of the ct entry. In my test, with 1s tc netem delay set on the NAT path, after the SHUTDOWN is sent, the sctp ct entry enters SCTP_CONNTRACK_SHUTDOWN_SEND state. However, due to 300ms (too short) delay, when the SHUTDOWN_ACK is sent back from the peer, the sctp ct entry has expired and been deleted, and then the SHUTDOWN_ACK has to be dropped. Also, it is confusing these two sysctl options always show 0 due to all timeout values using sec as unit: net.netfilter.nf_conntrack_sctp_timeout_shutdown_recd = 0 net.netfilter.nf_conntrack_sctp_timeout_shutdown_sent = 0 This patch fixes it by also using 3 secs for sctp shutdown send and recv state in sctp conntrack, which is also RTO.initial value in SCTP protocol. Note that the very short time value for SCTP_CONNTRACK_SHUTDOWN_SEND/RECV was probably used for a rare scenario where SHUTDOWN is sent on 1st path but SHUTDOWN_ACK is replied on 2nd path, then a new connection started immediately on 1st path. So this patch also moves from SHUTDOWN_SEND/RECV to CLOSE when receiving INIT in the ORIGINAL direction. Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") Reported-by: Paolo Valerio Signed-off-by: Xin Long Reviewed-by: Simon Horman Signed-off-by: Florian Westphal commit 7845914f45f066497ac75b30c50dbc735e84e884 Author: Florian Westphal Date: Sat Aug 12 20:03:57 2023 +0200 netfilter: nf_tables: don't fail inserts if duplicate has expired nftables selftests fail: run-tests.sh testcases/sets/0044interval_overlap_0 Expected: 0-2 . 0-3, got: W: [FAILED] ./testcases/sets/0044interval_overlap_0: got 1 Insertion must ignore duplicate but expired entries. Moreover, there is a strange asymmetry in nft_pipapo_activate: It refetches the current element, whereas the other ->activate callbacks (bitmap, hash, rhash, rbtree) use elem->priv. Same for .remove: other set implementations take elem->priv, nft_pipapo_remove fetches elem->priv, then does a relookup, remove this. I suspect this was the reason for the change that prompted the removal of the expired check in pipapo_get() in the first place, but skipping exired elements there makes no sense to me, this helper is used for normal get requests, insertions (duplicate check) and deactivate callback. In first two cases expired elements must be skipped. For ->deactivate(), this gets called for DELSETELEM, so it seems to me that expired elements should be skipped as well, i.e. delete request should fail with -ENOENT error. Fixes: 24138933b97b ("netfilter: nf_tables: don't skip expired elements during walk") Signed-off-by: Florian Westphal commit 90e5b3462efa37b8bba82d7c4e63683856e188af Author: Florian Westphal Date: Sat Aug 12 13:05:16 2023 +0200 netfilter: nf_tables: deactivate catchall elements in next generation When flushing, individual set elements are disabled in the next generation via the ->flush callback. Catchall elements are not disabled. This is incorrect and may lead to double-deactivations of catchall elements which then results in memory leaks: WARNING: CPU: 1 PID: 3300 at include/net/netfilter/nf_tables.h:1172 nft_map_deactivate+0x549/0x730 CPU: 1 PID: 3300 Comm: nft Not tainted 6.5.0-rc5+ #60 RIP: 0010:nft_map_deactivate+0x549/0x730 [..] ? nft_map_deactivate+0x549/0x730 nf_tables_delset+0xb66/0xeb0 (the warn is due to nft_use_dec() detecting underflow). Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support") Reported-by: lonial con Signed-off-by: Florian Westphal commit 08713cb006b6f07434f276c5ee214fb20c7fd965 Author: Florian Westphal Date: Thu Aug 10 23:59:03 2023 +0200 netfilter: nf_tables: fix kdoc warnings after gc rework Jakub Kicinski says: We've got some new kdoc warnings here: net/netfilter/nft_set_pipapo.c:1557: warning: Function parameter or member '_set' not described in 'pipapo_gc' net/netfilter/nft_set_pipapo.c:1557: warning: Excess function parameter 'set' description in 'pipapo_gc' include/net/netfilter/nf_tables.h:577: warning: Function parameter or member 'dead' not described in 'nft_set' Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane") Fixes: f6c383b8c31a ("netfilter: nf_tables: adapt set backend to use GC transaction API") Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netdev/20230810104638.746e46f1@kernel.org/ Signed-off-by: Florian Westphal commit b9f052dc68f69dac89fe1e24693354c033daa091 Author: Florian Westphal Date: Tue Aug 8 20:40:17 2023 +0200 netfilter: nf_tables: fix false-positive lockdep splat ->abort invocation may cause splat on debug kernels: WARNING: suspicious RCU usage net/netfilter/nft_set_pipapo.c:1697 suspicious rcu_dereference_check() usage! [..] rcu_scheduler_active = 2, debug_locks = 1 1 lock held by nft/133554: [..] (nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid [..] lockdep_rcu_suspicious+0x1ad/0x260 nft_pipapo_abort+0x145/0x180 __nf_tables_abort+0x5359/0x63d0 nf_tables_abort+0x24/0x40 nfnetlink_rcv+0x1a0a/0x22c0 netlink_unicast+0x73c/0x900 netlink_sendmsg+0x7f0/0xc20 ____sys_sendmsg+0x48d/0x760 Transaction mutex is held, so parallel updates are not possible. Switch to _protected and check mutex is held for lockdep enabled builds. Fixes: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol") Signed-off-by: Florian Westphal commit 0650d5098f8b6b232cd5ea0e15437fc38f7d63ba Author: Zhu Wang Date: Thu Aug 3 15:10:06 2023 +0800 fbdev: goldfishfb: Do not check 0 for platform_get_irq() Since platform_get_irq() never returned zero, so it need not to check whether it returned zero, and we use the return error code of platform_get_irq() to replace the current return error code. Please refer to the commit a85a6c86c25b ("driver core: platform: Clarify that IRQ 0 is invalid") to get that platform_get_irq() never returned zero. Signed-off-by: Zhu Wang Signed-off-by: Helge Deller commit 73d7f28b08319d33fb1e9939f89d7b1ab29c9672 Author: Ruan Jinjie Date: Fri Aug 11 15:28:10 2023 +0800 fbdev: atmel_lcdfb: Remove redundant of_match_ptr() The driver depends on CONFIG_OF, it is not necessary to use of_match_ptr() here. Signed-off-by: Ruan Jinjie Signed-off-by: Helge Deller commit 082f613127832c6e57ad21fa76500bc08427f04a Author: Yue Haibing Date: Mon Aug 14 22:05:10 2023 +0800 fbdev: kyro: Remove unused declarations These declarations is never implemented since the beginning of git history. Signed-off-by: Yue Haibing Signed-off-by: Helge Deller commit 4853c74bd7ab7fdb83f319bd9ace8a08c031e9b6 Merge: 2d7b8c6b90e40 7a894c8737477 Author: Linus Torvalds Date: Tue Aug 15 20:28:04 2023 +0000 Merge tag 'parisc-for-6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fix from Helge Deller: "Fix the parisc TLB ptlock checks so that they can be enabled together with the lightweight spinlock checks" * tag 'parisc-for-6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Fix CONFIG_TLB_PTLOCK to work with lightweight spinlock checks commit 2d7b8c6b90e4054a35eb59cd6d7c66e903e8ae4b Merge: d4f8e13b0614d 7b38f6ddc97bf Author: Linus Torvalds Date: Tue Aug 15 20:00:40 2023 +0000 Merge tag '6.5-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: "Three smb client fixes, all for stable: - fix for oops in unmount race with lease break of deferred close - debugging improvement for reconnect - fix for fscache deadlock (folio_wait_bit_common hang)" * tag '6.5-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb3: display network namespace in debug information cifs: Release folio lock on fscache read hit. cifs: fix potential oops in cifs_oplock_break commit d4f8e13b0614dc237deefb4e270d6d0f060bed70 Merge: 91aa6c412d7f8 7cdf55462c553 Author: Linus Torvalds Date: Tue Aug 15 19:34:12 2023 +0000 Merge tag 'regulator-fix-v6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "Two small driver specific fixes: one incorrect definition for one of the Qualcomm regulators and better handling of poorly formed DTs in the DA9063 driver" * tag 'regulator-fix-v6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: qcom-rpmh: Fix LDO 12 regulator for PM8550 regulator: da9063: better fix null deref with partial DT commit e4dd0d3a2f64b8bd8029ec70f52bdbebd0644408 Author: Jason Xing Date: Fri Aug 11 10:37:47 2023 +0800 net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled In the real workload, I encountered an issue which could cause the RTO timer to retransmit the skb per 1ms with linear option enabled. The amount of lost-retransmitted skbs can go up to 1000+ instantly. The root cause is that if the icsk_rto happens to be zero in the 6th round (which is the TCP_THIN_LINEAR_RETRIES value), then it will always be zero due to the changed calculation method in tcp_retransmit_timer() as follows: icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX); Above line could be converted to icsk->icsk_rto = min(0 << 1, TCP_RTO_MAX) = 0 Therefore, the timer expires so quickly without any doubt. I read through the RFC 6298 and found that the RTO value can be rounded up to a certain value, in Linux, say TCP_RTO_MIN as default, which is regarded as the lower bound in this patch as suggested by Eric. Fixes: 36e31b0af587 ("net: TCP thin linear timeouts") Suggested-by: Eric Dumazet Signed-off-by: Jason Xing Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit 220c8f67133010c37a3240ba179f7f1fa2425cc7 Merge: 7c761166399be 37aba3190891d Author: Takashi Iwai Date: Tue Aug 15 20:46:13 2023 +0200 Merge tag 'asoc-fix-v6.5-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.5 A fairly large collection of fixes here, mostly SOF and Intel related. The one core fix is Hans' change which reduces the log spam when working out new use cases for DPCM. commit 0fc7769e54e747c8fd1b4899af2ac43cb68daa1c Author: Kevin-Lu Date: Tue Aug 15 17:56:31 2023 +0800 MAINTAINERS: Add entries for TEXAS INSTRUMENTS ASoC DRIVERS Add the MAINTAINERS entries for TEXAS INSTRUMENTS ASoC DRIVERS. Signed-off-by: Kevin-Lu Link: https://lore.kernel.org/r/20230815095631.1655-1-kevin-lu@ti.com Signed-off-by: Mark Brown commit 96d3c1cadedb6ae2e8965e19cd12caa244afbd9c Author: Dan Carpenter Date: Thu Aug 10 15:23:06 2023 +0300 accel/qaic: Clean up integer overflow checking in map_user_pages() The encode_dma() function has some validation on in_trans->size but it would be more clear to move those checks to find_and_map_user_pages(). The encode_dma() had two checks: if (in_trans->addr + in_trans->size < in_trans->addr || !in_trans->size) return -EINVAL; The in_trans->addr variable is the starting address. The in_trans->size variable is the total size of the transfer. The transfer can occur in parts and the resources->xferred_dma_size tracks how many bytes we have already transferred. This patch introduces a new variable "remaining" which represents the amount we want to transfer (in_trans->size) minus the amount we have already transferred (resources->xferred_dma_size). I have modified the check for if in_trans->size is zero to instead check if in_trans->size is less than resources->xferred_dma_size. If we have already transferred more bytes than in_trans->size then there are negative bytes remaining which doesn't make sense. If there are zero bytes remaining to be copied, just return success. The check in encode_dma() checked that "addr + size" could not overflow and barring a driver bug that should work, but it's easier to check if we do this in parts. First check that "in_trans->addr + resources->xferred_dma_size" is safe. Then check that "xfer_start_addr + remaining" is safe. My final concern was that we are dealing with u64 values but on 32bit systems the kmalloc() function will truncate the sizes to 32 bits. So I calculated "total = in_trans->size + offset_in_page(xfer_start_addr);" and returned -EINVAL if it were >= SIZE_MAX. This will not affect 64bit systems. Fixes: 129776ac2e38 ("accel/qaic: Add control path") Signed-off-by: Dan Carpenter Reviewed-by: Jeffrey Hugo Reviewed-by: Carl Vanderlip Signed-off-by: Jeffrey Hugo Link: https://patchwork.freedesktop.org/patch/msgid/24d3348b-25ac-4c1b-b171-9dae7c43e4e0@moroto.mountain commit 2d956177b7c96e62fac762a3b7da4318cde27a73 Author: Pranjal Ramajor Asha Kanojiya Date: Wed Aug 2 08:59:37 2023 -0600 accel/qaic: Fix slicing memory leak The temporary buffer storing slicing configuration data from user is only freed on error. This is a memory leak. Free the buffer unconditionally. Fixes: ff13be830333 ("accel/qaic: Add datapath") Signed-off-by: Pranjal Ramajor Asha Kanojiya Reviewed-by: Carl Vanderlip Reviewed-by: Jeffrey Hugo Signed-off-by: Jeffrey Hugo Link: https://patchwork.freedesktop.org/patch/msgid/20230802145937.14827-1-quic_jhugo@quicinc.com commit 58abdd80b93b09023ca03007b608685c41e3a289 Author: Yangtao Li Date: Thu Jul 27 15:00:51 2023 +0800 mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove The order of function calls in sdhci_f_sdh30_remove is wrong, let's call sdhci_pltfm_unregister first. Cc: Uwe Kleine-König Fixes: 5def5c1c15bf ("mmc: sdhci-f-sdh30: Replace with sdhci_pltfm") Signed-off-by: Yangtao Li Reported-by: Uwe Kleine-König Acked-by: Uwe Kleine-König Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230727070051.17778-62-frank.li@vivo.com Signed-off-by: Ulf Hansson commit 609a1bcd7bebac90a1b443e9fed47fd48dac5799 Author: Randy Dunlap Date: Fri Aug 11 22:29:47 2023 -0700 wifi: iwlwifi: mvm: add dependency for PTP clock When the code to use the PTP HW clock was added, it didn't update the Kconfig entry for the PTP dependency, leading to build errors, so update the Kconfig entry to depend on PTP_1588_CLOCK_OPTIONAL. aarch64-linux-ld: drivers/net/wireless/intel/iwlwifi/mvm/ptp.o: in function `iwl_mvm_ptp_init': drivers/net/wireless/intel/iwlwifi/mvm/ptp.c:294: undefined reference to `ptp_clock_register' drivers/net/wireless/intel/iwlwifi/mvm/ptp.c:294:(.text+0xce8): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `ptp_clock_register' aarch64-linux-ld: drivers/net/wireless/intel/iwlwifi/mvm/ptp.c:301: undefined reference to `ptp_clock_index' drivers/net/wireless/intel/iwlwifi/mvm/ptp.c:301:(.text+0xd18): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `ptp_clock_index' aarch64-linux-ld: drivers/net/wireless/intel/iwlwifi/mvm/ptp.o: in function `iwl_mvm_ptp_remove': drivers/net/wireless/intel/iwlwifi/mvm/ptp.c:315: undefined reference to `ptp_clock_index' drivers/net/wireless/intel/iwlwifi/mvm/ptp.c:315:(.text+0xe80): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `ptp_clock_index' aarch64-linux-ld: drivers/net/wireless/intel/iwlwifi/mvm/ptp.c:319: undefined reference to `ptp_clock_unregister' drivers/net/wireless/intel/iwlwifi/mvm/ptp.c:319:(.text+0xeac): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `ptp_clock_unregister' Fixes: 1595ecce1cf3 ("wifi: iwlwifi: mvm: add support for PTP HW clock (PHC)") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Link: https://lore.kernel.org/all/202308110447.4QSJHmFH-lkp@intel.com/ Cc: Krishnanand Prabhu Cc: Luca Coelho Cc: Gregory Greenman Cc: Johannes Berg Cc: Kalle Valo Cc: linux-wireless@vger.kernel.org Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: netdev@vger.kernel.org Reviewed-by: Simon Horman Tested-by: Simon Horman # build-tested Acked-by: Richard Cochran Acked-by: Gregory Greenman Link: https://lore.kernel.org/r/20230812052947.22913-1-rdunlap@infradead.org Signed-off-by: Johannes Berg commit 91aa6c412d7f85e48aead7b00a7d9e91f5cf5863 Merge: 2ccdd1b13c591 f55484fd7be92 Author: Linus Torvalds Date: Tue Aug 15 06:03:44 2023 +0000 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "Just a bunch of bugfixes all over the place" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (26 commits) virtio-mem: check if the config changed before fake offlining memory virtio-mem: keep retrying on offline_and_remove_memory() errors in Sub Block Mode (SBM) virtio-mem: convert most offline_and_remove_memory() errors to -EBUSY virtio-mem: remove unsafe unplug in Big Block Mode (BBM) pds_vdpa: fix up debugfs feature bit printing pds_vdpa: alloc irq vectors on DRIVER_OK pds_vdpa: clean and reset vqs entries pds_vdpa: always allow offering VIRTIO_NET_F_MAC pds_vdpa: reset to vdpa specified mac virtio-net: Zero max_tx_vq field for VIRTIO_NET_CTRL_MQ_HASH_CONFIG case vdpa/mlx5: Fix crash on shutdown for when no ndev exists vdpa/mlx5: Delete control vq iotlb in destroy_mr only when necessary vdpa/mlx5: Fix mr->initialized semantics vdpa/mlx5: Correct default number of queues when MQ is on virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs() vduse: Use proper spinlock for IRQ injection vdpa: Enable strict validation for netlinks ops vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check vdpa: Add features attr to vdpa_nl_policy for nlattr length check ... commit 8a519a572598b7c0c07b02f69bf5b4e8dd4b2d7d Author: Liang Chen Date: Sat Aug 12 10:30:16 2023 +0800 net: veth: Page pool creation error handling for existing pools only The failure handling procedure destroys page pools for all queues, including those that haven't had their page pool created yet. this patch introduces necessary adjustments to prevent potential risks and inconsistency with the error handling behavior. Fixes: 0ebab78cbcbf ("net: veth: add page_pool for page recycling") Acked-by: Jesper Dangaard Brouer Signed-off-by: Liang Chen Link: https://lore.kernel.org/r/20230812023016.10553-1-liangchen.linux@gmail.com Signed-off-by: Jakub Kicinski commit f6f978fc4d006c9d3fa6df9f172d4660139fd3dd Merge: 6c461e394d11a 758c91078165a Author: Jakub Kicinski Date: Mon Aug 14 19:08:14 2023 -0700 Merge branch 'octeon_ep-fixes-for-error-and-remove-paths' Michal Schmidt says: ==================== octeon_ep: fixes for error and remove paths I have an Octeon card that's misconfigured in a way that exposes a couple of bugs in the octeon_ep driver's error paths. It can reproduce the issues that patches 1 & 4 are fixing. Patches 2 & 3 are a result of reviewing the nearby code. ==================== Link: https://lore.kernel.org/r/20230810150114.107765-1-mschmidt@redhat.com Signed-off-by: Jakub Kicinski commit 758c91078165ae641b698750a72eafe7968b3756 Author: Michal Schmidt Date: Thu Aug 10 17:01:14 2023 +0200 octeon_ep: cancel queued works in probe error path If it fails to get the devices's MAC address, octep_probe exits while leaving the delayed work intr_poll_task queued. When the work later runs, it's a use after free. Move the cancelation of intr_poll_task from octep_remove into octep_device_cleanup. This does not change anything in the octep_remove flow, but octep_device_cleanup is called also in the octep_probe error path, where the cancelation is needed. Note that the cancelation of ctrl_mbox_task has to follow intr_poll_task's, because the ctrl_mbox_task may be queued by intr_poll_task. Fixes: 24d4333233b3 ("octeon_ep: poll for control messages") Signed-off-by: Michal Schmidt Link: https://lore.kernel.org/r/20230810150114.107765-5-mschmidt@redhat.com Signed-off-by: Jakub Kicinski commit 607a7a45cdf38c1901e0d81e4e00a2a88786330a Author: Michal Schmidt Date: Thu Aug 10 17:01:13 2023 +0200 octeon_ep: cancel ctrl_mbox_task after intr_poll_task intr_poll_task may queue ctrl_mbox_task. The function octep_poll_non_ioq_interrupts_cn93_pf does this. When removing the driver and canceling these two works, cancel ctrl_mbox_task last to guarantee it does not run anymore. Fixes: 24d4333233b3 ("octeon_ep: poll for control messages") Signed-off-by: Michal Schmidt Link: https://lore.kernel.org/r/20230810150114.107765-4-mschmidt@redhat.com Signed-off-by: Jakub Kicinski commit 28458c80006bb4e993a09fc094094a8578cad292 Author: Michal Schmidt Date: Thu Aug 10 17:01:12 2023 +0200 octeon_ep: cancel tx_timeout_task later in remove sequence tx_timeout_task is canceled too early when removing the driver. Nothing prevents .ndo_tx_timeout from triggering and queuing the work again. Better cancel it after the netdev is unregistered. It's harmless for octep_tx_timeout_task to run in the window between the unregistration and cancelation, because it checks netif_running. Fixes: 862cd659a6fb ("octeon_ep: Add driver framework and device initialization") Signed-off-by: Michal Schmidt Link: https://lore.kernel.org/r/20230810150114.107765-3-mschmidt@redhat.com Signed-off-by: Jakub Kicinski commit 519b227904f0e70d4a1d6cf41daa5392715f2d2f Author: Michal Schmidt Date: Thu Aug 10 17:01:11 2023 +0200 octeon_ep: fix timeout value for waiting on mbox response The intention was to wait up to 500 ms for the mbox response. The third argument to wait_event_interruptible_timeout() is supposed to be the timeout duration. The driver mistakenly passed absolute time instead. Fixes: 577f0d1b1c5f ("octeon_ep: add separate mailbox command and response queues") Signed-off-by: Michal Schmidt Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230810150114.107765-2-mschmidt@redhat.com Signed-off-by: Jakub Kicinski commit 6c461e394d11a981c662cc16cebfb05b602e23ba Author: Radhey Shyam Pandey Date: Mon Aug 7 18:44:51 2023 +0530 net: macb: In ZynqMP resume always configure PS GTR for non-wakeup source On Zynq UltraScale+ MPSoC ubuntu platform when systemctl issues suspend, network manager bring down the interface and goes into suspend. When it wakes up it again enables the interface. This leads to xilinx-psgtr "PLL lock timeout" on interface bringup, as the power management controller power down the entire FPD (including SERDES) if none of the FPD devices are in use and serdes is not initialized on resume. $ sudo rtcwake -m no -s 120 -v $ sudo systemctl suspend $ ifconfig eth1 up xilinx-psgtr fd400000.phy: lane 0 (type 10, protocol 5): PLL lock timeout phy phy-fd400000.phy.0: phy poweron failed --> -110 macb driver is called in this way: 1. macb_close: Stop network interface. In this function, it reset MACB IP and disables PHY and network interface. 2. macb_suspend: It is called in kernel suspend flow. But because network interface has been disabled(netif_running(ndev) is false), it does nothing and returns directly; 3. System goes into suspend state. Some time later, system is waken up by RTC wakeup device; 4. macb_resume: It does nothing because network interface has been disabled; 5. macb_open: It is called to enable network interface again. ethernet interface is initialized in this API but serdes which is power-off by PMUFW during FPD-off suspend is not initialized again and so we hit GT PLL lock issue on open. To resolve this PLL timeout issue always do PS GTR initialization when ethernet device is configured as non-wakeup source. Fixes: f22bd29ba19a ("net: macb: Fix ZynqMP SGMII non-wakeup source resume failure") Fixes: 8b73fa3ae02b ("net: macb: Added ZynqMP-specific initialization") Signed-off-by: Radhey Shyam Pandey Link: https://lore.kernel.org/r/1691414091-2260697-1-git-send-email-radhey.shyam.pandey@amd.com Signed-off-by: Jakub Kicinski commit c96e2a695e00bca5487824d84b85aab6aa2c1891 Author: Jeff Layton Date: Mon Aug 14 13:36:54 2023 -0400 sunrpc: set the bv_offset of first bvec in svc_tcp_sendmsg svc_tcp_sendmsg used to factor in the xdr->page_base when sending pages, but commit 5df5dd03a8f7 ("sunrpc: Use sendmsg(MSG_SPLICE_PAGES) rather then sendpage") dropped that part of the handling. Fix it by setting the bv_offset of the first bvec. Fixes: 5df5dd03a8f7 ("sunrpc: Use sendmsg(MSG_SPLICE_PAGES) rather then sendpage") Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 4caf4cb1eaed469742ef719f2cc024b1ec3fa9e6 Author: Chengfeng Ye Date: Fri Jul 7 08:49:41 2023 +0000 i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue iproc_i2c_rd_reg() and iproc_i2c_wr_reg() are called from both interrupt context (e.g. bcm_iproc_i2c_isr) and process context (e.g. bcm_iproc_i2c_suspend). Therefore, interrupts should be disabled to avoid potential deadlock. To prevent this scenario, use spin_lock_irqsave(). Fixes: 9a1038728037 ("i2c: iproc: add NIC I2C support") Signed-off-by: Chengfeng Ye Acked-by: Ray Jui Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang commit 7d711966f94c189f38d9e2df05152a2336352ab8 Author: Uwe Kleine-König Date: Tue Jun 27 08:45:22 2023 +0200 i2c: Update documentation to use .probe() again Since commit 03c835f498b5 ("i2c: Switch .probe() to not take an id parameter") .probe() is the recommended callback to implement (again). Reflect this in the documentation and don't mention .probe_new() any more. Signed-off-by: Uwe Kleine-König Reviewed-by: Jean Delvare Reviewed-by: Javier Martinez Canillas Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang commit 423ffe62c06ae241ad460f4629dddb9dcf55e060 Author: Jani Nikula Date: Fri Aug 4 11:45:59 2023 +0300 drm/i915: fix display probe for IVB Q and IVB D GT2 server The current display probe is unable to differentiate between IVB Q and IVB D GT2 server, as they both have the same device id, but different subvendor and subdevice. This leads to the latter being misidentified as the former, and should just end up not having a display. However, the no display case returns a NULL as the display device info, and promptly oopses. As the IVB Q case is rare, and we're anyway moving towards GMD ID, handle the identification requiring subvendor and subdevice as a special case first, instead of unnecessarily growing the intel_display_ids[] array with subvendor and subdevice. [ 5.425298] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 5.426059] #PF: supervisor read access in kernel mode [ 5.426810] #PF: error_code(0x0000) - not-present page [ 5.427570] PGD 0 P4D 0 [ 5.428285] Oops: 0000 [#1] PREEMPT SMP PTI [ 5.429035] CPU: 0 PID: 137 Comm: (udev-worker) Not tainted 6.4.0-1-amd64 #1 Debian 6.4.4-1 [ 5.429759] Hardware name: HP HP Z220 SFF Workstation/HP Z220 SFF Workstation, BIOS 4.19-218-gb184e6e0a1 02/02/2023 [ 5.430485] RIP: 0010:intel_device_info_driver_create+0xf1/0x120 [i915] [ 5.431338] Code: 48 8b 97 80 1b 00 00 89 8f c0 1b 00 00 48 89 b7 b0 1b 00 00 48 89 97 b8 1b 00 00 0f b7 fd e8 76 e8 14 00 48 89 83 50 1b 00 00 <48> 8b 08 48 89 8b c4 1b 00 00 48 8b 48 08 48 89 8b cc 1b 00 00 8b [ 5.432920] RSP: 0018:ffffb8254044fb98 EFLAGS: 00010206 [ 5.433707] RAX: 0000000000000000 RBX: ffff923076e80000 RCX: 0000000000000000 [ 5.434494] RDX: 0000000000000260 RSI: 0000000100001000 RDI: 000000000000016a [ 5.435277] RBP: 000000000000016a R08: ffffb8254044fb00 R09: 0000000000000000 [ 5.436055] R10: ffff922d02761de8 R11: 00657361656c6572 R12: ffffffffc0e5d140 [ 5.436867] R13: ffff922d00b720d0 R14: 0000000076e80000 R15: ffff923078c0cae8 [ 5.437646] FS: 00007febd19a18c0(0000) GS:ffff92307c000000(0000) knlGS:0000000000000000 [ 5.438434] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5.439218] CR2: 0000000000000000 CR3: 000000010256e002 CR4: 00000000001706f0 [ 5.440009] Call Trace: [ 5.440824] [ 5.441611] ? __die+0x23/0x70 [ 5.442394] ? page_fault_oops+0x17d/0x4c0 [ 5.443173] ? exc_page_fault+0x7f/0x180 [ 5.443949] ? asm_exc_page_fault+0x26/0x30 [ 5.444756] ? intel_device_info_driver_create+0xf1/0x120 [i915] [ 5.445652] ? intel_device_info_driver_create+0xea/0x120 [i915] [ 5.446545] i915_driver_probe+0x7f/0xb60 [i915] [ 5.447431] ? drm_privacy_screen_get+0x15c/0x1a0 [drm] [ 5.448240] local_pci_probe+0x45/0xa0 [ 5.449013] pci_device_probe+0xc7/0x240 [ 5.449748] really_probe+0x19e/0x3e0 [ 5.450464] ? __pfx___driver_attach+0x10/0x10 [ 5.451172] __driver_probe_device+0x78/0x160 [ 5.451870] driver_probe_device+0x1f/0x90 [ 5.452601] __driver_attach+0xd2/0x1c0 [ 5.453293] bus_for_each_dev+0x88/0xd0 [ 5.453989] bus_add_driver+0x116/0x220 [ 5.454672] driver_register+0x59/0x100 [ 5.455336] i915_init+0x25/0xc0 [i915] [ 5.456104] ? __pfx_i915_init+0x10/0x10 [i915] [ 5.456882] do_one_initcall+0x5d/0x240 [ 5.457511] do_init_module+0x60/0x250 [ 5.458126] __do_sys_finit_module+0xac/0x120 [ 5.458721] do_syscall_64+0x60/0xc0 [ 5.459314] ? syscall_exit_to_user_mode+0x1b/0x40 [ 5.459897] ? do_syscall_64+0x6c/0xc0 [ 5.460510] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 5.461082] RIP: 0033:0x7febd20b0eb9 [ 5.461648] Code: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 2f 1f 0d 00 f7 d8 64 89 01 48 [ 5.462905] RSP: 002b:00007fffabb1ba78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 5.463554] RAX: ffffffffffffffda RBX: 0000561e6304f410 RCX: 00007febd20b0eb9 [ 5.464201] RDX: 0000000000000000 RSI: 00007febd2244f0d RDI: 0000000000000015 [ 5.464869] RBP: 00007febd2244f0d R08: 0000000000000000 R09: 000000000000000a [ 5.465512] R10: 0000000000000015 R11: 0000000000000246 R12: 0000000000020000 [ 5.466124] R13: 0000000000000000 R14: 0000561e63032b60 R15: 000000000000000a [ 5.466700] [ 5.467271] Modules linked in: i915(+) drm_buddy video crc32_pclmul sr_mod hid_generic wmi crc32c_intel i2c_algo_bit sd_mod cdrom drm_display_helper cec usbhid rc_core ghash_clmulni_intel hid sha512_ssse3 ttm sha512_generic xhci_pci ehci_pci xhci_hcd ehci_hcd nvme ahci drm_kms_helper nvme_core libahci t10_pi libata psmouse aesni_intel scsi_mod crypto_simd i2c_i801 scsi_common crc64_rocksoft_generic cryptd i2c_smbus drm lpc_ich crc64_rocksoft crc_t10dif e1000e usbcore crct10dif_generic usb_common crct10dif_pclmul crc64 crct10dif_common button [ 5.469750] CR2: 0000000000000000 [ 5.470364] ---[ end trace 0000000000000000 ]--- [ 5.470971] RIP: 0010:intel_device_info_driver_create+0xf1/0x120 [i915] [ 5.471699] Code: 48 8b 97 80 1b 00 00 89 8f c0 1b 00 00 48 89 b7 b0 1b 00 00 48 89 97 b8 1b 00 00 0f b7 fd e8 76 e8 14 00 48 89 83 50 1b 00 00 <48> 8b 08 48 89 8b c4 1b 00 00 48 8b 48 08 48 89 8b cc 1b 00 00 8b [ 5.473034] RSP: 0018:ffffb8254044fb98 EFLAGS: 00010206 [ 5.473698] RAX: 0000000000000000 RBX: ffff923076e80000 RCX: 0000000000000000 [ 5.474371] RDX: 0000000000000260 RSI: 0000000100001000 RDI: 000000000000016a [ 5.475045] RBP: 000000000000016a R08: ffffb8254044fb00 R09: 0000000000000000 [ 5.475725] R10: ffff922d02761de8 R11: 00657361656c6572 R12: ffffffffc0e5d140 [ 5.476405] R13: ffff922d00b720d0 R14: 0000000076e80000 R15: ffff923078c0cae8 [ 5.477124] FS: 00007febd19a18c0(0000) GS:ffff92307c000000(0000) knlGS:0000000000000000 [ 5.477811] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5.478499] CR2: 0000000000000000 CR3: 000000010256e002 CR4: 00000000001706f0 Fixes: 69d439818fe5 ("drm/i915/display: Make display responsible for probing its own IP") Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8991 Cc: Matt Roper Cc: Andrzej Hajda Reviewed-by: Luca Coelho Reviewed-by: Matt Roper Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20230804084600.1005818-1-jani.nikula@intel.com (cherry picked from commit 1435188307d128671f677eb908e165666dd83652) Signed-off-by: Rodrigo Vivi commit 2002eb6d3ea954dde9f8a223018d5335779937d0 Author: Jani Nikula Date: Thu Aug 3 15:27:06 2023 +0300 drm/i915/sdvo: fix panel_type initialization Commit 3f9ffce5765d ("drm/i915: Do panel VBT init early if the VBT declares an explicit panel type") started using -1 as the value for unset panel_type. It gets initialized in intel_panel_init_alloc(), but the SDVO code never calls it. Call intel_panel_init_alloc() to initialize the panel, including the panel_type. Reported-by: Tomi Leppänen Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8896 Fixes: 3f9ffce5765d ("drm/i915: Do panel VBT init early if the VBT declares an explicit panel type") Cc: Ville Syrjälä Cc: # v6.1+ Reviewed-by: Uma Shankar Tested-by: Tomi Leppänen Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20230803122706.838721-1-jani.nikula@intel.com (cherry picked from commit 26e60294e8eacedc8ebb33405b2c375fd80e0900) Signed-off-by: Rodrigo Vivi commit 5598c9bfdb81f40f2f5d769b342d25bff74b07a6 Author: Vinay Belgaumkar Date: Tue Jul 25 18:00:44 2023 -0700 drm/i915/guc/slpc: Restore efficient freq earlier This should be done before the soft min/max frequencies are restored. When we disable the "Ignore efficient frequency" flag, GuC does not actually bring the requested freq down to RPn. Specifically, this scenario- - ignore efficient freq set to true - reduce min to RPn (from efficient) - suspend - resume (includes GuC load, restore soft min/max, restore efficient freq) - validate min freq has been resored to RPn This will fail if we didn't first restore(disable, in this case) efficient freq flag before setting the soft min frequency. v2: Bring the min freq down to RPn when we disable efficient freq (Rodrigo) Also made the change to set the min softlimit to RPn at init. Otherwise, we were storing RPe there. Link: https://gitlab.freedesktop.org/drm/intel/-/issues/8736 Fixes: 55f9720dbf23 ("drm/i915/guc/slpc: Provide sysfs for efficient freq") Fixes: 95ccf312a1e4 ("drm/i915/guc/slpc: Allow SLPC to use efficient frequency") Signed-off-by: Vinay Belgaumkar Reviewed-by: Rodrigo Vivi Signed-off-by: John Harrison Link: https://patchwork.freedesktop.org/patch/msgid/20230726010044.3280402-1-vinay.belgaumkar@intel.com (cherry picked from commit 28e671114fb0f28f334fac8d0a6b9c395c7b0498) Signed-off-by: Rodrigo Vivi commit 0abbf0ac10eeede6e771a1a79342baf5e8466ee3 Author: Dan Carpenter Date: Tue Jun 27 10:12:36 2023 +0300 i2c: sun6i-p2wi: Fix an error message in probe() The "ret" variable is uninitialized. It was the "p2wi->rstc" variable that was intended. We can also use the %pe string format to print the error code name instead of just the number. Fixes: 75ff8a340a81 ("i2c: sun6i-p2wi: Use devm_clk_get_enabled()") Signed-off-by: Dan Carpenter Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang commit 9b378f6ad48cfa195ed868db9123c09ee7ec5ea2 Author: Filipe Manana Date: Sun Aug 13 12:34:08 2023 +0100 btrfs: fix infinite directory reads The readdir implementation currently processes always up to the last index it finds. This however can result in an infinite loop if the directory has a large number of entries such that they won't all fit in the given buffer passed to the readdir callback, that is, dir_emit() returns a non-zero value. Because in that case readdir() will be called again and if in the meanwhile new directory entries were added and we still can't put all the remaining entries in the buffer, we keep repeating this over and over. The following C program and test script reproduce the problem: $ cat /mnt/readdir_prog.c #include #include #include int main(int argc, char *argv[]) { DIR *dir = opendir("."); struct dirent *dd; while ((dd = readdir(dir))) { printf("%s\n", dd->d_name); rename(dd->d_name, "TEMPFILE"); rename("TEMPFILE", dd->d_name); } closedir(dir); } $ gcc -o /mnt/readdir_prog /mnt/readdir_prog.c $ cat test.sh #!/bin/bash DEV=/dev/sdi MNT=/mnt/sdi mkfs.btrfs -f $DEV &> /dev/null #mkfs.xfs -f $DEV &> /dev/null #mkfs.ext4 -F $DEV &> /dev/null mount $DEV $MNT mkdir $MNT/testdir for ((i = 1; i <= 2000; i++)); do echo -n > $MNT/testdir/file_$i done cd $MNT/testdir /mnt/readdir_prog cd /mnt umount $MNT This behaviour is surprising to applications and it's unlike ext4, xfs, tmpfs, vfat and other filesystems, which always finish. In this case where new entries were added due to renames, some file names may be reported more than once, but this varies according to each filesystem - for example ext4 never reported the same file more than once while xfs reports the first 13 file names twice. So change our readdir implementation to track the last index number when opendir() is called and then make readdir() never process beyond that index number. This gives the same behaviour as ext4. Reported-by: Rob Landley Link: https://lore.kernel.org/linux-btrfs/2c8c55ec-04c6-e0dc-9c5c-8c7924778c35@landley.net/ Link: https://bugzilla.kernel.org/show_bug.cgi?id=217681 CC: stable@vger.kernel.org # 6.4+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 7b38f6ddc97bf572c3422d3175e8678dd95502fa Author: Steve French Date: Thu Aug 10 21:41:03 2023 -0500 smb3: display network namespace in debug information We recently had problems where a network namespace was deleted causing hard to debug reconnect problems. To help deal with configuration issues like this it is useful to dump the network namespace to better debug what happened. So add this to information displayed in /proc/fs/cifs/DebugData for the server (and channels if mounted with multichannel). For example: Local Users To Server: 1 SecMode: 0x1 Req On Wire: 0 Net namespace: 4026531840 This can be easily compared with what is displayed for the processes on the system. For example /proc/1/ns/net in this case showed the same thing (see below), and we can see that the namespace is still valid in this example. 'net:[4026531840]' Cc: stable@vger.kernel.org Acked-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit fff67c1b17ee093947bdcbac6f64d072e644159a Author: Yicong Yang Date: Tue Aug 1 20:46:25 2023 +0800 i2c: hisi: Only handle the interrupt of the driver's transfer The controller may be shared with other port, for example the firmware. Handle the interrupt from other sources will cause crash since some data are not initialized. So only handle the interrupt of the driver's transfer and discard others. Fixes: d62fbdb99a85 ("i2c: add support for HiSilicon I2C controller") Signed-off-by: Yicong Yang Reviewed-by: Andi Shyti Link: https://lore.kernel.org/r/20230801124625.63587-1-yangyicong@huawei.com Signed-off-by: Wolfram Sang commit 69513dd669e243928f7450893190915a88f84a2b Author: Russell Harmon via samba-technical Date: Thu Aug 10 00:19:22 2023 -0700 cifs: Release folio lock on fscache read hit. Under the current code, when cifs_readpage_worker is called, the call contract is that the callee should unlock the page. This is documented in the read_folio section of Documentation/filesystems/vfs.rst as: > The filesystem should unlock the folio once the read has completed, > whether it was successful or not. Without this change, when fscache is in use and cache hit occurs during a read, the page lock is leaked, producing the following stack on subsequent reads (via mmap) to the page: $ cat /proc/3890/task/12864/stack [<0>] folio_wait_bit_common+0x124/0x350 [<0>] filemap_read_folio+0xad/0xf0 [<0>] filemap_fault+0x8b1/0xab0 [<0>] __do_fault+0x39/0x150 [<0>] do_fault+0x25c/0x3e0 [<0>] __handle_mm_fault+0x6ca/0xc70 [<0>] handle_mm_fault+0xe9/0x350 [<0>] do_user_addr_fault+0x225/0x6c0 [<0>] exc_page_fault+0x84/0x1b0 [<0>] asm_exc_page_fault+0x27/0x30 This requires a reboot to resolve; it is a deadlock. Note however that the call to cifs_readpage_from_fscache does mark the page clean, but does not free the folio lock. This happens in __cifs_readpage_from_fscache on success. Releasing the lock at that point however is not appropriate as cifs_readahead also calls cifs_readpage_from_fscache and *does* unconditionally release the lock after its return. This change therefore effectively makes cifs_readpage_worker work like cifs_readahead. Signed-off-by: Russell Harmon Acked-by: Paulo Alcantara (SUSE) Reviewed-by: David Howells Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 27ec43c77b5db780a56fc3a6d6de6bf2f74614f7 Author: Parker Newman Date: Tue Aug 8 16:01:06 2023 +0200 i2c: tegra: Fix i2c-tegra DMA config option processing Tegra processors prior to Tegra186 used APB DMA for I2C requiring CONFIG_TEGRA20_APB_DMA=y while Tegra186 and later use GPC DMA requiring CONFIG_TEGRA186_GPC_DMA=y. The check for if the processor uses APB DMA is inverted and so the wrong DMA config options are checked. This means if CONFIG_TEGRA20_APB_DMA=y but CONFIG_TEGRA186_GPC_DMA=n with a Tegra186 or later processor the driver will incorrectly think DMA is enabled and attempt to request DMA channels that will never be availible, leaving the driver in a perpetual EPROBE_DEFER state. Fixes: 48cb6356fae1 ("i2c: tegra: Add GPCDMA support") Signed-off-by: Parker Newman Acked-by: Andi Shyti Acked-by: Akhil R Link: https://lore.kernel.org/r/fcfcf9b3-c8c4-9b34-2ff8-cd60a3d490bd@connecttech.com Signed-off-by: Wolfram Sang commit b3497ef404dc3a8a7b8438a8950f46c4cd0e6ccf Author: Thierry Reding Date: Fri Jul 7 15:26:19 2023 +0200 i2c: tegra: Fix failure during probe deferral cleanup If the driver fails to obtain a DMA channel, it will initiate cleanup and try to release the DMA channel that couldn't be retrieved. This will cause a crash because the cleanup will try to dereference an ERR_PTR()- encoded error code. However, there's nothing to clean up at this point yet, so we can avoid this by simply resetting the DMA channel to NULL instead of storing the error code. Fixes: fcc8a89a1c83 ("i2c: tegra: Share same DMA channel for RX and TX") Signed-off-by: Thierry Reding Tested-by: Akhil R Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang commit 69f035c480d76f12bf061148ccfd578e1099e5fc Author: Tam Nguyen Date: Wed Jul 26 15:00:01 2023 +0700 i2c: designware: Handle invalid SMBus block data response length value In the I2C_FUNC_SMBUS_BLOCK_DATA case, the invalid length byte value (outside of 1-32) of the SMBus block data response from the Slave device is not correctly handled by the I2C Designware driver. In case IC_EMPTYFIFO_HOLD_MASTER_EN==1, which cannot be detected from the registers, the Master can be disabled only if the STOP bit is set. Without STOP bit set, the Master remains active, holding the bus until receiving a block data response length. This hangs the bus and is unrecoverable. Avoid this by issuing another dump read to reach the stop condition when an invalid length byte is received. Cc: stable@vger.kernel.org Signed-off-by: Tam Nguyen Acked-by: Jarkko Nikula Link: https://lore.kernel.org/r/20230726080001.337353-3-tamnguyenchi@os.amperecomputing.com Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang commit 49d4db3953cb9004ff94efc0c176e026c820af5a Author: Quan Nguyen Date: Wed Jul 26 15:00:00 2023 +0700 i2c: designware: Correct length byte validation logic Commit 0daede80f870 ("i2c: designware: Convert driver to using regmap API") changes the logic to validate the whole 32-bit return value of DW_IC_DATA_CMD register instead of 8-bit LSB without reason. Later, commit f53f15ba5a85 ("i2c: designware: Get right data length"), introduced partial fix but not enough because the "tmp > 0" still test tmp as 32-bit value and is wrong in case the IC_DATA_CMD[11] is set. Revert the logic to just before commit 0daede80f870 ("i2c: designware: Convert driver to using regmap API"). Fixes: f53f15ba5a85 ("i2c: designware: Get right data length") Fixes: 0daede80f870 ("i2c: designware: Convert driver to using regmap API") Cc: stable@vger.kernel.org Signed-off-by: Tam Nguyen Signed-off-by: Quan Nguyen Acked-by: Jarkko Nikula Link: https://lore.kernel.org/r/20230726080001.337353-2-tamnguyenchi@os.amperecomputing.com Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang commit b610c4bbd153c2cde548db48559e170905d7c369 Author: Carlos Song Date: Wed Jul 26 17:22:38 2023 +0800 i2c: imx-lpi2c: return -EINVAL when i2c peripheral clk doesn't work On MX8X platforms, the default clock rate is 0 if without explicit clock setting in dts nodes. I2c can't work when i2c peripheral clk rate is 0. Add a i2c peripheral clk rate check before configuring the clock register. When i2c peripheral clk rate is 0 and directly return -EINVAL. Signed-off-by: Carlos Song Acked-by: Dong Aisheng Reviewed-by: Andi Shyti Signed-off-by: Wolfram Sang commit e8470c0a7bcaa82f78ad34282d662dd7bd9630c2 Author: Luca Ceresoli Date: Fri Aug 4 17:12:39 2023 +0200 drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs Commit 03e909acd95a ("drm/panel: simple: Add support for AUO G121EAN01.4 panel") added support for this panel model, but the timings it implements are very different from what the datasheet describes. I checked both the G121EAN01.0 datasheet from [0] and the G121EAN01.4 one from [1] and they all have the same timings: for example the LVDS clock typical value is 74.4 MHz, not 66.7 MHz as implemented. Replace the timings with the ones from the documentation. These timings have been tested and the clock frequencies verified with an oscilloscope to ensure they are correct. Also use struct display_timing instead of struct drm_display_mode in order to also specify the minimum and maximum values. [0] https://embedded.avnet.com/product/g121ean01-0/ [1] https://embedded.avnet.com/product/g121ean01-4/ Fixes: 03e909acd95a ("drm/panel: simple: Add support for AUO G121EAN01.4 panel") Signed-off-by: Luca Ceresoli Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20230804151239.835216-1-luca.ceresoli@bootlin.com commit ae6546835efaa7195aaaa10e5ff4e695cd82a816 Author: David Heidelberg Date: Sat Aug 12 20:52:39 2023 +0200 drm/panel: JDI LT070ME05000 simplify with dev_err_probe() Use the dev_err_probe() helper to simplify error handling during probe. This also handle scenario, when EDEFER is returned and useless error is printed. Fixes error: panel-jdi-lt070me05000 4700000.dsi.0: cannot get enable-gpio -517 Signed-off-by: David Heidelberg Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20230812185239.378582-1-david@ixit.cz commit 7aff940ec88658f7fd21137cf515956a7deaaf54 Author: Shengyu Qu Date: Sun Aug 6 16:50:43 2023 +0800 ARM: dts: am335x-bone-common: Add vcc-supply for on-board eeprom The on-board eeprom on beaglebone series has a power supply from VDD_3V3A, add that to dts to reduce dummy regulator warning. Signed-off-by: Shengyu Qu Message-ID: Signed-off-by: Tony Lindgren commit 623cef652768860bd5f205fb7b741be278585fba Author: Shengyu Qu Date: Sun Aug 6 16:50:44 2023 +0800 ARM: dts: am335x-bone-common: Add GPIO PHY reset on revision C3 board This patch adds ethernet PHY reset GPIO config for Beaglebone Black series boards with revision C3. This fixes a random phy startup failure bug discussed at [1]. The GPIO pin used for reset is not used on older revisions, so it is ok to apply to all board revisions. The reset timing was discussed and tested at [2]. [1] https://forum.digikey.com/t/ethernet-device-is-not-detecting-on-ubuntu-20-04-lts-on-bbg/19948 [2] https://forum.beagleboard.org/t/recognizing-a-beaglebone-black-rev-c3-board/31249/ Signed-off-by: Robert Nelson Signed-off-by: Shengyu Qu Message-ID: Signed-off-by: Tony Lindgren commit 855067defa36b1f9effad8c219d9a85b655cf500 Author: Petr Machata Date: Fri Aug 11 17:59:27 2023 +0200 selftests: mirror_gre_changes: Tighten up the TTL test match This test verifies whether the encapsulated packets have the correct configured TTL. It does so by sending ICMP packets through the test topology and mirroring them to a gretap netdevice. On a busy host however, more than just the test ICMP packets may end up flowing through the topology, get mirrored, and counted. This leads to potential spurious failures as the test observes much more mirrored packets than the sent test packets, and assumes a bug. Fix this by tightening up the mirror action match. Change it from matchall to a flower classifier matching on ICMP packets specifically. Fixes: 45315673e0c5 ("selftests: forwarding: Test changes in mirror-to-gretap") Signed-off-by: Petr Machata Tested-by: Mirsad Todorovac Reviewed-by: Ido Schimmel Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 833fd800bf56b74d39d71d3f5936dffb3e0409c6 Author: Petr Pavlu Date: Tue Jul 11 11:19:52 2023 +0200 x86/retpoline,kprobes: Skip optprobe check for indirect jumps with retpolines and IBT The kprobes optimization check can_optimize() calls insn_is_indirect_jump() to detect indirect jump instructions in a target function. If any is found, creating an optprobe is disallowed in the function because the jump could be from a jump table and could potentially land in the middle of the target optprobe. With retpolines, insn_is_indirect_jump() additionally looks for calls to indirect thunks which the compiler potentially used to replace original jumps. This extra check is however unnecessary because jump tables are disabled when the kernel is built with retpolines. The same is currently the case with IBT. Based on this observation, remove the logic to look for calls to indirect thunks and skip the check for indirect jumps altogether if the kernel is built with retpolines or IBT. Remove subsequently the symbols __indirect_thunk_start and __indirect_thunk_end which are no longer needed. Dropping this logic indirectly fixes a problem where the range [__indirect_thunk_start, __indirect_thunk_end] wrongly included also the return thunk. It caused that machines which used the return thunk as a mitigation and didn't have it patched by any alternative ended up not being able to use optprobes in any regular function. Fixes: 0b53c374b9ef ("x86/retpoline: Use -mfunction-return") Suggested-by: Peter Zijlstra (Intel) Suggested-by: Masami Hiramatsu (Google) Signed-off-by: Petr Pavlu Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov (AMD) Acked-by: Masami Hiramatsu (Google) Link: https://lore.kernel.org/r/20230711091952.27944-3-petr.pavlu@suse.com commit 79cd2a11224eab86d6673fe8a11d2046ae9d2757 Author: Petr Pavlu Date: Tue Jul 11 11:19:51 2023 +0200 x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG The linker script arch/x86/kernel/vmlinux.lds.S matches the thunk sections ".text.__x86.*" from arch/x86/lib/retpoline.S as follows: .text { [...] TEXT_TEXT [...] __indirect_thunk_start = .; *(.text.__x86.*) __indirect_thunk_end = .; [...] } Macro TEXT_TEXT references TEXT_MAIN which normally expands to only ".text". However, with CONFIG_LTO_CLANG, TEXT_MAIN becomes ".text .text.[0-9a-zA-Z_]*" which wrongly matches also the thunk sections. The output layout is then different than expected. For instance, the currently defined range [__indirect_thunk_start, __indirect_thunk_end] becomes empty. Prevent the problem by using ".." as the first separator, for example, ".text..__x86.indirect_thunk". This pattern is utilized by other explicit section names which start with one of the standard prefixes, such as ".text" or ".data", and that need to be individually selected in the linker script. [ nathan: Fix conflicts with SRSO and fold in fix issue brought up by Andrew Cooper in post-review: https://lore.kernel.org/20230803230323.1478869-1-andrew.cooper3@citrix.com ] Fixes: dc5723b02e52 ("kbuild: add support for Clang LTO") Signed-off-by: Petr Pavlu Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Nathan Chancellor Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230711091952.27944-2-petr.pavlu@suse.com commit e9fbc47b818b964ddff5df5b2d5c0f5f32f4a147 Author: Borislav Petkov (AMD) Date: Sun Aug 13 12:39:34 2023 +0200 x86/srso: Disable the mitigation on unaffected configurations Skip the srso cmd line parsing which is not needed on Zen1/2 with SMT disabled and with the proper microcode applied (latter should be the case anyway) as those are not affected. Fixes: 5a15d8348881 ("x86/srso: Tie SBPB bit setting to microcode patch detection") Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230813104517.3346-1-bp@alien8.de commit f58d6fbcb7c848b7f2469be339bc571f2e9d245b Author: Borislav Petkov (AMD) Date: Fri Aug 11 23:38:24 2023 +0200 x86/CPU/AMD: Fix the DIV(0) initial fix attempt Initially, it was thought that doing an innocuous division in the #DE handler would take care to prevent any leaking of old data from the divider but by the time the fault is raised, the speculation has already advanced too far and such data could already have been used by younger operations. Therefore, do the innocuous division on every exit to userspace so that userspace doesn't see any potentially old data from integer divisions in kernel space. Do the same before VMRUN too, to protect host data from leaking into the guest too. Fixes: 77245f1c3c64 ("x86/CPU/AMD: Do not leak quotient data after a division by 0") Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://lore.kernel.org/r/20230811213824.10025-1-bp@alien8.de commit ba5ca5e5e6a1d55923e88b4a83da452166f5560e Author: Sean Christopherson Date: Fri Aug 11 08:52:55 2023 -0700 x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() Use LEA instead of ADD when adjusting %rsp in srso_safe_ret{,_alias}() so as to avoid clobbering flags. Drop one of the INT3 instructions to account for the LEA consuming one more byte than the ADD. KVM's emulator makes indirect calls into a jump table of sorts, where the destination of each call is a small blob of code that performs fast emulation by executing the target instruction with fixed operands. E.g. to emulate ADC, fastop() invokes adcb_al_dl(): adcb_al_dl: <+0>: adc %dl,%al <+2>: jmp <__x86_return_thunk> A major motivation for doing fast emulation is to leverage the CPU to handle consumption and manipulation of arithmetic flags, i.e. RFLAGS is both an input and output to the target of the call. fastop() collects the RFLAGS result by pushing RFLAGS onto the stack and popping them back into a variable (held in %rdi in this case): asm("push %[flags]; popf; " CALL_NOSPEC " ; pushf; pop %[flags]\n" <+71>: mov 0xc0(%r8),%rdx <+78>: mov 0x100(%r8),%rcx <+85>: push %rdi <+86>: popf <+87>: call *%rsi <+89>: nop <+90>: nop <+91>: nop <+92>: pushf <+93>: pop %rdi and then propagating the arithmetic flags into the vCPU's emulator state: ctxt->eflags = (ctxt->eflags & ~EFLAGS_MASK) | (flags & EFLAGS_MASK); <+64>: and $0xfffffffffffff72a,%r9 <+94>: and $0x8d5,%edi <+109>: or %rdi,%r9 <+122>: mov %r9,0x10(%r8) The failures can be most easily reproduced by running the "emulator" test in KVM-Unit-Tests. If you're feeling a bit of deja vu, see commit b63f20a778c8 ("x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386"). In addition, this breaks booting of clang-compiled guest on a gcc-compiled host where the host contains the %rsp-modifying SRSO mitigations. [ bp: Massage commit message, extend, remove addresses. ] Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation") Closes: https://lore.kernel.org/all/de474347-122d-54cd-eabf-9dcc95ab9eae@amd.com Reported-by: Srikanth Aithal Reported-by: Nathan Chancellor Signed-off-by: Sean Christopherson Signed-off-by: Borislav Petkov (AMD) Tested-by: Nathan Chancellor Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20230810013334.GA5354@dev-arch.thelio-3990X/ Link: https://lore.kernel.org/r/20230811155255.250835-1-seanjc@google.com commit 7a894c87374771f3cfb1b8e5453fbe03f1fb8135 Author: Helge Deller Date: Sun Aug 13 22:11:19 2023 +0200 parisc: Fix CONFIG_TLB_PTLOCK to work with lightweight spinlock checks For the TLB_PTLOCK checks we used an optimization to store the spc register into the spinlock to unlock it. This optimization works as long as the lightweight spinlock checks (CONFIG_LIGHTWEIGHT_SPINLOCK_CHECK) aren't enabled, because they really check if the lock word is zero or __ARCH_SPIN_LOCK_UNLOCKED_VAL and abort with a kernel crash ("Spinlock was trashed") otherwise. Drop that optimization to make it possible to activate both checks at the same time. Noticed-by: Sam James Signed-off-by: Helge Deller Tested-by: Sam James Cc: stable@vger.kernel.org # v6.4+ Fixes: 15e64ef6520e ("parisc: Add lightweight spinlock checks") commit ace0ab3a4b54205a01d3f4a0fd9bdb4616cfb60b Author: Vlad Buslov Date: Fri Aug 11 17:45:23 2023 +0200 Revert "vlan: Fix VLAN 0 memory leak" This reverts commit 718cb09aaa6fa78cc8124e9517efbc6c92665384. The commit triggers multiple syzbot issues, probably due to possibility of manually creating VLAN 0 on netdevice which will cause the code to delete it since it can't distinguish such VLAN from implicit VLAN 0 automatically created for devices with NETIF_F_HW_VLAN_CTAG_FILTER feature. Reported-by: syzbot+662f783a5cdf3add2719@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/00000000000090196d0602a6167d@google.com/ Reported-by: syzbot+4b4f06495414e92701d5@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/00000000000096ae870602a61602@google.com/ Reported-by: syzbot+d810d3cd45ed1848c3f7@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000009f0f9c0602a616ce@google.com/ Fixes: 718cb09aaa6f ("vlan: Fix VLAN 0 memory leak") Signed-off-by: Vlad Buslov Reviewed-by: Ido Schimmel Signed-off-by: David S. Miller commit 2fc8d02058dbec258039c3253ebd1f124766a796 Author: Michael Walle Date: Thu Aug 10 11:34:14 2023 +0200 MAINTAINERS: add content regex for gpio-regmap Add a glob to get patches of the users of gpio-regmap, too. Signed-off-by: Michael Walle Acked-by: Linus Walleij Signed-off-by: Bartosz Golaszewski commit 2ccdd1b13c591d306f0401d98dedc4bdcd02b421 Author: Linus Torvalds Date: Sun Aug 13 11:29:55 2023 -0700 Linux 6.5-rc6 commit 37aba3190891d4de189bd5192ee95220e295f34d Author: Shuming Fan Date: Fri Aug 11 17:38:22 2023 +0800 ASoC: rt1308-sdw: fix random louder sound This patch uses a vendor register to check whether the system hibernated ever. The driver will only set the preset when the driver brings up or the system hibernated. It will avoid the unknown issue that makes the speaker output louder and can't control the volume. Signed-off-by: Shuming Fan Date: Sun Aug 13 08:56:24 2023 -0700 Merge tag 'kbuild-fixes-v6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Clear errno before calling getline() - Fix a modpost warning for ARCH=alpha * tag 'kbuild-fixes-v6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: alpha: remove __init annotation from exported page_is_ram() scripts/kallsyms: Fix build failure by setting errno before calling getline() commit 3dcf1473c711be5536321fa4d465b9ed9e42a0ce Merge: 7308e92756d58 2b6aa6610dc96 Author: Linus Torvalds Date: Sun Aug 13 08:50:26 2023 -0700 Merge tag 'platform-drivers-x86-v6.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform drivers fixes from Hans de Goede: - lenovo-ymc driver causes keyboard + touchpad to not work with >= 6.4 on some Thinkbook models, fix this - A set of small fixes for mlx-platform - Other small fixes and hw-id additions * tag 'platform-drivers-x86-v6.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: lenovo-ymc: Only bind on machines with a convertible DMI chassis-type platform: mellanox: Change register offset addresses platform: mellanox: mlx-platform: Modify graceful shutdown callback and power down mask platform: mellanox: mlx-platform: Fix signals polarity and latch mask platform: mellanox: Fix order in exit flow platform/x86: ISST: Reduce noise for missing numa information in logs platform/x86: msi-ec: Fix the build ACPI: scan: Create platform device for CS35L56 platform/x86/amd/pmf: Fix unsigned comparison with less than zero commit 7308e92756d5891d58e7bcae01a516514583921d Merge: a785fd28d31f7 ef222f551e7c4 Author: Linus Torvalds Date: Sun Aug 13 08:43:26 2023 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Eleven small fixes, ten in drivers. Of the two fixes marked core, one is in the raid helper class (used by some raid device drivers) and the other one is the /proc/scsi/scsi parsing fix for potential reads beyond the end of the buffer" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: qedf: Fix firmware halt over suspend and resume scsi: qedi: Fix firmware halt over suspend and resume scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock scsi: lpfc: Remove reftag check in DIF paths scsi: ufs: renesas: Fix private allocation scsi: snic: Fix possible memory leak if device_add() fails scsi: core: Fix possible memory leak if device_add() fails scsi: core: Fix legacy /proc parsing buffer overflow scsi: 53c700: Check that command slot is not NULL scsi: fnic: Replace return codes in fnic_clean_pending_aborts() scsi: storvsc: Fix handling of virtual Fibre Channel timeouts commit 2b6aa6610dc9690f79d305ca938abfb799a4f766 Author: Hans de Goede Date: Sat Aug 12 16:48:18 2023 +0200 platform/x86: lenovo-ymc: Only bind on machines with a convertible DMI chassis-type The lenovo-ymc driver is causing the keyboard + touchpad to stop working on some regular laptop models such as the Lenovo ThinkBook 13s G2 ITL 20V9. The problem is that there are YMC WMI GUID methods in the ACPI tables of these laptops, despite them not being Yogas and lenovo-ymc loading causes libinput to see a SW_TABLET_MODE switch with state 1. This in turn causes libinput to ignore events from the builtin keyboard and touchpad, since it filters those out for a Yoga in tablet mode. Similar issues with false-positive SW_TABLET_MODE=1 reporting have been seen with the intel-hid driver. Copy the intel-hid driver approach to fix this and only bind to the WMI device on machines where the DMI chassis-type indicates the machine is a convertible. Add a 'force' module parameter to allow overriding the chassis-type check so that users can easily test if the YMC interface works on models which report an unexpected chassis-type. Fixes: e82882cdd241 ("platform/x86: Add driver for Yoga Tablet Mode switch") Link: https://bugzilla.redhat.com/show_bug.cgi?id=2229373 Cc: André Apitzsch Cc: stable@vger.kernel.org Tested-by: Andrew Kallmeyer Tested-by: Gergő Köteles Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230812144818.383230-1-hdegoede@redhat.com commit d66a8aab7dc36c975bbaa6aa74cf7445878e7c69 Author: Vadim Pasternak Date: Sun Aug 13 08:37:35 2023 +0000 platform: mellanox: Change register offset addresses Move debug register offsets to different location due to hardware changes. Fixes: dd635e33b5c9 ("platform: mellanox: Introduce support of new Nvidia L1 switch") Signed-off-by: Vadim Pasternak Reviewed-by: Michael Shych Link: https://lore.kernel.org/r/20230813083735.39090-5-vadimp@nvidia.com Signed-off-by: Hans de Goede commit 9f8ccdb5088bd03062d9ad9c0f6abf600cbed8e8 Author: Vadim Pasternak Date: Sun Aug 13 08:37:34 2023 +0000 platform: mellanox: mlx-platform: Modify graceful shutdown callback and power down mask Use kernel_power_off() instead of kernel_halt() to pass through machine_power_off() -> pm_power_off(), otherwise axillary power does not go off. Change "power down" bitmask. Fixes: dd635e33b5c9 ("platform: mellanox: Introduce support of new Nvidia L1 switch") Signed-off-by: Vadim Pasternak Reviewed-by: Michael Shych Link: https://lore.kernel.org/r/20230813083735.39090-4-vadimp@nvidia.com Signed-off-by: Hans de Goede commit 3c91d7e8c64f75c63da3565d16d5780320bd5d76 Author: Vadim Pasternak Date: Sun Aug 13 08:37:33 2023 +0000 platform: mellanox: mlx-platform: Fix signals polarity and latch mask Change polarity of chassis health and power signals and fix latch reset mask for L1 switch. Fixes: dd635e33b5c9 ("platform: mellanox: Introduce support of new Nvidia L1 switch") Signed-off-by: Vadim Pasternak Reviewed-by: Michael Shych Link: https://lore.kernel.org/r/20230813083735.39090-3-vadimp@nvidia.com Signed-off-by: Hans de Goede commit 8e3938cff0191c810b2abd827313c090fe09d166 Author: Vadim Pasternak Date: Sun Aug 13 08:37:32 2023 +0000 platform: mellanox: Fix order in exit flow Fix exit flow order: call mlxplat_post_exit() after mlxplat_i2c_main_exit() in order to unregister main i2c driver before to "mlxplat" driver. Fixes: 0170f616f496 ("platform: mellanox: Split initialization procedure") Signed-off-by: Vadim Pasternak Reviewed-by: Michael Shych Link: https://lore.kernel.org/r/20230813083735.39090-2-vadimp@nvidia.com Signed-off-by: Hans de Goede commit cc941e548bffc01b5816b4edc5cb432a137a58b3 Author: Russell King (Oracle) Date: Fri Aug 11 11:26:30 2023 +0100 net: phy: fix IRQ-based wake-on-lan over hibernate / power off Uwe reports: "Most PHYs signal WoL using an interrupt. So disabling interrupts [at shutdown] breaks WoL at least on PHYs covered by the marvell driver." Discussing with Ioana, the problem which was trying to be solved was: "The board in question is a LS1021ATSN which has two AR8031 PHYs that share an interrupt line. In case only one of the PHYs is probed and there are pending interrupts on the PHY#2 an IRQ storm will happen since there is no entity to clear the interrupt from PHY#2's registers. PHY#1's driver will get stuck in .handle_interrupt() indefinitely." Further confirmation that "the two AR8031 PHYs are on the same MDIO bus." With WoL using interrupts to wake the system, in such a case, the system will begin booting with an asserted interrupt. Thus, we need to cope with an interrupt asserted during boot. Solve this instead by disabling interrupts during PHY probe. This will ensure in Ioana's situation that both PHYs of the same type sharing an interrupt line on a common MDIO bus will have their interrupt outputs disabled when the driver probes the device, but before we hook in any interrupt handlers - thus avoiding the interrupt storm. A better fix would be for platform firmware to disable the interrupting devices at source during boot, before control is handed to the kernel. Fixes: e2f016cf7751 ("net: phy: add a shutdown procedure") Link: 20230804071757.383971-1-u.kleine-koenig@pengutronix.de Reported-by: Uwe Kleine-König Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit a785fd28d31f76d50004712b6e0b409d5a8239d8 Merge: ae545c3283dc6 92fb94b69c6ac Author: Linus Torvalds Date: Sat Aug 12 13:28:55 2023 -0700 Merge tag 'for-6.5-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "More fixes, some of them going back to older releases and there are fixes for hangs in stress tests regarding space caching: - fixes and progress tracking for hangs in free space caching, found by test generic/475 - writeback fixes, write pages in integrity mode and skip writing pages that have been written meanwhile - properly clear end of extent range after an error - relocation fixes: - fix race betwen qgroup tree creation and relocation - detect and report invalid reloc roots" * tag 'for-6.5-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: set cache_block_group_error if we find an error btrfs: reject invalid reloc tree root keys with stack dump btrfs: exit gracefully if reloc roots don't match btrfs: avoid race between qgroup tree creation and relocation btrfs: properly clear end of the unreserved range in cow_file_range btrfs: don't wait for writeback on clean pages in extent_write_cache_pages btrfs: don't stop integrity writeback too early btrfs: wait for actual caching progress during allocation commit ae545c3283dc673f7e748065efa46ba95f678ef2 Merge: c8afaa1b0f8bc 33f83d13ded16 Author: Linus Torvalds Date: Sat Aug 12 11:34:23 2023 -0700 Merge tag 'gpio-fixes-for-v6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - mark virtual chips exposed by gpio-sim as ones that can sleep (callbacks must not be called from interrupt context) - fix an off-by-one error in gpio-ws16c48 * tag 'gpio-fixes-for-v6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: ws16c48: Fix off-by-one error in WS16C48 resource region extent gpio: sim: mark the GPIO chip as a one that can sleep commit c8afaa1b0f8bc93d013ab2ea6b9649958af3f1d3 Author: Mateusz Guzik Date: Sat Aug 12 18:15:54 2023 +0200 locking: remove spin_lock_prefetch The only remaining consumer is new_inode, where it showed up in 2001 as commit c37fa164f793 ("v2.4.9.9 -> v2.4.9.10") in a historical repo [1] with a changelog which does not mention it. Since then the line got only touched up to keep compiling. While it may have been of benefit back in the day, it is guaranteed to at best not get in the way in the multicore setting -- as the code performs *a lot* of work between the prefetch and actual lock acquire, any contention means the cacheline is already invalid by the time the routine calls spin_lock(). It adds spurious traffic, for short. On top of it prefetch is notoriously tricky to use for single-threaded purposes, making it questionable from the get go. As such, remove it. I admit upfront I did not see value in benchmarking this change, but I can do it if that is deemed appropriate. Removal from new_inode and of the entire thing are in the same patch as requested by Linus, so whatever weird looks can be directed at that guy. Link: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git/commit/fs/inode.c?id=c37fa164f793735b32aa3f53154ff1a7659e6442 [1] Signed-off-by: Mateusz Guzik Signed-off-by: Linus Torvalds commit 3feecb1b848359b152dd66b26c24c2454a64fc15 Merge: 469a2f5041880 51a26bb02ae58 Author: Linus Torvalds Date: Sat Aug 12 09:03:15 2023 -0700 Merge tag 'char-misc-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc driver fixes from Greg KH: "Here are some small char/misc driver fixes for 6.5-rc6 that resolve some reported issues. Included in here are: - bunch of iio driver fixes for reported problems - interconnect driver fixes - counter driver build fix - cardreader driver fixes - binder driver fixes - other tiny driver fixes All of these have been in linux-next for a while with no reported problems" * tag 'char-misc-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (21 commits) misc: tps6594-esm: Disable ESM for rev 1 PMIC misc: rtsx: judge ASPM Mode to set PETXCFG Reg binder: fix memory leak in binder_init() iio: cros_ec: Fix the allocation size for cros_ec_command tools/counter: Makefile: Replace rmdir by rm to avoid make,clean failure iio: imu: lsm6dsx: Fix mount matrix retrieval iio: adc: meson: fix core clock enable/disable moment iio: core: Prevent invalid memory access when there is no parent iio: frequency: admv1013: propagate errors from regulator_get_voltage() counter: Fix menuconfig "Counter support" submenu entries disappearance dt-bindings: iio: adi,ad74115: remove ref from -nanoamp iio: adc: ina2xx: avoid NULL pointer dereference on OF device match iio: light: bu27008: Fix intensity data type iio: light: bu27008: Fix scale format iio: light: bu27034: Fix scale format iio: adc: ad7192: Fix ac excitation feature interconnect: qcom: sa8775p: add enable_mask for bcm nodes interconnect: qcom: sm8550: add enable_mask for bcm nodes interconnect: qcom: sm8450: add enable_mask for bcm nodes interconnect: qcom: Add support for mask-based BCMs ... commit 469a2f504188003d76718f99a4f5755c4d369b74 Merge: 43972cf2deb2f f48585c468f51 Author: Linus Torvalds Date: Sat Aug 12 08:58:54 2023 -0700 Merge tag 'usb-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt driver fixes from Greg KH: "Here are some small USB and Thunderbolt driver fixes for reported problems. Included in here are: - thunderbolt driver memory leak fix - thunderbolt display flicker fix - usb dwc3 driver fix - usb gadget uvc disconnect crash fix - usb typec Kconfig build dependency fix - usb typec small fixes - usb-con-gpio bugfix - usb-storage old driver bugfix All of these have been in linux-next for a while with no reported issues" * tag 'usb-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: thunderbolt: Fix memory leak in tb_handle_dp_bandwidth_request() usb: dwc3: Properly handle processing of pending events usb-storage: alauda: Fix uninit-value in alauda_check_media() usb: common: usb-conn-gpio: Prevent bailing out if initial role is none USB: Gadget: core: Help prevent panic during UVC unconfigure usb: typec: mux: intel: Add dependency on USB_COMMON usb: typec: nb7vpq904m: Add an error handling path in nb7vpq904m_probe() usb: typec: altmodes/displayport: Signal hpd when configuring pin assignment usb: typec: tcpm: Fix response to vsafe0V event thunderbolt: Fix Thunderbolt 3 display flickering issue on 2nd hot plug onwards commit 43972cf2deb2f54a97530c82b88c555fd682428e Merge: 272b86ba9d975 6dbef74aeb090 Author: Linus Torvalds Date: Sat Aug 12 08:47:01 2023 -0700 Merge tag 'x86_urgent_for_v6.5_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Do not parse the confidential computing blob on non-AMD hardware as it leads to an EFI config table ending up unmapped - Use the correct segment selector in the 32-bit version of getcpu() in the vDSO - Make sure vDSO and VVAR regions are placed in the 47-bit VA range even on 5-level paging systems - Add models 0x90-0x91 to the range of AMD Zenbleed-affected CPUs * tag 'x86_urgent_for_v6.5_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 x86/mm: Fix VDSO and VVAR placement on 5-level paging machines x86/linkage: Fix typo of BUILD_VDSO in asm/linkage.h x86/vdso: Choose the right GDT_ENTRY_CPUNODE for 32-bit getcpu() on 64-bit kernel x86/sev: Do not try to parse for the CC blob on non-AMD hardware commit 272b86ba9d97518b3c14b97514b6544eef87e7a5 Merge: f8de32cc060ba 3477144c878a5 Author: Linus Torvalds Date: Sat Aug 12 08:34:20 2023 -0700 Merge tag 'x86_bugs_for_v6.5_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mitigation fixes from Borislav Petkov: "The first set of fallout fixes after the embargo madness. There will be another set next week too. - A first series of cleanups/unifications and documentation improvements to the SRSO and GDS mitigations code which got postponed to after the embargo date - Fix the SRSO aliasing addresses assertion so that the LLVM linker can parse it too" * tag 'x86_bugs_for_v6.5_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: driver core: cpu: Fix the fallback cpu_show_gds() name x86: Move gds_ucode_mitigated() declaration to header x86/speculation: Add cpu_show_gds() prototype driver core: cpu: Make cpu_show_not_affected() static x86/srso: Fix build breakage with the LLVM linker Documentation/srso: Document IBPB aspect and fix formatting driver core: cpu: Unify redundant silly stubs Documentation/hw-vuln: Unify filename specification in index commit 6e6d847a8ce18ab2fbec4f579f682486a82d2c6b Author: Jiasheng Jiang Date: Thu Aug 10 22:01:04 2023 +0930 soc: aspeed: socinfo: Add kfree for kstrdup Add kfree() in the later error handling in order to avoid memory leak. Fixes: e0218dca5787 ("soc: aspeed: Add soc info driver") Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20230707021625.7727-1-jiasheng@iscas.ac.cn Signed-off-by: Joel Stanley Link: https://lore.kernel.org/r/20230810123104.231167-1-joel@jms.id.au Signed-off-by: Arnd Bergmann commit e4ad279ae345413d900d791f2f618d0a1cd0d791 Author: Zev Weiss Date: Thu Aug 10 21:59:41 2023 +0930 soc: aspeed: uart-routing: Use __sysfs_match_string The existing use of match_string() caused it to reject 'echo foo' due to the implicitly appended newline, which was somewhat ergonomically awkward and inconsistent with typical sysfs behavior. Using the __sysfs_* variant instead provides more convenient and consistent linefeed-agnostic behavior. Signed-off-by: Zev Weiss Fixes: c6807970c3bc ("soc: aspeed: Add UART routing support") Reviewed-by: Joel Stanley Link: https://lore.kernel.org/r/20230628083735.19946-2-zev@bewilderbeest.net Signed-off-by: Joel Stanley Link: https://lore.kernel.org/r/20230810122941.231085-1-joel@jms.id.au Signed-off-by: Arnd Bergmann commit 42ff49a1967af71772b264009659ce181f7d2d2a Author: Lin Yujun Date: Fri Aug 11 09:00:06 2023 +0200 ARM: dts: integrator: fix PCI bus dtc warnings An warning is reported when allmodconfig is used to compile the kernel of the ARM architecture: arch/arm/boot/dts/arm/integratorap.dts:161.22-206.4: Warning (pci_bridge): /pciv3@62000000: node name is not "pci" or "pcie" Change the node name to pci to clear the build warning. Signed-off-by: Lin Yujun Reviewed-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20230811-versatile-dts-v6-6-v1-1-d8cb9d1947ed@linaro.org Signed-off-by: Arnd Bergmann commit d842f4dc68a0700e83df6a77a646c145f85a79ea Merge: 991e0d9dbbd01 bb54e6609977f Author: Arnd Bergmann Date: Sat Aug 12 10:13:11 2023 +0200 Merge tag 'zynq-soc-for-6.6' of https://github.com/Xilinx/linux-xlnx into arm/fixes ARM: Zynq SoC changes for v6.6 - Sort out OF headers in pm.c * tag 'zynq-soc-for-6.6' of https://github.com/Xilinx/linux-xlnx: ARM: zynq: Explicitly include correct DT includes Link: https://lore.kernel.org/r/a56457a0-7e5a-df46-2c86-3f2ace578984@monstr.eu Signed-off-by: Arnd Bergmann commit 991e0d9dbbd018fb9904f369348fb248f0b22687 Merge: 52a93d39b17dc 78e869dd8b2ba Author: Arnd Bergmann Date: Sat Aug 12 10:12:23 2023 +0200 Merge tag 'imx-fixes-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.5, 2nd round: - Fix i.MX93 ANATOP 'reg' resource size to avoid overlapping with TMU memory area. - Fix RTC interrupt level on imx6qdl-phytec-mira board. - Remove LDB endpoint from from the common imx6sx.dtsi as it causes regression for boards that has the LCDIF connected directly to a parallel display. - Drop CSI1 PHY reference clock configuration from i.MX8MM/N device tree to avoid overclocking. - Set a proper default tuning step for i.MX6SX and i.MX7D uSDHC to fix a tuning failure seen with some SD cards. * tag 'imx-fixes-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx93: Fix anatop node size ARM: dts: imx: Set default tuning step for imx6sx usdhc arm64: dts: imx8mm: Drop CSI1 PHY reference clock configuration arm64: dts: imx8mn: Drop CSI1 PHY reference clock configuration ARM: dts: imx: Set default tuning step for imx7d usdhc ARM: dts: imx6: phytec: fix RTC interrupt level ARM: dts: imx6sx: Remove LDB endpoint Link: https://lore.kernel.org/r/20230809100034.GS151430@dragon Signed-off-by: Arnd Bergmann commit f8de32cc060ba3f63171aaa0e8764d22d8c37978 Merge: 9a20704fb4064 6aaf663ee04a8 Author: Linus Torvalds Date: Fri Aug 11 19:46:04 2023 -0700 Merge tag 'tpmdd-v6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm irq fixes from Jarkko Sakkinen: "These change the probing and enabling of interrupts advertised by the platform firmware (i.e. ACPI, Device Tree) to be an opt-in for tpm_tis, which can be set from the kernel command-line. Note that the opt-in change is only for the PC MMIO tpm_tis module. It does not affect other similar drivers using IRQs, like tpm_tis_spi and synquacer" * tag 'tpmdd-v6.5-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm_tis: Opt-in interrupts tpm: tpm_tis: Fix UPX-i11 DMI_MATCH condition commit 9a20704fb40642d5b7d4f1db58f252f6aca563a9 Merge: 0725a70411bd8 64b632654b973 Author: Linus Torvalds Date: Fri Aug 11 19:39:01 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "A few small bugs: - Fix longstanding mlx5 bug where ODP would fail with certain MR alignments - cancel work to prevent a hfi1 UAF - MAINTAINERS update - UAF, missing mutex_init and an error unwind bug in bnxt_re" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/bnxt_re: Initialize dpi_tbl_lock mutex RDMA/bnxt_re: Fix error handling in probe failure path RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF MAINTAINERS: Remove maintainer of HiSilicon RoCE IB/hfi1: Fix possible panic during hotplug remove RDMA/umem: Set iova in ODP flow commit 0725a70411bd836231c3e78090ac47cac51246b1 Merge: 5512c33c7b942 fe9da61ffccad Author: Linus Torvalds Date: Fri Aug 11 18:35:56 2023 -0700 Merge tag 'zonefs-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs fix from Damien Le Moal: - The switch to using iomap for executing a direct synchronous write to sequential files using a zone append BIO overlooked cases where the BIO built by iomap is too large and needs splitting, which is not allowed with zone append. Fix this by using regular write commands instead. The use of zone append commands will be reintroduced later with proper support from iomap. * tag 'zonefs-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: fix synchronous direct writes to sequential files commit 5512c33c7b942033f772db56be46d5de9493deae Merge: 190bf7b14b0cf 56b930dcd88c2 Author: Linus Torvalds Date: Fri Aug 11 18:30:29 2023 -0700 Merge tag 'hwmon-for-v6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - Fix sporadic comunication errors in pmbus/bel-pfe and aquacomputer_d5next drivers * tag 'hwmon-for-v6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (aquacomputer_d5next) Add selective 200ms delay after sending ctrl report hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100 commit 6aaf663ee04a80b445f8f5abff53cb92cb583c88 Author: Jarkko Sakkinen Date: Sat Aug 12 02:07:10 2023 +0300 tpm_tis: Opt-in interrupts Cc: stable@vger.kernel.org # v6.4+ Link: https://lore.kernel.org/linux-integrity/CAHk-=whRVp4h8uWOX1YO+Y99+44u4s=XxMK4v00B6F1mOfqPLg@mail.gmail.com/ Fixes: e644b2f498d2 ("tpm, tpm_tis: Enable interrupt test") Signed-off-by: Jarkko Sakkinen commit 51e5e551af53259e0274b0cd4ff83d8351fb8c40 Author: Peter Ujfalusi Date: Tue Aug 8 12:48:36 2023 +0300 tpm: tpm_tis: Fix UPX-i11 DMI_MATCH condition The patch which made it to the kernel somehow changed the match condition from DMI_MATCH(DMI_PRODUCT_NAME, "UPX-TGL01") to DMI_MATCH(DMI_PRODUCT_VERSION, "UPX-TGL") Revert back to the correct match condition to disable the interrupt mode on the board. Cc: stable@vger.kernel.org # v6.4+ Fixes: edb13d7bb034 ("tpm: tpm_tis: Disable interrupts *only* for AEON UPX-i11") Link: https://lore.kernel.org/lkml/20230524085844.11580-1-peter.ujfalusi@linux.intel.com/ Signed-off-by: Peter Ujfalusi Signed-off-by: Jarkko Sakkinen commit 190bf7b14b0cf3df19c059061be032bd8994a597 Merge: 29d99aae13cf2 5f1fc67f2cb8d Author: Linus Torvalds Date: Fri Aug 11 14:19:20 2023 -0700 Merge tag 'mm-hotfixes-stable-2023-08-11-13-44' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "14 hotfixes. 11 of these are cc:stable and the remainder address post-6.4 issues, or are not considered suitable for -stable backporting" * tag 'mm-hotfixes-stable-2023-08-11-13-44' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/damon/core: initialize damo_filter->list from damos_new_filter() nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput selftests: cgroup: fix test_kmem_basic false positives fs/proc/kcore: reinstate bounce buffer for KCORE_TEXT regions MAINTAINERS: add maple tree mailing list mm: compaction: fix endless looping over same migrate block selftests: mm: ksm: fix incorrect evaluation of parameter hugetlb: do not clear hugetlb dtor until allocating vmemmap mm: memory-failure: avoid false hwpoison page mapped error info mm: memory-failure: fix potential unexpected return value from unpoison_memory() mm/swapfile: fix wrong swap entry type for hwpoisoned swapcache page radix tree test suite: fix incorrect allocation size for pthreads crypto, cifs: fix error handling in extract_iter_to_sg() zsmalloc: fix races between modifications of fullness and isolated commit 6dbef74aeb090d6bee7d64ef3fa82ae6fa53f271 Author: Cristian Ciocaltea Date: Fri Aug 11 23:37:05 2023 +0300 x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 Commit 522b1d69219d ("x86/cpu/amd: Add a Zenbleed fix") provided a fix for the Zen2 VZEROUPPER data corruption bug affecting a range of CPU models, but the AMD Custom APU 0405 found on SteamDeck was not listed, although it is clearly affected by the vulnerability. Add this CPU variant to the Zenbleed erratum list, in order to unconditionally enable the fallback fix until a proper microcode update is available. Fixes: 522b1d69219d ("x86/cpu/amd: Add a Zenbleed fix") Signed-off-by: Cristian Ciocaltea Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230811203705.1699914-1-cristian.ciocaltea@collabora.com commit 33f83d13ded164cd49ce2a3bd2770115abc64e6f Author: William Breathitt Gray Date: Thu Aug 10 18:00:44 2023 -0400 gpio: ws16c48: Fix off-by-one error in WS16C48 resource region extent The WinSystems WS16C48 I/O address region spans offsets 0x0 through 0xA, which is a total of 11 bytes. Fix the WS16C48_EXTENT define to the correct value of 11 so that access to necessary device registers is properly requested in the ws16c48_probe() callback by the devm_request_region() function call. Fixes: 2c05a0f29f41 ("gpio: ws16c48: Implement and utilize register structures") Cc: stable@vger.kernel.org Cc: Paul Demetrotion Signed-off-by: William Breathitt Gray Reviewed-by: Andy Shevchenko Reviewed-by: Linus Walleij Signed-off-by: Bartosz Golaszewski commit 29d99aae13cf2713b85bc26a37921e231676ba48 Merge: 9578b04c32397 56fec0051a69a Author: Linus Torvalds Date: Fri Aug 11 12:30:00 2023 -0700 Merge tag 'acpi-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "Rework the handling of interrupt overrides on AMD Zen-based machines to avoid recently introduced regressions (Hans de Goede). Note that this is intended as a short-term mitigation for 6.5 and the long-term approach will be to attempt to use the configuration left by the BIOS, but it requires more investigation" * tag 'acpi-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: resource: Add IRQ override quirk for PCSpecialist Elimina Pro 16 M ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs ACPI: resource: revert "Remove "Zen" specific match and quirks" commit 9578b04c32397e664bd4643c8b7f525728df3028 Merge: 360e694282fce 4778e1288447d Author: Linus Torvalds Date: Fri Aug 11 12:24:22 2023 -0700 Merge tag 'pm-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix an amd-pstate cpufreq driver issues and recently introduced hibernation-related breakage. Specifics: - Make amd-pstate use device_attributes as expected by the CPU root kobject (Thomas Weißschuh) - Restore the previous behavior of resume_store() when hibernation is not available which is to return the full number of bytes that were to be written by user space (Vlastimil Babka)" * tag 'pm-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: amd-pstate: fix global sysfs attribute type PM: hibernate: fix resume_store() return value when hibernation not available commit 04c7f60ca477ffbf7b7910320482335050f0d23a Author: Tony Lindgren Date: Fri Aug 11 13:36:45 2023 +0300 serial: core: Fix serial core port id, including multiport devices We want to fix the serial core port DEVNAME to use a port id of the hardware specific controller port instance instead of the port->line. For example, the 8250 driver sets up a number of serial8250 ports initially that can be inherited by the hardware specific driver. At that the port->line no longer decribes the port's relation to the serial core controller instance. Let's fix the issue by assigning port->port_id for each serial core controller port instance. Fixes: 7d695d83767c ("serial: core: Fix serial_base_match() after fixing controller port name") Tested-by: Guenter Roeck Reviewed-by: Dhruva Gole Signed-off-by: Tony Lindgren Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230811103648.2826-1-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit 3d9e6f556e235ddcdc9f73600fdd46fe1736b090 Author: Jiri Slaby (SUSE) Date: Fri Aug 11 08:43:40 2023 +0200 serial: 8250: drop lockdep annotation from serial8250_clear_IER() The port lock is not always held when calling serial8250_clear_IER(). When an oops is in progress, the lock is tried to be taken and when it is not, a warning is issued: WARNING: CPU: 0 PID: 1 at drivers/tty/serial/8250/8250_port.c:707 +0x57/0x60 Modules linked in: CPU: 0 PID: 1 Comm: init Not tainted 6.5.0-rc5-1.g225bfb7-default+ #774 00f1be860db663ed29479b8255d3b01ab1135bd3 Hardware name: QEMU Standard PC ... RIP: 0010:serial8250_clear_IER+0x57/0x60 ... Call Trace: serial8250_console_write+0x9e/0x4b0 console_flush_all+0x217/0x5f0 ... Therefore, remove the annotation as it doesn't hold for all invocations. The other option would be to make the lockdep test conditional on 'oops_in_progress' or pass 'locked' from serial8250_console_write(). I don't think, that is worth it. Signed-off-by: "Jiri Slaby (SUSE)" Reported-by: Vlastimil Babka Cc: John Ogness Fixes: d0b309a5d3f4 (serial: 8250: synchronize and annotate UART_IER access) Link: https://lore.kernel.org/r/20230811064340.13400-1-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3c4f8333b582487a2d1e02171f1465531cde53e3 Author: Yi Yang Date: Fri Aug 11 11:11:21 2023 +0800 tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux In commit 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux"), the UAF problem is not completely fixed. There is a race condition in gsm_cleanup_mux(), which caused this UAF. The UAF problem is triggered by the following race: task[5046] task[5054] ----------------------- ----------------------- gsm_cleanup_mux(); dlci = gsm->dlci[0]; mutex_lock(&gsm->mutex); gsm_cleanup_mux(); dlci = gsm->dlci[0]; //Didn't take the lock gsm_dlci_release(gsm->dlci[i]); gsm->dlci[i] = NULL; mutex_unlock(&gsm->mutex); mutex_lock(&gsm->mutex); dlci->dead = true; //UAF Fix it by assigning values after mutex_lock(). Link: https://syzkaller.appspot.com/text?tag=CrashReport&x=176188b5a80000 Cc: stable Fixes: 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux") Fixes: aa371e96f05d ("tty: n_gsm: fix restart handling via CLD command") Signed-off-by: Yi Yang Co-developed-by: Qiumiao Zhang Signed-off-by: Qiumiao Zhang Link: https://lore.kernel.org/r/20230811031121.153237-1-yiyang13@huawei.com Signed-off-by: Greg Kroah-Hartman commit 360e694282fce69608e2775bf843b2aafd19e4b4 Merge: 2e40ed24e1696 a7a7dabb5dd72 Author: Linus Torvalds Date: Fri Aug 11 12:14:08 2023 -0700 Merge tag 'block-6.5-2023-08-11' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith: - Fixes for request_queue state (Ming) - Another uuid quirk (August) - RCU poll fix for NVMe (Ming) - Fix for an IO stall with polled IO (me) - Fix for blk-iocost stats enable/disable accounting (Chengming) - Regression fix for large pages for zram (Christoph) * tag 'block-6.5-2023-08-11' of git://git.kernel.dk/linux: nvme: core: don't hold rcu read lock in nvme_ns_chr_uring_cmd_iopoll blk-iocost: fix queue stats accounting block: don't make REQ_POLLED imply REQ_NOWAIT block: get rid of unused plug->nowait flag zram: take device and not only bvec offset into account nvme-pci: add NVME_QUIRK_BOGUS_NID for Samsung PM9B1 256G and 512G nvme-rdma: fix potential unbalanced freeze & unfreeze nvme-tcp: fix potential unbalanced freeze & unfreeze nvme: fix possible hang when removing a controller during error recovery commit 2e40ed24e1696e47e94e804d09ef88ecb6617201 Merge: 9106536c1aa37 56675f8b9f9b1 Author: Linus Torvalds Date: Fri Aug 11 12:06:51 2023 -0700 Merge tag 'io_uring-6.5-2023-08-11' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "A followup fix for the parisc/SHM_COLOUR fix, also from Helge, which is heading to stable. And then just the io_uring equivalent of the RESOLVE_CACHED fix in commit a0fc452a5d7f from last week for build_open_flags()" * tag 'io_uring-6.5-2023-08-11' of git://git.kernel.dk/linux: io_uring/parisc: Adjust pgoff in io_uring mmap() for parisc io_uring: correct check for O_TMPFILE commit 3477144c878a52fc3938a529186e81ea030e7779 Author: Borislav Petkov (AMD) Date: Fri Aug 11 11:32:09 2023 +0200 driver core: cpu: Fix the fallback cpu_show_gds() name In 6524c798b727 ("driver core: cpu: Make cpu_show_not_affected() static") I fat-fingered the name of cpu_show_gds(). Usually, I'd rebase but since those are extraordinary embargoed times, the commit above was already pulled into another tree so no no. Therefore, fix it ontop. Fixes: 6524c798b727 ("driver core: cpu: Make cpu_show_not_affected() static") Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20230811095831.27513-1-bp@alien8.de commit 4778e1288447d9f90d87df07d195dc89e290d973 Merge: df2f7cde73cb5 5e720f8c8c9d9 Author: Rafael J. Wysocki Date: Fri Aug 11 19:57:24 2023 +0200 Merge branch 'pm-cpufreq' Merge a cpufreq fix for 6.5-rc6. This makes amd-pstate use device_attributes as expected by the CPU root kobject. * pm-cpufreq: cpufreq: amd-pstate: fix global sysfs attribute type commit 9106536c1aa37bcf60202ad93bb8b94bcd29f3f0 Merge: 2a3c17edbf538 cc22522fd55e2 Author: Linus Torvalds Date: Fri Aug 11 09:39:17 2023 -0700 Merge tag 'pci-v6.5-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Add Manivannan Sadhasivam as DesignWare PCIe driver co-maintainer (Krzysztof Wilczyński) - Revert "PCI: dwc: Wait for link up only if link is started" to fix a regression on Qualcomm platforms that don't reach interconnect sync state if the slot is empty (Johan Hovold) - Revert "PCI: mvebu: Mark driver as BROKEN" so people can use pci-mvebu even though some others report problems (Bjorn Helgaas) - Avoid a NULL pointer dereference when using acpiphp for root bus hotplug to fix a regression added in v6.5-rc1 (Igor Mammedov) * tag 'pci-v6.5-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus Revert "PCI: mvebu: Mark driver as BROKEN" Revert "PCI: dwc: Wait for link up only if link is started" MAINTAINERS: Add Manivannan Sadhasivam as DesignWare PCIe driver maintainer commit 2a3c17edbf53816ba61746c38833b48c73ee2a16 Merge: feb0eee9aa3c8 7e3811521dc39 Author: Linus Torvalds Date: Fri Aug 11 09:12:44 2023 -0700 Merge tag 'riscv-for-linus-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - Fixes for a pair of kexec_file_load() failures - A fix to ensure the direct mapping is PMD-aligned - A fix for CPU feature detection on SMP=n - The MMIO ordering fences have been strengthened to ensure ordering WRT delay() - Fixes for a pair of -Wmissing-variable-declarations warnings - A fix to avoid PUD mappings in vmap on sv39 - flush_cache_vmap() now flushes the TLB to avoid issues on systems that cache invalid mappings * tag 'riscv-for-linus-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Implement flush_cache_vmap() riscv: Do not allow vmap pud mappings for 3-level page table riscv: mm: fix 2 instances of -Wmissing-variable-declarations riscv,mmio: Fix readX()-to-delay() ordering riscv: Fix CPU feature detection with SMP disabled riscv: Start of DRAM should at least be aligned on PMD size for the direct mapping riscv/kexec: load initrd high in available memory riscv/kexec: handle R_RISCV_CALL_PLT relocation type commit feb0eee9aa3c85aa15e3b60f82cb8d1fae28f2fe Merge: 2a5482c284e09 d863066e6ce0a Author: Linus Torvalds Date: Fri Aug 11 09:07:23 2023 -0700 Merge tag 'parisc-for-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture fixes from Helge Deller: "A bugfix in the LWS code, which used different lock words than the parisc lightweight spinlock checks. This inconsistency triggered false positives when the lightweight spinlock checks checked the locks of mutexes. The other patches are trivial cleanups and most of them fix sparse warnings. Summary: - Fix LWS code to use same lock words as for the parisc lightweight spinlocks - Use PTR_ERR_OR_ZERO() in pdt init code - Fix lots of sparse warnings" * tag 'parisc-for-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: perf: Make cpu_device variable static parisc: ftrace: Add declaration for ftrace_function_trampoline() parisc: boot: Nuke some sparse warnings in decompressor parisc: processor: Include asm/smp.h for init_per_cpu() parisc: unaligned: Include linux/sysctl.h for unaligned_enabled parisc: Move proc_mckinley_root and proc_runway_root to sba_iommu parisc: dma: Add prototype for pcxl_dma_start parisc: parisc_ksyms: Include libgcc.h for libgcc prototypes parisc: ucmpdi2: Fix no previous prototype for '__ucmpdi2' warning parisc: firmware: Mark pdc_result buffers local parisc: firmware: Fix sparse context imbalance warnings parisc: signal: Fix sparse incorrect type in assignment warning parisc: ioremap: Fix sparse warnings parisc: fault: Use C99 arrary initializers parisc: pdt: Use PTR_ERR_OR_ZERO() to simplify code parisc: Fix lightweight spinlock checks to not break futexes commit 2a5482c284e09423face5a7ef571b85185f43a48 Merge: 9b1b1b74ddb23 12acb348fa452 Author: Linus Torvalds Date: Fri Aug 11 09:00:31 2023 -0700 Merge tag 'cpuidle-psci-v6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull cpuidle psci fixes from Ulf Hansson: "A couple of cpuidle-psci fixes. Usually, this is managed by arm-soc maintainers or Rafael, although due to a busy period I have stepped in to help out: - Fix the error path to prevent reverting from OSI back to PC mode" * tag 'cpuidle-psci-v6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: cpuidle: psci: Move enabling OSI mode after power domains creation cpuidle: dt_idle_genpd: Add helper function to remove genpd topology commit 9b1b1b74ddb236e7ccf6d11d4c0b642fbe0c66c6 Merge: 25aa0bebba72b fbe8ff726a1de Author: Linus Torvalds Date: Fri Aug 11 08:53:58 2023 -0700 Merge tag 'drm-fixes-2023-08-11' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "This week's fixes, as expected amdgpu is probably a little larger since it skipped a week, but otherwise a few nouveau fixes, a couple of bridge, rockchip and ivpu fixes. amdgpu: - S/G display workaround for platforms with >= 64G of memory - S0i3 fix - SMU 13.0.0 fixes - Disable SMU 13.x OD features temporarily while the interface is reworked to enable additional functionality - Fix cursor gamma issues on DCN3+ - SMU 13.0.6 fixes - Fix possible UAF in CS IOCTL - Polaris display regression fix - Only enable CP GFX shadowing on SR-IOV amdkfd: - Raven/Picasso KFD regression fix bridge: - it6505: runtime PM fix - lt9611: revert Do not generate HFP/HBP/HSA and EOT packet nouveau: - enable global memory loads for helper invocations for userspace driver - dp 1.3 dpcd+ workaround fix - remove unused function - revert incorrect NULL check accel/ivpu: - Add set_pages_array_wc/uc for internal buffers rockchip: - Don't spam logs in atomic check" * tag 'drm-fixes-2023-08-11' of git://anongit.freedesktop.org/drm/drm: (23 commits) drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap() drm/amdkfd: disable IOMMUv2 support for Raven drm/amdkfd: disable IOMMUv2 support for KV/CZ drm/amdkfd: ignore crat by default drm/amdgpu/gfx11: only enable CP GFX shadowing on SR-IOV drm/amd/display: Fix a regression on Polaris cards drm/amdgpu: fix possible UAF in amdgpu_cs_pass1() drm/amd/pm: Fix SMU v13.0.6 energy reporting drm/amd/display: check attr flag before set cursor degamma on DCN3+ drm/amd/pm: disable the SMU13 OD feature support temporarily drm/amd/pm: correct the pcie width for smu 13.0.0 drm/amd/display: Don't show stack trace for missing eDP drm/amdgpu: Match against exact bootloader status drm/amd/pm: skip the RLC stop when S0i3 suspend for SMU v13.0.4/11 drm/amd: Disable S/G for APUs when 64GB or more host memory drm/rockchip: Don't spam logs in atomic check accel/ivpu: Add set_pages_array_wc/uc for internal buffers drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes Revert "drm/bridge: lt9611: Do not generate HFP/HBP/HSA and EOT packet" drm/nouveau: remove unused tu102_gr_load() function ... commit 7c761166399bedfc89c928bef8015546d85a9099 Author: Stefan Binding Date: Fri Aug 11 13:30:44 2023 +0100 ALSA: hda/cs8409: Support new Dell Dolphin Variants Add 4 new Dell Dolphin Systems, same configuration as older systems. Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20230811123044.1045651-1-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit a7a7dabb5dd72d2875bc3ce56f94ea5ceb259d5b Author: Ming Lei Date: Wed Aug 9 10:04:40 2023 +0800 nvme: core: don't hold rcu read lock in nvme_ns_chr_uring_cmd_iopoll Now nvme_ns_chr_uring_cmd_iopoll() has switched to request based io polling, and the associated NS is guaranteed to be live in case of io polling, so request is guaranteed to be valid because blk-mq uses pre-allocated request pool. Remove the rcu read lock in nvme_ns_chr_uring_cmd_iopoll(), which isn't needed any more after switching to request based io polling. Fix "BUG: sleeping function called from invalid context" because set_page_dirty_lock() from blk_rq_unmap_user() may sleep. Fixes: 585079b6e425 ("nvme: wire up async polling for io passthrough commands") Reported-by: Guangwu Zhang Cc: Kanchan Joshi Cc: Anuj Gupta Signed-off-by: Ming Lei Tested-by: Guangwu Zhang Link: https://lore.kernel.org/r/20230809020440.174682-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 829c6524d6729d05a82575dbcc16f99be5ee843d Author: Xiang Yang Date: Thu Aug 10 22:06:39 2023 +0800 net: pcs: Add missing put_device call in miic_create The reference of pdev->dev is taken by of_find_device_by_node, so it should be released when not need anymore. Fixes: 7dc54d3b8d91 ("net: pcs: add Renesas MII converter driver") Signed-off-by: Xiang Yang Reviewed-by: Vladimir Oltean Signed-off-by: David S. Miller commit 51b813176f098ff61bd2833f627f5319ead098a5 Author: Jason Wang Date: Wed Aug 9 23:12:56 2023 -0400 virtio-net: set queues after driver_ok Commit 25266128fe16 ("virtio-net: fix race between set queues and probe") tries to fix the race between set queues and probe by calling _virtnet_set_queues() before DRIVER_OK is set. This violates virtio spec. Fixing this by setting queues after virtio_device_ready(). Note that rtnl needs to be held for userspace requests to change the number of queues. So we are serialized in this way. Fixes: 25266128fe16 ("virtio-net: fix race between set queues and probe") Reported-by: Dragos Tatulea Acked-by: Michael S. Tsirkin Signed-off-by: Jason Wang Signed-off-by: David S. Miller commit fbe8ff726a1de82d87524f306b0f6491e13d7dfa Merge: 8ba371c778cbb 091ae5473f96c Author: Dave Airlie Date: Fri Aug 11 14:49:17 2023 +1000 Merge tag 'amd-drm-fixes-6.5-2023-08-09' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.5-2023-08-09: amdgpu: - S/G display workaround for platforms with >= 64G of memory - S0i3 fix - SMU 13.0.0 fixes - Disable SMU 13.x OD features temporarily while the interface is reworked to enable additional functionality - Fix cursor gamma issues on DCN3+ - SMU 13.0.6 fixes - Fix possible UAF in CS IOCTL - Polaris display regression fix - Only enable CP GFX shadowing on SR-IOV amdkfd: - Raven/Picasso KFD regression fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230809182827.8135-1-alexander.deucher@amd.com commit 8ba371c778cbb3f0399b8ba8919bf89e462cdda3 Merge: 52a93d39b17dc 07dd476f61169 Author: Dave Airlie Date: Fri Aug 11 13:56:20 2023 +1000 Merge tag 'drm-misc-fixes-2023-08-10' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Multiple fixes for nouveau around memory safety and DisplayPort, one fix to reduce the log level of rockchip, a power state fix for the it6505 bridge, a timing fix for the lt9611 bridge, a cache maintenance fix for ivpu and one to reset vma->vm_ops on mmap for shmem-helper. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/fwed6gzdtkse5ocrgd37elhyw7qirfptsvfp5mqqverdzifhxj@4da3vesxcqp2 commit e8f5f849ffce24490eb9449e98312b66c0dba76f Author: Steve French Date: Thu Aug 10 15:34:21 2023 -0500 cifs: fix potential oops in cifs_oplock_break With deferred close we can have closes that race with lease breaks, and so with the current checks for whether to send the lease response, oplock_response(), this can mean that an unmount (kill_sb) can occur just before we were checking if the tcon->ses is valid. See below: [Fri Aug 4 04:12:50 2023] RIP: 0010:cifs_oplock_break+0x1f7/0x5b0 [cifs] [Fri Aug 4 04:12:50 2023] Code: 7d a8 48 8b 7d c0 c0 e9 02 48 89 45 b8 41 89 cf e8 3e f5 ff ff 4c 89 f7 41 83 e7 01 e8 82 b3 03 f2 49 8b 45 50 48 85 c0 74 5e <48> 83 78 60 00 74 57 45 84 ff 75 52 48 8b 43 98 48 83 eb 68 48 39 [Fri Aug 4 04:12:50 2023] RSP: 0018:ffffb30607ddbdf8 EFLAGS: 00010206 [Fri Aug 4 04:12:50 2023] RAX: 632d223d32612022 RBX: ffff97136944b1e0 RCX: 0000000080100009 [Fri Aug 4 04:12:50 2023] RDX: 0000000000000001 RSI: 0000000080100009 RDI: ffff97136944b188 [Fri Aug 4 04:12:50 2023] RBP: ffffb30607ddbe58 R08: 0000000000000001 R09: ffffffffc08e0900 [Fri Aug 4 04:12:50 2023] R10: 0000000000000001 R11: 000000000000000f R12: ffff97136944b138 [Fri Aug 4 04:12:50 2023] R13: ffff97149147c000 R14: ffff97136944b188 R15: 0000000000000000 [Fri Aug 4 04:12:50 2023] FS: 0000000000000000(0000) GS:ffff9714f7c00000(0000) knlGS:0000000000000000 [Fri Aug 4 04:12:50 2023] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [Fri Aug 4 04:12:50 2023] CR2: 00007fd8de9c7590 CR3: 000000011228e000 CR4: 0000000000350ef0 [Fri Aug 4 04:12:50 2023] Call Trace: [Fri Aug 4 04:12:50 2023] [Fri Aug 4 04:12:50 2023] process_one_work+0x225/0x3d0 [Fri Aug 4 04:12:50 2023] worker_thread+0x4d/0x3e0 [Fri Aug 4 04:12:50 2023] ? process_one_work+0x3d0/0x3d0 [Fri Aug 4 04:12:50 2023] kthread+0x12a/0x150 [Fri Aug 4 04:12:50 2023] ? set_kthread_struct+0x50/0x50 [Fri Aug 4 04:12:50 2023] ret_from_fork+0x22/0x30 [Fri Aug 4 04:12:50 2023] To fix this change the ordering of the checks before sending the oplock_response to first check if the openFileList is empty. Fixes: da787d5b7498 ("SMB3: Do not send lease break acknowledgment if all file handles have been closed") Suggested-by: Bharath SM Reviewed-by: Bharath SM Reviewed-by: Shyam Prasad N Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 9ebbb29db9cae23e29881b9a268767d4baa53cdb Merge: 25aa0bebba72b eb3515dc99c7c Author: Jakub Kicinski Date: Thu Aug 10 18:18:24 2023 -0700 Merge branch 'x86/bugs' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Cross merge x86 fixes to fix clang linking errors: ld.lld: error: ./arch/x86/kernel/vmlinux.lds:221: at least one side of the expression must be absolute These will hopefully be downstream by the time we ship the next batch of fixes. * 'x86/bugs' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86: Move gds_ucode_mitigated() declaration to header x86/speculation: Add cpu_show_gds() prototype driver core: cpu: Make cpu_show_not_affected() static x86/srso: Fix build breakage with the LLVM linker Documentation/srso: Document IBPB aspect and fix formatting driver core: cpu: Unify redundant silly stubs Documentation/hw-vuln: Unify filename specification in index Link: https://lore.kernel.org/all/CAHk-=wj_b+FGTnevQSBAtCWuhCk=0oQ_THvthBW2hzqpOTLFmg@mail.gmail.com/ Signed-off-by: Jakub Kicinski commit d863066e6ce0a70c479a7f618088912ac0ba44ac Author: Helge Deller Date: Thu Aug 10 23:00:18 2023 +0200 parisc: perf: Make cpu_device variable static Signed-off-by: Helge Deller commit 2794f8ecb483b680610968423179005758a5ce63 Author: Helge Deller Date: Thu Aug 10 22:51:54 2023 +0200 parisc: ftrace: Add declaration for ftrace_function_trampoline() Make sparse happy by adding declaration for ftrace_function_trampoline(). Signed-off-by: Helge Deller commit b967f48d0240fa9b3ac0bfd7135647985016826e Author: Helge Deller Date: Thu Aug 10 22:42:57 2023 +0200 parisc: boot: Nuke some sparse warnings in decompressor Signed-off-by: Helge Deller commit 2c9227fd1c7e508f55eb4a38e8205f317e7c4ac9 Author: Helge Deller Date: Thu Aug 10 22:32:24 2023 +0200 parisc: processor: Include asm/smp.h for init_per_cpu() Fix sparse warning that init_per_cpu() isn't declared. Signed-off-by: Helge Deller commit 66f80386a99f2773611e1b537ad045061fdd92ec Author: Helge Deller Date: Thu Aug 10 20:23:01 2023 +0200 parisc: unaligned: Include linux/sysctl.h for unaligned_enabled Fix sparse warning that unaligned_enabled wasn't declared. Signed-off-by: Helge Deller commit 547259580dfa9a5d345dd1b46fd5e9977654c1cc Author: Helge Deller Date: Thu Aug 10 19:56:19 2023 +0200 parisc: Move proc_mckinley_root and proc_runway_root to sba_iommu Clean up the procfs root entries for gsc, runway, and mckinley busses. Signed-off-by: Helge Deller commit f55484fd7be923b740e8e1fc304070ba53675cb4 Author: David Hildenbrand Date: Thu Jul 13 16:55:51 2023 +0200 virtio-mem: check if the config changed before fake offlining memory If we repeatedly fail to fake offline memory to unplug it, we won't be sending any unplug requests to the device. However, we only check if the config changed when sending such (un)plug requests. We could end up trying for a long time to unplug memory, even though the config changed already and we're not supposed to unplug memory anymore. For example, the hypervisor might detect a low-memory situation while unplugging memory and decide to replug some memory. Continuing trying to unplug memory in that case can be problematic. So let's check on a more regular basis. Signed-off-by: David Hildenbrand Message-Id: <20230713145551.2824980-5-david@redhat.com> Signed-off-by: Michael S. Tsirkin commit a31648fd4f96fbe0a4d0aeb16b57a2405c6943c0 Author: David Hildenbrand Date: Thu Jul 13 16:55:50 2023 +0200 virtio-mem: keep retrying on offline_and_remove_memory() errors in Sub Block Mode (SBM) In case offline_and_remove_memory() fails in SBM, we leave a completely unplugged Linux memory block stick around until we try plugging memory again. We won't try removing that memory block again. offline_and_remove_memory() may, for example, fail if we're racing with another alloc_contig_range() user, if allocating temporary memory fails, or if some memory notifier rejected the offlining request. Let's handle that case better, by simple retrying to offline and remove such memory. Tested using CONFIG_MEMORY_NOTIFIER_ERROR_INJECT. Signed-off-by: David Hildenbrand Message-Id: <20230713145551.2824980-4-david@redhat.com> Signed-off-by: Michael S. Tsirkin commit ddf409851461f515cc32974714b73efe2e012bde Author: David Hildenbrand Date: Thu Jul 13 16:55:49 2023 +0200 virtio-mem: convert most offline_and_remove_memory() errors to -EBUSY Just like we do with alloc_contig_range(), let's convert all unknown errors to -EBUSY, but WARN so we can look into the issue. For example, offline_pages() could fail with -EINTR, which would be unexpected in our case. Signed-off-by: David Hildenbrand Message-Id: <20230713145551.2824980-3-david@redhat.com> Signed-off-by: Michael S. Tsirkin commit f504e15b94eb4e5b47f8715da59c0207f68dffe1 Author: David Hildenbrand Date: Thu Jul 13 16:55:48 2023 +0200 virtio-mem: remove unsafe unplug in Big Block Mode (BBM) When "unsafe unplug" is enabled, we don't fake-offline all memory ahead of actual memory offlining using alloc_contig_range(). Instead, we rely on offline_pages() to also perform actual page migration, which might fail or take a very long time. In that case, it's possible to easily run into endless loops that cannot be aborted anymore (as offlining is triggered by a workqueue then): For example, a single (accidentally) permanently unmovable page in ZONE_MOVABLE results in an endless loop. For ZONE_NORMAL, races between isolating the pageblock (and checking for unmovable pages) and concurrent page allocation are possible and similarly result in endless loops. The idea of the unsafe unplug mode was to make it possible to more reliably unplug large memory blocks. However, (a) we really should be tackling that differently, by extending the alloc_contig_range()-based mechanism; and (b) this mode is not the default and as far as I know, it's unused either way. So let's simply get rid of it. Signed-off-by: David Hildenbrand Message-Id: <20230713145551.2824980-2-david@redhat.com> Signed-off-by: Michael S. Tsirkin commit 8efc365b20dc9a5b0c8fd0e8a195690bf21cd8be Author: Shannon Nelson Date: Mon Jul 10 21:24:37 2023 -0700 pds_vdpa: fix up debugfs feature bit printing Make clearer in debugfs output the difference between the hw feature bits, the features supported through the driver, and the features that have been negotiated. Signed-off-by: Shannon Nelson Message-Id: <20230711042437.69381-6-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit c0a6c5cbf1a9e49357e942ed393da08a55808a49 Author: Allen Hubbe Date: Mon Jul 10 21:24:36 2023 -0700 pds_vdpa: alloc irq vectors on DRIVER_OK We were allocating irq vectors at the time the aux dev was probed, but that is before the PCI VF is assigned to a separate iommu domain by vhost_vdpa. Because vhost_vdpa later changes the iommu domain the interrupts do not work. Instead, we can allocate the irq vectors later when we see DRIVER_OK and know that the reassignment of the PCI VF to an iommu domain has already happened. Fixes: 151cc834f3dd ("pds_vdpa: add support for vdpa and vdpamgmt interfaces") Signed-off-by: Allen Hubbe Signed-off-by: Shannon Nelson Acked-by: Jason Wang Message-Id: <20230711042437.69381-5-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin commit ed88863040daad18d3f9b12f7c9c1c3da3731e1f Author: Shannon Nelson Date: Mon Jul 10 21:24:35 2023 -0700 pds_vdpa: clean and reset vqs entries Make sure that we initialize the vqs[] entries the same way both for initial setup and after a vq reset. Fixes: 151cc834f3dd ("pds_vdpa: add support for vdpa and vdpamgmt interfaces") Signed-off-by: Shannon Nelson Message-Id: <20230711042437.69381-4-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit abdf31bd91120035172dc58e2e87064a72e9e087 Author: Shannon Nelson Date: Mon Jul 10 21:24:34 2023 -0700 pds_vdpa: always allow offering VIRTIO_NET_F_MAC Our driver sets a mac if the HW is 00:..:00 so we need to be sure to advertise VIRTIO_NET_F_MAC even if the HW doesn't. We also need to be sure that virtio_net sees the VIRTIO_NET_F_MAC and doesn't rewrite the mac address that a user may have set with the vdpa utility. After reading the hw_feature bits, add the VIRTIO_NET_F_MAC to the driver's supported_features and use that for reporting what is available. If the HW is not advertising it, be sure to strip the VIRTIO_NET_F_MAC before finishing the feature negotiation. If the user specifies a device_features bitpattern in the vdpa utility without the VIRTIO_NET_F_MAC set, then don't set the mac. Fixes: 151cc834f3dd ("pds_vdpa: add support for vdpa and vdpamgmt interfaces") Signed-off-by: Shannon Nelson Message-Id: <20230711042437.69381-3-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 0cd2c13b1c15dbbdf1e2ae5b7160537f97df06b5 Author: Allen Hubbe Date: Mon Jul 10 21:24:33 2023 -0700 pds_vdpa: reset to vdpa specified mac When the vdpa device is reset, also reinitialize it with the mac address that was assigned when the device was added. Fixes: 151cc834f3dd ("pds_vdpa: add support for vdpa and vdpamgmt interfaces") Signed-off-by: Allen Hubbe Signed-off-by: Shannon Nelson Message-Id: <20230711042437.69381-2-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 2c507ce90e02cd78d00fd4b0fe26c8641873c13f Author: Hawkins Jiawei Date: Thu Aug 10 19:04:05 2023 +0800 virtio-net: Zero max_tx_vq field for VIRTIO_NET_CTRL_MQ_HASH_CONFIG case Kernel uses `struct virtio_net_ctrl_rss` to save command-specific-data for both the VIRTIO_NET_CTRL_MQ_HASH_CONFIG and VIRTIO_NET_CTRL_MQ_RSS_CONFIG commands. According to the VirtIO standard, "Field reserved MUST contain zeroes. It is defined to make the structure to match the layout of virtio_net_rss_config structure, defined in 5.1.6.5.7.". Yet for the VIRTIO_NET_CTRL_MQ_HASH_CONFIG command case, the `max_tx_vq` field in struct virtio_net_ctrl_rss, which corresponds to the `reserved` field in struct virtio_net_hash_config, is not zeroed, thereby violating the VirtIO standard. This patch solves this problem by zeroing this field in virtnet_init_default_rss(). Cc: Andrew Melnychenko Cc: stable@vger.kernel.org Fixes: c7114b1249fa ("drivers/net/virtio_net: Added basic RSS support.") Signed-off-by: Hawkins Jiawei Acked-by: Jason Wang Acked-by: Eugenio Pérez Acked-by: Michael S. Tsirkin Message-Id: <20230810110405.25558-1-yin31149@gmail.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo Acked-by: Jason Wang commit 25aa0bebba72b318e71fe205bfd1236550cc9534 Merge: 30813656c6b82 5e3d20617b055 Author: Linus Torvalds Date: Thu Aug 10 12:37:24 2023 -0700 Merge tag 'net-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter, wireless and bpf. Still trending up in size but the good news is that the "current" regressions are resolved, AFAIK. We're getting weirdly many fixes for Wake-on-LAN and suspend/resume handling on embedded this week (most not merged yet), not sure why. But those are all for older bugs. Current release - regressions: - tls: set MSG_SPLICE_PAGES consistently when handing encrypted data over to TCP Current release - new code bugs: - eth: mlx5: correct IDs on VFs internal to the device (IPU) Previous releases - regressions: - phy: at803x: fix WoL support / reporting on AR8032 - bonding: fix incorrect deletion of ETH_P_8021AD protocol VID from slaves, leading to BUG_ON() - tun: prevent tun_build_skb() from exceeding the packet size limit - wifi: rtw89: fix 8852AE disconnection caused by RX full flags - eth/PCI: enetc: fix probing after 6fffbc7ae137 ("PCI: Honor firmware's device disabled status"), keep PCI devices around even if they are disabled / not going to be probed to be able to apply quirks on them - eth: prestera: fix handling IPv4 routes with nexthop IDs Previous releases - always broken: - netfilter: re-work garbage collection to avoid races between user-facing API and timeouts - tunnels: fix generating ipv4 PMTU error on non-linear skbs - nexthop: fix infinite nexthop bucket dump when using maximum nexthop ID - wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() Misc: - unix: use consistent error code in SO_PEERPIDFD - ipv6: adjust ndisc_is_useropt() to include PREFIX_INFO, in prep for upcoming IETF RFC" * tag 'net-6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (94 commits) net: hns3: fix strscpy causing content truncation issue net: tls: set MSG_SPLICE_PAGES consistently ibmvnic: Ensure login failure recovery is safe from other resets ibmvnic: Do partial reset on login failure ibmvnic: Handle DMA unmapping of login buffs in release functions ibmvnic: Unmap DMA login rsp buffer on send login fail ibmvnic: Enforce stronger sanity checks on login response net: mana: Fix MANA VF unload when hardware is unresponsive netfilter: nf_tables: remove busy mark and gc batch API netfilter: nft_set_hash: mark set element as dead when deleting from packet path netfilter: nf_tables: adapt set backend to use GC transaction API netfilter: nf_tables: GC transaction API to avoid race with control plane selftests/bpf: Add sockmap test for redirecting partial skb data selftests/bpf: fix a CI failure caused by vsock sockmap test bpf, sockmap: Fix bug that strp_done cannot be called bpf, sockmap: Fix map type error in sock_map_del_link xsk: fix refcount underflow in error path ipv6: adjust ndisc_is_useropt() to also return true for PIO selftests: forwarding: bridge_mdb: Make test more robust selftests: forwarding: bridge_mdb_max: Fix failing test with old libnet ... commit 64b632654b97319b253c2c902fe4c11349aaa70f Author: Kashyap Desai Date: Wed Aug 9 21:44:37 2023 -0700 RDMA/bnxt_re: Initialize dpi_tbl_lock mutex Fix the missing dpi_tbl_lock mutex initialization. Fixes: 0ac20faf5d83 ("RDMA/bnxt_re: Reorg the bar mapping") Link: https://lore.kernel.org/r/1691642677-21369-4-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Kashyap Desai Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 5ac8480ae4d01f0ca5dfd561884424046df2478a Author: Kalesh AP Date: Wed Aug 9 21:44:36 2023 -0700 RDMA/bnxt_re: Fix error handling in probe failure path During bnxt_re_dev_init(), when bnxt_re_setup_chip_ctx() fails unregister with L2 first before bailing out probe. Fixes: ae8637e13185 ("RDMA/bnxt_re: Add chip context to identify 57500 series") Link: https://lore.kernel.org/r/1691642677-21369-3-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Kalesh AP Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 5363fc488da579923edf6a2fdca3d3b651dd800b Author: Selvin Xavier Date: Wed Aug 9 21:44:35 2023 -0700 RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF ib_dealloc_device() should be called only after device cleanup. Fix the dealloc sequence. Fixes: 6d758147c7b8 ("RDMA/bnxt_re: Use auxiliary driver interface") Link: https://lore.kernel.org/r/1691642677-21369-2-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 810b0cc1c28a9b8d055dd8f7d85975e3cf9f4430 Author: Dragos Tatulea Date: Thu Aug 3 18:26:33 2023 +0300 vdpa/mlx5: Fix crash on shutdown for when no ndev exists The ndev was accessed on shutdown without a check if it actually exists. This triggered the crash pasted below. Instead of doing the ndev check, delete the shutdown handler altogether. The irqs will be released at the parent VF level (mlx5_core). BUG: kernel NULL pointer dereference, address: 0000000000000300 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted 6.5.0-rc2_for_upstream_min_debug_2023_07_17_15_05 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:mlx5v_shutdown+0xe/0x50 [mlx5_vdpa] RSP: 0018:ffff8881003bfdc0 EFLAGS: 00010286 RAX: ffff888103befba0 RBX: ffff888109d28008 RCX: 0000000000000017 RDX: 0000000000000001 RSI: 0000000000000212 RDI: ffff888109d28000 RBP: 0000000000000000 R08: 0000000d3a3a3882 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888109d28000 R13: ffff888109d28080 R14: 00000000fee1dead R15: 0000000000000000 FS: 00007f4969e0be40(0000) GS:ffff88852c800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000300 CR3: 00000001051cd006 CR4: 0000000000370eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? __die+0x20/0x60 ? page_fault_oops+0x14c/0x3c0 ? exc_page_fault+0x75/0x140 ? asm_exc_page_fault+0x22/0x30 ? mlx5v_shutdown+0xe/0x50 [mlx5_vdpa] device_shutdown+0x13e/0x1e0 kernel_restart+0x36/0x90 __do_sys_reboot+0x141/0x210 ? vfs_writev+0xcd/0x140 ? handle_mm_fault+0x161/0x260 ? do_writev+0x6b/0x110 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f496990fb56 RSP: 002b:00007fffc7bdde88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a9 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f496990fb56 RDX: 0000000001234567 RSI: 0000000028121969 RDI: fffffffffee1dead RBP: 00007fffc7bde1d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 00007fffc7bddf10 R14: 0000000000000000 R15: 00007fffc7bde2b8 CR2: 0000000000000300 ---[ end trace 0000000000000000 ]--- Fixes: bc9a2b3e686e ("vdpa/mlx5: Support interrupt bypassing") Signed-off-by: Dragos Tatulea Message-Id: <20230803152648.199297-1-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin commit ad03a0f44cdb97b46e5c84ed353dac9b8ae2c276 Author: Eugenio Pérez Date: Wed Aug 2 20:12:20 2023 +0300 vdpa/mlx5: Delete control vq iotlb in destroy_mr only when necessary mlx5_vdpa_destroy_mr can be called from .set_map with data ASID after the control virtqueue ASID iotlb has been populated. The control vq iotlb must not be cleared, since it will not be populated again. So call the ASID aware destroy function which makes sure that the right vq resource is destroyed. Fixes: 8fcd20c30704 ("vdpa/mlx5: Support different address spaces for control and data") Signed-off-by: Eugenio Pérez Reviewed-by: Gal Pressman Message-Id: <20230802171231.11001-5-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 9ee811009ad8f87982b69e61d07447d12233ad01 Author: Dragos Tatulea Date: Wed Aug 2 20:12:18 2023 +0300 vdpa/mlx5: Fix mr->initialized semantics The mr->initialized flag is shared between the control vq and data vq part of the mr init/uninit. But if the control vq and data vq get placed in different ASIDs, it can happen that initializing the control vq will prevent the data vq mr from being initialized. This patch consolidates the control and data vq init parts into their own init functions. The mr->initialized will now be used for the data vq only. The control vq currently doesn't need a flag. The uninitializing part is also taken care of: mlx5_vdpa_destroy_mr got split into data and control vq functions which are now also ASID aware. Fixes: 8fcd20c30704 ("vdpa/mlx5: Support different address spaces for control and data") Signed-off-by: Dragos Tatulea Reviewed-by: Eugenio Pérez Reviewed-by: Gal Pressman Message-Id: <20230802171231.11001-3-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 3fe024193340b225d1fd410d78c495434a9d68e0 Author: Dragos Tatulea Date: Thu Jul 27 20:23:46 2023 +0300 vdpa/mlx5: Correct default number of queues when MQ is on The standard specifies that the initial number of queues is the default, which is 1 (1 tx, 1 rx). Signed-off-by: Dragos Tatulea Reviewed-by: Eugenio Pérez Message-Id: <20230727172354.68243-2-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Tested-by: Lei Yang commit df9557046440b0a62250fee3169a8f6a139f55a6 Author: Gal Pressman Date: Wed Jul 26 22:10:07 2023 +0300 virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs() Free the cpumask allocated by create_affinity_masks() before returning from the function. Fixes: 3dad56823b53 ("virtio-vdpa: Support interrupt affinity spreading mechanism") Signed-off-by: Gal Pressman Reviewed-by: Dragos Tatulea Message-Id: <20230726191036.14324-1-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Reviewed-by: Xie Yongji commit 7ca26efb09a1543fddb29308ea3b63b66cb5d3ee Author: Maxime Coquelin Date: Wed Jul 5 13:45:05 2023 +0200 vduse: Use proper spinlock for IRQ injection The IRQ injection work used spin_lock_irq() to protect the scheduling of the softirq, but spin_lock_bh() should be used. With spin_lock_irq(), we noticed delay of more than 6 seconds between the time a NAPI polling work is scheduled and the time it is executed. Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace") Cc: xieyongji@bytedance.com Suggested-by: Jason Wang Signed-off-by: Maxime Coquelin Message-Id: <20230705114505.63274-1-maxime.coquelin@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Reviewed-by: Xie Yongji commit f46c1e1620c6bbc9aad5693082efd1b80822e97c Author: Dragos Tatulea Date: Thu Jul 27 20:57:54 2023 +0300 vdpa: Enable strict validation for netlinks ops The previous patches added the missing nla policies that were required for validation to work. Now strict validation on netlink ops can be enabled. This patch does it. Signed-off-by: Dragos Tatulea Cc: stable@vger.kernel.org Message-Id: <20230727175757.73988-9-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 5d6ba607d6cb5c58a4ddf33381e18c83dbb4098f Author: Lin Ma Date: Thu Jul 27 20:57:52 2023 +0300 vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops. That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773. This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs. Fixes: ad69dd0bf26b ("vdpa: Introduce query of device config layout") Signed-off-by: Lin Ma Cc: stable@vger.kernel.org Message-Id: <20230727175757.73988-7-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin commit b3003e1b54e057f5f3124e437b80c3bef26ed3fe Author: Lin Ma Date: Thu Jul 27 20:57:50 2023 +0300 vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops. That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773. This patch adds the missing nla_policy for vdpa queue index attr to avoid such bugs. Fixes: 13b00b135665 ("vdpa: Add support for querying vendor statistics") Signed-off-by: Lin Ma Cc: stable@vger.kernelorg Message-Id: <20230727175757.73988-5-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 79c8651587504ba263d2fd67fd4406240fb21f69 Author: Lin Ma Date: Thu Jul 27 20:57:48 2023 +0300 vdpa: Add features attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops. That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773. This patch adds the missing nla_policy for vdpa features attr to avoid such bugs. Fixes: 90fea5a800c3 ("vdpa: device feature provisioning") Signed-off-by: Lin Ma Cc: stable@vger.kernel.org Message-Id: <20230727175757.73988-3-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 13f3efaca024e16ccfab0e8b2cf29d66489d8d54 Author: Feng Liu Date: Wed Jul 19 11:45:50 2023 -0400 virtio-pci: Fix legacy device flag setting error in probe The 'is_legacy' flag is used to differentiate between legacy vs modern device. Currently, it is based on the value of vp_dev->ldev.ioaddr. However, due to the shared memory of the union between struct virtio_pci_legacy_device and struct virtio_pci_modern_device, when virtio_pci_modern_probe modifies the content of struct virtio_pci_modern_device, it affects the content of struct virtio_pci_legacy_device, and ldev.ioaddr is no longer zero, causing the 'is_legacy' flag to be set as true. To resolve issue, when legacy device is probed, mark 'is_legacy' as true, when modern device is probed, keep 'is_legacy' as false. Fixes: 4f0fc22534e3 ("virtio_pci: Optimize virtio_pci_device structure size") Signed-off-by: Feng Liu Reviewed-by: Parav Pandit Reviewed-by: Jiri Pirko Message-Id: <20230719154550.79536-1-feliu@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo Acked-by: Jason Wang commit 8d4bdf11f096e5b343ee0f9aaa8c262dc16d2e1e Author: Mike Christie Date: Sat Jul 15 09:20:27 2023 -0500 MAINTAINERS: add vhost-scsi entry and myself as a co-maintainer I've been doing a lot of the development on vhost-scsi the last couple of years, so per Michael T's suggestion this adds me as co-maintainer. Signed-off-by: Mike Christie Message-Id: <20230715142027.5572-1-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Acked-by: Stefano Garzarella Acked-by: Stefan Hajnoczi commit c5ace19efb0ac884a9a417e2a1499ce9849bdaa5 Author: Mike Christie Date: Sun Jul 9 15:28:59 2023 -0500 vhost-scsi: Rename vhost_scsi_iov_to_sgl Rename vhost_scsi_iov_to_sgl to vhost_scsi_map_iov_to_sgl so it matches matches the naming style used for vhost_scsi_copy_iov_to_sgl. Signed-off-by: Mike Christie Message-Id: <20230709202859.138387-3-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin Acked-by: Stefan Hajnoczi commit 5ced58bfa132c8ba0f9c893eb621595a84cfee12 Author: Mike Christie Date: Sun Jul 9 15:28:58 2023 -0500 vhost-scsi: Fix alignment handling with windows The linux block layer requires bios/requests to have lengths with a 512 byte alignment. Some drivers/layers like dm-crypt and the directi IO code will test for it and just fail. Other drivers like SCSI just assume the requirement is met and will end up in infinte retry loops. The problem for drivers like SCSI is that it uses functions like blk_rq_cur_sectors and blk_rq_sectors which divide the request's length by 512. If there's lefovers then it just gets dropped. But other code in the block/scsi layer may use blk_rq_bytes/blk_rq_cur_bytes and end up thinking there is still data left and try to retry the cmd. We can then end up getting stuck in retry loops where part of the block/scsi thinks there is data left, but other parts think we want to do IOs of zero length. Linux will always check for alignment, but windows will not. When vhost-scsi then translates the iovec it gets from a windows guest to a scatterlist, we can end up with sg items where the sg->length is not divisible by 512 due to the misaligned offset: sg[0].offset = 255; sg[0].length = 3841; sg... sg[N].offset = 0; sg[N].length = 255; When the lio backends then convert the SG to bios or other iovecs, we end up sending them with the same misaligned values and can hit the issues above. This just has us drop down to allocating a temp page and copying the data when we detect a misaligned buffer and the IO is large enough that it will get split into multiple bad IOs. Signed-off-by: Mike Christie Message-Id: <20230709202859.138387-2-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin Acked-by: Stefan Hajnoczi commit 9ad1a29cb0991e3145996cdce691525e8ac65db7 Author: Shannon Nelson Date: Thu Jul 6 16:17:18 2023 -0700 pds_vdpa: protect Makefile from unconfigured debugfs debugfs.h protects itself from an undefined DEBUG_FS, so it is not necessary to check it in the driver code or the Makefile. The driver code had been updated for this, but the Makefile had missed the update. Link: https://lore.kernel.org/linux-next/fec68c3c-8249-7af4-5390-0495386a76f9@infradead.org/ Fixes: a16291b5bcbb ("pds_vdpa: Add new vDPA driver for AMD/Pensando DSC") Signed-off-by: Shannon Nelson Message-Id: <20230706231718.54198-1-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap # build-tested Acked-by: Jason Wang commit 55c91fedd03d7b9cf0c5199b2eb12b9b8e95281a Author: Wolfram Sang Date: Thu Jun 29 14:05:26 2023 +0200 virtio-mmio: don't break lifecycle of vm_dev vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct. Allocating the vm_dev struct with devres totally breaks this protection, though. Instead of waiting for the vm_dev release callback, the memory is freed when the platform_device is removed. Resulting in a use-after-free when finally the callback is to be called. To easily see the problem, compile the kernel with CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs. The fix is easy, don't use devres in this case. Found during my research about object lifetime problems. Fixes: 7eb781b1bbb7 ("virtio_mmio: add cleanup for virtio_mmio_probe") Signed-off-by: Wolfram Sang Message-Id: <20230629120526.7184-1-wsa+renesas@sang-engineering.com> Signed-off-by: Michael S. Tsirkin commit 5e3d20617b055e725e785e0058426368269949f3 Author: Hao Chen Date: Wed Aug 9 10:09:02 2023 +0800 net: hns3: fix strscpy causing content truncation issue hns3_dbg_fill_content()/hclge_dbg_fill_content() is aim to integrate some items to a string for content, and we add '\n' and '\0' in the last two bytes of content. strscpy() will add '\0' in the last byte of destination buffer(one of items), it result in finishing content print ahead of schedule and some dump content truncation. One Error log shows as below: cat mac_list/uc UC MAC_LIST: Expected: UC MAC_LIST: FUNC_ID MAC_ADDR STATE pf 00:2b:19:05:03:00 ACTIVE The destination buffer is length-bounded and not required to be NUL-terminated, so just change strscpy() to memcpy() to fix it. Fixes: 1cf3d5567f27 ("net: hns3: fix strncpy() not using dest-buf length as length issue") Signed-off-by: Hao Chen Signed-off-by: Jijie Shao Link: https://lore.kernel.org/r/20230809020902.1941471-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 6b486676b41c369fe822fe65771ffda7eeb3ea6f Author: Jakub Kicinski Date: Tue Aug 8 11:09:17 2023 -0700 net: tls: set MSG_SPLICE_PAGES consistently We used to change the flags for the last segment, because non-last segments had the MSG_SENDPAGE_NOTLAST flag set. That flag is no longer a thing so remove the setting. Since flags most likely don't have MSG_SPLICE_PAGES set this avoids passing parts of the sg as splice and parts as non-splice. Before commit under Fixes we'd have called tcp_sendpage() which would add the MSG_SPLICE_PAGES. Why this leads to trouble remains unclear but Tariq reports hitting the WARN_ON(!sendpage_ok()) due to page refcount of 0. Fixes: e117dcfd646e ("tls: Inline do_tcp_sendpages()") Reported-by: Tariq Toukan Link: https://lore.kernel.org/all/4c49176f-147a-4283-f1b1-32aac7b4b996@gmail.com/ Tested-by: Tariq Toukan Link: https://lore.kernel.org/r/20230808180917.1243540-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 30813656c6b827947be024484d6da8b18e50c186 Merge: 374a7f47bf401 422dbc66b7702 Author: Linus Torvalds Date: Thu Aug 10 11:32:26 2023 -0700 Merge tag 'dmaengine-fix-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: - HAS_IOMEM fixes for fsl edma and intel idma - return-value fix, interrupt vector setting and typo fix for xilinx xdma - email updates for codeaurora email domain move - correct pause status for pl330 driver - idxd clear flag on disable fix - function documentation fix for owl dma - potential un-allocated memory fix for mcf driver * tag 'dmaengine-fix-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dmaengine: xilinx: xdma: Fix typo dmaengine: xilinx: xdma: Fix interrupt vector setting dmaengine: owl-dma: Modify mismatched function name dmaengine: idxd: Clear PRS disable flag when disabling IDXD device dmaengine: pl330: Return DMA_PAUSED when transaction is paused dmaengine: qcom_hidma: Update codeaurora email domain dmaengine: mcf-edma: Fix a potential un-allocated memory access dmaengine: xilinx: xdma: Fix Judgment of the return value idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM commit 3e91b0ebd994635df2346353322ac51ce84ce6d8 Merge: 62d02fca8be59 a2dd0233cbc4d Author: Jakub Kicinski Date: Thu Aug 10 10:47:07 2023 -0700 Merge tag 'nf-23-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The existing attempt to resolve races between control plane and GC work is error prone, as reported by Bien Pham , some places forgot to call nft_set_elem_mark_busy(), leading to double-deactivation of elements. This series contains the following patches: 1) Do not skip expired elements during walk otherwise elements might never decrement the reference counter on data, leading to memleak. 2) Add a GC transaction API to replace the former attempt to deal with races between control plane and GC. GC worker sets on NFT_SET_ELEM_DEAD_BIT on elements and it creates a GC transaction to remove the expired elements, GC transaction could abort in case of interference with control plane and retried later (GC async). Set backends such as rbtree and pipapo also perform GC from control plane (GC sync), in such case, element deactivation and removal is safe because mutex is held then collected elements are released via call_rcu(). 3) Adapt existing set backends to use the GC transaction API. 4) Update rhash set backend to set on _DEAD bit to report deleted elements from datapath for GC. 5) Remove old GC batch API and the NFT_SET_ELEM_BUSY_BIT. * tag 'nf-23-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: remove busy mark and gc batch API netfilter: nft_set_hash: mark set element as dead when deleting from packet path netfilter: nf_tables: adapt set backend to use GC transaction API netfilter: nf_tables: GC transaction API to avoid race with control plane netfilter: nf_tables: don't skip expired elements during walk ==================== Link: https://lore.kernel.org/r/20230810070830.24064-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 62d02fca8be59292703ba369b48b4c910f71d9a6 Merge: 6db541ae279bd b734f02c887d9 Author: Jakub Kicinski Date: Thu Aug 10 10:41:36 2023 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Martin KaFai Lau says: ==================== pull-request: bpf 2023-08-09 We've added 5 non-merge commits during the last 7 day(s) which contain a total of 6 files changed, 102 insertions(+), 8 deletions(-). The main changes are: 1) A bpf sockmap memleak fix and a fix in accessing the programs of a sockmap under the incorrect map type from Xu Kuohai. 2) A refcount underflow fix in xsk from Magnus Karlsson. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Add sockmap test for redirecting partial skb data selftests/bpf: fix a CI failure caused by vsock sockmap test bpf, sockmap: Fix bug that strp_done cannot be called bpf, sockmap: Fix map type error in sock_map_del_link xsk: fix refcount underflow in error path ==================== Link: https://lore.kernel.org/r/20230810055303.120917-1-martin.lau@linux.dev Signed-off-by: Jakub Kicinski commit 6db541ae279bd4e76dbd939e5fbf298396166242 Author: Nick Child Date: Wed Aug 9 17:10:38 2023 -0500 ibmvnic: Ensure login failure recovery is safe from other resets If a login request fails, the recovery process should be protected against parallel resets. It is a known issue that freeing and registering CRQ's in quick succession can result in a failover CRQ from the VIOS. Processing a failover during login recovery is dangerous for two reasons: 1. This will result in two parallel initialization processes, this can cause serious issues during login. 2. It is possible that the failover CRQ is received but never executed. We get notified of a pending failover through a transport event CRQ. The reset is not performed until a INIT CRQ request is received. Previously, if CRQ init fails during login recovery, then the ibmvnic irq is freed and the login process returned error. If failover_pending is true (a transport event was received), then the ibmvnic device would never be able to process the reset since it cannot receive the CRQ_INIT request due to the irq being freed. This leaved the device in a inoperable state. Therefore, the login failure recovery process must be hardened against these possible issues. Possible failovers (due to quick CRQ free and init) must be avoided and any issues during re-initialization should be dealt with instead of being propagated up the stack. This logic is similar to that of ibmvnic_probe(). Fixes: dff515a3e71d ("ibmvnic: Harden device login requests") Signed-off-by: Nick Child Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230809221038.51296-5-nnac123@linux.ibm.com Signed-off-by: Jakub Kicinski commit 23cc5f667453ca7645a24c8d21bf84dbf61107b2 Author: Nick Child Date: Wed Aug 9 17:10:37 2023 -0500 ibmvnic: Do partial reset on login failure Perform a partial reset before sending a login request if any of the following are true: 1. If a previous request times out. This can be dangerous because the VIOS could still receive the old login request at any point after the timeout. Therefore, it is best to re-register the CRQ's and sub-CRQ's before retrying. 2. If the previous request returns an error that is not described in PAPR. PAPR provides procedures if the login returns with partial success or aborted return codes (section L.5.1) but other values do not have a defined procedure. Previously, these conditions just returned error from the login function rather than trying to resolve the issue. This can cause further issues since most callers of the login function are not prepared to handle an error when logging in. This improper cleanup can lead to the device being permanently DOWN'd. For example, if the VIOS believes that the device is already logged in then it will return INVALID_STATE (-7). If we never re-register CRQ's then it will always think that the device is already logged in. This leaves the device inoperable. The partial reset involves freeing the sub-CRQs, freeing the CRQ then registering and initializing a new CRQ and sub-CRQs. This essentially restarts all communication with VIOS to allow for a fresh login attempt that will be unhindered by any previous failed attempts. Fixes: dff515a3e71d ("ibmvnic: Harden device login requests") Signed-off-by: Nick Child Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230809221038.51296-4-nnac123@linux.ibm.com Signed-off-by: Jakub Kicinski commit d78a671eb8996af19d6311ecdee9790d2fa479f0 Author: Nick Child Date: Wed Aug 9 17:10:36 2023 -0500 ibmvnic: Handle DMA unmapping of login buffs in release functions Rather than leaving the DMA unmapping of the login buffers to the login response handler, move this work into the login release functions. Previously, these functions were only used for freeing the allocated buffers. This could lead to issues if there are more than one outstanding login buffer requests, which is possible if a login request times out. If a login request times out, then there is another call to send login. The send login function makes a call to the login buffer release function. In the past, this freed the buffers but did not DMA unmap. Therefore, the VIOS could still write to the old login (now freed) buffer. It is for this reason that it is a good idea to leave the DMA unmap call to the login buffers release function. Since the login buffer release functions now handle DMA unmapping, remove the duplicate DMA unmapping in handle_login_rsp(). Fixes: dff515a3e71d ("ibmvnic: Harden device login requests") Signed-off-by: Nick Child Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230809221038.51296-3-nnac123@linux.ibm.com Signed-off-by: Jakub Kicinski commit 411c565b4bc63e9584a8493882bd566e35a90588 Author: Nick Child Date: Wed Aug 9 17:10:35 2023 -0500 ibmvnic: Unmap DMA login rsp buffer on send login fail If the LOGIN CRQ fails to send then we must DMA unmap the response buffer. Previously, if the CRQ failed then the memory was freed without DMA unmapping. Fixes: c98d9cc4170d ("ibmvnic: send_login should check for crq errors") Signed-off-by: Nick Child Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230809221038.51296-2-nnac123@linux.ibm.com Signed-off-by: Jakub Kicinski commit db17ba719bceb52f0ae4ebca0e4c17d9a3bebf05 Author: Nick Child Date: Wed Aug 9 17:10:34 2023 -0500 ibmvnic: Enforce stronger sanity checks on login response Ensure that all offsets in a login response buffer are within the size of the allocated response buffer. Any offsets or lengths that surpass the allocation are likely the result of an incomplete response buffer. In these cases, a full reset is necessary. When attempting to login, the ibmvnic device will allocate a response buffer and pass a reference to the VIOS. The VIOS will then send the ibmvnic device a LOGIN_RSP CRQ to signal that the buffer has been filled with data. If the ibmvnic device does not get a response in 20 seconds, the old buffer is freed and a new login request is sent. With 2 outstanding requests, any LOGIN_RSP CRQ's could be for the older login request. If this is the case then the login response buffer (which is for the newer login request) could be incomplete and contain invalid data. Therefore, we must enforce strict sanity checks on the response buffer values. Testing has shown that the `off_rxadd_buff_size` value is filled in last by the VIOS and will be the smoking gun for these circumstances. Until VIOS can implement a mechanism for tracking outstanding response buffers and a method for mapping a LOGIN_RSP CRQ to a particular login response buffer, the best ibmvnic can do in this situation is perform a full reset. Fixes: dff515a3e71d ("ibmvnic: Harden device login requests") Signed-off-by: Nick Child Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230809221038.51296-1-nnac123@linux.ibm.com Signed-off-by: Jakub Kicinski commit a7dfeda6fdeccab4c7c3dce9a72c4262b9530c80 Author: Souradeep Chakrabarti Date: Wed Aug 9 03:22:05 2023 -0700 net: mana: Fix MANA VF unload when hardware is unresponsive When unloading the MANA driver, mana_dealloc_queues() waits for the MANA hardware to complete any inflight packets and set the pending send count to zero. But if the hardware has failed, mana_dealloc_queues() could wait forever. Fix this by adding a timeout to the wait. Set the timeout to 120 seconds, which is a somewhat arbitrary value that is more than long enough for functional hardware to complete any sends. Cc: stable@vger.kernel.org Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)") Signed-off-by: Souradeep Chakrabarti Link: https://lore.kernel.org/r/1691576525-24271-1-git-send-email-schakrabarti@linux.microsoft.com Signed-off-by: Jakub Kicinski commit a4c59c9adc5f6b2a6b0115e3c4dc1e5127c2a01b Author: Helge Deller Date: Thu Aug 10 19:12:16 2023 +0200 parisc: dma: Add prototype for pcxl_dma_start Signed-off-by: Helge Deller commit 388d5bdba3fd791f734cc6687309fe59fb3343bb Author: Helge Deller Date: Thu Aug 10 18:32:24 2023 +0200 parisc: parisc_ksyms: Include libgcc.h for libgcc prototypes Signed-off-by: Helge Deller commit 438e9230d60ed8771db5770c3c795f3272ef7aae Author: Helge Deller Date: Thu Aug 10 18:31:47 2023 +0200 parisc: ucmpdi2: Fix no previous prototype for '__ucmpdi2' warning Signed-off-by: Helge Deller commit eb3515dc99c7c85f4170b50838136b2a193f8012 Author: Arnd Bergmann Date: Wed Aug 9 15:05:00 2023 +0200 x86: Move gds_ucode_mitigated() declaration to header The declaration got placed in the .c file of the caller, but that causes a warning for the definition: arch/x86/kernel/cpu/bugs.c:682:6: error: no previous prototype for 'gds_ucode_mitigated' [-Werror=missing-prototypes] Move it to a header where both sides can observe it instead. Fixes: 81ac7e5d74174 ("KVM: Add GDS_NO support to KVM") Signed-off-by: Arnd Bergmann Signed-off-by: Dave Hansen Tested-by: Daniel Sneddon Cc: stable@kernel.org Link: https://lore.kernel.org/all/20230809130530.1913368-2-arnd%40kernel.org commit a57c27c7ad85c420b7de44c6ee56692d51709dda Author: Arnd Bergmann Date: Wed Aug 9 15:04:59 2023 +0200 x86/speculation: Add cpu_show_gds() prototype The newly added function has two definitions but no prototypes: drivers/base/cpu.c:605:16: error: no previous prototype for 'cpu_show_gds' [-Werror=missing-prototypes] Add a declaration next to the other ones for this file to avoid the warning. Fixes: 8974eb588283b ("x86/speculation: Add Gather Data Sampling mitigation") Signed-off-by: Arnd Bergmann Signed-off-by: Dave Hansen Tested-by: Daniel Sneddon Cc: stable@kernel.org Link: https://lore.kernel.org/all/20230809130530.1913368-1-arnd%40kernel.org commit 7e3811521dc3934e2ecae8458676fc4a1f62bf9f Author: Alexandre Ghiti Date: Tue Jul 25 15:22:46 2023 +0200 riscv: Implement flush_cache_vmap() The RISC-V kernel needs a sfence.vma after a page table modification: we used to rely on the vmalloc fault handling to emit an sfence.vma, but commit 7d3332be011e ("riscv: mm: Pre-allocate PGD entries for vmalloc/modules area") got rid of this path for 64-bit kernels, so now we need to explicitly emit a sfence.vma in flush_cache_vmap(). Note that we don't need to implement flush_cache_vunmap() as the generic code should emit a flush tlb after unmapping a vmalloc region. Fixes: 7d3332be011e ("riscv: mm: Pre-allocate PGD entries for vmalloc/modules area") Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230725132246.817726-1-alexghiti@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit d566bea4a638ff0ae824df804bc08818bace41a5 Author: Alexandre Ghiti Date: Tue Aug 8 15:07:09 2023 +0200 riscv: Do not allow vmap pud mappings for 3-level page table The vmalloc_fault() path was removed and to avoid syncing the vmalloc PGD mappings, they are now preallocated. But if the kernel can use a PUD mapping (which in sv39 is actually a PGD mapping) for large vmalloc allocation, it will free the current unused preallocated PGD mapping and install a new leaf one. Since there is no sync anymore, some page tables lack this new mapping and that triggers a panic. So only allow PUD mappings for sv48 and sv57. Fixes: 7d3332be011e ("riscv: mm: Pre-allocate PGD entries for vmalloc/modules area") Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230808130709.1502614-1-alexghiti@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit eed869aaf1305444434ad5a9a56abc45aacc0c40 Author: Helge Deller Date: Thu Aug 10 04:34:58 2023 +0200 parisc: firmware: Mark pdc_result buffers local This fixes a sparse warning which suggest to make those static. Signed-off-by: Helge Deller commit a07c03e8064026d55d1699d161c536cc437d58d6 Author: Helge Deller Date: Thu Aug 10 04:29:29 2023 +0200 parisc: firmware: Fix sparse context imbalance warnings Tell sparse about correct context for pdc_cpu_rendezvous_*lock() functions. Signed-off-by: Helge Deller commit dc54a52a8cd43cff4fbe8d761c98edeb857d3ad7 Author: Helge Deller Date: Thu Aug 10 04:07:01 2023 +0200 parisc: signal: Fix sparse incorrect type in assignment warning Signed-off-by: Helge Deller commit b873bde58578db2201b2f30ca708dcb0e35ff4b1 Author: Helge Deller Date: Thu Aug 10 03:55:47 2023 +0200 parisc: ioremap: Fix sparse warnings Fix sparse warning: incorrect type in assignment (different base types) expected unsigned long [usertype] addr got void *addr Signed-off-by: Helge Deller commit aa1bb8b6351a81b28b9e10ab3414c21ded7cf11d Author: Helge Deller Date: Thu Aug 10 03:31:18 2023 +0200 parisc: fault: Use C99 arrary initializers Sparse wants C99 array initializers. Signed-off-by: Helge Deller commit 56cf894effc2946f273f7bfc9a28f3741978156c Author: Yang Yingliang Date: Wed Aug 9 17:19:53 2023 +0800 parisc: pdt: Use PTR_ERR_OR_ZERO() to simplify code Return PTR_ERR_OR_ZERO() instead of return 0 or PTR_ERR() to simplify code. Signed-off-by: Yang Yingliang Signed-off-by: Helge Deller commit a0f4b7879f2e14986200747d1b545e5daac8c624 Author: Helge Deller Date: Wed Aug 9 09:21:58 2023 +0200 parisc: Fix lightweight spinlock checks to not break futexes The lightweight spinlock checks verify that a spinlock has either value 0 (spinlock locked) and that not any other bits than in __ARCH_SPIN_LOCK_UNLOCKED_VAL is set. This breaks the current LWS code, which writes the address of the lock into the lock word to unlock it, which was an optimization to save one assembler instruction. Fix it by making spinlock_types.h accessible for asm code, change the LWS spinlock-unlocking code to write __ARCH_SPIN_LOCK_UNLOCKED_VAL into the lock word, and add some missing lightweight spinlock checks to the LWS path. Finally, make the spinlock checks dependend on DEBUG_KERNEL. Noticed-by: John David Anglin Signed-off-by: Helge Deller Tested-by: John David Anglin Cc: stable@vger.kernel.org # v6.4+ Fixes: 15e64ef6520e ("parisc: Add lightweight spinlock checks") commit 92fb94b69c6accf1e49fff699640fa0ce03dc910 Author: Josef Bacik Date: Wed Aug 2 09:20:24 2023 -0400 btrfs: set cache_block_group_error if we find an error We set cache_block_group_error if btrfs_cache_block_group() returns an error, this is because we could end up not finding space to allocate and mistakenly return -ENOSPC, and which could then abort the transaction with the incorrect errno, and in the case of ENOSPC result in a WARN_ON() that will trip up tests like generic/475. However there's the case where multiple threads can be racing, one thread gets the proper error, and the other thread doesn't actually call btrfs_cache_block_group(), it instead sees ->cached == BTRFS_CACHE_ERROR. Again the result is the same, we fail to allocate our space and return -ENOSPC. Instead we need to set cache_block_group_error to -EIO in this case to make sure that if we do not make our allocation we get the appropriate error returned back to the caller. CC: stable@vger.kernel.org # 4.14+ Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 6ebcd021c92b8e4b904552e4d87283032100796d Author: Qu Wenruo Date: Thu Aug 3 17:20:43 2023 +0800 btrfs: reject invalid reloc tree root keys with stack dump [BUG] Syzbot reported a crash that an ASSERT() got triggered inside prepare_to_merge(). That ASSERT() makes sure the reloc tree is properly pointed back by its subvolume tree. [CAUSE] After more debugging output, it turns out we had an invalid reloc tree: BTRFS error (device loop1): reloc tree mismatch, root 8 has no reloc root, expect reloc root key (-8, 132, 8) gen 17 Note the above root key is (TREE_RELOC_OBJECTID, ROOT_ITEM, QUOTA_TREE_OBJECTID), meaning it's a reloc tree for quota tree. But reloc trees can only exist for subvolumes, as for non-subvolume trees, we just COW the involved tree block, no need to create a reloc tree since those tree blocks won't be shared with other trees. Only subvolumes tree can share tree blocks with other trees (thus they have BTRFS_ROOT_SHAREABLE flag). Thus this new debug output proves my previous assumption that corrupted on-disk data can trigger that ASSERT(). [FIX] Besides the dedicated fix and the graceful exit, also let tree-checker to check such root keys, to make sure reloc trees can only exist for subvolumes. CC: stable@vger.kernel.org # 5.15+ Reported-by: syzbot+ae97a827ae1c3336bbb4@syzkaller.appspotmail.com Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 05d7ce504545f7874529701664c90814ca645c5d Author: Qu Wenruo Date: Thu Aug 3 17:20:42 2023 +0800 btrfs: exit gracefully if reloc roots don't match [BUG] Syzbot reported a crash that an ASSERT() got triggered inside prepare_to_merge(). [CAUSE] The root cause of the triggered ASSERT() is we can have a race between quota tree creation and relocation. This leads us to create a duplicated quota tree in the btrfs_read_fs_root() path, and since it's treated as fs tree, it would have ROOT_SHAREABLE flag, causing us to create a reloc tree for it. The bug itself is fixed by a dedicated patch for it, but this already taught us the ASSERT() is not something straightforward for developers. [ENHANCEMENT] Instead of using an ASSERT(), let's handle it gracefully and output extra info about the mismatch reloc roots to help debug. Also with the above ASSERT() removed, we can trigger ASSERT(0)s inside merge_reloc_roots() later. Also replace those ASSERT(0)s with WARN_ON()s. CC: stable@vger.kernel.org # 5.15+ Reported-by: syzbot+ae97a827ae1c3336bbb4@syzkaller.appspotmail.com Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 773e722a98e25caf96f91aced7070c1858250ba2 Author: Qu Wenruo Date: Thu Aug 3 17:20:41 2023 +0800 btrfs: avoid race between qgroup tree creation and relocation [BUG] Syzbot reported a weird ASSERT() triggered inside prepare_to_merge(). assertion failed: root->reloc_root == reloc_root, in fs/btrfs/relocation.c:1919 ------------[ cut here ]------------ kernel BUG at fs/btrfs/relocation.c:1919! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 9904 Comm: syz-executor.3 Not tainted 6.4.0-syzkaller-08881-g533925cb7604 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 RIP: 0010:prepare_to_merge+0xbb2/0xc40 fs/btrfs/relocation.c:1919 Code: fe e9 f5 (...) RSP: 0018:ffffc9000325f760 EFLAGS: 00010246 RAX: 000000000000004f RBX: ffff888075644030 RCX: 1481ccc522da5800 RDX: ffffc90005c09000 RSI: 00000000000364ca RDI: 00000000000364cb RBP: ffffc9000325f870 R08: ffffffff816f33ac R09: 1ffff9200064bea0 R10: dffffc0000000000 R11: fffff5200064bea1 R12: ffff888075644000 R13: ffff88803b166000 R14: ffff88803b166560 R15: ffff88803b166558 FS: 00007f4e305fd700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056080679c000 CR3: 00000000193ad000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: relocate_block_group+0xa5d/0xcd0 fs/btrfs/relocation.c:3749 btrfs_relocate_block_group+0x7ab/0xd70 fs/btrfs/relocation.c:4087 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3283 __btrfs_balance+0x1b06/0x2690 fs/btrfs/volumes.c:4018 btrfs_balance+0xbdb/0x1120 fs/btrfs/volumes.c:4402 btrfs_ioctl_balance+0x496/0x7c0 fs/btrfs/ioctl.c:3604 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xf8/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f4e2f88c389 [CAUSE] With extra debugging, the offending reloc_root is for quota tree (rootid 8). Normally we should not use the reloc tree for quota root at all, as reloc trees are only for subvolume trees. But there is a race between quota enabling and relocation, this happens after commit 85724171b302 ("btrfs: fix the btrfs_get_global_root return value"). Before that commit, for quota and free space tree, we exit immediately if we cannot grab it from fs_info. But now we would try to read it from disk, just as if they are fs trees, this sets ROOT_SHAREABLE flags in such race: Thread A | Thread B ---------------------------------+------------------------------ btrfs_quota_enable() | | | btrfs_get_root_ref() | | |- btrfs_get_global_root() | | | Returned NULL | | |- btrfs_lookup_fs_root() | | | Returned NULL |- btrfs_create_tree() | | | Now quota root item is | | | inserted | |- btrfs_read_tree_root() | | | Got the newly inserted quota root | | |- btrfs_init_fs_root() | | | Set ROOT_SHAREABLE flag [FIX] Get back to the old behavior by returning PTR_ERR(-ENOENT) if the target objectid is not a subvolume tree or data reloc tree. Reported-and-tested-by: syzbot+ae97a827ae1c3336bbb4@syzkaller.appspotmail.com Fixes: 85724171b302 ("btrfs: fix the btrfs_get_global_root return value") Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 12b2d64e591652a2d97dd3afa2b062ca7a4ba352 Author: Christoph Hellwig Date: Mon Jul 24 06:26:55 2023 -0700 btrfs: properly clear end of the unreserved range in cow_file_range When the call to btrfs_reloc_clone_csums in cow_file_range returns an error, we jump to the out_unlock label with the extent_reserved variable set to false. The cleanup at the label will then call extent_clear_unlock_delalloc on the range from start to end. But we've already added cur_alloc_size to start before the jump, so there might no range be left from the newly incremented start to end. Move the check for 'start < end' so that it is reached by also for the !extent_reserved case. CC: stable@vger.kernel.org # 6.1+ Fixes: a315e68f6e8b ("Btrfs: fix invalid attempt to free reserved space on failure to cow range") Reviewed-by: Josef Bacik Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5c25699871112853f231e52d51c576d5c759a020 Author: Christoph Hellwig Date: Mon Jul 24 06:26:54 2023 -0700 btrfs: don't wait for writeback on clean pages in extent_write_cache_pages __extent_writepage could have started on more pages than the one it was called for. This happens regularly for zoned file systems, and in theory could happen for compressed I/O if the worker thread was executed very quickly. For such pages extent_write_cache_pages waits for writeback to complete before moving on to the next page, which is highly inefficient as it blocks the flusher thread. Port over the PageDirty check that was added to write_cache_pages in commit 515f4a037fb ("mm: write_cache_pages optimise page cleaning") to fix this. CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Josef Bacik Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit effa24f689ce0948f68c754991a445a8d697d3a8 Author: Christoph Hellwig Date: Mon Jul 24 06:26:53 2023 -0700 btrfs: don't stop integrity writeback too early extent_write_cache_pages stops writing pages as soon as nr_to_write hits zero. That is the right thing for opportunistic writeback, but incorrect for data integrity writeback, which needs to ensure that no dirty pages are left in the range. Thus only stop the writeback for WB_SYNC_NONE if nr_to_write hits 0. This is a port of write_cache_pages changes in commit 05fe478dd04e ("mm: write_cache_pages integrity fix"). Note that I've only trigger the problem with other changes to the btrfs writeback code, but this condition seems worthwhile fixing anyway. CC: stable@vger.kernel.org # 4.14+ Reviewed-by: Josef Bacik Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba [ updated comment ] Signed-off-by: David Sterba commit 56fec0051a69ace182ca3fba47be9c13038b4e3f Author: Hans de Goede Date: Thu Aug 10 11:00:11 2023 +0200 ACPI: resource: Add IRQ override quirk for PCSpecialist Elimina Pro 16 M The PCSpecialist Elimina Pro 16 M laptop model is a Zen laptop which needs to use the MADT IRQ settings override and which does not have an INT_SRC_OVR entry for IRQ 1 in its MADT. So this model needs a DMI quirk to enable the MADT IRQ settings override to fix its keyboard not working. Fixes: a9c4a912b7dc ("ACPI: resource: Remove "Zen" specific match and quirks") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217394#c18 Cc: All applicable Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit fc1f91b9231a28fba333f931a031bf776bc6ef0e Author: Josef Bacik Date: Fri Jul 21 16:09:43 2023 -0400 btrfs: wait for actual caching progress during allocation Recently we've been having mysterious hangs while running generic/475 on the CI system. This turned out to be something like this: Task 1 dmsetup suspend --nolockfs -> __dm_suspend -> dm_wait_for_completion -> dm_wait_for_bios_completion -> Unable to complete because of IO's on a plug in Task 2 Task 2 wb_workfn -> wb_writeback -> blk_start_plug -> writeback_sb_inodes -> Infinite loop unable to make an allocation Task 3 cache_block_group ->read_extent_buffer_pages ->Waiting for IO to complete that can't be submitted because Task 1 suspended the DM device The problem here is that we need Task 2 to be scheduled completely for the blk plug to flush. Normally this would happen, we normally wait for the block group caching to finish (Task 3), and this schedule would result in the block plug flushing. However if there's enough free space available from the current caching to satisfy the allocation we won't actually wait for the caching to complete. This check however just checks that we have enough space, not that we can make the allocation. In this particular case we were trying to allocate 9MiB, and we had 10MiB of free space, but we didn't have 9MiB of contiguous space to allocate, and thus the allocation failed and we looped. We specifically don't cycle through the FFE loop until we stop finding cached block groups because we don't want to allocate new block groups just because we're caching, so we short circuit the normal loop once we hit LOOP_CACHING_WAIT and we found a caching block group. This is normally fine, except in this particular case where the caching thread can't make progress because the DM device has been suspended. Fix this by not only waiting for free space to >= the amount of space we want to allocate, but also that we make some progress in caching from the time we start waiting. This will keep us from busy looping when the caching is taking a while but still theoretically has enough space for us to allocate from, and fixes this particular case by forcing us to actually sleep and wait for forward progress, which will flush the plug. With this fix we're no longer hanging with generic/475. CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Boris Burkov Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 6524c798b727ffdb5c7eaed2f50e8e839997df8e Author: Borislav Petkov (AMD) Date: Thu Aug 10 13:22:29 2023 +0200 driver core: cpu: Make cpu_show_not_affected() static Fix a -Wmissing-prototypes warning and add the gather_data_sampling() stub macro call for real. Fixes: 0fddfe338210 ("driver core: cpu: Unify redundant silly stubs") Closes: https://lore.kernel.org/oe-kbuild-all/202308101956.oRj1ls7s-lkp@intel.com Reported-by: kernel test robot Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/202308101956.oRj1ls7s-lkp@intel.com commit cbe8ded48b939b9d55d2c5589ab56caa7b530709 Author: Nick Desaulniers Date: Wed Aug 9 09:40:26 2023 -0700 x86/srso: Fix build breakage with the LLVM linker The assertion added to verify the difference in bits set of the addresses of srso_untrain_ret_alias() and srso_safe_ret_alias() would fail to link in LLVM's ld.lld linker with the following error: ld.lld: error: ./arch/x86/kernel/vmlinux.lds:210: at least one side of the expression must be absolute ld.lld: error: ./arch/x86/kernel/vmlinux.lds:211: at least one side of the expression must be absolute Use ABSOLUTE to evaluate the expression referring to at least one of the symbols so that LLD can evaluate the linker script. Also, add linker version info to the comment about XOR being unsupported in either ld.bfd or ld.lld until somewhat recently. Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation") Closes: https://lore.kernel.org/llvm/CA+G9fYsdUeNu-gwbs0+T6XHi4hYYk=Y9725-wFhZ7gJMspLDRA@mail.gmail.com/ Reported-by: Nathan Chancellor Reported-by: Daniel Kolesa Reported-by: Naresh Kamboju Suggested-by: Sven Volkinsfeld Signed-off-by: Nick Desaulniers Signed-off-by: Borislav Petkov (AMD) Link: https://github.com/ClangBuiltLinux/linux/issues/1907 Link: https://lore.kernel.org/r/20230809-gds-v1-1-eaac90b0cbcc@google.com commit 09f9f37c324d90102e8574856ab168c34de1916d Author: Borislav Petkov (AMD) Date: Wed Aug 2 20:07:32 2023 +0200 Documentation/srso: Document IBPB aspect and fix formatting Add a note about the dependency of the User->User mitigation on the previous Spectre v2 IBPB selection. Make the layout moar pretty. Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20230809102700.29449-4-bp@alien8.de commit 0fddfe338210aa018137c03030c581f5ea4be282 Author: Borislav Petkov (AMD) Date: Sat Jul 29 17:20:33 2023 +0200 driver core: cpu: Unify redundant silly stubs Make them all a weak function, aliasing to a single function which issues the "Not affected" string. No functional changes. Suggested-by: Linus Torvalds Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Greg Kroah-Hartman Reviewed-by: Nikolay Borisov Link: https://lore.kernel.org/r/20230809102700.29449-3-bp@alien8.de commit 9757300d2750ef76f139aa6f5f7eadd61a0de0d3 Author: Ninad Naik Date: Wed Aug 9 15:36:34 2023 +0530 pinctrl: qcom: Add intr_target_width field to support increased number of interrupt targets SA8775 and newer target have added support for an increased number of interrupt targets. To implement this change, the intr_target field, which is used to configure the interrupt target in the interrupt configuration register is increased from 3 bits to 4 bits. In accordance to these updates, a new intr_target_width member is introduced in msm_pingroup structure. This member stores the value of width of intr_target field in the interrupt configuration register. This value is used to dynamically calculate and generate mask for setting the intr_target field. By default, this mask is set to 3 bit wide, to ensure backward compatibility with the older targets. Fixes: 4b6b18559927 ("pinctrl: qcom: add the tlmm driver sa8775p platforms") Tested-by: Andrew Halaney # sa8775p-ride Signed-off-by: Ninad Naik Reviewed-by: Konrad Dybcio Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230809100634.3961-1-quic_ninanaik@quicinc.com Signed-off-by: Linus Walleij commit 182ac87070e26d32a01445cec7ca7afa07411468 Author: Borislav Petkov (AMD) Date: Sat Jul 29 16:53:02 2023 +0200 Documentation/hw-vuln: Unify filename specification in index Most of the index.rst files in Documentation/ refer to other rst files without their file extension in the name. Do that here too. No functional changes. Reported-by: Linus Torvalds Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20230809102700.29449-2-bp@alien8.de commit 98c68ea0312ad629f6b05f9db762f468af805326 Author: Stefan Binding Date: Wed Aug 9 15:29:57 2023 +0100 ALSA: hda/realtek: Switch Dell Oasis models to use SPI All I2C Dell Oasis models using CS35L41 have been changed to use SPI. In addition, System 10280cc5 is no longer required. Fixes: de90f5165b1c ("ALSA: hda/realtek: Add support for DELL Oasis 13/14/16 laptops") Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20230809142957.675933-3-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit fb8cce69e5e56eedb35fc4d77b2f099860965859 Author: Stefan Binding Date: Wed Aug 9 15:29:56 2023 +0100 ALSA: hda/realtek: Add quirks for HP G11 Laptops These HP G11 laptops use Realtek HDA codec combined with 2xCS35L41 Amplifiers using SPI or I2C with External Boost. Laptop 103c8c26 has been removed as this has been replaced by this new series of laptops. Fixes: 3e10f6ca76c4 ("ALSA: hda/realtek: Add quirk for HP EliteBook G10 laptops") Signed-off-by: Stefan Binding Link: https://lore.kernel.org/r/20230809142957.675933-2-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 07dd476f6116966cb2006e25fdcf48f0715115ff Author: Boris Brezillon Date: Mon Jul 24 13:26:10 2023 +0200 drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap() The dma-buf backend is supposed to provide its own vm_ops, but some implementation just have nothing special to do and leave vm_ops untouched, probably expecting this field to be zero initialized (this is the case with the system_heap implementation for instance). Let's reset vma->vm_ops to NULL to keep things working with these implementations. Fixes: 26d3ac3cb04d ("drm/shmem-helpers: Redirect mmap for imported dma-buf") Cc: Cc: Daniel Vetter Reported-by: Roman Stratiienko Signed-off-by: Boris Brezillon Tested-by: Roman Stratiienko Reviewed-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230724112610.60974-1-boris.brezillon@collabora.com commit a2dd0233cbc4d8a0abb5f64487487ffc9265beb5 Author: Pablo Neira Ayuso Date: Wed Aug 9 15:00:36 2023 +0200 netfilter: nf_tables: remove busy mark and gc batch API Ditch it, it has been replace it by the GC transaction API and it has no clients anymore. Signed-off-by: Pablo Neira Ayuso commit c92db3030492b8ad1d0faace7a93bbcf53850d0c Author: Pablo Neira Ayuso Date: Wed Aug 9 15:00:06 2023 +0200 netfilter: nft_set_hash: mark set element as dead when deleting from packet path Set on the NFT_SET_ELEM_DEAD_BIT flag on this element, instead of performing element removal which might race with an ongoing transaction. Enable gc when dynamic flag is set on since dynset deletion requires garbage collection after this patch. Fixes: d0a8d877da97 ("netfilter: nft_dynset: support for element deletion") Signed-off-by: Pablo Neira Ayuso commit f6c383b8c31a93752a52697f8430a71dcbc46adf Author: Pablo Neira Ayuso Date: Wed Aug 9 14:54:23 2023 +0200 netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction API to replace the old and buggy gc API and the busy mark approach. No set elements are removed from async garbage collection anymore, instead the _DEAD bit is set on so the set element is not visible from lookup path anymore. Async GC enqueues transaction work that might be aborted and retried later. rbtree and pipapo set backends does not set on the _DEAD bit from the sync GC path since this runs in control plane path where mutex is held. In this case, set elements are deactivated, removed and then released via RCU callback, sync GC never fails. Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Fixes: 8d8540c4f5e0 ("netfilter: nft_set_rbtree: add timeout support") Fixes: 9d0982927e79 ("netfilter: nft_hash: add support for timeouts") Signed-off-by: Pablo Neira Ayuso commit 5f68718b34a531a556f2f50300ead2862278da26 Author: Pablo Neira Ayuso Date: Wed Aug 9 14:31:54 2023 +0200 netfilter: nf_tables: GC transaction API to avoid race with control plane The set types rhashtable and rbtree use a GC worker to reclaim memory. From system work queue, in periodic intervals, a scan of the table is done. The major caveat here is that the nft transaction mutex is not held. This causes a race between control plane and GC when they attempt to delete the same element. We cannot grab the netlink mutex from the work queue, because the control plane has to wait for the GC work queue in case the set is to be removed, so we get following deadlock: cpu 1 cpu2 GC work transaction comes in , lock nft mutex `acquire nft mutex // BLOCKS transaction asks to remove the set set destruction calls cancel_work_sync() cancel_work_sync will now block forever, because it is waiting for the mutex the caller already owns. This patch adds a new API that deals with garbage collection in two steps: 1) Lockless GC of expired elements sets on the NFT_SET_ELEM_DEAD_BIT so they are not visible via lookup. Annotate current GC sequence in the GC transaction. Enqueue GC transaction work as soon as it is full. If ruleset is updated, then GC transaction is aborted and retried later. 2) GC work grabs the mutex. If GC sequence has changed then this GC transaction lost race with control plane, abort it as it contains stale references to objects and let GC try again later. If the ruleset is intact, then this GC transaction deactivates and removes the elements and it uses call_rcu() to destroy elements. Note that no elements are removed from GC lockless path, the _DEAD bit is set and pointers are collected. GC catchall does not remove the elements anymore too. There is a new set->dead flag that is set on to abort the GC transaction to deal with set->ops->destroy() path which removes the remaining elements in the set from commit_release, where no mutex is held. To deal with GC when mutex is held, which allows safe deactivate and removal, add sync GC API which releases the set element object via call_rcu(). This is used by rbtree and pipapo backends which also perform garbage collection from control plane path. Since element removal from sets can happen from control plane and element garbage collection/timeout, it is necessary to keep the set structure alive until all elements have been deactivated and destroyed. We cannot do a cancel_work_sync or flush_work in nft_set_destroy because its called with the transaction mutex held, but the aforementioned async work queue might be blocked on the very mutex that nft_set_destroy() callchain is sitting on. This gives us the choice of ABBA deadlock or UaF. To avoid both, add set->refs refcount_t member. The GC API can then increment the set refcount and release it once the elements have been free'd. Set backends are adapted to use the GC transaction API in a follow up patch entitled: ("netfilter: nf_tables: use gc transaction API in set backends") This is joint work with Florian Westphal. Fixes: cfed7e1b1f8e ("netfilter: nf_tables: add set garbage collection helpers") Signed-off-by: Pablo Neira Ayuso commit 374a7f47bf401441edff0a64465e61326bf70a82 Merge: b4f63b0f2d170 79ed288cef201 Author: Linus Torvalds Date: Wed Aug 9 21:12:56 2023 -0700 Merge tag '6.5-rc5-ksmbd-server' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: "Two ksmbd server fixes, both also for stable: - improve buffer validation when multiple EAs returned - missing check for command payload size" * tag '6.5-rc5-ksmbd-server' of git://git.samba.org/ksmbd: ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea() ksmbd: validate command request size commit 56b930dcd88c2adc261410501c402c790980bdb5 Author: Aleksa Savic Date: Mon Aug 7 19:20:03 2023 +0200 hwmon: (aquacomputer_d5next) Add selective 200ms delay after sending ctrl report Add a 200ms delay after sending a ctrl report to Quadro, Octo, D5 Next and Aquaero to give them enough time to process the request and save the data to memory. Otherwise, under heavier userspace loads where multiple sysfs entries are usually set in quick succession, a new ctrl report could be requested from the device while it's still processing the previous one and fail with -EPIPE. The delay is only applied if two ctrl report operations are near each other in time. Reported by a user on Github [1] and tested by both of us. [1] https://github.com/aleksamagicka/aquacomputer_d5next-hwmon/issues/82 Fixes: 752b927951ea ("hwmon: (aquacomputer_d5next) Add support for Aquacomputer Octo") Signed-off-by: Aleksa Savic Link: https://lore.kernel.org/r/20230807172004.456968-1-savicaleksa83@gmail.com Signed-off-by: Guenter Roeck commit b4f63b0f2d170b9dfae0de3fd2981424873cce2b Merge: cacc6e22932f3 487ae3b42d104 Author: Linus Torvalds Date: Wed Aug 9 21:06:14 2023 -0700 Merge tag 'perf-tools-fixes-for-v6.5-3-2023-08-09' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux Pull perf tools fixes from Arnaldo Carvalho de Melo: - Revert a patch that unconditionally resolved addresses to inlines in callchains, something that was done before when DWARF mode was asked for, but could as well be done when just frame pointers (the default) was selected. This enriches the callchains with inlines but the way to resolve it is gross right now, relying on addr2line, and even if we come up with an efficient way of processing all the associated DWARF info for a big file as vmlinux is, this has to be something people opt-in, as it will still result in overheads, so revert it until we get this done in a saner way. - Update the x86 msr-index.h header with the kernel original, no change in tooling output, just addresses a tools/perf build warning. - Resolve a regression where special "tool events", such as "duration_time" were being presented for all CPUs, when it only makes sense to show it for the workload, that is, just once. * tag 'perf-tools-fixes-for-v6.5-3-2023-08-09' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux: perf stat: Don't display zero tool counts tools arch x86: Sync the msr-index.h copy with the kernel sources Revert "perf report: Append inlines to non-DWARF callchains" commit fe9da61ffccad80ae79fadad836971acf0d465bd Author: Damien Le Moal Date: Mon Aug 7 13:11:48 2023 +0900 zonefs: fix synchronous direct writes to sequential files Commit 16d7fd3cfa72 ("zonefs: use iomap for synchronous direct writes") changes zonefs code from a self-built zone append BIO to using iomap for synchronous direct writes. This change relies on iomap submit BIO callback to change the write BIO built by iomap to a zone append BIO. However, this change overlooked the fact that a write BIO may be very large as it is split when issued. The change from a regular write to a zone append operation for the built BIO can result in a block layer warning as zone append BIO are not allowed to be split. WARNING: CPU: 18 PID: 202210 at block/bio.c:1644 bio_split+0x288/0x350 Call Trace: ? __warn+0xc9/0x2b0 ? bio_split+0x288/0x350 ? report_bug+0x2e6/0x390 ? handle_bug+0x41/0x80 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? bio_split+0x288/0x350 bio_split_rw+0x4bc/0x810 ? __pfx_bio_split_rw+0x10/0x10 ? lockdep_unlock+0xf2/0x250 __bio_split_to_limits+0x1d8/0x900 blk_mq_submit_bio+0x1cf/0x18a0 ? __pfx_iov_iter_extract_pages+0x10/0x10 ? __pfx_blk_mq_submit_bio+0x10/0x10 ? find_held_lock+0x2d/0x110 ? lock_release+0x362/0x620 ? mark_held_locks+0x9e/0xe0 __submit_bio+0x1ea/0x290 ? __pfx___submit_bio+0x10/0x10 ? seqcount_lockdep_reader_access.constprop.0+0x82/0x90 submit_bio_noacct_nocheck+0x675/0xa20 ? __pfx_bio_iov_iter_get_pages+0x10/0x10 ? __pfx_submit_bio_noacct_nocheck+0x10/0x10 iomap_dio_bio_iter+0x624/0x1280 __iomap_dio_rw+0xa22/0x18a0 ? lock_is_held_type+0xe3/0x140 ? __pfx___iomap_dio_rw+0x10/0x10 ? lock_release+0x362/0x620 ? zonefs_file_write_iter+0x74c/0xc80 [zonefs] ? down_write+0x13d/0x1e0 iomap_dio_rw+0xe/0x40 zonefs_file_write_iter+0x5ea/0xc80 [zonefs] do_iter_readv_writev+0x18b/0x2c0 ? __pfx_do_iter_readv_writev+0x10/0x10 ? inode_security+0x54/0xf0 do_iter_write+0x13b/0x7c0 ? lock_is_held_type+0xe3/0x140 vfs_writev+0x185/0x550 ? __pfx_vfs_writev+0x10/0x10 ? __handle_mm_fault+0x9bd/0x1c90 ? find_held_lock+0x2d/0x110 ? lock_release+0x362/0x620 ? find_held_lock+0x2d/0x110 ? lock_release+0x362/0x620 ? __up_read+0x1ea/0x720 ? do_pwritev+0x136/0x1f0 do_pwritev+0x136/0x1f0 ? __pfx_do_pwritev+0x10/0x10 ? syscall_enter_from_user_mode+0x22/0x90 ? lockdep_hardirqs_on+0x7d/0x100 do_syscall_64+0x58/0x80 This error depends on the hardware used, specifically on the max zone append bytes and max_[hw_]sectors limits. Tests using AMD Epyc machines that have low limits did not reveal this issue while runs on Intel Xeon machines with larger limits trigger it. Manually splitting the zone append BIO using bio_split_rw() can solve this issue but also requires issuing the fragment BIOs synchronously with submit_bio_wait(), to avoid potential reordering of the zone append BIO fragments, which would lead to data corruption. That is, this solution is not better than using regular write BIOs which are subject to serialization using zone write locking at the IO scheduler level. Given this, fix the issue by removing zone append support and using regular write BIOs for synchronous direct writes. This allows preseving the use of iomap and having identical synchronous and asynchronous sequential file write path. Zone append support will be reintroduced later through io_uring commands to ensure that the needed special handling is done correctly. Reported-by: Shin'ichiro Kawasaki Fixes: 16d7fd3cfa72 ("zonefs: use iomap for synchronous direct writes") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Tested-by: Shin'ichiro Kawasaki Reviewed-by: Christoph Hellwig commit b734f02c887d9a02cd777ee3a74be38df341fabb Merge: 85c2c79a07302 a4b7193d8efdf Author: Martin KaFai Lau Date: Wed Aug 9 20:29:03 2023 -0700 Merge branch 'bug fixes for sockmap' Xu Kuohai says: ==================== bug fixes and a new test case for sockmap. v3: fix bpf ci failure v2: https://lore.kernel.org/bpf/20230803064838.108784-1-xukuohai@huaweicloud.com add a test case v1: https://lore.kernel.org/bpf/20230728105649.3978774-1-xukuohai@huaweicloud.com https://lore.kernel.org/bpf/20230728105717.3978849-1-xukuohai@huaweicloud.com ==================== Signed-off-by: Martin KaFai Lau commit a4b7193d8efdfde1ea89fe34e921ad031f79f993 Author: Xu Kuohai Date: Fri Aug 4 03:37:40 2023 -0400 selftests/bpf: Add sockmap test for redirecting partial skb data Add a test case to check whether sockmap redirection works correctly when data length returned by stream_parser is less than skb->len. In addition, this test checks whether strp_done is called correctly. The reason is that we returns skb->len - 1 from the stream_parser, so the last byte in the skb will be held by strp->skb_head. Therefore, if strp_done is not called to free strp->skb_head, we'll get a memleak warning. Signed-off-by: Xu Kuohai Link: https://lore.kernel.org/r/20230804073740.194770-5-xukuohai@huaweicloud.com Signed-off-by: Martin KaFai Lau commit 90f0074cd9f9a24b7b6c4d5afffa676aee48c0e9 Author: Xu Kuohai Date: Fri Aug 4 03:37:39 2023 -0400 selftests/bpf: fix a CI failure caused by vsock sockmap test BPF CI has reported the following failure: Error: #200/79 sockmap_listen/sockmap VSOCK test_vsock_redir Error: #200/79 sockmap_listen/sockmap VSOCK test_vsock_redir ./test_progs:vsock_unix_redir_connectible:1506: egress: write: Transport endpoint is not connected vsock_unix_redir_connectible:FAIL:1506 ./test_progs:vsock_unix_redir_connectible:1506: ingress: write: Transport endpoint is not connected vsock_unix_redir_connectible:FAIL:1506 ./test_progs:vsock_unix_redir_connectible:1506: egress: write: Transport endpoint is not connected vsock_unix_redir_connectible:FAIL:1506 ./test_progs:vsock_unix_redir_connectible:1514: ingress: recv() err, errno=11 vsock_unix_redir_connectible:FAIL:1514 ./test_progs:vsock_unix_redir_connectible:1518: ingress: vsock socket map failed, a != b vsock_unix_redir_connectible:FAIL:1518 ./test_progs:vsock_unix_redir_connectible:1525: ingress: want pass count 1, have 0 It’s because the recv(... MSG_DONTWAIT) syscall in the test case is called before the queued work sk_psock_backlog() in the kernel finishes executing. So the data to be read is still queued in psock->ingress_skb and cannot be read by the user program. Therefore, the non-blocking recv() reads nothing and reports an EAGAIN error. So replace recv(... MSG_DONTWAIT) with xrecv_nonblock(), which calls select() to wait for data to be readable or timeout before calls recv(). Fixes: d61bd8c1fd02 ("selftests/bpf: add a test case for vsock sockmap") Signed-off-by: Xu Kuohai Link: https://lore.kernel.org/r/20230804073740.194770-4-xukuohai@huaweicloud.com Signed-off-by: Martin KaFai Lau commit 809e4dc71a0f2b8d2836035d98603694fff11d5d Author: Xu Kuohai Date: Fri Aug 4 03:37:38 2023 -0400 bpf, sockmap: Fix bug that strp_done cannot be called strp_done is only called when psock->progs.stream_parser is not NULL, but stream_parser was set to NULL by sk_psock_stop_strp(), called by sk_psock_drop() earlier. So, strp_done can never be called. Introduce SK_PSOCK_RX_ENABLED to mark whether there is strp on psock. Change the condition for calling strp_done from judging whether stream_parser is set to judging whether this flag is set. This flag is only set once when strp_init() succeeds, and will never be cleared later. Fixes: c0d95d3380ee ("bpf, sockmap: Re-evaluate proto ops when psock is removed from sockmap") Signed-off-by: Xu Kuohai Reviewed-by: John Fastabend Link: https://lore.kernel.org/r/20230804073740.194770-3-xukuohai@huaweicloud.com Signed-off-by: Martin KaFai Lau commit 7e96ec0e6605b69bb21bbf6c0ff9051e656ec2b1 Author: Xu Kuohai Date: Fri Aug 4 03:37:37 2023 -0400 bpf, sockmap: Fix map type error in sock_map_del_link sock_map_del_link() operates on both SOCKMAP and SOCKHASH, although both types have member named "progs", the offset of "progs" member in these two types is different, so "progs" should be accessed with the real map type. Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Xu Kuohai Reviewed-by: John Fastabend Link: https://lore.kernel.org/r/20230804073740.194770-2-xukuohai@huaweicloud.com Signed-off-by: Martin KaFai Lau commit 85c2c79a07302fe68a1ad5cc449458cc559e314d Author: Magnus Karlsson Date: Wed Aug 9 16:28:43 2023 +0200 xsk: fix refcount underflow in error path Fix a refcount underflow problem reported by syzbot that can happen when a system is running out of memory. If xp_alloc_tx_descs() fails, and it can only fail due to not having enough memory, then the error path is triggered. In this error path, the refcount of the pool is decremented as it has incremented before. However, the reference to the pool in the socket was not nulled. This means that when the socket is closed later, the socket teardown logic will think that there is a pool attached to the socket and try to decrease the refcount again, leading to a refcount underflow. I chose this fix as it involved adding just a single line. Another option would have been to move xp_get_pool() and the assignment of xs->pool to after the if-statement and using xs_umem->pool instead of xs->pool in the whole if-statement resulting in somewhat simpler code, but this would have led to much more churn in the code base perhaps making it harder to backport. Fixes: ba3beec2ec1d ("xsk: Fix possible crash when multiple sockets are created") Reported-by: syzbot+8ada0057e69293a05fd4@syzkaller.appspotmail.com Signed-off-by: Magnus Karlsson Link: https://lore.kernel.org/r/20230809142843.13944-1-magnus.karlsson@gmail.com Signed-off-by: Martin KaFai Lau commit c1f848f12103920ca165758aedb1c10904e193e1 Author: Jerome Brunet Date: Wed Aug 9 19:19:31 2023 +0200 ASoC: meson: axg-tdm-formatter: fix channel slot allocation When the tdm lane mask is computed, the driver currently fills the 1st lane before moving on to the next. If the stream has less channels than the lanes can accommodate, slots will be disabled on the last lanes. Unfortunately, the HW distribute channels in a different way. It distribute channels in pair on each lanes before moving on the next slots. This difference leads to problems if a device has an interface with more than 1 lane and with more than 2 slots per lane. For example: a playback interface with 2 lanes and 4 slots each (total 8 slots - zero based numbering) - Playing a 8ch stream: - All slots activated by the driver - channel #2 will be played on lane #1 - slot #0 following HW placement - Playing a 4ch stream: - Lane #1 disabled by the driver - channel #2 will be played on lane #0 - slot #2 This behaviour is obviously not desirable. Change the way slots are activated on the TDM lanes to follow what the HW does and make sure each channel always get mapped to the same slot/lane. Fixes: 1a11d88f499c ("ASoC: meson: add tdm formatter base driver") Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20230809171931.1244502-1-jbrunet@baylibre.com Signed-off-by: Mark Brown commit 048c796beb6eb4fa3a5a647ee1c81f5c6f0f6a2a Author: Maciej Żenczykowski Date: Mon Aug 7 03:25:32 2023 -0700 ipv6: adjust ndisc_is_useropt() to also return true for PIO The upcoming (and nearly finalized): https://datatracker.ietf.org/doc/draft-collink-6man-pio-pflag/ will update the IPv6 RA to include a new flag in the PIO field, which will serve as a hint to perform DHCPv6-PD. As we don't want DHCPv6 related logic inside the kernel, this piece of information needs to be exposed to userspace. The simplest option is to simply expose the entire PIO through the already existing mechanism. Even without this new flag, the already existing PIO R (router address) flag (from RFC6275) cannot AFAICT be handled entirely in kernel, and provides useful information that should be exposed to userspace (the router's global address, for use by Mobile IPv6). Also cc'ing stable@ for inclusion in LTS, as while technically this is not quite a bugfix, and instead more of a feature, it is absolutely trivial and the alternative is manually cherrypicking into all Android Common Kernel trees - and I know Greg will ask for it to be sent in via LTS instead... Cc: Jen Linkova Cc: Lorenzo Colitti Cc: David Ahern Cc: YOSHIFUJI Hideaki / 吉藤英明 Cc: stable@vger.kernel.org Signed-off-by: Maciej Żenczykowski Link: https://lore.kernel.org/r/20230807102533.1147559-1-maze@google.com Signed-off-by: Jakub Kicinski commit 15c8795dbff8105b9071a7e38e6d4a1649747ec9 Merge: acaaffc570f77 06f2ab86a5b6e Author: Jakub Kicinski Date: Wed Aug 9 15:04:44 2023 -0700 Merge tag 'wireless-2023-08-09' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Just a few small updates: * fix an integer overflow in nl80211 * fix rtw89 8852AE disconnections * fix a buffer overflow in ath12k * fix AP_VLAN configuration lookups * fix allocation failure handling in brcm80211 * update MAINTAINERS for some drivers * tag 'wireless-2023-08-09' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: ath12k: Fix buffer overflow when scanning with extraie wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() wifi: cfg80211: fix sband iftype data lookup for AP_VLAN wifi: rtw89: fix 8852AE disconnection caused by RX full flags MAINTAINERS: Remove tree entry for rtl8180 MAINTAINERS: Update entry for rtl8187 wifi: brcm80211: handle params_v1 allocation failure ==================== Link: https://lore.kernel.org/r/20230809124818.167432-2-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit f099a108cabf72a1184b1e14e4a09f4ca3375750 Author: Chengming Zhou Date: Fri Aug 4 15:06:09 2023 +0800 blk-iocost: fix queue stats accounting The q->stats->accounting is not only used by iocost, but iocost only increase this counter, never decrease it. So queue stats accounting will always enabled after using iocost once. Signed-off-by: Chengming Zhou Acked-by: Tejun Heo Link: https://lore.kernel.org/r/20230804070609.31623-1-chengming.zhou@linux.dev Signed-off-by: Jens Axboe commit 2bc057692599a5b3dc93d75a3dff34f72576355d Author: Jens Axboe Date: Tue Aug 8 11:06:17 2023 -0600 block: don't make REQ_POLLED imply REQ_NOWAIT Normally these two flags do go together, as the issuer of polled IO generally cannot wait for resources that will get freed as part of IO completion. This is because that very task is the one that will complete the request and free those resources, hence that would introduce a deadlock. But it is possible to have someone else issue the polled IO, eg via io_uring if the request is punted to io-wq. For that case, it's fine to have the task block on IO submission, as it is not the same task that will be completing the IO. It's completely up to the caller to ask for both polled and nowait IO separately! If we don't allow polled IO where IOCB_NOWAIT isn't set in the kiocb, then we can run into repeated -EAGAIN submissions and not make any progress. Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe commit acaaffc570f7743ce6395ffba31d34a566e32b85 Merge: 8a70ed9520c5f 8b5ff37097775 Author: Jakub Kicinski Date: Wed Aug 9 14:53:38 2023 -0700 Merge branch 'selftests-forwarding-various-fixes' Ido Schimmel says: ==================== selftests: forwarding: Various fixes Fix various problems with forwarding selftests. See individual patches for problem description and solution. ==================== Link: https://lore.kernel.org/r/20230808141503.4060661-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 8b5ff37097775cdbd447442603957066dd2e4d02 Author: Ido Schimmel Date: Tue Aug 8 17:15:03 2023 +0300 selftests: forwarding: bridge_mdb: Make test more robust Some test cases check that the group timer is (or isn't) 0. Instead of grepping for "0.00" grep for " 0.00" as the former can also match "260.00" which is the default group membership interval. Fixes: b6d00da08610 ("selftests: forwarding: Add bridge MDB test") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/ Signed-off-by: Ido Schimmel Tested-by: Mirsad Todorovac Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-18-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit cb034948ac292da82cc0e6bc1340f81be36e117d Author: Ido Schimmel Date: Tue Aug 8 17:15:02 2023 +0300 selftests: forwarding: bridge_mdb_max: Fix failing test with old libnet As explained in commit 8bcfb4ae4d97 ("selftests: forwarding: Fix failing tests with old libnet"), old versions of libnet (used by mausezahn) do not use the "SO_BINDTODEVICE" socket option. For IP unicast packets, this can be solved by prefixing mausezahn invocations with "ip vrf exec". However, IP multicast packets do not perform routing and simply egress the bound device, which does not exist in this case. Fix by specifying the source and destination MAC of the packet which will cause mausezahn to use a packet socket instead of an IP socket. Fixes: 3446dcd7df05 ("selftests: forwarding: bridge_mdb_max: Add a new selftest") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/ Signed-off-by: Ido Schimmel Tested-by: Mirsad Todorovac Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-17-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit e98e195d90cc93b1bf2ad762c7c274a40dab7173 Author: Ido Schimmel Date: Tue Aug 8 17:15:01 2023 +0300 selftests: forwarding: bridge_mdb: Fix failing test with old libnet As explained in commit 8bcfb4ae4d97 ("selftests: forwarding: Fix failing tests with old libnet"), old versions of libnet (used by mausezahn) do not use the "SO_BINDTODEVICE" socket option. For IP unicast packets, this can be solved by prefixing mausezahn invocations with "ip vrf exec". However, IP multicast packets do not perform routing and simply egress the bound device, which does not exist in this case. Fix by specifying the source and destination MAC of the packet which will cause mausezahn to use a packet socket instead of an IP socket. Fixes: b6d00da08610 ("selftests: forwarding: Add bridge MDB test") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/ Signed-off-by: Ido Schimmel Tested-by: Mirsad Todorovac Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-16-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 21a72166abb9c9d13fe24a07cef0a0b9f1e331b0 Author: Ido Schimmel Date: Tue Aug 8 17:15:00 2023 +0300 selftests: forwarding: tc_flower_l2_miss: Fix failing test with old libnet As explained in commit 8bcfb4ae4d97 ("selftests: forwarding: Fix failing tests with old libnet"), old versions of libnet (used by mausezahn) do not use the "SO_BINDTODEVICE" socket option. For IP unicast packets, this can be solved by prefixing mausezahn invocations with "ip vrf exec". However, IP multicast packets do not perform routing and simply egress the bound device, which does not exist in this case. Fix by specifying the source and destination MAC of the packet which will cause mausezahn to use a packet socket instead of an IP socket. Fixes: 8c33266ae26a ("selftests: forwarding: Add layer 2 miss test cases") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/ Signed-off-by: Ido Schimmel Tested-by: Mirsad Todorovac Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-15-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 11604178fdc3404d46518e5332f1fe865d30c4a1 Author: Ido Schimmel Date: Tue Aug 8 17:14:59 2023 +0300 selftests: forwarding: tc_tunnel_key: Make filters more specific The test installs filters that match on various IP fragments (e.g., no fragment, first fragment) and expects a certain amount of packets to hit each filter. This is problematic as the filters are not specific enough and can match IP packets (e.g., IGMP) generated by the stack, resulting in failures [1]. Fix by making the filters more specific and match on more fields in the IP header: Source IP, destination IP and protocol. [1] # timeout set to 0 # selftests: net/forwarding: tc_tunnel_key.sh # TEST: tunnel_key nofrag (skip_hw) [FAIL] # packet smaller than MTU was not tunneled # INFO: Could not test offloaded functionality not ok 89 selftests: net/forwarding: tc_tunnel_key.sh # exit=1 Fixes: 533a89b1940f ("selftests: forwarding: add tunnel_key "nofrag" test case") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/ Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Tested-by: Mirsad Todorovac Acked-by: Davide Caratti Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-14-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 9ee37e53e7687654b487fc94e82569377272a7a8 Author: Ido Schimmel Date: Tue Aug 8 17:14:58 2023 +0300 selftests: forwarding: tc_flower: Relax success criterion The test checks that filters that match on source or destination MAC were only hit once. A host can send more than one packet with a given source or destination MAC, resulting in failures. Fix by relaxing the success criterion and instead check that the filters were not hit zero times. Using tc_check_at_least_x_packets() is also an option, but it is not available in older kernels. Fixes: 07e5c75184a1 ("selftests: forwarding: Introduce tc flower matching tests") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/ Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Tested-by: Mirsad Todorovac Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-13-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 5e8670610b93158ffacc3241f835454ff26a3469 Author: Ido Schimmel Date: Tue Aug 8 17:14:57 2023 +0300 selftests: forwarding: tc_actions: Use ncat instead of nc The test relies on 'nc' being the netcat version from the nmap project. While this seems to be the case on Fedora, it is not the case on Ubuntu, resulting in failures such as [1]. Fix by explicitly using the 'ncat' utility from the nmap project and the skip the test in case it is not installed. [1] # timeout set to 0 # selftests: net/forwarding: tc_actions.sh # TEST: gact drop and ok (skip_hw) [ OK ] # TEST: mirred egress flower redirect (skip_hw) [ OK ] # TEST: mirred egress flower mirror (skip_hw) [ OK ] # TEST: mirred egress matchall mirror (skip_hw) [ OK ] # TEST: mirred_egress_to_ingress (skip_hw) [ OK ] # nc: invalid option -- '-' # usage: nc [-46CDdFhklNnrStUuvZz] [-I length] [-i interval] [-M ttl] # [-m minttl] [-O length] [-P proxy_username] [-p source_port] # [-q seconds] [-s sourceaddr] [-T keyword] [-V rtable] [-W recvlimit] # [-w timeout] [-X proxy_protocol] [-x proxy_address[:port]] # [destination] [port] # nc: invalid option -- '-' # usage: nc [-46CDdFhklNnrStUuvZz] [-I length] [-i interval] [-M ttl] # [-m minttl] [-O length] [-P proxy_username] [-p source_port] # [-q seconds] [-s sourceaddr] [-T keyword] [-V rtable] [-W recvlimit] # [-w timeout] [-X proxy_protocol] [-x proxy_address[:port]] # [destination] [port] # TEST: mirred_egress_to_ingress_tcp (skip_hw) [FAIL] # server output check failed # INFO: Could not test offloaded functionality not ok 80 selftests: net/forwarding: tc_actions.sh # exit=1 Fixes: ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/ Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Tested-by: Mirsad Todorovac Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-12-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 23fb886a1ced6f885ddd541cc86d45c415ce705c Author: Ido Schimmel Date: Tue Aug 8 17:14:56 2023 +0300 selftests: forwarding: ethtool_mm: Skip when MAC Merge is not supported MAC Merge cannot be tested with veth pairs, resulting in failures: # ./ethtool_mm.sh [...] TEST: Manual configuration with verification: swp1 to swp2 [FAIL] Verification did not succeed Fix by skipping the test when the interfaces do not support MAC Merge. Fixes: e6991384ace5 ("selftests: forwarding: add a test for MAC Merge layer") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/ Signed-off-by: Ido Schimmel Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-11-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 9a711cde07c245a163d95eee5b42ed1871e73236 Author: Ido Schimmel Date: Tue Aug 8 17:14:55 2023 +0300 selftests: forwarding: hw_stats_l3_gre: Skip when using veth pairs Layer 3 hardware stats cannot be used when the underlying interfaces are veth pairs, resulting in failures: # ./hw_stats_l3_gre.sh TEST: ping gre flat [ OK ] TEST: Test rx packets: [FAIL] Traffic not reflected in the counter: 0 -> 0 TEST: Test tx packets: [FAIL] Traffic not reflected in the counter: 0 -> 0 Fix by skipping the test when used with veth pairs. Fixes: 813f97a26860 ("selftests: forwarding: Add a tunnel-based test for L3 HW stats") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/ Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Tested-by: Mirsad Todorovac Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-10-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit b3d9305e60d121dac20a77b6847c4cf14a4c0001 Author: Ido Schimmel Date: Tue Aug 8 17:14:54 2023 +0300 selftests: forwarding: ethtool_extended_state: Skip when using veth pairs Ethtool extended state cannot be tested with veth pairs, resulting in failures: # ./ethtool_extended_state.sh TEST: Autoneg, No partner detected [FAIL] Expected "Autoneg", got "Link detected: no" [...] Fix by skipping the test when used with veth pairs. Fixes: 7d10bcce98cd ("selftests: forwarding: Add tests for ethtool extended state") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/ Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Tested-by: Mirsad Todorovac Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-9-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 60a36e21915c31c0375d9427be9406aa8ce2ec34 Author: Ido Schimmel Date: Tue Aug 8 17:14:53 2023 +0300 selftests: forwarding: ethtool: Skip when using veth pairs Auto-negotiation cannot be tested with veth pairs, resulting in failures: # ./ethtool.sh TEST: force of same speed autoneg off [FAIL] error in configuration. swp1 speed Not autoneg off [...] Fix by skipping the test when used with veth pairs. Fixes: 64916b57c0b1 ("selftests: forwarding: Add speed and auto-negotiation test") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/ Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Tested-by: Mirsad Todorovac Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-8-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 66e131861ab7bf754b50813216f5c6885cd32d63 Author: Ido Schimmel Date: Tue Aug 8 17:14:52 2023 +0300 selftests: forwarding: Add a helper to skip test when using veth pairs A handful of tests require physical loopbacks to be used instead of veth pairs. Add a helper that these tests will invoke in order to be skipped when executed with veth pairs. Fixes: 64916b57c0b1 ("selftests: forwarding: Add speed and auto-negotiation test") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Tested-by: Mirsad Todorovac Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-7-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 38f7c44d6e760a8513557e27340d61b820c91b8f Author: Ido Schimmel Date: Tue Aug 8 17:14:51 2023 +0300 selftests: forwarding: Set default IPv6 traceroute utility The test uses the 'TROUTE6' environment variable to encode the name of the IPv6 traceroute utility. By default (without a configuration file), this variable is not set, resulting in failures: # ./ip6_forward_instats_vrf.sh TEST: ping6 [ OK ] TEST: Ip6InTooBigErrors [ OK ] TEST: Ip6InHdrErrors [FAIL] TEST: Ip6InAddrErrors [ OK ] TEST: Ip6InDiscards [ OK ] Fix by setting a default utility name and skip the test if the utility is not present. Fixes: 0857d6f8c759 ("ipv6: When forwarding count rx stats on the orig netdev") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/adc5e40d-d040-a65e-eb26-edf47dac5b02@alu.unizg.hr/ Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Tested-by: Mirsad Todorovac Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-6-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 6bdf3d9765f4e0eebfd919e70acc65bce5daa9b9 Author: Ido Schimmel Date: Tue Aug 8 17:14:50 2023 +0300 selftests: forwarding: bridge_mdb_max: Check iproute2 version The selftest relies on iproute2 changes present in version 6.3, but the test does not check for it, resulting in errors: # ./bridge_mdb_max.sh INFO: 802.1d tests TEST: cfg4: port: ngroups reporting [FAIL] Number of groups was null, now is null, but 5 expected TEST: ctl4: port: ngroups reporting [FAIL] Number of groups was null, now is null, but 5 expected TEST: cfg6: port: ngroups reporting [FAIL] Number of groups was null, now is null, but 5 expected [...] Fix by skipping the test if iproute2 is too old. Fixes: 3446dcd7df05 ("selftests: forwarding: bridge_mdb_max: Add a new selftest") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/6b04b2ba-2372-6f6b-3ac8-b7cba1cfae83@alu.unizg.hr/ Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Tested-by: Mirsad Todorovac Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-5-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit ab2eda04e2c2116910b9d77ccc82e727efa71d49 Author: Ido Schimmel Date: Tue Aug 8 17:14:49 2023 +0300 selftests: forwarding: bridge_mdb: Check iproute2 version The selftest relies on iproute2 changes present in version 6.3, but the test does not check for it, resulting in error: # ./bridge_mdb.sh INFO: # Host entries configuration tests TEST: Common host entries configuration tests (IPv4) [FAIL] Managed to add IPv4 host entry with a filter mode TEST: Common host entries configuration tests (IPv6) [FAIL] Managed to add IPv6 host entry with a filter mode TEST: Common host entries configuration tests (L2) [FAIL] Managed to add L2 host entry with a filter mode INFO: # Port group entries configuration tests - (*, G) Command "replace" is unknown, try "bridge mdb help". [...] Fix by skipping the test if iproute2 is too old. Fixes: b6d00da08610 ("selftests: forwarding: Add bridge MDB test") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/6b04b2ba-2372-6f6b-3ac8-b7cba1cfae83@alu.unizg.hr/ Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Tested-by: Mirsad Todorovac Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-4-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 0529883ad102f6c04e19fb7018f31e1bda575bbe Author: Ido Schimmel Date: Tue Aug 8 17:14:48 2023 +0300 selftests: forwarding: Switch off timeout The default timeout for selftests is 45 seconds, but it is not enough for forwarding selftests which can takes minutes to finish depending on the number of tests cases: # make -C tools/testing/selftests TARGETS=net/forwarding run_tests TAP version 13 1..102 # timeout set to 45 # selftests: net/forwarding: bridge_igmp.sh # TEST: IGMPv2 report 239.10.10.10 [ OK ] # TEST: IGMPv2 leave 239.10.10.10 [ OK ] # TEST: IGMPv3 report 239.10.10.10 is_include [ OK ] # TEST: IGMPv3 report 239.10.10.10 include -> allow [ OK ] # not ok 1 selftests: net/forwarding: bridge_igmp.sh # TIMEOUT 45 seconds Fix by switching off the timeout and setting it to 0. A similar change was done for BPF selftests in commit 6fc5916cc256 ("selftests: bpf: Switch off timeout"). Fixes: 81573b18f26d ("selftests/net/forwarding: add Makefile to install tests") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/8d149f8c-818e-d141-a0ce-a6bae606bc22@alu.unizg.hr/ Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Tested-by: Mirsad Todorovac Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit d72c83b1e4b4a36a38269c77a85ff52f95eb0d08 Author: Ido Schimmel Date: Tue Aug 8 17:14:47 2023 +0300 selftests: forwarding: Skip test when no interfaces are specified As explained in [1], the forwarding selftests are meant to be run with either physical loopbacks or veth pairs. The interfaces are expected to be specified in a user-provided forwarding.config file or as command line arguments. By default, this file is not present and the tests fail: # make -C tools/testing/selftests TARGETS=net/forwarding run_tests [...] TAP version 13 1..102 # timeout set to 45 # selftests: net/forwarding: bridge_igmp.sh # Command line is not complete. Try option "help" # Failed to create netif not ok 1 selftests: net/forwarding: bridge_igmp.sh # exit=1 [...] Fix by skipping a test if interfaces are not provided either via the configuration file or command line arguments. # make -C tools/testing/selftests TARGETS=net/forwarding run_tests [...] TAP version 13 1..102 # timeout set to 45 # selftests: net/forwarding: bridge_igmp.sh # SKIP: Cannot create interface. Name not specified ok 1 selftests: net/forwarding: bridge_igmp.sh # SKIP [1] tools/testing/selftests/net/forwarding/README Fixes: 81573b18f26d ("selftests/net/forwarding: add Makefile to install tests") Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/netdev/856d454e-f83c-20cf-e166-6dc06cbc1543@alu.unizg.hr/ Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Tested-by: Mirsad Todorovac Reviewed-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230808141503.4060661-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 8a70ed9520c5fafaac91053cacdd44625c39e188 Author: Eric Dumazet Date: Tue Aug 8 08:49:23 2023 +0000 tcp: add missing family to tcp_set_ca_state() tracepoint Before this code is copied, add the missing family, as we did in commit 3dd344ea84e1 ("net: tracepoint: exposing sk_family in all tcp:tracepoints") Fixes: 15fcdf6ae116 ("tcp: Add tracepoint for tcp_set_ca_state") Signed-off-by: Eric Dumazet Cc: Ping Gan Cc: Manjusaka Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230808084923.2239142-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit f8d3e0dc4b3aed92063de6e9fd34a75efe8d4a03 Merge: 718cb09aaa6fa 8743aeff5bc4d Author: Jakub Kicinski Date: Wed Aug 9 13:42:09 2023 -0700 Merge branch 'nexthop-nexthop-dump-fixes' Ido Schimmel says: ==================== nexthop: Nexthop dump fixes Patches #1 and #3 fix two problems related to nexthops and nexthop buckets dump, respectively. Patch #2 is a preparation for the third patch. The pattern described in these patches of splitting the NLMSG_DONE to a separate response is prevalent in other rtnetlink dump callbacks. I don't know if it's because I'm missing something or if this was done intentionally to ensure the message is delivered to user space. After commit 0642840b8bb0 ("af_netlink: ensure that NLMSG_DONE never fails in dumps") this is no longer necessary and I can improve these dump callbacks assuming this analysis is correct. No regressions in existing tests: # ./fib_nexthops.sh [...] Tests passed: 230 Tests failed: 0 ==================== Link: https://lore.kernel.org/r/20230808075233.3337922-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 8743aeff5bc4dcb5b87b43765f48d5ac3ad7dd9f Author: Ido Schimmel Date: Tue Aug 8 10:52:33 2023 +0300 nexthop: Fix infinite nexthop bucket dump when using maximum nexthop ID A netlink dump callback can return a positive number to signal that more information needs to be dumped or zero to signal that the dump is complete. In the second case, the core netlink code will append the NLMSG_DONE message to the skb in order to indicate to user space that the dump is complete. The nexthop bucket dump callback always returns a positive number if nexthop buckets were filled in the provided skb, even if the dump is complete. This means that a dump will span at least two recvmsg() calls as long as nexthop buckets are present. In the last recvmsg() call the dump callback will not fill in any nexthop buckets because the previous call indicated that the dump should restart from the last dumped nexthop ID plus one. # ip link add name dummy1 up type dummy # ip nexthop add id 1 dev dummy1 # ip nexthop add id 10 group 1 type resilient buckets 2 # strace -e sendto,recvmsg -s 5 ip nexthop bucket sendto(3, [[{nlmsg_len=24, nlmsg_type=RTM_GETNEXTHOPBUCKET, nlmsg_flags=NLM_F_REQUEST|NLM_F_DUMP, nlmsg_seq=1691396980, nlmsg_pid=0}, {family=AF_UNSPEC, data="\x00\x00\x00\x00\x00"...}], {nlmsg_len=0, nlmsg_type=0 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=0}], 152, 0, NULL, 0) = 152 recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=NULL, iov_len=0}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_TRUNC}, MSG_PEEK|MSG_TRUNC) = 128 recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[[{nlmsg_len=64, nlmsg_type=RTM_NEWNEXTHOPBUCKET, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691396980, nlmsg_pid=347}, {family=AF_UNSPEC, data="\x00\x00\x00\x00\x00"...}], [{nlmsg_len=64, nlmsg_type=RTM_NEWNEXTHOPBUCKET, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691396980, nlmsg_pid=347}, {family=AF_UNSPEC, data="\x00\x00\x00\x00\x00"...}]], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 128 id 10 index 0 idle_time 6.66 nhid 1 id 10 index 1 idle_time 6.66 nhid 1 recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=NULL, iov_len=0}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_TRUNC}, MSG_PEEK|MSG_TRUNC) = 20 recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NLMSG_DONE, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691396980, nlmsg_pid=347}, 0], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 +++ exited with 0 +++ This behavior is both inefficient and buggy. If the last nexthop to be dumped had the maximum ID of 0xffffffff, then the dump will restart from 0 (0xffffffff + 1) and never end: # ip link add name dummy1 up type dummy # ip nexthop add id 1 dev dummy1 # ip nexthop add id $((2**32-1)) group 1 type resilient buckets 2 # ip nexthop bucket id 4294967295 index 0 idle_time 5.55 nhid 1 id 4294967295 index 1 idle_time 5.55 nhid 1 id 4294967295 index 0 idle_time 5.55 nhid 1 id 4294967295 index 1 idle_time 5.55 nhid 1 [...] Fix by adjusting the dump callback to return zero when the dump is complete. After the fix only one recvmsg() call is made and the NLMSG_DONE message is appended to the RTM_NEWNEXTHOPBUCKET responses: # ip link add name dummy1 up type dummy # ip nexthop add id 1 dev dummy1 # ip nexthop add id $((2**32-1)) group 1 type resilient buckets 2 # strace -e sendto,recvmsg -s 5 ip nexthop bucket sendto(3, [[{nlmsg_len=24, nlmsg_type=RTM_GETNEXTHOPBUCKET, nlmsg_flags=NLM_F_REQUEST|NLM_F_DUMP, nlmsg_seq=1691396737, nlmsg_pid=0}, {family=AF_UNSPEC, data="\x00\x00\x00\x00\x00"...}], {nlmsg_len=0, nlmsg_type=0 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=0}], 152, 0, NULL, 0) = 152 recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=NULL, iov_len=0}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_TRUNC}, MSG_PEEK|MSG_TRUNC) = 148 recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[[{nlmsg_len=64, nlmsg_type=RTM_NEWNEXTHOPBUCKET, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691396737, nlmsg_pid=350}, {family=AF_UNSPEC, data="\x00\x00\x00\x00\x00"...}], [{nlmsg_len=64, nlmsg_type=RTM_NEWNEXTHOPBUCKET, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691396737, nlmsg_pid=350}, {family=AF_UNSPEC, data="\x00\x00\x00\x00\x00"...}], [{nlmsg_len=20, nlmsg_type=NLMSG_DONE, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691396737, nlmsg_pid=350}, 0]], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 148 id 4294967295 index 0 idle_time 6.61 nhid 1 id 4294967295 index 1 idle_time 6.61 nhid 1 +++ exited with 0 +++ Note that if the NLMSG_DONE message cannot be appended because of size limitations, then another recvmsg() will be needed, but the core netlink code will not invoke the dump callback and simply reply with a NLMSG_DONE message since it knows that the callback previously returned zero. Add a test that fails before the fix: # ./fib_nexthops.sh -t basic_res [...] TEST: Maximum nexthop ID dump [FAIL] [...] And passes after it: # ./fib_nexthops.sh -t basic_res [...] TEST: Maximum nexthop ID dump [ OK ] [...] Fixes: 8a1bbabb034d ("nexthop: Add netlink handlers for bucket dump") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20230808075233.3337922-4-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit f10d3d9df49d9e6ee244fda6ca264f901a9c5d85 Author: Ido Schimmel Date: Tue Aug 8 10:52:32 2023 +0300 nexthop: Make nexthop bucket dump more efficient rtm_dump_nexthop_bucket_nh() is used to dump nexthop buckets belonging to a specific resilient nexthop group. The function returns a positive return code (the skb length) upon both success and failure. The above behavior is problematic. When a complete nexthop bucket dump is requested, the function that walks the different nexthops treats the non-zero return code as an error. This causes buckets belonging to different resilient nexthop groups to be dumped using different buffers even if they can all fit in the same buffer: # ip link add name dummy1 up type dummy # ip nexthop add id 1 dev dummy1 # ip nexthop add id 10 group 1 type resilient buckets 1 # ip nexthop add id 20 group 1 type resilient buckets 1 # strace -e recvmsg -s 0 ip nexthop bucket [...] recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[...], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 64 id 10 index 0 idle_time 10.27 nhid 1 [...] recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[...], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 64 id 20 index 0 idle_time 6.44 nhid 1 [...] Fix by only returning a non-zero return code when an error occurred and restarting the dump from the bucket index we failed to fill in. This allows buckets belonging to different resilient nexthop groups to be dumped using the same buffer: # ip link add name dummy1 up type dummy # ip nexthop add id 1 dev dummy1 # ip nexthop add id 10 group 1 type resilient buckets 1 # ip nexthop add id 20 group 1 type resilient buckets 1 # strace -e recvmsg -s 0 ip nexthop bucket [...] recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[...], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 128 id 10 index 0 idle_time 30.21 nhid 1 id 20 index 0 idle_time 26.7 nhid 1 [...] While this change is more of a performance improvement change than an actual bug fix, it is a prerequisite for a subsequent patch that does fix a bug. Fixes: 8a1bbabb034d ("nexthop: Add netlink handlers for bucket dump") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20230808075233.3337922-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 913f60cacda73ccac8eead94983e5884c03e04cd Author: Ido Schimmel Date: Tue Aug 8 10:52:31 2023 +0300 nexthop: Fix infinite nexthop dump when using maximum nexthop ID A netlink dump callback can return a positive number to signal that more information needs to be dumped or zero to signal that the dump is complete. In the second case, the core netlink code will append the NLMSG_DONE message to the skb in order to indicate to user space that the dump is complete. The nexthop dump callback always returns a positive number if nexthops were filled in the provided skb, even if the dump is complete. This means that a dump will span at least two recvmsg() calls as long as nexthops are present. In the last recvmsg() call the dump callback will not fill in any nexthops because the previous call indicated that the dump should restart from the last dumped nexthop ID plus one. # ip nexthop add id 1 blackhole # strace -e sendto,recvmsg -s 5 ip nexthop sendto(3, [[{nlmsg_len=24, nlmsg_type=RTM_GETNEXTHOP, nlmsg_flags=NLM_F_REQUEST|NLM_F_DUMP, nlmsg_seq=1691394315, nlmsg_pid=0}, {nh_family=AF_UNSPEC, nh_scope=RT_SCOPE_UNIVERSE, nh_protocol=RTPROT_UNSPEC, nh_flags=0}], {nlmsg_len=0, nlmsg_type=0 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=0}], 152, 0, NULL, 0) = 152 recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=NULL, iov_len=0}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_TRUNC}, MSG_PEEK|MSG_TRUNC) = 36 recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{nlmsg_len=36, nlmsg_type=RTM_NEWNEXTHOP, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691394315, nlmsg_pid=343}, {nh_family=AF_INET, nh_scope=RT_SCOPE_UNIVERSE, nh_protocol=RTPROT_UNSPEC, nh_flags=0}, [[{nla_len=8, nla_type=NHA_ID}, 1], {nla_len=4, nla_type=NHA_BLACKHOLE}]], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 36 id 1 blackhole recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=NULL, iov_len=0}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_TRUNC}, MSG_PEEK|MSG_TRUNC) = 20 recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{nlmsg_len=20, nlmsg_type=NLMSG_DONE, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691394315, nlmsg_pid=343}, 0], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 20 +++ exited with 0 +++ This behavior is both inefficient and buggy. If the last nexthop to be dumped had the maximum ID of 0xffffffff, then the dump will restart from 0 (0xffffffff + 1) and never end: # ip nexthop add id $((2**32-1)) blackhole # ip nexthop id 4294967295 blackhole id 4294967295 blackhole [...] Fix by adjusting the dump callback to return zero when the dump is complete. After the fix only one recvmsg() call is made and the NLMSG_DONE message is appended to the RTM_NEWNEXTHOP response: # ip nexthop add id $((2**32-1)) blackhole # strace -e sendto,recvmsg -s 5 ip nexthop sendto(3, [[{nlmsg_len=24, nlmsg_type=RTM_GETNEXTHOP, nlmsg_flags=NLM_F_REQUEST|NLM_F_DUMP, nlmsg_seq=1691394080, nlmsg_pid=0}, {nh_family=AF_UNSPEC, nh_scope=RT_SCOPE_UNIVERSE, nh_protocol=RTPROT_UNSPEC, nh_flags=0}], {nlmsg_len=0, nlmsg_type=0 /* NLMSG_??? */, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=0}], 152, 0, NULL, 0) = 152 recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=NULL, iov_len=0}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_TRUNC}, MSG_PEEK|MSG_TRUNC) = 56 recvmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[[{nlmsg_len=36, nlmsg_type=RTM_NEWNEXTHOP, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691394080, nlmsg_pid=342}, {nh_family=AF_INET, nh_scope=RT_SCOPE_UNIVERSE, nh_protocol=RTPROT_UNSPEC, nh_flags=0}, [[{nla_len=8, nla_type=NHA_ID}, 4294967295], {nla_len=4, nla_type=NHA_BLACKHOLE}]], [{nlmsg_len=20, nlmsg_type=NLMSG_DONE, nlmsg_flags=NLM_F_MULTI, nlmsg_seq=1691394080, nlmsg_pid=342}, 0]], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 56 id 4294967295 blackhole +++ exited with 0 +++ Note that if the NLMSG_DONE message cannot be appended because of size limitations, then another recvmsg() will be needed, but the core netlink code will not invoke the dump callback and simply reply with a NLMSG_DONE message since it knows that the callback previously returned zero. Add a test that fails before the fix: # ./fib_nexthops.sh -t basic [...] TEST: Maximum nexthop ID dump [FAIL] [...] And passes after it: # ./fib_nexthops.sh -t basic [...] TEST: Maximum nexthop ID dump [ OK ] [...] Fixes: ab84be7e54fc ("net: Initial nexthop code") Reported-by: Petr Machata Closes: https://lore.kernel.org/netdev/87sf91enuf.fsf@nvidia.com/ Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20230808075233.3337922-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 718cb09aaa6fa78cc8124e9517efbc6c92665384 Author: Vlad Buslov Date: Tue Aug 8 11:35:21 2023 +0200 vlan: Fix VLAN 0 memory leak The referenced commit intended to fix memleak of VLAN 0 that is implicitly created on devices with NETIF_F_HW_VLAN_CTAG_FILTER feature. However, it doesn't take into account that the feature can be re-set during the netdevice lifetime which will cause memory leak if feature is disabled during the device deletion as illustrated by [0]. Fix the leak by unconditionally deleting VLAN 0 on NETDEV_DOWN event. [0]: > modprobe 8021q > ip l set dev eth2 up > ethtool -K eth2 rx-vlan-filter off > modprobe -r mlx5_ib > modprobe -r mlx5_core > cat /sys/kernel/debug/kmemleak unreferenced object 0xffff888103dcd900 (size 256): comm "ip", pid 1490, jiffies 4294907305 (age 325.364s) hex dump (first 32 bytes): 00 80 5d 03 81 88 ff ff 00 00 00 00 00 00 00 00 ..]............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000899f3bb9>] kmalloc_trace+0x25/0x80 [<000000002889a7a2>] vlan_vid_add+0xa0/0x210 [<000000007177800e>] vlan_device_event+0x374/0x760 [8021q] [<000000009a0716b1>] notifier_call_chain+0x35/0xb0 [<00000000bbf3d162>] __dev_notify_flags+0x58/0xf0 [<0000000053d2b05d>] dev_change_flags+0x4d/0x60 [<00000000982807e9>] do_setlink+0x28d/0x10a0 [<0000000058c1be00>] __rtnl_newlink+0x545/0x980 [<00000000e66c3bd9>] rtnl_newlink+0x44/0x70 [<00000000a2cc5970>] rtnetlink_rcv_msg+0x29c/0x390 [<00000000d307d1e4>] netlink_rcv_skb+0x54/0x100 [<00000000259d16f9>] netlink_unicast+0x1f6/0x2c0 [<000000007ce2afa1>] netlink_sendmsg+0x232/0x4a0 [<00000000f3f4bb39>] sock_sendmsg+0x38/0x60 [<000000002f9c0624>] ____sys_sendmsg+0x1e3/0x200 [<00000000d6ff5520>] ___sys_sendmsg+0x80/0xc0 unreferenced object 0xffff88813354fde0 (size 32): comm "ip", pid 1490, jiffies 4294907305 (age 325.364s) hex dump (first 32 bytes): a0 d9 dc 03 81 88 ff ff a0 d9 dc 03 81 88 ff ff ................ 81 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000899f3bb9>] kmalloc_trace+0x25/0x80 [<000000002da64724>] vlan_vid_add+0xdf/0x210 [<000000007177800e>] vlan_device_event+0x374/0x760 [8021q] [<000000009a0716b1>] notifier_call_chain+0x35/0xb0 [<00000000bbf3d162>] __dev_notify_flags+0x58/0xf0 [<0000000053d2b05d>] dev_change_flags+0x4d/0x60 [<00000000982807e9>] do_setlink+0x28d/0x10a0 [<0000000058c1be00>] __rtnl_newlink+0x545/0x980 [<00000000e66c3bd9>] rtnl_newlink+0x44/0x70 [<00000000a2cc5970>] rtnetlink_rcv_msg+0x29c/0x390 [<00000000d307d1e4>] netlink_rcv_skb+0x54/0x100 [<00000000259d16f9>] netlink_unicast+0x1f6/0x2c0 [<000000007ce2afa1>] netlink_sendmsg+0x232/0x4a0 [<00000000f3f4bb39>] sock_sendmsg+0x38/0x60 [<000000002f9c0624>] ____sys_sendmsg+0x1e3/0x200 [<00000000d6ff5520>] ___sys_sendmsg+0x80/0xc0 Fixes: efc73f4bbc23 ("net: Fix memory leak - vlan_info struct") Reviewed-by: Ido Schimmel Signed-off-by: Vlad Buslov Link: https://lore.kernel.org/r/20230808093521.1468929-1-vladbu@nvidia.com Signed-off-by: Jakub Kicinski commit 1b8b1aa90c9c0e825b181b98b8d9e249dc395470 Author: Kirill A. Shutemov Date: Thu Aug 3 18:16:09 2023 +0300 x86/mm: Fix VDSO and VVAR placement on 5-level paging machines Yingcong has noticed that on the 5-level paging machine, VDSO and VVAR VMAs are placed above the 47-bit border: 8000001a9000-8000001ad000 r--p 00000000 00:00 0 [vvar] 8000001ad000-8000001af000 r-xp 00000000 00:00 0 [vdso] This might confuse users who are not aware of 5-level paging and expect all userspace addresses to be under the 47-bit border. So far problem has only been triggered with ASLR disabled, although it may also occur with ASLR enabled if the layout is randomized in a just right way. The problem happens due to custom placement for the VMAs in the VDSO code: vdso_addr() tries to place them above the stack and checks the result against TASK_SIZE_MAX, which is wrong. TASK_SIZE_MAX is set to the 56-bit border on 5-level paging machines. Use DEFAULT_MAP_WINDOW instead. Fixes: b569bab78d8d ("x86/mm: Prepare to expose larger address space to userspace") Reported-by: Yingcong Wu Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20230803151609.22141-1-kirill.shutemov%40linux.intel.com commit af8a6d281bfb68023fb60f616ec87fe8a875875e Author: Srinivas Pandruvada Date: Tue Aug 8 10:43:59 2023 -0700 platform/x86: ISST: Reduce noise for missing numa information in logs On platforms with no numa support and with several CPUs, logs have lots of noise for message "Fail to get numa node for CPU:.." Change pr_info() to pr_info_once() as one print is enough to show the issue. Signed-off-by: Srinivas Pandruvada Link: https://lore.kernel.org/r/20230808174359.50602-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 5a66d59b5ff537ddae84a1f175c3f8eb1140a562 Author: Jean Delvare Date: Sat Aug 5 10:10:10 2023 +0200 platform/x86: msi-ec: Fix the build The msi-ec driver fails to build for me (gcc 7.5): CC [M] drivers/platform/x86/msi-ec.o drivers/platform/x86/msi-ec.c:72:6: error: initializer element is not constant { SM_ECO_NAME, 0xc2 }, ^~~~~~~~~~~ drivers/platform/x86/msi-ec.c:72:6: note: (near initialization for ‘CONF0.shift_mode.modes[0].name’) drivers/platform/x86/msi-ec.c:73:6: error: initializer element is not constant { SM_COMFORT_NAME, 0xc1 }, ^~~~~~~~~~~~~~~ drivers/platform/x86/msi-ec.c:73:6: note: (near initialization for ‘CONF0.shift_mode.modes[1].name’) drivers/platform/x86/msi-ec.c:74:6: error: initializer element is not constant { SM_SPORT_NAME, 0xc0 }, ^~~~~~~~~~~~~ drivers/platform/x86/msi-ec.c:74:6: note: (near initialization for ‘CONF0.shift_mode.modes[2].name’) (...) Don't try to be smart, just use defines for the constant strings. The compiler will recognize it's the same string and will store it only once in the data section anyway. Signed-off-by: Jean Delvare Fixes: 392cacf2aa10 ("platform/x86: Add new msi-ec driver") Cc: stable@vger.kernel.org Cc: Nikita Kravets Cc: Hans de Goede Cc: Mark Gross Link: https://lore.kernel.org/r/20230805101010.54d49e91@endymion.delvare Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit c6a1fd910d1bf8a0e3db7aebb229e3c81bc305c4 Author: Hans de Goede Date: Wed Aug 9 10:55:25 2023 +0200 ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen On AMD Zen acpi_dev_irq_override() by default prefers the DSDT IRQ 1 settings over the MADT settings. This causes the keyboard to malfunction on some laptop models (see Links), all models from the Links have an INT_SRC_OVR MADT entry for IRQ 1. Fixes: a9c4a912b7dc ("ACPI: resource: Remove "Zen" specific match and quirks") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217336 Link: https://bugzilla.kernel.org/show_bug.cgi?id=217394 Link: https://bugzilla.kernel.org/show_bug.cgi?id=217406 Cc: All applicable Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 9728ac221160c5ea111879125a7694bb81364720 Author: Hans de Goede Date: Wed Aug 9 10:55:24 2023 +0200 ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs All the cases, were the DSDT IRQ settings should be used instead of the MADT override, are for IRQ 1 or 12, the PS/2 kbd resp. mouse IRQs. Simplify things by always honering the override for other legacy IRQs (for non DMI quirked cases). This allows removing the DMI quirks to honor the override for some non i8042 IRQs on some AMD ZEN based Lenovo models. Fixes: a9c4a912b7dc ("ACPI: resource: Remove "Zen" specific match and quirks") Cc: All applicable Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 2d331a6ac4815e2e2fe5f2d80d908566e57797cc Author: Hans de Goede Date: Wed Aug 9 10:55:23 2023 +0200 ACPI: resource: revert "Remove "Zen" specific match and quirks" Commit a9c4a912b7dc ("ACPI: resource: Remove "Zen" specific match and quirks") is causing keyboard problems for quite a log of AMD based laptop users, leading to many bug reports. Revert this change for now, until we can come up with a better fix for the PS/2 IRQ trigger-type/polarity problems on some x86 laptops. Fixes: a9c4a912b7dc ("ACPI: resource: Remove "Zen" specific match and quirks") Link: https://bugzilla.redhat.com/show_bug.cgi?id=2228891 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2229165 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2229317 Link: https://bugzilla.kernel.org/show_bug.cgi?id=217718 Link: https://bugzilla.kernel.org/show_bug.cgi?id=217726 Link: https://bugzilla.kernel.org/show_bug.cgi?id=217731 Cc: All applicable Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 3fa7187eceee11998f756481e45ce8c4f9d9dc48 Author: Qingsong Chen Date: Tue Aug 8 10:54:01 2023 +0800 rust: macros: vtable: fix `HAS_*` redefinition (`gen_const_name`) If we define the same function name twice in a trait (using `#[cfg]`), the `vtable` macro will redefine its `gen_const_name`, e.g. this will define `HAS_BAR` twice: #[vtable] pub trait Foo { #[cfg(CONFIG_X)] fn bar(); #[cfg(not(CONFIG_X))] fn bar(x: usize); } Fixes: b44becc5ee80 ("rust: macros: add `#[vtable]` proc macro") Signed-off-by: Qingsong Chen Reviewed-by: Andreas Hindborg Reviewed-by: Gary Guo Reviewed-by: Sergio González Collado Link: https://lore.kernel.org/r/20230808025404.2053471-1-changxian.cqs@antgroup.com Signed-off-by: Miguel Ojeda commit 6ccbd7fd474674654019a20177c943359469103a Author: Masahiro Yamada Date: Sat Jul 29 16:42:23 2023 +0900 alpha: remove __init annotation from exported page_is_ram() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Commit c5a130325f13 ("ACPI/APEI: Add parameter check before error injection") exported page_is_ram(), hence the __init annotation should be removed. This fixes the modpost warning in ARCH=alpha builds: WARNING: modpost: vmlinux: page_is_ram: EXPORT_SYMBOL used for init symbol. Remove __init or EXPORT_SYMBOL. Fixes: c5a130325f13 ("ACPI/APEI: Add parameter check before error injection") Signed-off-by: Masahiro Yamada Reviewed-by: Randy Dunlap commit cacc6e22932f373a91d7be55a9b992dc77f4c59b Author: Mario Limonciello Date: Mon Aug 7 23:12:29 2023 -0500 tpm: Add a helper for checking hwrng enabled The same checks are repeated in three places to decide whether to use hwrng. Consolidate these into a helper. Also this fixes a case that one of them was missing a check in the cleanup path. Fixes: 554b841d4703 ("tpm: Disable RNG for all AMD fTPMs") Signed-off-by: Mario Limonciello Signed-off-by: Linus Torvalds commit 421d467dc2d483175bad4fb76a31b9e5a3d744cf Author: Remi Pommarel Date: Wed Aug 9 17:29:13 2023 +0200 batman-adv: Fix batadv_v_ogm_aggr_send memory leak When batadv_v_ogm_aggr_send is called for an inactive interface, the skb is silently dropped by batadv_v_ogm_send_to_if() but never freed causing the following memory leak: unreferenced object 0xffff00000c164800 (size 512): comm "kworker/u8:1", pid 2648, jiffies 4295122303 (age 97.656s) hex dump (first 32 bytes): 00 80 af 09 00 00 ff ff e1 09 00 00 75 01 60 83 ............u.`. 1f 00 00 00 b8 00 00 00 15 00 05 00 da e3 d3 64 ...............d backtrace: [<0000000007ad20f6>] __kmalloc_track_caller+0x1a8/0x310 [<00000000d1029e55>] kmalloc_reserve.constprop.0+0x70/0x13c [<000000008b9d4183>] __alloc_skb+0xec/0x1fc [<00000000c7af5051>] __netdev_alloc_skb+0x48/0x23c [<00000000642ee5f5>] batadv_v_ogm_aggr_send+0x50/0x36c [<0000000088660bd7>] batadv_v_ogm_aggr_work+0x24/0x40 [<0000000042fc2606>] process_one_work+0x3b0/0x610 [<000000002f2a0b1c>] worker_thread+0xa0/0x690 [<0000000059fae5d4>] kthread+0x1fc/0x210 [<000000000c587d3a>] ret_from_fork+0x10/0x20 Free the skb in that case to fix this leak. Cc: stable@vger.kernel.org Fixes: 0da0035942d4 ("batman-adv: OGMv2 - add basic infrastructure") Signed-off-by: Remi Pommarel Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit 22883973244b1caaa26f9c6171a41ba843c8d4bd Author: Kirill A. Shutemov Date: Wed Aug 9 17:46:00 2023 +0300 mm: Fix access_remote_vm() regression on tagged addresses GDB uses /proc/PID/mem to access memory of the target process. GDB doesn't untag addresses manually, but relies on kernel to do the right thing. mem_rw() of procfs uses access_remote_vm() to get data from the target process. It worked fine until recent changes in __access_remote_vm() that now checks if there's VMA at target address using raw address. Untag the address before looking up the VMA. Signed-off-by: Kirill A. Shutemov Reported-by: Christina Schimpe Fixes: eee9c708cc89 ("gup: avoid stack expansion warning for known-good case") Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds commit 091ae5473f96ced844af6ba39b94757359b12348 Author: Alex Deucher Date: Fri Jul 28 11:38:02 2023 -0400 drm/amdkfd: disable IOMMUv2 support for Raven Use the dGPU path instead. There were a lot of platform issues with IOMMU in general on these chips due to windows not enabling IOMMU at the time. The dGPU path has been used for a long time with newer APUs and works fine. This also paves the way to simplify the driver significantly. Reviewed-by: Felix Kuehling Acked-by: Christian König Tested-by: Mike Lothian Signed-off-by: Alex Deucher commit 616f92d188ee7142a95a52068efdbea82645f859 Author: Alex Deucher Date: Fri Jul 28 11:34:59 2023 -0400 drm/amdkfd: disable IOMMUv2 support for KV/CZ Use the dGPU path instead. There were a lot of platform issues with IOMMU in general on these chips due to windows not enabling IOMMU at the time. The dGPU path has been used for a long time with newer APUs and works fine. This also paves the way to simplify the driver significantly. v2: use the dGPU queue manager functions Reviewed-by: Felix Kuehling Acked-by: Christian König Tested-by: Mike Lothian Signed-off-by: Alex Deucher commit a6dea2d64ff92851e68cd4e20a35f6534286e016 Author: Alex Deucher Date: Fri Jul 28 11:45:53 2023 -0400 drm/amdkfd: ignore crat by default We are dropping the IOMMUv2 path, so no need to enable this. It's often buggy on consumer platforms anyway. Reviewed-by: Felix Kuehling Acked-by: Christian König Tested-by: Mike Lothian Signed-off-by: Alex Deucher commit 2e91e731f24817bc55f9c9acc95a8939c4077b05 Author: Alex Deucher Date: Fri Jul 28 16:53:49 2023 -0400 drm/amdgpu/gfx11: only enable CP GFX shadowing on SR-IOV This is only required for SR-IOV world switches, but it adds additional latency leading to reduced performance in some benchmarks. Disable for now on bare metal. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 3bb575572bf498a9d39e9d1ca5c06cc3152928a1 Author: Mario Limonciello Date: Fri Jul 28 17:04:01 2023 -0500 drm/amd/display: Fix a regression on Polaris cards DCE products don't define a `remove_stream_from_ctx` like DCN ones do. This means that when compute_mst_dsc_configs_for_state() is called it always returns -EINVAL which causes MST to fail to setup. Cc: stable@vger.kernel.org # 6.4.y Cc: Harry Wentland Reported-by: Klaus.Kusche@computerix.info Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2671 Fixes: efa4c4df864e ("drm/amd/display: call remove_stream_from_ctx from res_pool funcs") Signed-off-by: Mario Limonciello Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 90e065677e0362a777b9db97ea21d43a39211399 Author: Alex Deucher Date: Fri Jul 28 11:14:05 2023 -0400 drm/amdgpu: fix possible UAF in amdgpu_cs_pass1() Since the gang_size check is outside of chunk parsing loop, we need to reset i before we free the chunk data. Suggested by Ye Zhang (@VAR10CK) of Baidu Security. Reviewed-by: Guchun Chen Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 77245f1c3c6495521f6a3af082696ee2f8ce3921 Author: Borislav Petkov (AMD) Date: Sat Aug 5 00:06:43 2023 +0200 x86/CPU/AMD: Do not leak quotient data after a division by 0 Under certain circumstances, an integer division by 0 which faults, can leave stale quotient data from a previous division operation on Zen1 microarchitectures. Do a dummy division 0/1 before returning from the #DE exception handler in order to avoid any leaks of potentially sensitive data. Signed-off-by: Borislav Petkov (AMD) Cc: Signed-off-by: Linus Torvalds commit a73ea79a0c94bacfab4df23a1043644d14f56591 Author: Lijo Lazar Date: Wed Aug 2 10:24:36 2023 +0530 drm/amd/pm: Fix SMU v13.0.6 energy reporting Energy counter should be reported in units of 15.259 uJ. Don't apply any conversion. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 96b020e2163fb2197266b2f71b1007495206e6bb Author: Melissa Wen Date: Mon Jul 31 07:35:05 2023 -0100 drm/amd/display: check attr flag before set cursor degamma on DCN3+ Don't set predefined degamma curve to cursor plane if the cursor attribute flag is not set. Applying a degamma curve to the cursor by default breaks userspace expectation. Checking the flag before performing any color transformation prevents too dark cursor gamma in DCN3+ on many Linux desktop environment (KDE Plasma, GNOME, wlroots-based, etc.) as reported at: - https://gitlab.freedesktop.org/drm/amd/-/issues/1513 This is the same approach followed by DCN2 drivers where the issue is not present. Fixes: 03f54d7d3448 ("drm/amd/display: Add DCN3 DPP") Link: https://gitlab.freedesktop.org/drm/amd/-/issues/1513 Signed-off-by: Melissa Wen Reviewed-by: Harry Wentland Tested-by: Alex Hung Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 61319b8e3b58a7167cf146313fd4523fe72586bc Author: Evan Quan Date: Fri Jul 21 19:18:00 2023 +0800 drm/amd/pm: disable the SMU13 OD feature support temporarily The existing OD interface cannot support the growing demand for more OD features. We are in the transition to a new OD mechanism. So, disable the SMU13 OD feature support temporarily. And this should be reverted when the new OD mechanism online. Signed-off-by: Evan Quan Reviewed-by: Guchun Chen Signed-off-by: Alex Deucher commit bd60e2eafd8fb053948b6e23e8167baf7a159750 Author: Kenneth Feng Date: Thu Jul 27 19:37:31 2023 +0800 drm/amd/pm: correct the pcie width for smu 13.0.0 correct the pcie width value in pp_dpm_pcie for smu 13.0.0 Signed-off-by: Kenneth Feng Reviewed-by: Harish Kasiviswanathan Acked-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 7ad1dfc144cbf62702fd07838da8fd8a77921083 Author: Mario Limonciello Date: Mon Jul 31 09:22:05 2023 -0500 drm/amd/display: Don't show stack trace for missing eDP Some systems are only connected by HDMI or DP, so warning related to missing eDP is unnecessary. Downgrade to debug instead. Cc: Hamza Mahfooz Fixes: 6d9b6dceaa51 ("drm/amd/display: only warn once in dce110_edp_wait_for_hpd_ready()") Reported-by: Mastan.Katragadda@amd.com Signed-off-by: Mario Limonciello Reviewed-by: Hamza Mahfooz Signed-off-by: Alex Deucher commit d3de41ee5febe5c2d9989fe9810bce2bb54a3a8e Author: Lijo Lazar Date: Tue Jul 25 19:11:54 2023 +0530 drm/amdgpu: Match against exact bootloader status On PSP v13.x ASICs, boot loader will set only the MSB to 1 and clear the least significant bits for any command submission. Hence match against the exact register value, otherwise a register value of all 0xFFs also could falsely indicate that boot loader is ready. Also, from PSP v13.0.6 and newer, bits[7:0] will be used to indicate command error status. Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 730d44e1fa306a20746ad4a85da550662aed9daa Author: Tim Huang Date: Thu Jul 27 09:59:45 2023 +0800 drm/amd/pm: skip the RLC stop when S0i3 suspend for SMU v13.0.4/11 For SMU v13.0.4/11, driver does not need to stop RLC for S0i3, the firmwares will handle that properly. Signed-off-by: Tim Huang Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher commit 08fffa74d9772d9538338be3f304006c94dde6f0 Author: Mario Limonciello Date: Thu Jul 27 10:22:20 2023 -0500 drm/amd: Disable S/G for APUs when 64GB or more host memory Users report a white flickering screen on multiple systems that is tied to having 64GB or more memory. When S/G is enabled pages will get pinned to both VRAM carve out and system RAM leading to this. Until it can be fixed properly, disable S/G when 64GB of memory or more is detected. This will force pages to be pinned into VRAM. This should fix white screen flickers but if VRAM pressure is encountered may lead to black screens. It's a trade-off for now. Fixes: 81d0bcf99009 ("drm/amdgpu: make display pinning more flexible (v2)") Cc: Hamza Mahfooz Cc: Roman Li Cc: # 6.1.y: bf0207e172703 ("drm/amdgpu: add S/G display parameter") Cc: # 6.4.y Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2735 Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2354 Signed-off-by: Mario Limonciello Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit e6475ce253187d2e68867102fddd57341ebbf8eb Author: Peter Ujfalusi Date: Wed Aug 9 15:56:56 2023 +0300 ASoC: SOF: ipc4-topology: Update the basecfg for copier earlier The sof_ipc4_update_resource_usage() call updates the CPC value in basecfg and it must be done prior to making a copy of the copier configuration for the init message. Other module types do the resource update as last step or in case of a process module at the correct time, before the memcpy. Fixes: d8a2c9879349 ("ASoC: SOF: ipc4-loader/topology: Query the CPC value from manifest") Signed-off-by: Peter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Adrian Bonislawski Reviewed-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Chao Song Link: https://lore.kernel.org/r/20230809125656.27585-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 06f2ab86a5b6ed55f013258de4be9319841853ea Author: Wen Gong Date: Wed Aug 9 04:12:41 2023 -0400 wifi: ath12k: Fix buffer overflow when scanning with extraie If cfg80211 is providing extraie's for a scanning process then ath12k will copy that over to the firmware. The extraie.len is a 32 bit value in struct element_info and describes the amount of bytes for the vendor information elements. The problem is the allocation of the buffer. It has to align the TLV sections by 4 bytes. But the code was using an u8 to store the newly calculated length of this section (with alignment). And the new calculated length was then used to allocate the skbuff. But the actual code to copy in the data is using the extraie.len and not the calculated "aligned" length. The length of extraie with IEEE80211_HW_SINGLE_SCAN_ON_ALL_BANDS enabled was 264 bytes during tests with a wifi card. But it only allocated 8 bytes (264 bytes % 256) for it. As consequence, the code to memcpy the extraie into the skb was then just overwriting data after skb->end. Things like shinfo were therefore corrupted. This could usually be seen by a crash in skb_zcopy_clear which tried to call a ubuf_info callback (using a bogus address). Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 Signed-off-by: Wen Gong Link: https://lore.kernel.org/r/20230809081241.32765-1-quic_wgong@quicinc.com Signed-off-by: Johannes Berg commit 6311071a056272e1e761de8d0305e87cc566f734 Author: Keith Yeo Date: Mon Jul 31 11:47:20 2023 +0800 wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() nl80211_parse_mbssid_elems() uses a u8 variable num_elems to count the number of MBSSID elements in the nested netlink attribute attrs, which can lead to an integer overflow if a user of the nl80211 interface specifies 256 or more elements in the corresponding attribute in userspace. The integer overflow can lead to a heap buffer overflow as num_elems determines the size of the trailing array in elems, and this array is thereafter written to for each element in attrs. Note that this vulnerability only affects devices with the wiphy->mbssid_max_interfaces member set for the wireless physical device struct in the device driver, and can only be triggered by a process with CAP_NET_ADMIN capabilities. Fix this by checking for a maximum of 255 elements in attrs. Cc: stable@vger.kernel.org Fixes: dc1e3cb8da8b ("nl80211: MBSSID and EMA support in AP mode") Signed-off-by: Keith Yeo Link: https://lore.kernel.org/r/20230731034719.77206-1-keithyjy@gmail.com Signed-off-by: Johannes Berg commit 24138933b97b055d486e8064b4a1721702442a9b Author: Florian Westphal Date: Wed Aug 9 14:31:15 2023 +0200 netfilter: nf_tables: don't skip expired elements during walk There is an asymmetry between commit/abort and preparation phase if the following conditions are met: 1. set is a verdict map ("1.2.3.4 : jump foo") 2. timeouts are enabled In this case, following sequence is problematic: 1. element E in set S refers to chain C 2. userspace requests removal of set S 3. kernel does a set walk to decrement chain->use count for all elements from preparation phase 4. kernel does another set walk to remove elements from the commit phase (or another walk to do a chain->use increment for all elements from abort phase) If E has already expired in 1), it will be ignored during list walk, so its use count won't have been changed. Then, when set is culled, ->destroy callback will zap the element via nf_tables_set_elem_destroy(), but this function is only safe for elements that have been deactivated earlier from the preparation phase: lack of earlier deactivate removes the element but leaks the chain use count, which results in a WARN splat when the chain gets removed later, plus a leak of the nft_chain structure. Update pipapo_get() not to skip expired elements, otherwise flush command reports bogus ENOENT errors. Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Fixes: 8d8540c4f5e0 ("netfilter: nft_set_rbtree: add timeout support") Fixes: 9d0982927e79 ("netfilter: nft_hash: add support for timeouts") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 43dae319b50fac075ad864f84501c703ef20eb2b Author: Daniel Stone Date: Tue Aug 8 11:44:05 2023 +0100 drm/rockchip: Don't spam logs in atomic check Userspace should not be able to trigger DRM_ERROR messages to spam the logs; especially not through atomic commit parameters which are completely legitimate for userspace to attempt. Signed-off-by: Daniel Stone Fixes: 7707f7227f09 ("drm/rockchip: Add support for afbc") Signed-off-by: Heiko Stuebner Link: https://patchwork.freedesktop.org/patch/msgid/20230808104405.522493-1-daniels@collabora.com commit a4a79e03bab57729bd8046d22bf3666912e586fb Author: Tony Lindgren Date: Sun Aug 6 09:20:50 2023 +0300 serial: core: Revert port_id use Guenter reports boot issues with duplicate sysfs entries for multiport drivers. Let's go back to using port->line for now to fix the regression. With this change, the serial core port device names are not correct for the hardware specific 8250 single port drivers, but that's a cosmetic issue for now. Fixes: d962de6ae51f ("serial: core: Fix serial core port id to not use port->line") Reported-by: Guenter Roeck Signed-off-by: Tony Lindgren Tested-by: Guenter Roeck Link: https://lore.kernel.org/r/20230806062052.47737-1-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit 3f29d9ee323ae5cda59d144d1f8b0b10ea065be0 Author: Günther Noack Date: Tue Aug 8 22:11:12 2023 +0200 TIOCSTI: Document CAP_SYS_ADMIN behaviour in Kconfig Clarifies that the LEGACY_TIOCSTI setting is safe to turn off even when running BRLTTY, as it was introduced in commit 690c8b804ad2 ("TIOCSTI: always enable for CAP_SYS_ADMIN"). Signed-off-by: Günther Noack Reviewed-by: Samuel Thibault Link: https://lore.kernel.org/r/20230808201115.23993-1-gnoack3000@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2908042a37b56d6a9a595eca946e187e9d2df39a Author: Fabio Estevam Date: Tue Jul 25 21:14:45 2023 +0200 media: imx: imx7-media-csi: Fix applying format constraints v4l_bound_align_image() aligns to a multiple of 2 to the power of walign, not to walign. Depending on the pixel format, this causes the image width to be aligned to 16 or 256 pixels instead of 4 or 8 as required by the hardware. Fix it by rounding and clamping the width and height manually. Closes: https://lore.kernel.org/linux-media/CAJ+vNU0BOVLTL17ofgHwtexbpuMYwH_aGUC==EXABUtHHiv_ag@mail.gmail.com Reported-by: Tim Harvey Fixes: 6f482c4729d9 ("media: imx: imx7-media-csi: Get rid of superfluous call to imx7_csi_mbus_fmt_to_pix_fmt") Co-developed-by: Alexander Stein Signed-off-by: Alexander Stein Signed-off-by: Fabio Estevam Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab commit cf3f15b8c6601c1dc70f85949788ee993dd9a439 Author: Harshit Mogalapalli Date: Wed Aug 9 00:18:11 2023 -0700 mmc: sunplus: Fix error handling in spmmc_drv_probe() When mmc allocation succeeds, the error paths are not freeing mmc. Fix the above issue by changing mmc_alloc_host() to devm_mmc_alloc_host() to simplify the error handling. Remove label 'probe_free_host' as devm_* api takes care of freeing, also remove mmc_free_host() from remove function as devm_* takes care of freeing. Fixes: 4e268fed8b18 ("mmc: Add mmc driver for Sunplus SP7021") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/a3829ed3-d827-4b9d-827e-9cc24a3ec3bc@moroto.mountain/ Signed-off-by: Harshit Mogalapalli Reviewed-by: Dan Carpenter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230809071812.547229-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Ulf Hansson commit dce6d8f985fa1ef5c2af47f4f86ea65511b78656 Author: Wei Chen Date: Thu Jun 22 09:02:33 2023 +0000 mmc: sunplus: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, 1. the memory allocated in mmc_alloc_host() will be leaked 2. null-ptr-deref will happen when calling mmc_remove_host() in remove function spmmc_drv_remove() because deleting not added device. Fix this by checking the return value of mmc_add_host(). Moreover, I fixed the error handling path of spmmc_drv_probe() to clean up. Fixes: 4e268fed8b18 ("mmc: Add mmc driver for Sunplus SP7021") Cc: stable@vger.kernel.org Signed-off-by: Wei Chen Link: https://lore.kernel.org/r/20230622090233.188539-1-harperchen1110@gmail.com Signed-off-by: Ulf Hansson commit d83035433701919ac6db15f7737cbf554c36c1a6 Author: Yang Yingliang Date: Mon Aug 7 20:44:42 2023 +0800 mmc: wbsd: fix double mmc_free_host() in wbsd_init() mmc_free_host() has already be called in wbsd_free_mmc(), remove the mmc_free_host() in error path in wbsd_init(). Fixes: dc5b9b50fc9d ("mmc: wbsd: fix return value check of mmc_add_host()") Signed-off-by: Yang Yingliang Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230807124443.3431366-1-yangyingliang@huawei.com Signed-off-by: Ulf Hansson commit c992fde9f977da9beec584528f9026d21c27a053 Merge: d0378ae6d16ca 30c3c4a4497c3 Author: David S. Miller Date: Wed Aug 9 11:20:29 2023 +0100 Merge branch 'smc-fixes' Gerd Bayer says: ==================== net/smc: Fix effective buffer size commit 0227f058aa29 ("net/smc: Unbind r/w buffer size from clcsock and make them tunable") started to derive the effective buffer size for SMC connections inconsistently in case a TCP fallback was used and memory consumption of SMC with the default settings was doubled when a connection negotiated SMC. That was not what we want. This series consolidates the resulting effective buffer size that is used with SMC sockets, which is based on Jan Karcher's effort (see [1]). For all TCP exchanges (in particular in case of a fall back when no SMC connection was possible) the values from net.ipv4.tcp_[rw]mem are used. If SMC succeeds in establishing a SMC connection, the newly introduced values from net.smc.[rw]mem are used. net.smc.[rw]mem is initialized to 64kB, respectively. Internal test have show this to be a good compromise between throughput/latency and memory consumption. Also net.smc.[rw]mem is now decoupled completely from any tuning through net.ipv4.tcp_[rw]mem. If a user chose to tune a socket's receive or send buffer size with setsockopt, this tuning is now consistently applied to either fall-back TCP or proper SMC connections over the socket. Thanks, Gerd v2 - v3: - Rebase to and resolve conflict of second patch with latest net/master. v1 - v2: - In second patch, use sock_net() helper as suggested by Tony and demanded by kernel test robot. ==================== Signed-off-by: David S. Miller commit 30c3c4a4497c3765bf6b298f5072c8165aeaf7cc Author: Gerd Bayer Date: Fri Aug 4 19:06:24 2023 +0200 net/smc: Use correct buffer sizes when switching between TCP and SMC Tuning of the effective buffer size through setsockopts was working for SMC traffic only but not for TCP fall-back connections even before commit 0227f058aa29 ("net/smc: Unbind r/w buffer size from clcsock and make them tunable"). That change made it apparent that TCP fall-back connections would use net.smc.[rw]mem as buffer size instead of net.ipv4_tcp_[rw]mem. Amend the code that copies attributes between the (TCP) clcsock and the SMC socket and adjust buffer sizes appropriately: - Copy over sk_userlocks so that both sockets agree on whether tuning via setsockopt is active. - When falling back to TCP use sk_sndbuf or sk_rcvbuf as specified with setsockopt. Otherwise, use the sysctl value for TCP/IPv4. - Likewise, use either values from setsockopt or from sysctl for SMC (duplicated) on successful SMC connect. In smc_tcp_listen_work() drop the explicit copy of buffer sizes as that is taken care of by the attribute copy. Fixes: 0227f058aa29 ("net/smc: Unbind r/w buffer size from clcsock and make them tunable") Reviewed-by: Wenjia Zhang Reviewed-by: Tony Lu Signed-off-by: Gerd Bayer Signed-off-by: David S. Miller commit 833bac7ec392bf75053c8a4fa4c36d4148dac77d Author: Gerd Bayer Date: Fri Aug 4 19:06:23 2023 +0200 net/smc: Fix setsockopt and sysctl to specify same buffer size again Commit 0227f058aa29 ("net/smc: Unbind r/w buffer size from clcsock and make them tunable") introduced the net.smc.rmem and net.smc.wmem sysctls to specify the size of buffers to be used for SMC type connections. This created a regression for users that specified the buffer size via setsockopt() as the effective buffer size was now doubled. Re-introduce the division by 2 in the SMC buffer create code and level this out by duplicating the net.smc.[rw]mem values used for initializing sk_rcvbuf/sk_sndbuf at socket creation time. This gives users of both methods (setsockopt or sysctl) the effective buffer size that they expect. Initialize net.smc.[rw]mem from its own constant of 64kB, respectively. Internal performance tests show that this value is a good compromise between throughput/latency and memory consumption. Also, this decouples it from any tuning that was done to net.ipv4.tcp_[rw]mem[1] before the module for SMC protocol was loaded. Check that no more than INT_MAX / 2 is assigned to net.smc.[rw]mem, in order to avoid any overflow condition when that is doubled for use in sk_sndbuf or sk_rcvbuf. While at it, drop the confusing sk_buf_size variable from __smc_buf_create and name "compressed" buffer size variables more consistently. Background: Before the commit mentioned above, SMC's buffer allocator in __smc_buf_create() always used half of the sockets' sk_rcvbuf/sk_sndbuf value as initial value to search for appropriate buffers. If the search resorted to using a bigger buffer when all buffers of the specified size were busy, the duplicate of the used effective buffer size is stored back to sk_rcvbuf/sk_sndbuf. When available, buffers of exactly the size that a user had specified as input to setsockopt() were used, despite setsockopt()'s documentation in "man 7 socket" talking of a mandatory duplication: [...] SO_SNDBUF Sets or gets the maximum socket send buffer in bytes. The kernel doubles this value (to allow space for book‐ keeping overhead) when it is set using setsockopt(2), and this doubled value is returned by getsockopt(2). The default value is set by the /proc/sys/net/core/wmem_default file and the maximum allowed value is set by the /proc/sys/net/core/wmem_max file. The minimum (doubled) value for this option is 2048. [...] Fixes: 0227f058aa29 ("net/smc: Unbind r/w buffer size from clcsock and make them tunable") Co-developed-by: Jan Karcher Signed-off-by: Jan Karcher Reviewed-by: Wenjia Zhang Reviewed-by: Tony Lu Signed-off-by: Gerd Bayer Signed-off-by: David S. Miller commit d0378ae6d16cac86579c0350d275741fd898ba08 Merge: 0fb1d8eb234b6 bfce089ddd0e4 Author: David S. Miller Date: Wed Aug 9 09:18:31 2023 +0100 Merge branch 'enetc-probe-fix' Vladimir Oltean says: ==================== Fix ENETC probing after 6fffbc7ae137 ("PCI: Honor firmware's device disabled status") I'm not sure who should take this patch set (net maintainers or PCI maintainers). Everyone could pick up just their part, and that would work (no compile time dependencies). However, the entire series needs ACK from both sides and Rob for sure. v1 at: https://lore.kernel.org/netdev/20230521115141.2384444-1-vladimir.oltean@nxp.com/ ==================== Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit bfce089ddd0e440d799717cb7312b44faac47983 Author: Vladimir Oltean Date: Thu Aug 3 16:58:58 2023 +0300 net: enetc: remove of_device_is_available() handling Since commit 6fffbc7ae137 ("PCI: Honor firmware's device disabled status"), this is redundant and does nothing, because enetc_pf_probe() no longer even gets called. Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit f0168042a21292d20007d24ab2e4fc32f79ebf11 Author: Vladimir Oltean Date: Thu Aug 3 16:58:57 2023 +0300 net: enetc: reimplement RFS/RSS memory clearing as PCI quirk The workaround implemented in commit 3222b5b613db ("net: enetc: initialize RFS/RSS memories for unused ports too") is no longer effective after commit 6fffbc7ae137 ("PCI: Honor firmware's device disabled status"). Thus, it has introduced a regression and we see AER errors being reported again: $ ip link set sw2p0 up && dhclient -i sw2p0 && ip addr show sw2p0 fsl_enetc 0000:00:00.2 eno2: configuring for fixed/internal link mode fsl_enetc 0000:00:00.2 eno2: Link is Up - 2.5Gbps/Full - flow control rx/tx mscc_felix 0000:00:00.5 swp2: configuring for fixed/sgmii link mode mscc_felix 0000:00:00.5 swp2: Link is Up - 1Gbps/Full - flow control off sja1105 spi2.2 sw2p0: configuring for phy/rgmii-id link mode sja1105 spi2.2 sw2p0: Link is Up - 1Gbps/Full - flow control off pcieport 0000:00:1f.0: AER: Multiple Corrected error received: 0000:00:00.0 pcieport 0000:00:1f.0: AER: can't find device of ID0000 Rob's suggestion is to reimplement the enetc driver workaround as a PCI fixup, and to modify the PCI core to run the fixups for all PCI functions. This change handles the first part. We refactor the common code in enetc_psi_create() and enetc_psi_destroy(), and use the PCI fixup only for those functions for which enetc_pf_probe() won't get called. This avoids some work being done twice for the PFs which are enabled. Fixes: 6fffbc7ae137 ("PCI: Honor firmware's device disabled status") Link: https://lore.kernel.org/netdev/CAL_JsqLsVYiPLx2kcHkDQ4t=hQVCR7NHziDwi9cCFUFhx48Qow@mail.gmail.com/ Suggested-by: Rob Herring Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 1a8c251cff2052b60009a070173308322e9600d3 Author: Vladimir Oltean Date: Thu Aug 3 16:58:56 2023 +0300 PCI: move OF status = "disabled" detection to dev->match_driver The blamed commit has broken probing on arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi when &enetc_port0 (PCI function 0) has status = "disabled". Background: pci_scan_slot() has logic to say that if the function 0 of a device is absent, the entire device is absent and we can skip the other functions entirely. Traditionally, this has meant that pci_bus_read_dev_vendor_id() returns an error code for that function. However, since the blamed commit, there is an extra confounding condition: function 0 of the device exists and has a valid vendor id, but it is disabled in the device tree. In that case, pci_scan_slot() would incorrectly skip the entire device instead of just that function. In the case of NXP LS1028A, status = "disabled" does not mean that the PCI function's config space is not available for reading. It is, but the Ethernet port is just not functionally useful with a particular SerDes protocol configuration (0x9999) due to pinmuxing constraints of the Soc. So, pci_scan_slot() skips all other functions on the ENETC ECAM (enetc_port1, enetc_port2, enetc_mdio_pf3 etc) when just enetc_port0 had to not be probed. There is an additional regression introduced by the change, caused by its fundamental premise. The enetc driver needs to run code for all PCI functions, regardless of whether they're enabled or not in the device tree. That is no longer possible if the driver's probe function is no longer called. But Rob recommends that we move the of_device_is_available() detection to dev->match_driver, and this makes the PCI fixups still run on all functions, while just probing drivers for those functions that are enabled. So, a separate change in the enetc driver will have to move the workarounds to a PCI fixup. Fixes: 6fffbc7ae137 ("PCI: Honor firmware's device disabled status") Link: https://lore.kernel.org/netdev/CAL_JsqLsVYiPLx2kcHkDQ4t=hQVCR7NHziDwi9cCFUFhx48Qow@mail.gmail.com/ Suggested-by: Rob Herring Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller commit 0fb1d8eb234b6979d4981d2d385780dd7d8d9771 Author: Piotr Gardocki Date: Mon Aug 7 13:50:11 2023 -0700 iavf: fix potential races for FDIR filters Add fdir_fltr_lock locking in unprotected places. The change in iavf_fdir_is_dup_fltr adds a spinlock around a loop which iterates over all filters and looks for a duplicate. The filter can be removed from list and freed from memory at the same time it's being compared. All other places where filters are deleted are already protected with spinlock. The remaining changes protect adapter->fdir_active_fltr variable so now all its uses are under a spinlock. Fixes: 527691bf0682 ("iavf: Support IPv4 Flow Director filters") Signed-off-by: Piotr Gardocki Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230807205011.3129224-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 06b412589eef780b792e73df131d35dc43cc4a49 Author: Muhammad Husaini Zulkifli Date: Mon Aug 7 13:51:29 2023 -0700 igc: Add lock to safeguard global Qbv variables Access to shared variables through hrtimer requires locking in order to protect the variables because actions to write into these variables (oper_gate_closed, admin_gate_closed, and qbv_transition) might potentially occur simultaneously. This patch provides a locking mechanisms to avoid such scenarios. Fixes: 175c241288c0 ("igc: Fix TX Hang issue when QBV Gate is closed") Suggested-by: Leon Romanovsky Signed-off-by: Muhammad Husaini Zulkifli Tested-by: Naama Meir Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20230807205129.3129346-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit b9077ef4c1368b5a51852facc53c24fcd234e910 Merge: 81f3768d91ac5 548ee049b19fb Author: Jakub Kicinski Date: Tue Aug 8 16:33:18 2023 -0700 Merge tag 'mlx5-fixes-2023-08-07' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2023-08-07 This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2023-08-07' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5e: Add capability check for vnic counters net/mlx5: Reload auxiliary devices in pci error handlers net/mlx5: Skip clock update work when device is in error state net/mlx5: LAG, Check correct bucket when modifying LAG net/mlx5e: Unoffload post act rule when handling FIB events net/mlx5: Fix devlink controller number for ECVF net/mlx5: Allow 0 for total host VFs net/mlx5: Return correct EC_VF function ID net/mlx5: DR, Fix wrong allocation of modify hdr pattern net/mlx5e: TC, Fix internal port memory leak net/mlx5e: Take RTNL lock when needed before calling xdp_set_features() ==================== Link: https://lore.kernel.org/r/20230807212607.50883-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 81f3768d91ac535528e9a7ad07cfefe5c705629f Merge: b6f79e826fbd2 ac6257a3ae5db Author: Jakub Kicinski Date: Tue Aug 8 16:13:07 2023 -0700 Merge branch 'there-are-some-bugfix-for-the-hns3-ethernet-driver' Jijie Shao says: ==================== There are some bugfix for the HNS3 ethernet driver There are some bugfix for the HNS3 ethernet driver v1: https://lore.kernel.org/all/20230728075840.4022760-2-shaojijie@huawei.com/ ==================== Link: https://lore.kernel.org/r/20230807113452.474224-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit ac6257a3ae5db5193b1f19c268e4f72d274ddb88 Author: Yonglong Liu Date: Mon Aug 7 19:34:52 2023 +0800 net: hns3: fix deadlock issue when externel_lb and reset are executed together When externel_lb and reset are executed together, a deadlock may occur: [ 3147.217009] INFO: task kworker/u321:0:7 blocked for more than 120 seconds. [ 3147.230483] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 3147.238999] task:kworker/u321:0 state:D stack: 0 pid: 7 ppid: 2 flags:0x00000008 [ 3147.248045] Workqueue: hclge hclge_service_task [hclge] [ 3147.253957] Call trace: [ 3147.257093] __switch_to+0x7c/0xbc [ 3147.261183] __schedule+0x338/0x6f0 [ 3147.265357] schedule+0x50/0xe0 [ 3147.269185] schedule_preempt_disabled+0x18/0x24 [ 3147.274488] __mutex_lock.constprop.0+0x1d4/0x5dc [ 3147.279880] __mutex_lock_slowpath+0x1c/0x30 [ 3147.284839] mutex_lock+0x50/0x60 [ 3147.288841] rtnl_lock+0x20/0x2c [ 3147.292759] hclge_reset_prepare+0x68/0x90 [hclge] [ 3147.298239] hclge_reset_subtask+0x88/0xe0 [hclge] [ 3147.303718] hclge_reset_service_task+0x84/0x120 [hclge] [ 3147.309718] hclge_service_task+0x2c/0x70 [hclge] [ 3147.315109] process_one_work+0x1d0/0x490 [ 3147.319805] worker_thread+0x158/0x3d0 [ 3147.324240] kthread+0x108/0x13c [ 3147.328154] ret_from_fork+0x10/0x18 In externel_lb process, the hns3 driver call napi_disable() first, then the reset happen, then the restore process of the externel_lb will fail, and will not call napi_enable(). When doing externel_lb again, napi_disable() will be double call, cause a deadlock of rtnl_lock(). This patch use the HNS3_NIC_STATE_DOWN state to protect the calling of napi_disable() and napi_enable() in externel_lb process, just as the usage in ndo_stop() and ndo_start(). Fixes: 04b6ba143521 ("net: hns3: add support for external loopback test") Signed-off-by: Yonglong Liu Signed-off-by: Jijie Shao Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230807113452.474224-5-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 6265e242f7b95f2c1195b42ec912b84ad161470e Author: Jie Wang Date: Mon Aug 7 19:34:51 2023 +0800 net: hns3: add wait until mac link down In some configure flow of hns3 driver, for example, change mtu, it will disable MAC through firmware before configuration. But firmware disables MAC asynchronously. The rx traffic may be not stopped in this case. So fixes it by waiting until mac link is down. Fixes: a9775bb64aa7 ("net: hns3: fix set and get link ksettings issue") Signed-off-by: Jie Wang Signed-off-by: Jijie Shao Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230807113452.474224-4-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 08469dacfad25428b66549716811807203744f4f Author: Jie Wang Date: Mon Aug 7 19:34:50 2023 +0800 net: hns3: refactor hclge_mac_link_status_wait for interface reuse Some nic configurations could only be performed after link is down. So this patch refactor this API for reuse. Signed-off-by: Jie Wang Signed-off-by: Jijie Shao Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230807113452.474224-3-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 15159ec0c831b565820c2de05114ea1b4cf07681 Author: Jian Shen Date: Mon Aug 7 19:34:49 2023 +0800 net: hns3: restore user pause configure when disable autoneg Restore the mac pause state to user configuration when autoneg is disabled Signed-off-by: Jian Shen Signed-off-by: Peiyang Wang Signed-off-by: Jijie Shao Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230807113452.474224-2-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit b6f79e826fbd26e91e2fb28070484634cacdeb26 Author: David Rheinsberg Date: Mon Aug 7 10:12:25 2023 +0200 net/unix: use consistent error code in SO_PEERPIDFD Change the new (unreleased) SO_PEERPIDFD sockopt to return ENODATA rather than ESRCH if a socket type does not support remote peer-PID queries. Currently, SO_PEERPIDFD returns ESRCH when the socket in question is not an AF_UNIX socket. This is quite unexpected, given that one would assume ESRCH means the peer process already exited and thus cannot be found. However, in that case the sockopt actually returns EINVAL (via pidfd_prepare()). This is rather inconsistent with other syscalls, which usually return ESRCH if a given PID refers to a non-existant process. This changes SO_PEERPIDFD to return ENODATA instead. This is also what SO_PEERGROUPS returns, and thus keeps a consistent behavior across sockopts. Note that this code is returned in 2 cases: First, if the socket type is not AF_UNIX, and secondly if the socket was not yet connected. In both cases ENODATA seems suitable. Signed-off-by: David Rheinsberg Reviewed-by: Christian Brauner Acked-by: Luca Boccassi Fixes: 7b26952a91cf ("net: core: add getsockopt SO_PEERPIDFD") Link: https://lore.kernel.org/r/20230807081225.816199-1-david@readahead.eu Signed-off-by: Jakub Kicinski commit d2402048bc8a206a56fde4bc41dd01336c7b5a21 Author: Nick Desaulniers Date: Tue Aug 8 09:35:00 2023 -0700 riscv: mm: fix 2 instances of -Wmissing-variable-declarations I'm looking to enable -Wmissing-variable-declarations behind W=1. 0day bot spotted the following instance in ARCH=riscv builds: arch/riscv/mm/init.c:276:7: warning: no previous extern declaration for non-static variable 'trampoline_pg_dir' [-Wmissing-variable-declarations] 276 | pgd_t trampoline_pg_dir[PTRS_PER_PGD] __page_aligned_bss; | ^ arch/riscv/mm/init.c:276:1: note: declare 'static' if the variable is not intended to be used outside of this translation unit 276 | pgd_t trampoline_pg_dir[PTRS_PER_PGD] __page_aligned_bss; | ^ arch/riscv/mm/init.c:279:7: warning: no previous extern declaration for non-static variable 'early_pg_dir' [-Wmissing-variable-declarations] 279 | pgd_t early_pg_dir[PTRS_PER_PGD] __initdata __aligned(PAGE_SIZE); | ^ arch/riscv/mm/init.c:279:1: note: declare 'static' if the variable is not intended to be used outside of this translation unit 279 | pgd_t early_pg_dir[PTRS_PER_PGD] __initdata __aligned(PAGE_SIZE); | ^ These symbols are referenced by more than one translation unit, so make sure they're both declared and include the correct header for their declarations. Finally, sort the list of includes to help keep them tidy. Reported-by: kernel test robot Closes: https://lore.kernel.org/llvm/202308081000.tTL1ElTr-lkp@intel.com/ Signed-off-by: Nick Desaulniers Link: https://lore.kernel.org/r/20230808-riscv_static-v2-1-2a1e2d2c7a4f@google.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 4eb2eb1b4c0eb07793c240744843498564a67b83 Author: Andrea Parri Date: Thu Aug 3 06:27:38 2023 +0200 riscv,mmio: Fix readX()-to-delay() ordering Section 2.1 of the Platform Specification [1] states: Unless otherwise specified by a given I/O device, I/O devices are on ordering channel 0 (i.e., they are point-to-point strongly ordered). which is not sufficient to guarantee that a readX() by a hart completes before a subsequent delay() on the same hart (cf. memory-barriers.txt, "Kernel I/O barrier effects"). Set the I(nput) bit in __io_ar() to restore the ordering, align inline comments. [1] https://github.com/riscv/riscv-platform-specs Signed-off-by: Andrea Parri Link: https://lore.kernel.org/r/20230803042738.5937-1-parri.andrea@gmail.com Fixes: fab957c11efe ("RISC-V: Atomic and Locking Code") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 6514f81e1bd55cbe419a5001a4ce910acc276211 Author: Samuel Holland Date: Wed Aug 2 18:26:06 2023 -0700 riscv: Fix CPU feature detection with SMP disabled commit 914d6f44fc50 ("RISC-V: only iterate over possible CPUs in ISA string parser") changed riscv_fill_hwcap() from iterating over CPU DT nodes to iterating over logical CPU IDs. Since this function runs long before cpu_dev_init() creates CPU devices, it hits the fallback path in of_cpu_device_node_get(), which itself iterates over the DT nodes, searching for a node with the requested CPU ID. (Incidentally, this makes riscv_fill_hwcap() now take quadratic time.) riscv_fill_hwcap() passes a logical CPU ID to of_cpu_device_node_get(), which uses the arch_match_cpu_phys_id() hook to translate the logical ID to a physical ID as found in the DT. arch_match_cpu_phys_id() has a generic weak definition, and RISC-V provides a strong definition using cpuid_to_hartid_map(). However, the RISC-V specific implementation is located in arch/riscv/kernel/smp.c, and that file is only compiled when SMP is enabled. As a result, when SMP is disabled, the generic definition is used, and riscv_isa gets initialized based on the ISA string of hart 0, not the boot hart. On FU740, this means has_fpu() returns false, and userspace crashes when trying to use floating-point instructions. Fix this by moving arch_match_cpu_phys_id() to a file which is always compiled. Fixes: 70114560b285 ("RISC-V: Add RISC-V specific arch_match_cpu_phys_id") Fixes: 914d6f44fc50 ("RISC-V: only iterate over possible CPUs in ISA string parser") Reported-by: Palmer Dabbelt Signed-off-by: Samuel Holland Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230803012608.3540081-1-samuel.holland@sifive.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 13b9372068660fe4f7023f43081067376582ef3c Merge: 02aee814d37c5 cdddb626dc053 Author: Linus Torvalds Date: Tue Aug 8 14:59:49 2023 -0700 Merge tag 'hardening-v6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - Replace remaining open-coded struct_size_t() instance (Gustavo A. R. Silva) - Adjust vboxsf's trailing arrays to be proper flexible arrays * tag 'hardening-v6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: media: venus: Use struct_size_t() helper in pkt_session_unset_buffers() vboxsf: Use flexible arrays for trailing string member commit d74f714896fd6268882789ba28e52c9145951403 Author: Jens Axboe Date: Tue Aug 8 11:03:28 2023 -0600 block: get rid of unused plug->nowait flag This was introduced to add a plug based way of signaling nowait issues, but we have since moved on from that. Kill the old dead code, nobody is setting it anymore. Reviewed-by: Chaitanya Kulkarni Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe commit fa40ea27ede397cb19b8cb264f136db9c43c6f7e Author: Claudiu Beznea Date: Fri Aug 4 08:00:07 2023 +0300 MAINTAINERS: update Claudiu Beznea's email address Update MAINTAINERS entries with a valid email address as the Microchip one is no longer valid. Acked-by: Conor Dooley Acked-by: Nicolas Ferre Signed-off-by: Claudiu Beznea Acked-by: Sebastian Reichel Link: https://lore.kernel.org/r/20230804050007.235799-1-claudiu.beznea@tuxon.dev Signed-off-by: Jakub Kicinski commit 7324f74d39531262b8e362f228b46512e6bee632 Author: Jinghao Jia Date: Tue Aug 8 14:23:53 2023 -0400 x86/linkage: Fix typo of BUILD_VDSO in asm/linkage.h The BUILD_VDSO macro was incorrectly spelled as BULID_VDSO in asm/linkage.h. This causes the !defined(BULID_VDSO) directive to always evaluate to true. Correct the spelling to BUILD_VDSO. Fixes: bea75b33895f ("x86/Kconfig: Introduce function padding") Signed-off-by: Jinghao Jia Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Thomas Gleixner Acked-by: Randy Dunlap Cc: Link: https://lore.kernel.org/r/20230808182353.76218-1-jinghao@linux.ibm.com commit cc22522fd55e257c86d340ae9aedc122e705a435 Author: Igor Mammedov Date: Wed Jul 26 14:35:18 2023 +0200 PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus 40613da52b13 ("PCI: acpiphp: Reassign resources on bridge if necessary") changed acpiphp hotplug to use pci_assign_unassigned_bridge_resources() which depends on bridge being available, however enable_slot() can be called without bridge associated: 1. Legitimate case of hotplug on root bus (widely used in virt world) 2. A (misbehaving) firmware, that sends ACPI Bus Check notifications to non existing root ports (Dell Inspiron 7352/0W6WV0), which end up at enable_slot(..., bridge = 0) where bus has no bridge assigned to it. acpihp doesn't know that it's a bridge, and bus specific 'PCI subsystem' can't augment ACPI context with bridge information since the PCI device to get this data from is/was not available. Issue is easy to reproduce with QEMU's 'pc' machine, which supports PCI hotplug on hostbridge slots. To reproduce, boot kernel at commit 40613da52b13 in VM started with following CLI (assuming guest root fs is installed on sda1 partition): # qemu-system-x86_64 -M pc -m 1G -enable-kvm -cpu host \ -monitor stdio -serial file:serial.log \ -kernel arch/x86/boot/bzImage \ -append "root=/dev/sda1 console=ttyS0" \ guest_disk.img Once guest OS is fully booted at qemu prompt: (qemu) device_add e1000 (check serial.log) it will cause NULL pointer dereference at: void pci_assign_unassigned_bridge_resources(struct pci_dev *bridge) { struct pci_bus *parent = bridge->subordinate; BUG: kernel NULL pointer dereference, address: 0000000000000018 ? pci_assign_unassigned_bridge_resources+0x1f/0x260 enable_slot+0x21f/0x3e0 acpiphp_hotplug_notify+0x13d/0x260 acpi_device_hotplug+0xbc/0x540 acpi_hotplug_work_fn+0x15/0x20 process_one_work+0x1f7/0x370 worker_thread+0x45/0x3b0 The issue was discovered on Dell Inspiron 7352/0W6WV0 laptop with following sequence: 1. Suspend to RAM 2. Wake up with the same backtrace being observed: 3. 2nd suspend to RAM attempt makes laptop freeze Fix it by using __pci_bus_assign_resources() instead of pci_assign_unassigned_bridge_resources() as we used to do, but only in case when bus doesn't have a bridge associated (to cover for the case of ACPI event on hostbridge or non existing root port). That lets us keep hotplug on root bus working like it used to and at the same time keeps resource reassignment usable on root ports (and other 1st level bridges) that was fixed by 40613da52b13. Fixes: 40613da52b13 ("PCI: acpiphp: Reassign resources on bridge if necessary") Link: https://lore.kernel.org/r/20230726123518.2361181-2-imammedo@redhat.com Reported-by: Woody Suwalski Tested-by: Woody Suwalski Tested-by: Michal Koutný Link: https://lore.kernel.org/r/11fc981c-af49-ce64-6b43-3e282728bd1a@gmail.com Signed-off-by: Igor Mammedov Signed-off-by: Bjorn Helgaas Acked-by: Rafael J. Wysocki Acked-by: Michael S. Tsirkin commit 56675f8b9f9b15b024b8e3145fa289b004916ab7 Author: Helge Deller Date: Mon Aug 7 20:04:09 2023 +0200 io_uring/parisc: Adjust pgoff in io_uring mmap() for parisc The changes from commit 32832a407a71 ("io_uring: Fix io_uring mmap() by using architecture-provided get_unmapped_area()") to the parisc implementation of get_unmapped_area() broke glibc's locale-gen executable when running on parisc. This patch reverts those architecture-specific changes, and instead adjusts in io_uring_mmu_get_unmapped_area() the pgoff offset which is then given to parisc's get_unmapped_area() function. This is much cleaner than the previous approach, and we still will get a coherent addresss. This patch has no effect on other architectures (SHM_COLOUR is only defined on parisc), and the liburing testcase stil passes on parisc. Cc: stable@vger.kernel.org # 6.4 Signed-off-by: Helge Deller Reported-by: Christoph Biedl Fixes: 32832a407a71 ("io_uring: Fix io_uring mmap() by using architecture-provided get_unmapped_area()") Fixes: d808459b2e31 ("io_uring: Adjust mapping wrt architecture aliasing requirements") Link: https://lore.kernel.org/r/ZNEyGV0jyI8kOOfz@p100 Signed-off-by: Jens Axboe commit 8e7b295da1ed051baedd068b7f785f5d959ef95d Author: Junxian Huang Date: Mon Aug 7 14:42:28 2023 +0800 MAINTAINERS: Remove maintainer of HiSilicon RoCE Haoyue no longer maintains the Hisilicon RoCE driver. So remove him from MAINTAINERS. Signed-off-by: Junxian Huang Link: https://lore.kernel.org/r/20230807064228.4032536-1-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit 487ae3b42d1040b4cd5ff9754e7516b409204029 Author: Ian Rogers Date: Tue Aug 1 13:54:52 2023 -0700 perf stat: Don't display zero tool counts Andi reported (see link below) a regression when printing the 'duration_time' tool event, where it gets printed as "not counted" for most of the CPUs, fix it by skipping zero counts for tool events. Reported-by: Andi Kleen Signed-off-by: Ian Rogers Tested-by: Andi Kleen Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Claire Jensen Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/all/ZMlrzcVrVi1lTDmn@tassilo/ Signed-off-by: Arnaldo Carvalho de Melo commit 02aee814d37c563e24b73bcd0f9cb608fbd403d4 Merge: da703fe9416d7 0be8432166a61 Author: Linus Torvalds Date: Tue Aug 8 09:27:08 2023 -0700 Merge tag 'gfs2-v6.4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 fixes from Andreas Gruenbacher: - Fix a freeze consistency check in gfs2_trans_add_meta() - Don't use filemap_splice_read as it can cause deadlocks on gfs2 * tag 'gfs2-v6.4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: Don't use filemap_splice_read gfs2: Fix freeze consistency check in gfs2_trans_add_meta commit 1963546390ed8b649f529993a755eba0fdeb7aaa Author: Karol Wachowski Date: Wed Aug 2 08:37:35 2023 +0200 accel/ivpu: Add set_pages_array_wc/uc for internal buffers Buffers mapped with pgprot_writecombined() are not correctly flushed. This triggers issues on VPU access using random memory content such as MMU translation faults, invalid context descriptors being fetched and can lead to VPU FW crashes. Fixes: 647371a6609d ("accel/ivpu: Add GEM buffer object management") Cc: stable@vger.kernel.org # 6.3+ Signed-off-by: Karol Wachowski Reviewed-by: Stanislaw Gruszka Signed-off-by: Stanislaw Gruszka Link: https://patchwork.freedesktop.org/patch/msgid/20230802063735.3005291-1-stanislaw.gruszka@linux.intel.com commit 12acb348fa4528a4203edf1cce7a3be2c9af2279 Author: Maulik Shah Date: Mon Jul 3 14:25:54 2023 +0530 cpuidle: psci: Move enabling OSI mode after power domains creation A switch from OSI to PC mode is only possible if all CPUs other than the calling one are OFF, either through a call to CPU_OFF or not yet booted. Currently OSI mode is enabled before power domains are created. In cases where CPUidle states are not using hierarchical CPU topology the bail out path tries to switch back to PC mode which gets denied by firmware since other CPUs are online at this point and creates inconsistent state as firmware is in OSI mode and Linux in PC mode. This change moves enabling OSI mode after power domains are created, this would makes sure that hierarchical CPU topology is used before switching firmware to OSI mode. Cc: stable@vger.kernel.org Fixes: 70c179b49870 ("cpuidle: psci: Allow PM domain to be initialized even if no OSI mode") Signed-off-by: Maulik Shah Reviewed-by: Ulf Hansson Signed-off-by: Ulf Hansson commit 9a8fa00dad3c7b260071f2f220cfb00505372c40 Author: Maulik Shah Date: Mon Jul 3 14:25:53 2023 +0530 cpuidle: dt_idle_genpd: Add helper function to remove genpd topology Genpd parent and child domain topology created using dt_idle_pd_init_topology() needs to be removed during error cases. Add new helper function dt_idle_pd_remove_topology() for same. Cc: stable@vger.kernel.org Reviewed-by: Ulf Hanssson Signed-off-by: Maulik Shah Signed-off-by: Ulf Hansson commit 8cdd4aeff2e858c95bb088409028893cfb4e53d4 Author: Arnaldo Carvalho de Melo Date: Mon Aug 7 10:41:42 2023 -0300 tools arch x86: Sync the msr-index.h copy with the kernel sources To pick up the changes from these csets: 522b1d69219d8f08 ("x86/cpu/amd: Add a Zenbleed fix") That cause no changes to tooling: $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > before $ cp arch/x86/include/asm/msr-index.h tools/arch/x86/include/asm/msr-index.h $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > after $ diff -u before after $ Just silences this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Cc: Adrian Hunter Cc: Borislav Petkov (AMD) Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/ZND17H7BI4ariERn@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit c0b067588a4836b762cfc6a4c83f122ca1dbb93a Author: Arnaldo Carvalho de Melo Date: Tue Aug 1 18:42:47 2023 -0300 Revert "perf report: Append inlines to non-DWARF callchains" This reverts commit 46d21ec067490ab9cdcc89b9de5aae28786a8b8e. The tests were made with a specific workload, further tests on a recently updated fedora 38 system with a system wide perf.data file shows 'perf report' taking excessive time resolving inlines in vmlinux, so lets revert this until a full investigation and improvement on the addr2line support code is made. Reported-by: Jesper Dangaard Brouer Acked-by: Artem Savkov Tested-by: Jesper Dangaard Brouer Cc: Andrii Nakryiko Cc: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Milian Wolff Cc: Peter Zijlstra Link: https://lore.kernel.org/r/ZMl8VyhdwhClTM5g@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 90219f1bd273055f1dc1d7bdc0965755b992c045 Author: Ranjani Sridharan Date: Tue Aug 8 14:06:27 2023 +0300 ASoC: SOF: intel: hda: Clean up link DMA for IPC3 during stop With IPC3, we reset hw_params during the stop trigger, so we should also clean up the link DMA during the stop trigger. Fixes: 1bf83fa6654c ("ASoC: SOF: Intel: hda-dai: Do not perform DMA cleanup during stop") Closes: https://github.com/thesofproject/linux/issues/4455 Closes: https://github.com/thesofproject/linux/issues/4482 Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217673 Signed-off-by: Ranjani Sridharan Reviewed-by: Pierre-Louis Bossart Reviewed-by: Rander Wang Reviewed-by: Péter Ujfalusi Reviewed-by: Guennadi Liakhovetski Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20230808110627.32375-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 5fb9a9fb71a33be61d7d8e8ba4597bfb18d604d0 Author: Felix Fietkau Date: Thu Jun 22 18:59:19 2023 +0200 wifi: cfg80211: fix sband iftype data lookup for AP_VLAN AP_VLAN interfaces are virtual, so doesn't really exist as a type for capabilities. When passed in as a type, AP is the one that's really intended. Fixes: c4cbaf7973a7 ("cfg80211: Add support for HE") Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230622165919.46841-1-nbd@nbd.name Signed-off-by: Johannes Berg commit b74bb07cdab6859e1a3fc9fe7351052176322ddf Author: Ping-Ke Shih Date: Tue Aug 8 08:54:26 2023 +0800 wifi: rtw89: fix 8852AE disconnection caused by RX full flags RX full flags are raised if certain types of RX FIFO are full, and then drop all following MPDU of AMPDU. In order to resume to receive MPDU when RX FIFO becomes available, we clear the register bits by the commit a0d99ebb3ecd ("wifi: rtw89: initialize DMA of CMAC"). But, 8852AE needs more settings to support this. To quickly fix disconnection problem, revert the behavior as before. Fixes: a0d99ebb3ecd ("wifi: rtw89: initialize DMA of CMAC") Reported-by: Damian B Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217710 Cc: Signed-off-by: Ping-Ke Shih Tested-by: Damian B Link: https://lore.kernel.org/r/20230808005426.5327-1-pkshih@realtek.com Signed-off-by: Johannes Berg commit 017e9420c1ca19bc169e20fa749709723eaf1eb7 Author: Larry Finger Date: Fri Aug 4 17:24:38 2023 -0500 MAINTAINERS: Remove tree entry for rtl8180 This entry is not needed. Remove it. Signed-off-by: Larry Finger Link: https://lore.kernel.org/r/20230804222438.16076-3-Larry.Finger@lwfinger.net Signed-off-by: Johannes Berg commit 6a67fe45fe3fffb0721ba068e21103b94a1e57a0 Author: Larry Finger Date: Fri Aug 4 17:24:37 2023 -0500 MAINTAINERS: Update entry for rtl8187 As Herton Ronaldo Krzesinski is no longer active, remove him as maintainer for rtl8187. The git tree entry is also removed. Signed-off-by: Larry Finger Link: https://lore.kernel.org/r/20230804222438.16076-2-Larry.Finger@lwfinger.net Signed-off-by: Johannes Berg commit 07d698324110339b420deebab7a7805815340b4f Author: Petr Tesarik Date: Wed Aug 2 18:34:30 2023 +0200 wifi: brcm80211: handle params_v1 allocation failure Return -ENOMEM from brcmf_run_escan() if kzalloc() fails for v1 params. Fixes: 398ce273d6b1 ("wifi: brcmfmac: cfg80211: Add support for scan params v2") Signed-off-by: Petr Tesarik Link: https://lore.kernel.org/r/20230802163430.1656-1-petrtesarik@huaweicloud.com Signed-off-by: Johannes Berg commit d5712cd22b9cf109fded1b7f178f4c1888c8b84b Author: Karol Herbst Date: Sat Aug 5 12:18:13 2023 +0200 drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes The original commit adding that check tried to protect the kenrel against a potential invalid NULL pointer access. However we call nouveau_connector_detect_depth once without a native_mode set on purpose for non LVDS connectors and this broke DP support in a few cases. Cc: Olaf Skibbe Cc: Lyude Paul Closes: https://gitlab.freedesktop.org/drm/nouveau/-/issues/238 Closes: https://gitlab.freedesktop.org/drm/nouveau/-/issues/245 Fixes: 20a2ce87fbaf8 ("drm/nouveau/dp: check for NULL nv_connector->native_mode") Signed-off-by: Karol Herbst Reviewed-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20230805101813.2603989-1-kherbst@redhat.com commit 4b430d4ac99750ee2ae2f893f1055c7af1ec3dc5 Author: Yibin Ding Date: Wed Aug 2 10:30:23 2023 +0800 mmc: block: Fix in_flight[issue_type] value error For a completed request, after the mmc_blk_mq_complete_rq(mq, req) function is executed, the bitmap_tags corresponding to the request will be cleared, that is, the request will be regarded as idle. If the request is acquired by a different type of process at this time, the issue_type of the request may change. It further caused the value of mq->in_flight[issue_type] to be abnormal, and a large number of requests could not be sent. p1: p2: mmc_blk_mq_complete_rq blk_mq_free_request blk_mq_get_request blk_mq_rq_ctx_init mmc_blk_mq_dec_in_flight mmc_issue_type(mq, req) This strategy can ensure the consistency of issue_type before and after executing mmc_blk_mq_complete_rq. Fixes: 81196976ed94 ("mmc: block: Add blk-mq support") Cc: stable@vger.kernel.org Signed-off-by: Yibin Ding Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20230802023023.1318134-1-yunlong.xing@unisoc.com Signed-off-by: Ulf Hansson commit f48585c468f51ac038c2cfaafcd4437bc3746bce Merge: 3ddaa6a274578 596a5123cc782 Author: Greg Kroah-Hartman Date: Tue Aug 8 10:04:47 2023 +0200 Merge tag 'thunderbolt-for-v6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-linus Mika writes: thunderbolt: Fixes for v6.5-rc6 This includes two fixes for v6.5-rc6: - Correct display flickering when connecting a Thunderbolt 3 device to an AMD USB4 host controller - Fix a memory leak in bandwidth allocation request. Both have been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Fix memory leak in tb_handle_dp_bandwidth_request() thunderbolt: Fix Thunderbolt 3 display flickering issue on 2nd hot plug onwards commit 39163d5479285a36522b6e8f9cc568cc4987db08 Author: Xin Li Date: Tue Mar 21 23:17:58 2023 -0700 x86/vdso: Choose the right GDT_ENTRY_CPUNODE for 32-bit getcpu() on 64-bit kernel The vDSO getcpu() reads CPU ID from the GDT_ENTRY_CPUNODE entry when the RDPID instruction is not available. And GDT_ENTRY_CPUNODE is defined as 28 on 32-bit Linux kernel and 15 on 64-bit. But the 32-bit getcpu() on 64-bit Linux kernel is compiled with 32-bit Linux kernel GDT_ENTRY_CPUNODE, i.e., 28, beyond the 64-bit Linux kernel GDT limit. Thus, it just fails _silently_. When BUILD_VDSO32_64 is defined, choose the 64-bit Linux kernel GDT definitions to compile the 32-bit getcpu(). Fixes: 877cff5296faa6e ("x86/vdso: Fake 32bit VDSO build on 64bit compile for vgetcpu") Reported-by: kernel test robot Reported-by: Shan Kang Signed-off-by: Xin Li Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20230322061758.10639-1-xin3.li@intel.com Link: https://lore.kernel.org/oe-lkp/202303020903.b01fd1de-yujie.liu@intel.com commit 2aa71b4b294ee2c3041d085404cea914be9b3225 Author: Jonas Gorski Date: Fri Aug 4 12:12:20 2023 +0200 net: marvell: prestera: fix handling IPv4 routes with nhid Fix handling IPv4 routes referencing a nexthop via its id by replacing calls to fib_info_nh() with fib_info_nhc(). Trying to add an IPv4 route referencing a nextop via nhid: $ ip link set up swp5 $ ip a a 10.0.0.1/24 dev swp5 $ ip nexthop add dev swp5 id 20 via 10.0.0.2 $ ip route add 10.0.1.0/24 nhid 20 triggers warnings when trying to handle the route: [ 528.805763] ------------[ cut here ]------------ [ 528.810437] WARNING: CPU: 3 PID: 53 at include/net/nexthop.h:468 __prestera_fi_is_direct+0x2c/0x68 [prestera] [ 528.820434] Modules linked in: prestera_pci act_gact act_police sch_ingress cls_u32 cls_flower prestera arm64_delta_tn48m_dn_led(O) arm64_delta_tn48m_dn_cpld(O) [last unloaded: prestera_pci] [ 528.837485] CPU: 3 PID: 53 Comm: kworker/u8:3 Tainted: G O 6.4.5 #1 [ 528.845178] Hardware name: delta,tn48m-dn (DT) [ 528.849641] Workqueue: prestera_ordered __prestera_router_fib_event_work [prestera] [ 528.857352] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 528.864347] pc : __prestera_fi_is_direct+0x2c/0x68 [prestera] [ 528.870135] lr : prestera_k_arb_fib_evt+0xb20/0xd50 [prestera] [ 528.876007] sp : ffff80000b20bc90 [ 528.879336] x29: ffff80000b20bc90 x28: 0000000000000000 x27: ffff0001374d3a48 [ 528.886510] x26: ffff000105604000 x25: ffff000134af8a28 x24: ffff0001374d3800 [ 528.893683] x23: ffff000101c89148 x22: ffff000101c89000 x21: ffff000101c89200 [ 528.900855] x20: ffff00013641fda0 x19: ffff800009d01088 x18: 0000000000000059 [ 528.908027] x17: 0000000000000277 x16: 0000000000000000 x15: 0000000000000000 [ 528.915198] x14: 0000000000000003 x13: 00000000000fe400 x12: 0000000000000000 [ 528.922371] x11: 0000000000000002 x10: 0000000000000aa0 x9 : ffff8000013d2020 [ 528.929543] x8 : 0000000000000018 x7 : 000000007b1703f8 x6 : 000000001ca72f86 [ 528.936715] x5 : 0000000033399ea7 x4 : 0000000000000000 x3 : ffff0001374d3acc [ 528.943886] x2 : 0000000000000000 x1 : ffff00010200de00 x0 : ffff000134ae3f80 [ 528.951058] Call trace: [ 528.953516] __prestera_fi_is_direct+0x2c/0x68 [prestera] [ 528.958952] __prestera_router_fib_event_work+0x100/0x158 [prestera] [ 528.965348] process_one_work+0x208/0x488 [ 528.969387] worker_thread+0x4c/0x430 [ 528.973068] kthread+0x120/0x138 [ 528.976313] ret_from_fork+0x10/0x20 [ 528.979909] ---[ end trace 0000000000000000 ]--- [ 528.984998] ------------[ cut here ]------------ [ 528.989645] WARNING: CPU: 3 PID: 53 at include/net/nexthop.h:468 __prestera_fi_is_direct+0x2c/0x68 [prestera] [ 528.999628] Modules linked in: prestera_pci act_gact act_police sch_ingress cls_u32 cls_flower prestera arm64_delta_tn48m_dn_led(O) arm64_delta_tn48m_dn_cpld(O) [last unloaded: prestera_pci] [ 529.016676] CPU: 3 PID: 53 Comm: kworker/u8:3 Tainted: G W O 6.4.5 #1 [ 529.024368] Hardware name: delta,tn48m-dn (DT) [ 529.028830] Workqueue: prestera_ordered __prestera_router_fib_event_work [prestera] [ 529.036539] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 529.043533] pc : __prestera_fi_is_direct+0x2c/0x68 [prestera] [ 529.049318] lr : __prestera_k_arb_fc_apply+0x280/0x2f8 [prestera] [ 529.055452] sp : ffff80000b20bc60 [ 529.058781] x29: ffff80000b20bc60 x28: 0000000000000000 x27: ffff0001374d3a48 [ 529.065953] x26: ffff000105604000 x25: ffff000134af8a28 x24: ffff0001374d3800 [ 529.073126] x23: ffff000101c89148 x22: ffff000101c89148 x21: ffff00013641fda0 [ 529.080299] x20: ffff000101c89000 x19: ffff000101c89020 x18: 0000000000000059 [ 529.087471] x17: 0000000000000277 x16: 0000000000000000 x15: 0000000000000000 [ 529.094642] x14: 0000000000000003 x13: 00000000000fe400 x12: 0000000000000000 [ 529.101814] x11: 0000000000000002 x10: 0000000000000aa0 x9 : ffff8000013cee80 [ 529.108985] x8 : 0000000000000018 x7 : 000000007b1703f8 x6 : 0000000000000018 [ 529.116157] x5 : 00000000d3497eb6 x4 : ffff000105604081 x3 : 000000008e979557 [ 529.123329] x2 : 0000000000000000 x1 : ffff00010200de00 x0 : ffff000134ae3f80 [ 529.130501] Call trace: [ 529.132958] __prestera_fi_is_direct+0x2c/0x68 [prestera] [ 529.138394] prestera_k_arb_fib_evt+0x6b8/0xd50 [prestera] [ 529.143918] __prestera_router_fib_event_work+0x100/0x158 [prestera] [ 529.150313] process_one_work+0x208/0x488 [ 529.154348] worker_thread+0x4c/0x430 [ 529.158030] kthread+0x120/0x138 [ 529.161274] ret_from_fork+0x10/0x20 [ 529.164867] ---[ end trace 0000000000000000 ]--- and results in a non offloaded route: $ ip route 10.0.0.0/24 dev swp5 proto kernel scope link src 10.0.0.1 rt_trap 10.0.1.0/24 nhid 20 via 10.0.0.2 dev swp5 rt_trap When creating a route referencing a nexthop via its ID, the nexthop will be stored in a separate nh pointer instead of the array of nexthops in the fib_info struct. This causes issues since fib_info_nh() only handles the nexthops array, but not the separate nh pointer, and will loudly WARN about it. In contrast fib_info_nhc() handles both, but returns a fib_nh_common pointer instead of a fib_nh pointer. Luckily we only ever access fields from the fib_nh_common parts, so we can just replace all instances of fib_info_nh() with fib_info_nhc() and access the fields via their fib_nh_common names. This allows handling IPv4 routes with an external nexthop, and they now get offloaded as expected: $ ip route 10.0.0.0/24 dev swp5 proto kernel scope link src 10.0.0.1 rt_trap 10.0.1.0/24 nhid 20 via 10.0.0.2 dev swp5 offload rt_offload Fixes: 396b80cb5cc8 ("net: marvell: prestera: Add neighbour cache accounting") Signed-off-by: Jonas Gorski Acked-by: Elad Nachman Link: https://lore.kernel.org/r/20230804101220.247515-1-jonas.gorski@bisdn.de Signed-off-by: Jakub Kicinski commit d14eea09edf427fa36bd446f4a3271f99164202f Author: Andrew Kanner Date: Thu Aug 3 21:03:18 2023 +0200 net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() Syzkaller reported the following issue: ======================================= Too BIG xdp->frame_sz = 131072 WARNING: CPU: 0 PID: 5020 at net/core/filter.c:4121 ____bpf_xdp_adjust_tail net/core/filter.c:4121 [inline] WARNING: CPU: 0 PID: 5020 at net/core/filter.c:4121 bpf_xdp_adjust_tail+0x466/0xa10 net/core/filter.c:4103 ... Call Trace: bpf_prog_4add87e5301a4105+0x1a/0x1c __bpf_prog_run include/linux/filter.h:600 [inline] bpf_prog_run_xdp include/linux/filter.h:775 [inline] bpf_prog_run_generic_xdp+0x57e/0x11e0 net/core/dev.c:4721 netif_receive_generic_xdp net/core/dev.c:4807 [inline] do_xdp_generic+0x35c/0x770 net/core/dev.c:4866 tun_get_user+0x2340/0x3ca0 drivers/net/tun.c:1919 tun_chr_write_iter+0xe8/0x210 drivers/net/tun.c:2043 call_write_iter include/linux/fs.h:1871 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x650/0xe40 fs/read_write.c:584 ksys_write+0x12f/0x250 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd xdp->frame_sz > PAGE_SIZE check was introduced in commit c8741e2bfe87 ("xdp: Allow bpf_xdp_adjust_tail() to grow packet size"). But Jesper Dangaard Brouer noted that after introducing the xdp_init_buff() which all XDP driver use - it's safe to remove this check. The original intend was to catch cases where XDP drivers have not been updated to use xdp.frame_sz, but that is not longer a concern (since xdp_init_buff). Running the initial syzkaller repro it was discovered that the contiguous physical memory allocation is used for both xdp paths in tun_get_user(), e.g. tun_build_skb() and tun_alloc_skb(). It was also stated by Jesper Dangaard Brouer that XDP can work on higher order pages, as long as this is contiguous physical memory (e.g. a page). Reported-and-tested-by: syzbot+f817490f5bd20541b90a@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000774b9205f1d8a80d@google.com/T/ Link: https://syzkaller.appspot.com/bug?extid=f817490f5bd20541b90a Link: https://lore.kernel.org/all/20230725155403.796-1-andrew.kanner@gmail.com/T/ Fixes: 43b5169d8355 ("net, xdp: Introduce xdp_init_buff utility routine") Signed-off-by: Andrew Kanner Acked-by: Jesper Dangaard Brouer Acked-by: Jason Wang Link: https://lore.kernel.org/r/20230803190316.2380231-1-andrew.kanner@gmail.com Signed-off-by: Jakub Kicinski commit 59eeb232940515590de513b997539ef495faca9a Author: Andrew Kanner Date: Thu Aug 3 20:59:48 2023 +0200 drivers: net: prevent tun_build_skb() to exceed the packet size limit Using the syzkaller repro with reduced packet size it was discovered that XDP_PACKET_HEADROOM is not checked in tun_can_build_skb(), although pad may be incremented in tun_build_skb(). This may end up with exceeding the PAGE_SIZE limit in tun_build_skb(). Jason Wang proposed to count XDP_PACKET_HEADROOM always (e.g. without rcu_access_pointer(tun->xdp_prog)) in tun_can_build_skb() since there's a window during which XDP program might be attached between tun_can_build_skb() and tun_build_skb(). Fixes: 7df13219d757 ("tun: reserve extra headroom only when XDP is set") Link: https://syzkaller.appspot.com/bug?extid=f817490f5bd20541b90a Signed-off-by: Andrew Kanner Link: https://lore.kernel.org/r/20230803185947.2379988-1-andrew.kanner@gmail.com Signed-off-by: Jakub Kicinski commit ef222f551e7c4e2008fc442ffc9edcd1a7fd8f63 Author: Nilesh Javali Date: Mon Aug 7 15:07:24 2023 +0530 scsi: qedf: Fix firmware halt over suspend and resume While performing certain power-off sequences, PCI drivers are called to suspend and resume their underlying devices through PCI PM (power management) interface. However the hardware does not support PCI PM suspend/resume operations so system wide suspend/resume leads to bad MFW (management firmware) state which causes various follow-up errors in driver when communicating with the device/firmware. To fix this driver implements PCI PM suspend handler to indicate unsupported operation to the PCI subsystem explicitly, thus avoiding system to go into suspended/standby mode. Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.") Signed-off-by: Saurav Kashyap Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20230807093725.46829-1-njavali@marvell.com Signed-off-by: Martin K. Petersen commit 1516ee035df32115197cd93ae3619dba7b020986 Author: Nilesh Javali Date: Mon Aug 7 15:07:25 2023 +0530 scsi: qedi: Fix firmware halt over suspend and resume While performing certain power-off sequences, PCI drivers are called to suspend and resume their underlying devices through PCI PM (power management) interface. However the hardware does not support PCI PM suspend/resume operations so system wide suspend/resume leads to bad MFW (management firmware) state which causes various follow-up errors in driver when communicating with the device/firmware. To fix this driver implements PCI PM suspend handler to indicate unsupported operation to the PCI subsystem explicitly, thus avoiding system to go into suspended/standby mode. Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.") Signed-off-by: Nilesh Javali Link: https://lore.kernel.org/r/20230807093725.46829-2-njavali@marvell.com Signed-off-by: Martin K. Petersen commit dd64f80587190265ca8a0f4be6c64c2fda6d3ac2 Author: Chengfeng Ye Date: Wed Jul 26 12:56:55 2023 +0000 scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock As &qedi_percpu->p_work_lock is acquired by hard IRQ qedi_msix_handler(), other acquisitions of the same lock under process context should disable IRQ, otherwise deadlock could happen if the IRQ preempts the execution while the lock is held in process context on the same CPU. qedi_cpu_offline() is one such function which acquires the lock in process context. [Deadlock Scenario] qedi_cpu_offline() ->spin_lock(&p->p_work_lock) ->qedi_msix_handler() ->edi_process_completions() ->spin_lock_irqsave(&p->p_work_lock, flags); (deadlock here) This flaw was found by an experimental static analysis tool I am developing for IRQ-related deadlocks. The tentative patch fix the potential deadlock by spin_lock_irqsave() under process context. Signed-off-by: Chengfeng Ye Link: https://lore.kernel.org/r/20230726125655.4197-1-dg573847474@gmail.com Acked-by: Manish Rangankar Signed-off-by: Martin K. Petersen commit 8eebf0e84f0614cebc7347f7bbccba4056d77d42 Author: Justin Tee Date: Thu Aug 3 14:19:32 2023 -0700 scsi: lpfc: Remove reftag check in DIF paths When preparing protection DIF I/O for DMA, the driver obtains reference tags from scsi_prot_ref_tag(). Previously, there was a wrong assumption that an all 0xffffffff value meant error and thus the driver failed the I/O. This patch removes the evaluation code and accepts whatever the upper layer returns. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20230803211932.155745-1-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit b6d128f89a85771433a004e8656090ccbe1fb969 Author: Yoshihiro Shimoda Date: Thu Aug 3 17:18:12 2023 +0900 scsi: ufs: renesas: Fix private allocation Should use devm_kzalloc() for struct ufs_renesas_priv because the .initialized should be false as default. Fixes: d69520288efd ("scsi: ufs: ufs-renesas: Add support for Renesas R-Car UFS controller") Signed-off-by: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20230803081812.1446282-1-yoshihiro.shimoda.uh@renesas.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 41320b18a0e0dfb236dba4edb9be12dba1878156 Author: Zhu Wang Date: Tue Aug 1 19:14:21 2023 +0800 scsi: snic: Fix possible memory leak if device_add() fails If device_add() returns error, the name allocated by dev_set_name() needs be freed. As the comment of device_add() says, put_device() should be used to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanp(). Fixes: c8806b6c9e82 ("snic: driver for Cisco SCSI HBA") Signed-off-by: Zhu Wang Acked-by: Narsimhulu Musini Link: https://lore.kernel.org/r/20230801111421.63651-1-wangzhu9@huawei.com Signed-off-by: Martin K. Petersen commit 04b5b5cb0136ce970333a9c6cec7e46adba1ea3a Author: Zhu Wang Date: Thu Aug 3 10:02:30 2023 +0800 scsi: core: Fix possible memory leak if device_add() fails If device_add() returns error, the name allocated by dev_set_name() needs be freed. As the comment of device_add() says, put_device() should be used to decrease the reference count in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanp(). Fixes: ee959b00c335 ("SCSI: convert struct class_device to struct device") Signed-off-by: Zhu Wang Link: https://lore.kernel.org/r/20230803020230.226903-1-wangzhu9@huawei.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit da703fe9416d7a03058432ccc27b898504b1383d Merge: 64094e7e3118a 534fc31d09b70 Author: Linus Torvalds Date: Mon Aug 7 17:25:19 2023 -0700 Merge tag 'xsa432-6.5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen netback buffer overflow fix from Juergen Gross: "The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire packet being split into as many pieces as permitted by the protocol, yet still being smaller than the area that's specially dealt with to keep all (possible) headers together. Such an unusual packet would therefore trigger a buffer overrun in the driver" * tag 'xsa432-6.5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/netback: Fix buffer overrun triggered by unusual packet commit 64094e7e3118aff4b0be8ff713c242303e139834 Merge: 138bcddb86d8a 1b0fc0345f285 Author: Linus Torvalds Date: Mon Aug 7 17:03:54 2023 -0700 Merge tag 'gds-for-linus-2023-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86/gds fixes from Dave Hansen: "Mitigate Gather Data Sampling issue: - Add Base GDS mitigation - Support GDS_NO under KVM - Fix a documentation typo" * tag 'gds-for-linus-2023-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Documentation/x86: Fix backwards on/off logic about YMM support KVM: Add GDS_NO support to KVM x86/speculation: Add Kconfig option for GDS x86/speculation: Add force option to GDS mitigation x86/speculation: Add Gather Data Sampling mitigation commit 138bcddb86d8a4f842e4ed6f0585abc9b1a764ff Merge: 14f9643dc90ad 5a15d8348881e Author: Linus Torvalds Date: Mon Aug 7 16:35:44 2023 -0700 Merge tag 'x86_bugs_srso' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86/srso fixes from Borislav Petkov: "Add a mitigation for the speculative RAS (Return Address Stack) overflow vulnerability on AMD processors. In short, this is yet another issue where userspace poisons a microarchitectural structure which can then be used to leak privileged information through a side channel" * tag 'x86_bugs_srso' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/srso: Tie SBPB bit setting to microcode patch detection x86/srso: Add a forgotten NOENDBR annotation x86/srso: Fix return thunks in generated code x86/srso: Add IBPB on VMEXIT x86/srso: Add IBPB x86/srso: Add SRSO_NO support x86/srso: Add IBPB_BRTYPE support x86/srso: Add a Speculative RAS Overflow mitigation x86/bugs: Increase the x86 bugs vector size to two u32s commit e61994882611d1a49387be37fda005e0ef6226ac Author: jairaj-arava Date: Mon Aug 7 16:49:59 2023 -0500 ASoC: Intel: sof-sdw-cs42142: fix for codec button mapping The CS42142 soundwire codec button mapping is corrected to handle the button detection correctly. Fixes: 43cdea08a4ac ("ASoC: Intel: sof_sdw: Add helper function for cs42l42 codec") Signed-off-by: jairaj-arava Signed-off-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20230807215000.515846-2-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit bd76caa26ab53ed3bf13ad541d69f119e910d764 Author: Pierre-Louis Bossart Date: Mon Aug 7 16:50:00 2023 -0500 ASoC: Intel: sof-sdw: update jack detection quirk for LunarLake RVP Experimental results show that the headset is only detected with the JD2 quirk. Signed-off-by: Pierre-Louis Bossart Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20230807215000.515846-3-pierre-louis.bossart@linux.intel.com Signed-off-by: Mark Brown commit 14f9643dc90adea074a0ffb7a17d337eafc6a5cc Merge: 8043e2225aa2e aa6fde93f3a49 Author: Linus Torvalds Date: Mon Aug 7 13:07:12 2023 -0700 Merge tag 'wq-for-6.5-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fixes from Tejun Heo: - The recently added cpu_intensive auto detection and warning mechanism was spuriously triggered on slow CPUs. While not causing serious issues, it's still a nuisance and can cause unintended concurrency management behaviors. Relax the threshold on machines with lower BogoMIPS. While BogoMIPS is not an accurate measure of performance by most measures, we don't have to be accurate and it has rough but strong enough correlation. - A correction in Kconfig help text * tag 'wq-for-6.5-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Scale up wq_cpu_intensive_thresh_us if BogoMIPS is below 4000 workqueue: Fix cpu_intensive_thresh_us name in help text commit 8043e2225aa2ef7c7a04aac129a7ded3b1771aba Merge: a027b2eca0b7e e117e7adc637e Author: Linus Torvalds Date: Mon Aug 7 13:03:36 2023 -0700 Merge tag 'tpmdd-v6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm fixes from Jarkko Sakkinen: "A few more bug fixes" * tag 'tpmdd-v6.5-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm/tpm_tis: Disable interrupts for Lenovo P620 devices tpm: Disable RNG for all AMD fTPMs sysctl: set variable key_sysctls storage-class-specifier to static tpm/tpm_tis: Disable interrupts for TUXEDO InfinityBook S 15/17 Gen7 commit fa41884c1c6deb6774135390e5813a97184903e0 Merge: 01f4fd2708707 46622219aae2b Author: Jakub Kicinski Date: Mon Aug 7 12:26:58 2023 -0700 Merge branch 'wireguard-fixes-for-6-5-rc6' Jason A. Donenfeld says: ==================== wireguard fixes for 6.5-rc6 Just one patch this time, somewhat late in the cycle: 1) Fix an off-by-one calculation for the maximum node depth size in the allowedips trie data structure, and also adjust the self-tests to hit this case so it doesn't regress again in the future. ==================== Link: https://lore.kernel.org/r/20230807132146.2191597-1-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit 46622219aae2b67813fe31a7b8cb7da5baff5c8a Author: Jason A. Donenfeld Date: Mon Aug 7 15:21:27 2023 +0200 wireguard: allowedips: expand maximum node depth In the allowedips self-test, nodes are inserted into the tree, but it generated an even amount of nodes, but for checking maximum node depth, there is of course the root node, which makes the total number necessarily odd. With two few nodes added, it never triggered the maximum depth check like it should have. So, add 129 nodes instead of 128 nodes, and do so with a more straightforward scheme, starting with all the bits set, and shifting over one each time. Then increase the maximum depth to 129, and choose a better name for that variable to make it clear that it represents depth as opposed to bits. Cc: stable@vger.kernel.org Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Signed-off-by: Jason A. Donenfeld Link: https://lore.kernel.org/r/20230807132146.2191597-2-Jason@zx2c4.com Signed-off-by: Jakub Kicinski commit 01f4fd27087078c90a0e22860d1dfa2cd0510791 Author: Ziyang Xuan Date: Wed Aug 2 19:43:20 2023 +0800 bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves BUG_ON(!vlan_info) is triggered in unregister_vlan_dev() with following testcase: # ip netns add ns1 # ip netns exec ns1 ip link add bond0 type bond mode 0 # ip netns exec ns1 ip link add bond_slave_1 type veth peer veth2 # ip netns exec ns1 ip link set bond_slave_1 master bond0 # ip netns exec ns1 ip link add link bond_slave_1 name vlan10 type vlan id 10 protocol 802.1ad # ip netns exec ns1 ip link add link bond0 name bond0_vlan10 type vlan id 10 protocol 802.1ad # ip netns exec ns1 ip link set bond_slave_1 nomaster # ip netns del ns1 The logical analysis of the problem is as follows: 1. create ETH_P_8021AD protocol vlan10 for bond_slave_1: register_vlan_dev() vlan_vid_add() vlan_info_alloc() __vlan_vid_add() // add [ETH_P_8021AD, 10] vid to bond_slave_1 2. create ETH_P_8021AD protocol bond0_vlan10 for bond0: register_vlan_dev() vlan_vid_add() __vlan_vid_add() vlan_add_rx_filter_info() if (!vlan_hw_filter_capable(dev, proto)) // condition established because bond0 without NETIF_F_HW_VLAN_STAG_FILTER return 0; if (netif_device_present(dev)) return dev->netdev_ops->ndo_vlan_rx_add_vid(dev, proto, vid); // will be never called // The slaves of bond0 will not refer to the [ETH_P_8021AD, 10] vid. 3. detach bond_slave_1 from bond0: __bond_release_one() vlan_vids_del_by_dev() list_for_each_entry(vid_info, &vlan_info->vid_list, list) vlan_vid_del(dev, vid_info->proto, vid_info->vid); // bond_slave_1 [ETH_P_8021AD, 10] vid will be deleted. // bond_slave_1->vlan_info will be assigned NULL. 4. delete vlan10 during delete ns1: default_device_exit_batch() dev->rtnl_link_ops->dellink() // unregister_vlan_dev() for vlan10 vlan_info = rtnl_dereference(real_dev->vlan_info); // real_dev of vlan10 is bond_slave_1 BUG_ON(!vlan_info); // bond_slave_1->vlan_info is NULL now, bug is triggered!!! Add S-VLAN tag related features support to bond driver. So the bond driver will always propagate the VLAN info to its slaves. Fixes: 8ad227ff89a7 ("net: vlan: add 802.1ad support") Suggested-by: Ido Schimmel Signed-off-by: Ziyang Xuan Reviewed-by: Ido Schimmel Link: https://lore.kernel.org/r/20230802114320.4156068-1-william.xuanziyang@huawei.com Signed-off-by: Jakub Kicinski commit 548ee049b19fb9a3d0a4335314d0d1217a521bc5 Author: Lama Kayal Date: Sun Jun 11 16:29:13 2023 +0300 net/mlx5e: Add capability check for vnic counters Add missing capability check for each of the vnic counters exposed by devlink health reporter, and thus avoid unexpected behavior due to invalid access to registers. While at it, read only the exact number of bits for each counter whether it was 32 bits or 64 bits. Fixes: b0bc615df488 ("net/mlx5: Add vnic devlink health reporter to PFs/VFs") Fixes: a33682e4e78e ("net/mlx5e: Expose catastrophic steering error counters") Signed-off-by: Lama Kayal Reviewed-by: Gal Pressman Reviewed-by: Rahul Rameshbabu Reviewed-by: Maher Sanalla Signed-off-by: Saeed Mahameed commit aab8e1a200b926147db51e3f82fd07bb9edf6a98 Author: Moshe Shemesh Date: Sun Jul 23 11:03:01 2023 +0300 net/mlx5: Reload auxiliary devices in pci error handlers Handling pci errors should fully teardown and load back auxiliary devices, same as done through mlx5 health recovery flow. Fixes: 72ed5d5624af ("net/mlx5: Suspend auxiliary devices only in case of PCI device suspend") Signed-off-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit d006207625657322ba8251b6e7e829f9659755dc Author: Moshe Shemesh Date: Wed Jul 19 11:33:44 2023 +0300 net/mlx5: Skip clock update work when device is in error state When device is in error state, marked by the flag MLX5_DEVICE_STATE_INTERNAL_ERROR, the HW and PCI may not be accessible and so clock update work should be skipped. Furthermore, such access through PCI in error state, after calling mlx5_pci_disable_device() can result in failing to recover from pci errors. Fixes: ef9814deafd0 ("net/mlx5e: Add HW timestamping (TS) support") Reported-and-tested-by: Ganesh G R Closes: https://lore.kernel.org/netdev/9bdb9b9d-140a-7a28-f0de-2e64e873c068@nvidia.com Signed-off-by: Moshe Shemesh Reviewed-by: Aya Levin Signed-off-by: Saeed Mahameed commit 86ed7b773c01ba71617538b3b107c33fd9cf90b8 Author: Shay Drory Date: Sun Jul 30 09:26:27 2023 +0300 net/mlx5: LAG, Check correct bucket when modifying LAG Cited patch introduced buckets in hash mode, but missed to update the ports/bucket check when modifying LAG. Fix the check. Fixes: 352899f384d4 ("net/mlx5: Lag, use buckets in hash mode") Signed-off-by: Shay Drory Reviewed-by: Maor Gottlieb Signed-off-by: Saeed Mahameed commit 6b5926eb1c034affff3fb44a98cb8c67153847d8 Author: Chris Mi Date: Wed Jul 26 09:06:33 2023 +0300 net/mlx5e: Unoffload post act rule when handling FIB events If having the following tc rule on stack device: filter parent ffff: protocol ip pref 3 flower chain 1 filter parent ffff: protocol ip pref 3 flower chain 1 handle 0x1 dst_mac 24:25:d0:e1:00:00 src_mac 02:25:d0:25:01:02 eth_type ipv4 ct_state +trk+new in_hw in_hw_count 1 action order 1: ct commit zone 0 pipe index 2 ref 1 bind 1 installed 3807 sec used 3779 sec firstused 3800 sec Action statistics: Sent 120 bytes 2 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0 used_hw_stats delayed action order 2: tunnel_key set src_ip 192.168.1.25 dst_ip 192.168.1.26 key_id 4 dst_port 4789 csum pipe index 3 ref 1 bind 1 installed 3807 sec used 3779 sec firstused 3800 sec Action statistics: Sent 120 bytes 2 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0 used_hw_stats delayed action order 3: mirred (Egress Redirect to device vxlan1) stolen index 9 ref 1 bind 1 installed 3807 sec used 3779 sec firstused 3800 sec Action statistics: Sent 120 bytes 2 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0 used_hw_stats delayed When handling FIB events, the rule in post act will not be deleted. And because the post act rule has packet reformat and modify header actions, also will hit the following syndromes: mlx5_core 0000:08:00.0: mlx5_cmd_out_err:829:(pid 11613): DEALLOC_MODIFY_HEADER_CONTEXT(0x941) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0x1ab444), err(-22) mlx5_core 0000:08:00.0: mlx5_cmd_out_err:829:(pid 11613): DEALLOC_PACKET_REFORMAT_CONTEXT(0x93e) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0x179e84), err(-22) Fix it by unoffloading post act rule when handling FIB events. Fixes: 314e1105831b ("net/mlx5e: Add post act offload/unoffload API") Signed-off-by: Chris Mi Reviewed-by: Vlad Buslov Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 2d691c90f45ad2d0eafdd24c6abb0973a831c1d2 Author: Daniel Jurgens Date: Tue Aug 1 21:46:00 2023 +0300 net/mlx5: Fix devlink controller number for ECVF The controller number for ECVFs is always 0, because the ECPF must be the eswitch owner for EC VFs to be enabled. Fixes: dc13180824b7 ("net/mlx5: Enable devlink port for embedded cpu VF vports") Signed-off-by: Daniel Jurgens Signed-off-by: Saeed Mahameed commit 2dc2b3922d3c0f52d3a792d15dcacfbc4cc76b8f Author: Daniel Jurgens Date: Tue Jul 11 00:28:10 2023 +0300 net/mlx5: Allow 0 for total host VFs When querying eswitch functions 0 is a valid number of host VFs. After introducing ARM SRIOV falling through to getting the max value from PCI results in using the total VFs allowed on the ARM for the host. Fixes: 86eec50beaf3 ("net/mlx5: Support querying max VFs from device"); Signed-off-by: Daniel Jurgens Signed-off-by: Saeed Mahameed commit 06c868fde61fd0bbf9a7c7405f6eb9925bf0c2ed Author: Daniel Jurgens Date: Mon Jun 26 22:55:03 2023 +0300 net/mlx5: Return correct EC_VF function ID The ECVF function ID range is 1..max_ec_vfs. Currently mlx5_vport_to_func_id returns 0..max_ec_vfs - 1. Which results in a syndrome when querying the caps with more recent firmware, or reading incorrect caps with older firmware that supports EC VFs. Fixes: 9ac0b128248e ("net/mlx5: Update vport caps query/set for EC VFs") Signed-off-by: Daniel Jurgens Signed-off-by: Saeed Mahameed commit 8bfe1e19fb96d89fce14302e35cba0cd9f39d0a1 Author: Yevgeny Kliteynik Date: Wed Jul 26 14:38:03 2023 +0300 net/mlx5: DR, Fix wrong allocation of modify hdr pattern Fixing wrong calculation of the modify hdr pattern size, where the previously calculated number would not be enough to accommodate the required number of actions. Fixes: da5d0027d666 ("net/mlx5: DR, Add cache for modify header pattern") Signed-off-by: Yevgeny Kliteynik Reviewed-by: Erez Shitrit Signed-off-by: Saeed Mahameed commit ac5da544a3c2047cbfd715acd9cec8380d7fe5c6 Author: Jianbo Liu Date: Fri Apr 14 08:48:20 2023 +0000 net/mlx5e: TC, Fix internal port memory leak The flow rule can be splited, and the extra post_act rules are added to post_act table. It's possible to trigger memleak when the rule forwards packets from internal port and over tunnel, in the case that, for example, CT 'new' state offload is allowed. As int_port object is assigned to the flow attribute of post_act rule, and its refcnt is incremented by mlx5e_tc_int_port_get(), but mlx5e_tc_int_port_put() is not called, the refcnt is never decremented, then int_port is never freed. The kmemleak reports the following error: unreferenced object 0xffff888128204b80 (size 64): comm "handler20", pid 50121, jiffies 4296973009 (age 642.932s) hex dump (first 32 bytes): 01 00 00 00 19 00 00 00 03 f0 00 00 04 00 00 00 ................ 98 77 67 41 81 88 ff ff 98 77 67 41 81 88 ff ff .wgA.....wgA.... backtrace: [<00000000e992680d>] kmalloc_trace+0x27/0x120 [<000000009e945a98>] mlx5e_tc_int_port_get+0x3f3/0xe20 [mlx5_core] [<0000000035a537f0>] mlx5e_tc_add_fdb_flow+0x473/0xcf0 [mlx5_core] [<0000000070c2cec6>] __mlx5e_add_fdb_flow+0x7cf/0xe90 [mlx5_core] [<000000005cc84048>] mlx5e_configure_flower+0xd40/0x4c40 [mlx5_core] [<000000004f8a2031>] mlx5e_rep_indr_offload.isra.0+0x10e/0x1c0 [mlx5_core] [<000000007df797dc>] mlx5e_rep_indr_setup_tc_cb+0x90/0x130 [mlx5_core] [<0000000016c15cc3>] tc_setup_cb_add+0x1cf/0x410 [<00000000a63305b4>] fl_hw_replace_filter+0x38f/0x670 [cls_flower] [<000000008bc9e77c>] fl_change+0x1fd5/0x4430 [cls_flower] [<00000000e7f766e4>] tc_new_tfilter+0x867/0x2010 [<00000000e101c0ef>] rtnetlink_rcv_msg+0x6fc/0x9f0 [<00000000e1111d44>] netlink_rcv_skb+0x12c/0x360 [<0000000082dd6c8b>] netlink_unicast+0x438/0x710 [<00000000fc568f70>] netlink_sendmsg+0x794/0xc50 [<0000000016e92590>] sock_sendmsg+0xc5/0x190 So fix this by moving int_port cleanup code to the flow attribute free helper, which is used by all the attribute free cases. Fixes: 8300f225268b ("net/mlx5e: Create new flow attr for multi table actions") Signed-off-by: Jianbo Liu Reviewed-by: Vlad Buslov Signed-off-by: Saeed Mahameed commit 72cc654970658e88a1cdea08f06b11c218efa4da Author: Gal Pressman Date: Sun Jul 16 14:28:10 2023 +0300 net/mlx5e: Take RTNL lock when needed before calling xdp_set_features() Hold RTNL lock when calling xdp_set_features() with a registered netdev, as the call triggers the netdev notifiers. This could happen when switching from uplink rep to nic profile for example. This resolves the following call trace: RTNL: assertion failed at net/core/dev.c (1953) WARNING: CPU: 6 PID: 112670 at net/core/dev.c:1953 call_netdevice_notifiers_info+0x7c/0x80 Modules linked in: sch_mqprio sch_mqprio_lib act_tunnel_key act_mirred act_skbedit cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress bonding ib_umad ip_gre rdma_ucm mlx5_vfio_pci ipip tunnel4 ip6_gre gre mlx5_ib vfio_pci vfio_pci_core vfio_iommu_type1 ib_uverbs vfio mlx5_core ib_ipoib geneve nf_tables ip6_tunnel tunnel6 iptable_raw openvswitch nsh rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: ib_uverbs] CPU: 6 PID: 112670 Comm: devlink Not tainted 6.4.0-rc7_for_upstream_min_debug_2023_06_28_17_02 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:call_netdevice_notifiers_info+0x7c/0x80 Code: 90 ff 80 3d 2d 6b f7 00 00 75 c5 ba a1 07 00 00 48 c7 c6 e4 ce 0b 82 48 c7 c7 c8 f4 04 82 c6 05 11 6b f7 00 01 e8 a4 7c 8e ff <0f> 0b eb a2 0f 1f 44 00 00 55 48 89 e5 41 54 48 83 e4 f0 48 83 ec RSP: 0018:ffff8882a21c3948 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffff82e6f880 RCX: 0000000000000027 RDX: ffff88885f99b5c8 RSI: 0000000000000001 RDI: ffff88885f99b5c0 RBP: 0000000000000028 R08: ffff88887ffabaa8 R09: 0000000000000003 R10: ffff88887fecbac0 R11: ffff88887ff7bac0 R12: ffff8882a21c3968 R13: ffff88811c018940 R14: 0000000000000000 R15: ffff8881274401a0 FS: 00007fe141c81800(0000) GS:ffff88885f980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f787c28b948 CR3: 000000014bcf3005 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? __warn+0x79/0x120 ? call_netdevice_notifiers_info+0x7c/0x80 ? report_bug+0x17c/0x190 ? handle_bug+0x3c/0x60 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? call_netdevice_notifiers_info+0x7c/0x80 ? call_netdevice_notifiers_info+0x7c/0x80 call_netdevice_notifiers+0x2e/0x50 mlx5e_set_xdp_feature+0x21/0x50 [mlx5_core] mlx5e_nic_init+0xf1/0x1a0 [mlx5_core] mlx5e_netdev_init_profile+0x76/0x110 [mlx5_core] mlx5e_netdev_attach_profile+0x1f/0x90 [mlx5_core] mlx5e_netdev_change_profile+0x92/0x160 [mlx5_core] mlx5e_netdev_attach_nic_profile+0x1b/0x30 [mlx5_core] mlx5e_vport_rep_unload+0xaa/0xc0 [mlx5_core] __esw_offloads_unload_rep+0x52/0x60 [mlx5_core] mlx5_esw_offloads_rep_unload+0x52/0x70 [mlx5_core] esw_offloads_unload_rep+0x34/0x70 [mlx5_core] esw_offloads_disable+0x2b/0x90 [mlx5_core] mlx5_eswitch_disable_locked+0x1b9/0x210 [mlx5_core] mlx5_devlink_eswitch_mode_set+0xf5/0x630 [mlx5_core] ? devlink_get_from_attrs_lock+0x9e/0x110 devlink_nl_cmd_eswitch_set_doit+0x60/0xe0 genl_family_rcv_msg_doit.isra.0+0xc2/0x110 genl_rcv_msg+0x17d/0x2b0 ? devlink_get_from_attrs_lock+0x110/0x110 ? devlink_nl_cmd_eswitch_get_doit+0x290/0x290 ? devlink_pernet_pre_exit+0xf0/0xf0 ? genl_family_rcv_msg_doit.isra.0+0x110/0x110 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1f6/0x2c0 netlink_sendmsg+0x232/0x4a0 sock_sendmsg+0x38/0x60 ? _copy_from_user+0x2a/0x60 __sys_sendto+0x110/0x160 ? __count_memcg_events+0x48/0x90 ? handle_mm_fault+0x161/0x260 ? do_user_addr_fault+0x278/0x6e0 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fe141b1340a Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007fff61d03de8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000afab00 RCX: 00007fe141b1340a RDX: 0000000000000038 RSI: 0000000000afab00 RDI: 0000000000000003 RBP: 0000000000afa910 R08: 00007fe141d80200 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 Fixes: 4d5ab0ad964d ("net/mlx5e: take into account device reconfiguration for xdp_features flag") Signed-off-by: Gal Pressman Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 41aad0905568508070842e22ebc5398f8b733939 Author: Xia Fukun Date: Mon Aug 7 15:51:18 2023 +0800 ASoC: SOF: Fix incorrect use of sizeof in sof_ipc3_do_rx_work() Here hdr is a pointer, and we should measure the size of struct sof_ipc_cmd_hdr. Fixes: 12c41c779fad ("ASoC: SOF: Refactor rx function for fuzzing") Signed-off-by: Xia Fukun Reviewed-by: Curtis Malainey Link: https://lore.kernel.org/r/20230807075118.128122-1-xiafukun@huawei.com Signed-off-by: Mark Brown commit 1f566435141047ca7db26aa4b0b6647a25badaee Author: Hans de Goede Date: Sat Aug 5 19:14:35 2023 +0200 ASoC: lower "no backend DAIs enabled for ... Port" log severity If SNDRV_PCM_IOCTL_PREPARE is called when the mixer settings linking frontend and backend have not been setup yet this results in e.g. the following errors getting logged: [ 43.244549] Baytrail Audio Port: ASoC: no backend DAIs enabled for Baytrail Audio Port [ 43.244744] Baytrail Audio Port: ASoC: error at dpcm_fe_dai_prepare on Baytrail Audio Port: -22 pipewire triggers this leading to 96 lines getting logged after the user has logged into a GNOME session. Change the actual "no backend DAIs enabled for ... Port" error to dev_err_once() to avoid it getting repeated 48 times. While at it also improve the error by hinting the user how to fix this. To not make developing new UCM profiles harder, also log the error at dev_dbg() level all the time (vs once). So that e.g. dyndbg can be used to (re)enable the messages. Also changes _soc_pcm_ret() to not log for -EINVAL errors, to fix the other error getting logged 48 times. Userspace passing wrong parameters should not lead to dmesg messages. Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/3407 Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230805171435.31696-1-hdegoede@redhat.com Signed-off-by: Mark Brown commit 72dbde0f2afbe4af8e8595a89c650ae6b9d9c36f Author: Aleksa Sarai Date: Mon Aug 7 12:24:15 2023 +1000 io_uring: correct check for O_TMPFILE O_TMPFILE is actually __O_TMPFILE|O_DIRECTORY. This means that the old check for whether RESOLVE_CACHED can be used would incorrectly think that O_DIRECTORY could not be used with RESOLVE_CACHED. Cc: stable@vger.kernel.org # v5.12+ Fixes: 3a81fd02045c ("io_uring: enable LOOKUP_CACHED path resolution for filename lookups") Signed-off-by: Aleksa Sarai Link: https://lore.kernel.org/r/20230807-resolve_cached-o_tmpfile-v3-1-e49323e1ef6f@cyphar.com Signed-off-by: Jens Axboe commit e117e7adc637e364b599dc766f1d740698e7e027 Author: Jonathan McDowell Date: Fri Aug 4 17:08:40 2023 +0000 tpm/tpm_tis: Disable interrupts for Lenovo P620 devices The Lenovo ThinkStation P620 suffers from an irq storm issue like various other Lenovo machines, so add an entry for it to tpm_tis_dmi_table and force polling. It is worth noting that 481c2d14627d (tpm,tpm_tis: Disable interrupts after 1000 unhandled IRQs) does not seem to fix the problem on this machine, but setting 'tpm_tis.interrupts=0' on the kernel command line does. [jarkko@kernel.org: truncated the commit ID in the description to 12 characters] Cc: stable@vger.kernel.org # v6.4+ Fixes: e644b2f498d2 ("tpm, tpm_tis: Enable interrupt test") Signed-off-by: Jonathan McDowell Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 554b841d470338a3b1d6335b14ee1cd0c8f5d754 Author: Mario Limonciello Date: Wed Aug 2 07:25:33 2023 -0500 tpm: Disable RNG for all AMD fTPMs The TPM RNG functionality is not necessary for entropy when the CPU already supports the RDRAND instruction. The TPM RNG functionality was previously disabled on a subset of AMD fTPM series, but reports continue to show problems on some systems causing stutter root caused to TPM RNG functionality. Expand disabling TPM RNG use for all AMD fTPMs whether they have versions that claim to have fixed or not. To accomplish this, move the detection into part of the TPM CRB registration and add a flag indicating that the TPM should opt-out of registration to hwrng. Cc: stable@vger.kernel.org # 6.1.y+ Fixes: b006c439d58d ("hwrng: core - start hwrng kthread also for untrusted sources") Fixes: f1324bbc4011 ("tpm: disable hwrng for fTPM on some AMD designs") Reported-by: daniil.stas@posteo.net Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217719 Reported-by: bitlord0xff@gmail.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217212 Signed-off-by: Mario Limonciello Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 0de030b308236a1392f924f527cf74614d8b6aef Author: Tom Rix Date: Sun Jun 11 07:32:10 2023 -0400 sysctl: set variable key_sysctls storage-class-specifier to static smatch reports security/keys/sysctl.c:12:18: warning: symbol 'key_sysctls' was not declared. Should it be static? This variable is only used in its defining file, so it should be static. Signed-off-by: Tom Rix Signed-off-by: Jarkko Sakkinen commit 0b15afc9038146bb2009e7924b1ead2e919b2a56 Author: Takashi Iwai Date: Wed Jul 26 20:00:35 2023 +0200 tpm/tpm_tis: Disable interrupts for TUXEDO InfinityBook S 15/17 Gen7 TUXEDO InfinityBook S 15/17 Gen7 suffers from an IRQ problem on tpm_tis like a few other laptops. Add an entry for the workaround. Cc: stable@vger.kernel.org Fixes: e644b2f498d2 ("tpm, tpm_tis: Enable interrupt test") Link: https://bugzilla.suse.com/show_bug.cgi?id=1213645 Signed-off-by: Takashi Iwai Acked-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 5e720f8c8c9d959283c3908bbf32a91a01a86547 Author: Thomas Weißschuh Date: Mon Aug 7 08:37:45 2023 +0200 cpufreq: amd-pstate: fix global sysfs attribute type In commit 3666062b87ec ("cpufreq: amd-pstate: move to use bus_get_dev_root()") the "amd_pstate" attributes where moved from a dedicated kobject to the cpu root kobject. While the dedicated kobject expects to contain kobj_attributes the root kobject needs device_attributes. As the changed arguments are not used by the callbacks it works most of the time. However CFI will detect this issue: [ 4947.849350] CFI failure at dev_attr_show+0x24/0x60 (target: show_status+0x0/0x70; expected type: 0x8651b1de) ... [ 4947.849409] Call Trace: [ 4947.849410] [ 4947.849411] ? __warn+0xcf/0x1c0 [ 4947.849414] ? dev_attr_show+0x24/0x60 [ 4947.849415] ? report_cfi_failure+0x4e/0x60 [ 4947.849417] ? handle_cfi_failure+0x14c/0x1d0 [ 4947.849419] ? __cfi_show_status+0x10/0x10 [ 4947.849420] ? handle_bug+0x4f/0x90 [ 4947.849421] ? exc_invalid_op+0x1a/0x60 [ 4947.849422] ? asm_exc_invalid_op+0x1a/0x20 [ 4947.849424] ? __cfi_show_status+0x10/0x10 [ 4947.849425] ? dev_attr_show+0x24/0x60 [ 4947.849426] sysfs_kf_seq_show+0xa6/0x110 [ 4947.849433] seq_read_iter+0x16c/0x4b0 [ 4947.849436] vfs_read+0x272/0x2d0 [ 4947.849438] ksys_read+0x72/0xe0 [ 4947.849439] do_syscall_64+0x76/0xb0 [ 4947.849440] ? do_user_addr_fault+0x252/0x650 [ 4947.849442] ? exc_page_fault+0x7a/0x1b0 [ 4947.849443] entry_SYSCALL_64_after_hwframe+0x72/0xdc Fixes: 3666062b87ec ("cpufreq: amd-pstate: move to use bus_get_dev_root()") Reported-by: Jannik Glückert Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217765 Link: https://lore.kernel.org/lkml/c7f1bf9b-b183-bf6e-1cbb-d43f72494083@gmail.com/ Cc: All applicable Signed-off-by: Thomas Weißschuh Reviewed-by: Greg Kroah-Hartman Reviewed-by: Nathan Chancellor Signed-off-by: Rafael J. Wysocki commit a027b2eca0b7e90b11a0b0ddfad0dc4068707799 Merge: 016ce29713a0f d5ad9aae13dcc Author: Linus Torvalds Date: Mon Aug 7 10:18:20 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "x86: - Fix SEV race condition ARM: - Fixes for the configuration of SVE/SME traps when hVHE mode is in use - Allow use of pKVM on systems with FF-A implementations that are v1.0 compatible - Request/release percpu IRQs (arch timer, vGIC maintenance) correctly when pKVM is in use - Fix function prototype after __kvm_host_psci_cpu_entry() rename - Skip to the next instruction when emulating writes to TCR_EL1 on AmpereOne systems Selftests: - Fix missing include" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: selftests/rseq: Fix build with undefined __weak KVM: SEV: remove ghcb variable declarations KVM: SEV: only access GHCB fields once KVM: SEV: snapshot the GHCB before accessing it KVM: arm64: Skip instruction after emulating write to TCR_EL1 KVM: arm64: fix __kvm_host_psci_cpu_entry() prototype KVM: arm64: Fix resetting SME trap values on reset for (h)VHE KVM: arm64: Fix resetting SVE trap values on reset for hVHE KVM: arm64: Use the appropriate feature trap register when activating traps KVM: arm64: Helper to write to appropriate feature trap register based on mode KVM: arm64: Disable SME traps for (h)VHE at setup KVM: arm64: Use the appropriate feature trap register for SVE at EL2 setup KVM: arm64: Factor out code for checking (h)VHE mode into a macro KVM: arm64: Rephrase percpu enable/disable tracking in terms of hyp KVM: arm64: Fix hardware enable/disable flows for pKVM KVM: arm64: Allow pKVM on v1.0 compatible FF-A implementations commit 016ce29713a0f276ce73e6e8172b9968e62e9b09 Merge: 52a93d39b17dc 5def5c1c15bf2 Author: Linus Torvalds Date: Mon Aug 7 10:08:55 2023 -0700 Merge tag 'mmc-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - moxart: Fix big-endian conversion for SCR structure - sdhci-f-sdh30: Replace with sdhci_pltfm to fix PM support * tag 'mmc-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-f-sdh30: Replace with sdhci_pltfm mmc: moxart: read scr register without changing byte order commit 0be8432166a61abc537e1247e530f4b85970b56b Author: Bob Peterson Date: Wed Aug 2 09:24:12 2023 -0500 gfs2: Don't use filemap_splice_read Starting with patch 2cb1e08985, gfs2 started using the new function filemap_splice_read rather than the old (and subsequently deleted) function generic_file_splice_read. filemap_splice_read works by taking references to a number of folios in the page cache and splicing those folios into a pipe. The folios are then read from the pipe and the folio references are dropped. This can take an arbitrary amount of time. We cannot allow that in gfs2 because those folio references will pin the inode glock to the node and prevent it from being demoted, which can lead to cluster-wide deadlocks. Instead, use copy_splice_read. (In addition, the old generic_file_splice_read called into ->read_iter, which called gfs2_file_read_iter, which took the inode glock during the operation. The new filemap_splice_read interface does not take the inode glock anymore. This is fixable, but it still wouldn't prevent cluster-wide deadlocks.) Fixes: 2cb1e08985e3 ("splice: Use filemap_splice_read() instead of generic_file_splice_read()") Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher commit 2cbd80642b76480c9b0697297af917d9388a0b46 Author: Andreas Gruenbacher Date: Fri Aug 4 22:17:32 2023 +0200 gfs2: Fix freeze consistency check in gfs2_trans_add_meta Function gfs2_trans_add_meta() checks for the SDF_FROZEN flag to make sure that no buffers are added to a transaction while the filesystem is frozen. With the recent freeze/thaw rework, the SDF_FROZEN flag is cleared after thaw_super() is called, which is sufficient for serializing freeze/thaw. However, other filesystem operations started after thaw_super() may now be calling gfs2_trans_add_meta() before the SDF_FROZEN flag is cleared, which will trigger the SDF_FROZEN check in gfs2_trans_add_meta(). Fix that by checking the s_writers.frozen state instead. In addition, make sure not to call gfs2_assert_withdraw() with the sd_log_lock spin lock held. Check for a withdrawn filesystem before checking for a frozen filesystem, and don't pin/add buffers to the current transaction in case of a failure in either case. Signed-off-by: Andreas Gruenbacher Signed-off-by: Bob Peterson commit bee6cf1a80b54548a039e224c651bb15b644a480 Author: Borislav Petkov (AMD) Date: Sun Jul 16 20:22:20 2023 +0200 x86/sev: Do not try to parse for the CC blob on non-AMD hardware Tao Liu reported a boot hang on an Intel Atom machine due to an unmapped EFI config table. The reason being that the CC blob which contains the CPUID page for AMD SNP guests is parsed for before even checking whether the machine runs on AMD hardware. Usually that's not a problem on !AMD hw - it simply won't find the CC blob's GUID and return. However, if any parts of the config table pointers array is not mapped, the kernel will #PF very early in the decompressor stage without any opportunity to recover. Therefore, do a superficial CPUID check before poking for the CC blob. This will fix the current issue on real hardware. It would also work as a guest on a non-lying hypervisor. For the lying hypervisor, the check is done again, *after* parsing the CC blob as the real CPUID page will be present then. Clear the #VC handler in case SEV-{ES,SNP} hasn't been detected, as a precaution. Fixes: c01fce9cef84 ("x86/compressed: Add SEV-SNP feature detection/setup") Reported-by: Tao Liu Signed-off-by: Borislav Petkov (AMD) Acked-by: Tom Lendacky Tested-by: Tao Liu Cc: Link: https://lore.kernel.org/r/20230601072043.24439-1-ltao@redhat.com commit 7cdf55462c5533a1c78ae13ab8563558e30e4130 Author: Abel Vesa Date: Tue Aug 1 12:57:02 2023 +0300 regulator: qcom-rpmh: Fix LDO 12 regulator for PM8550 The LDO 12 is NLDO 515 low voltage type, so fix accordingly. Fixes: e6e3776d682d ("regulator: qcom-rpmh: Add support for PM8550 regulators") Signed-off-by: Abel Vesa Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20230801095702.2891127-1-abel.vesa@linaro.org Signed-off-by: Mark Brown commit c163108e706909570f8aa9aa5bcf6806e2b4c98c Author: Zhang Shurong Date: Tue Aug 1 23:59:11 2023 +0800 ASoC: rt5665: add missed regulator_bulk_disable The driver forgets to call regulator_bulk_disable() Add the missed call to fix it. Fixes: 33ada14a26c8 ("ASoC: add rt5665 codec driver") Signed-off-by: Zhang Shurong Link: https://lore.kernel.org/r/tencent_A560D01E3E0A00A85A12F137E4B5205B3508@qq.com Signed-off-by: Mark Brown commit df2f7cde73cb58c0e6a60f97d1cd6037138a45cd Author: Vlastimil Babka Date: Mon Aug 7 10:33:57 2023 +0200 PM: hibernate: fix resume_store() return value when hibernation not available On a laptop with hibernation set up but not actively used, and with secure boot and lockdown enabled kernel, 6.5-rc1 gets stuck on boot with the following repeated messages: A start job is running for Resume from hibernation using device /dev/system/swap (24s / no limit) lockdown_is_locked_down: 25311154 callbacks suppressed Lockdown: systemd-hiberna: hibernation is restricted; see man kernel_lockdown.7 ... Checking the resume code leads to commit cc89c63e2fe3 ("PM: hibernate: move finding the resume device out of software_resume") which inadvertently changed the return value from resume_store() to 0 when !hibernation_available(). This apparently translates to userspace write() returning 0 as in number of bytes written, and userspace looping indefinitely in the attempt to write the intended value. Fix this by returning the full number of bytes that were to be written, as that's what was done before the commit. Fixes: cc89c63e2fe3 ("PM: hibernate: move finding the resume device out of software_resume") Signed-off-by: Vlastimil Babka Reviewed-by: Christoph Hellwig Acked-by: Greg Kroah-Hartman Signed-off-by: Rafael J. Wysocki commit 5a15d8348881e9371afdf9f5357a135489496955 Author: Borislav Petkov (AMD) Date: Mon Aug 7 10:46:04 2023 +0200 x86/srso: Tie SBPB bit setting to microcode patch detection The SBPB bit in MSR_IA32_PRED_CMD is supported only after a microcode patch has been applied so set X86_FEATURE_SBPB only then. Otherwise, guests would attempt to set that bit and #GP on the MSR write. While at it, make SMT detection more robust as some guests - depending on how and what CPUID leafs their report - lead to cpu_smt_control getting set to CPU_SMT_NOT_SUPPORTED but SRSO_NO should be set for any guest incarnation where one simply cannot do SMT, for whatever reason. Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation") Reported-by: Konrad Rzeszutek Wilk Reported-by: Salvatore Bonaccorso Signed-off-by: Borislav Petkov (AMD) commit 52a93d39b17dc7eb98b6aa3edb93943248e03b2f Author: Linus Torvalds Date: Sun Aug 6 15:07:51 2023 -0700 Linux 6.5-rc5 commit 422dbc66b7702ae797326d5480c3c9b6467053da Author: Miquel Raynal Date: Mon Jul 31 12:14:40 2023 +0200 dmaengine: xilinx: xdma: Fix typo Probably a copy/paste error with the previous block, here we are actually managing C2H IRQs. Fixes: 17ce252266c7 ("dmaengine: xilinx: xdma: Add xilinx xdma driver") Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20230731101442.792514-3-miquel.raynal@bootlin.com Signed-off-by: Vinod Koul commit 96891e90d1256b569b1c183e7c9a0cfc568fa3b0 Author: Miquel Raynal Date: Mon Jul 31 12:14:39 2023 +0200 dmaengine: xilinx: xdma: Fix interrupt vector setting A couple of hardware registers need to be set to reflect which interrupts have been allocated to the device. Each register is 32-bit wide and can receive four 8-bit values. If we provide any other interrupt number than four, the irq_num variable will never be 0 within the while check and the while block will loop forever. There is an easy way to prevent this: just break the for loop when we reach "irq_num == 0", which anyway means all interrupts have been processed. Cc: stable@vger.kernel.org Fixes: 17ce252266c7 ("dmaengine: xilinx: xdma: Add xilinx xdma driver") Signed-off-by: Miquel Raynal Acked-by: Lizhi Hou Link: https://lore.kernel.org/r/20230731101442.792514-2-miquel.raynal@bootlin.com Signed-off-by: Vinod Koul commit 74d7221c1f9c9f3a8c316a3557ca7dca8b99d14c Author: Zhang Jianhua Date: Sat Jul 22 15:32:44 2023 +0000 dmaengine: owl-dma: Modify mismatched function name No functional modification involved. drivers/dma/owl-dma.c:208: warning: expecting prototype for struct owl_dma_pchan. Prototype was for struct owl_dma_vchan instead HDRTEST usr/include/sound/asequencer.h Fixes: 47e20577c24d ("dmaengine: Add Actions Semi Owl family S900 DMA driver") Signed-off-by: Zhang Jianhua Reviewed-by: Randy Dunlap Link: https://lore.kernel.org/r/20230722153244.2086949-1-chris.zjh@huawei.com Signed-off-by: Vinod Koul commit 863676fe1ac1b82fc9eb56c242e80acfbfc18b76 Author: Fenghua Yu Date: Wed Jul 12 12:35:05 2023 -0700 dmaengine: idxd: Clear PRS disable flag when disabling IDXD device Disabling IDXD device doesn't reset Page Request Service (PRS) disable flag to its initial value 0. This may cause user confusion because once PRS is disabled user will see PRS still remains the previous setting (i.e. disabled) via sysfs interface even after the device is disabled. To eliminate user confusion, reset PRS disable flag to ensure that the PRS flag bit reflects correct state after the device is disabled. Additionally, simplify the code by setting wq->flags to 0, which clears all flag bits, including any future additions. Fixes: f2dc327131b5 ("dmaengine: idxd: add per wq PRS disable") Tested-by: Tony Zhu Signed-off-by: Fenghua Yu Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20230712193505.3440752-1-fenghua.yu@intel.com Signed-off-by: Vinod Koul commit 8cda3ececf07d374774f6a13e5a94bc2dc04c26c Author: Ilpo Järvinen Date: Fri May 26 13:54:34 2023 +0300 dmaengine: pl330: Return DMA_PAUSED when transaction is paused pl330_pause() does not set anything to indicate paused condition which causes pl330_tx_status() to return DMA_IN_PROGRESS. This breaks 8250 DMA flush after the fix in commit 57e9af7831dc ("serial: 8250_dma: Fix DMA Rx rearm race"). The function comment for pl330_pause() claims pause is supported but resume is not which is enough for 8250 DMA flush to work as long as DMA status reports DMA_PAUSED when appropriate. Add PAUSED state for descriptor and mark BUSY descriptors with PAUSED in pl330_pause(). Return DMA_PAUSED from pl330_tx_status() when the descriptor is PAUSED. Reported-by: Richard Tresidder Tested-by: Richard Tresidder Fixes: 88987d2c7534 ("dmaengine: pl330: add DMA_PAUSE feature") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-serial/f8a86ecd-64b1-573f-c2fa-59f541083f1a@electromag.com.au/ Signed-off-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20230526105434.14959-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Vinod Koul commit e2dcbc330f46afb82fd49a6dcbb10f6cdcb466ec Author: Jeffrey Hugo Date: Fri Jul 7 13:50:03 2023 -0600 dmaengine: qcom_hidma: Update codeaurora email domain The codeaurora.org email domain is defunct and will bounce. Update entries to Sinan's kernel.org address which is the address in MAINTAINERS for this component. Signed-off-by: Jeffrey Hugo Acked-By: Sinan Kaya Link: https://lore.kernel.org/r/20230707195003.6619-1-quic_jhugo@quicinc.com Signed-off-by: Vinod Koul commit 0a46781c89dece85386885a407244ca26e5c1c44 Author: Christophe JAILLET Date: Wed Jul 12 18:26:45 2023 +0530 dmaengine: mcf-edma: Fix a potential un-allocated memory access When 'mcf_edma' is allocated, some space is allocated for a flexible array at the end of the struct. 'chans' item are allocated, that is to say 'pdata->dma_channels'. Then, this number of item is stored in 'mcf_edma->n_chans'. A few lines later, if 'mcf_edma->n_chans' is 0, then a default value of 64 is set. This ends to no space allocated by devm_kzalloc() because chans was 0, but 64 items are read and/or written in some not allocated memory. Change the logic to define a default value before allocating the memory. Fixes: e7a3ff92eaf1 ("dmaengine: fsl-edma: add ColdFire mcf5441x edma support") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/f55d914407c900828f6fad3ea5fa791a5f17b9a4.1685172449.git.christophe.jaillet@wanadoo.fr Signed-off-by: Vinod Koul commit 0108963f14e96abcfae0c4d1186c237cfb1a7fad Merge: f0ab9f34e59e0 7d84d1b9af636 Author: Linus Torvalds Date: Sun Aug 6 10:43:52 2023 -0700 Merge tag 'v6.5-rc5.vfs.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix a wrong check for O_TMPFILE during RESOLVE_CACHED lookup - Clean up directory iterators and clarify file_needs_f_pos_lock() * tag 'v6.5-rc5.vfs.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: rely on ->iterate_shared to determine f_pos locking vfs: get rid of old '->iterate' directory operation proc: fix missing conversion to 'iterate_shared' open: make RESOLVE_CACHED correctly test for O_TMPFILE commit 52417a95ff2d810dc31a68ae71102e741efea772 Author: Nitya Sunkad Date: Fri Aug 4 13:56:22 2023 -0700 ionic: Add missing err handling for queue reconfig ionic_start_queues_reconfig returns an error code if txrx_init fails. Handle this error code in the relevant places. This fixes a corner case where the device could get left in a detached state if the CMB reconfig fails and the attempt to clean up the mess also fails. Note that calling netif_device_attach when the netdev is already attached does not lead to unexpected behavior. Change goto name "errout" to "err_out" to maintain consistency across goto statements. Fixes: 40bc471dc714 ("ionic: add tx/rx-push support with device Component Memory Buffers") Fixes: 6f7d6f0fd7a3 ("ionic: pull reset_queues into tx_timeout handler") Signed-off-by: Nitya Sunkad Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit b1c936e9af5dd08636d568736fc6075ed9d1d529 Author: Fedor Pchelkin Date: Fri Aug 4 18:53:36 2023 +0300 drivers: vxlan: vnifilter: free percpu vni stats on error path In case rhashtable_lookup_insert_fast() fails inside vxlan_vni_add(), the allocated percpu vni stats are not freed on the error path. Introduce vxlan_vni_free() which would work as a nice wrapper to free vxlan_vni_node resources properly. Found by Linux Verification Center (linuxtesting.org). Fixes: 4095e0e1328a ("drivers: vxlan: vnifilter: per vni stats") Suggested-by: Ido Schimmel Signed-off-by: Fedor Pchelkin Signed-off-by: David S. Miller commit f38963b9cd0645a336cf30c5da2e89e34e34fec3 Author: Tao Ren Date: Fri Aug 4 15:14:03 2023 -0700 hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100 Skip status check for both pfe1100 and pfe3000 because the communication error is also observed on pfe1100 devices. Signed-off-by: Tao Ren Fixes: 626bb2f3fb3c hwmon: (pmbus) add driver for BEL PFE1100 and PFE3000 Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230804221403.28931-1-rentao.bupt@gmail.com Signed-off-by: Guenter Roeck commit 7d84d1b9af6366aa9df1b523bdb7e002372e38d0 Author: Christian Brauner Date: Sun Aug 6 14:49:35 2023 +0200 fs: rely on ->iterate_shared to determine f_pos locking Now that we removed ->iterate we don't need to check for either ->iterate or ->iterate_shared in file_needs_f_pos_lock(). Simply check for ->iterate_shared instead. This will tell us whether we need to unconditionally take the lock. Not just does it allow us to avoid checking f_inode's mode it also actually clearly shows that we're locking because of readdir. Signed-off-by: Christian Brauner commit 3e3271549670783be20e233a2b78a87a0b04c715 Author: Linus Torvalds Date: Sat Aug 5 12:25:01 2023 -0700 vfs: get rid of old '->iterate' directory operation All users now just use '->iterate_shared()', which only takes the directory inode lock for reading. Filesystems that never got convered to shared mode now instead use a wrapper that drops the lock, re-takes it in write mode, calls the old function, and then downgrades the lock back to read mode. This way the VFS layer and other callers no longer need to care about filesystems that never got converted to the modern era. The filesystems that use the new wrapper are ceph, coda, exfat, jfs, ntfs, ocfs2, overlayfs, and vboxsf. Honestly, several of them look like they really could just iterate their directories in shared mode and skip the wrapper entirely, but the point of this change is to not change semantics or fix filesystems that haven't been fixed in the last 7+ years, but to finally get rid of the dual iterators. Signed-off-by: Linus Torvalds Signed-off-by: Christian Brauner commit 0a2c2baafa312ac4cec4f0bababedab3f971f224 Author: Linus Torvalds Date: Sat Aug 5 10:49:31 2023 -0700 proc: fix missing conversion to 'iterate_shared' I'm looking at the directory handling due to the discussion about f_pos locking (see commit 797964253d35: "file: reinstate f_pos locking optimization for regular files"), and wanting to clean that up. And one source of ugliness is how we were supposed to move filesystems over to the '->iterate_shared()' function that only takes the inode lock for reading many many years ago, but several filesystems still use the bad old '->iterate()' that takes the inode lock for exclusive access. See commit 6192269444eb ("introduce a parallel variant of ->iterate()") that also added some documentation stating Old method is only used if the new one is absent; eventually it will be removed. Switch while you still can; the old one won't stay. and that was back in April 2016. Here we are, many years later, and the old version is still clearly sadly alive and well. Now, some of those old style iterators are probably just because the filesystem may end up having per-inode mutable data that it uses for iterating a directory, but at least one case is just a mistake. Al switched over most filesystems to use '->iterate_shared()' back when it was introduced. In particular, the /proc filesystem was converted as one of the first ones in commit f50752eaa0b0 ("switch all procfs directories ->iterate_shared()"). But then later one new user of '->iterate()' was then re-introduced by commit 6d9c939dbe4d ("procfs: add smack subdir to attrs"). And that's clearly not what we wanted, since that new case just uses the same 'proc_pident_readdir()' and 'proc_pident_lookup()' helper functions that other /proc pident directories use, and they are most definitely safe to use with the inode lock held shared. So just fix it. This still leaves a fair number of oddball filesystems using the old-style directory iterator (ceph, coda, exfat, jfs, ntfs, ocfs2, overlayfs, and vboxsf), but at least we don't have any remaining in the core filesystems. I'm going to add a wrapper function that just drops the read-lock and takes it as a write lock, so that we can clean up the core vfs layer and make all the ugly 'this filesystem needs exclusive inode locking' be just filesystem-internal warts. I just didn't want to make that conversion when we still had a core user left. Signed-off-by: Linus Torvalds Signed-off-by: Christian Brauner commit a0fc452a5d7fed986205539259df1d60546f536c Author: Aleksa Sarai Date: Sun Aug 6 02:11:58 2023 +1000 open: make RESOLVE_CACHED correctly test for O_TMPFILE O_TMPFILE is actually __O_TMPFILE|O_DIRECTORY. This means that the old fast-path check for RESOLVE_CACHED would reject all users passing O_DIRECTORY with -EAGAIN, when in fact the intended test was to check for __O_TMPFILE. Cc: stable@vger.kernel.org # v5.12+ Fixes: 99668f618062 ("fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED") Signed-off-by: Aleksa Sarai Message-Id: <20230806-resolve_cached-o_tmpfile-v1-1-7ba16308465e@cyphar.com> Signed-off-by: Christian Brauner commit 32d0a49d36a2a306c2e47fe5659361e424f0ed3f Author: Eric Dumazet Date: Fri Aug 4 17:26:52 2023 +0000 macsec: use DEV_STATS_INC() syzbot/KCSAN reported data-races in macsec whenever dev->stats fields are updated. It appears all of these updates can happen from multiple cpus. Adopt SMP safe DEV_STATS_INC() to update dev->stats fields. Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Sabrina Dubroca Signed-off-by: David S. Miller commit 6b47808f223c70ff564f9b363446d2a5fa1e05b2 Author: Jakub Kicinski Date: Fri Aug 4 15:59:51 2023 -0700 net: tls: avoid discarding data on record close TLS records end with a 16B tag. For TLS device offload we only need to make space for this tag in the stream, the device will generate and replace it with the actual calculated tag. Long time ago the code would just re-reference the head frag which mostly worked but was suboptimal because it prevented TCP from combining the record into a single skb frag. I'm not sure if it was correct as the first frag may be shorter than the tag. The commit under fixes tried to replace that with using the page frag and if the allocation failed rolling back the data, if record was long enough. It achieves better fragment coalescing but is also buggy. We don't roll back the iterator, so unless we're at the end of send we'll skip the data we designated as tag and start the next record as if the rollback never happened. There's also the possibility that the record was constructed with MSG_MORE and the data came from a different syscall and we already told the user space that we "got it". Allocate a single dummy page and use it as fallback. Found by code inspection, and proven by forcing allocation failures. Fixes: e7b159a48ba6 ("net/tls: remove the record tail optimization") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller commit 78e869dd8b2ba19765ac9b05cdea3e432d1dc188 Author: Alexander Stein Date: Fri Jul 28 10:34:35 2023 +0200 arm64: dts: imx93: Fix anatop node size Although the memory map of i.MX93 reference manual rev. 2 claims that analog top has start address of 0x44480000 and end address of 0x4448ffff, this overlaps with TMU memory area starting at 0x44482000, as stated in section 73.6.1. As PLL configuration registers start at addresses up to 0x44481400, as used by clk-imx93, reduce the anatop size to 0x2000, so exclude the TMU area but keep all PLL registers inside. Fixes: ec8b5b5058ea ("arm64: dts: freescale: Add i.MX93 dtsi support") Signed-off-by: Alexander Stein Reviewed-by: Peng Fan Reviewed-by: Jacky Bai Signed-off-by: Shawn Guo commit f0ab9f34e59e0c01a1c31142e0b336245367fd86 Merge: fb0d91991cedb b05544884300e Author: Linus Torvalds Date: Sat Aug 5 19:28:02 2023 -0700 Merge tag 'rust-fixes-6.5-rc5' of https://github.com/Rust-for-Linux/linux Pull rust fixes from Miguel Ojeda: - Allocator: prevent mis-aligned allocation - Types: delete 'ForeignOwnable::borrow_mut'. A sound replacement is planned for the merge window - Build: fix bindgen error with UBSAN_BOUNDS_STRICT * tag 'rust-fixes-6.5-rc5' of https://github.com/Rust-for-Linux/linux: rust: fix bindgen build error with UBSAN_BOUNDS_STRICT rust: delete `ForeignOwnable::borrow_mut` rust: allocator: Prevent mis-aligned allocation commit 79ed288cef201f1f212dfb934bcaac75572fb8f6 Author: Namjae Jeon Date: Sun Aug 6 08:44:17 2023 +0900 ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea() There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request from client. ksmbd find next smb2_ea_info using ->NextEntryOffset of current smb2_ea_info. ksmbd need to validate buffer length Before accessing the next ea. ksmbd should check buffer length using buf_len, not next variable. next is the start offset of current ea that got from previous ea. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21598 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 5aa4fda5aa9c2a5a7bac67b4a12b089ab81fee3c Author: Long Li Date: Sat Jul 29 11:36:18 2023 +0800 ksmbd: validate command request size In commit 2b9b8f3b68ed ("ksmbd: validate command payload size"), except for SMB2_OPLOCK_BREAK_HE command, the request size of other commands is not checked, it's not expected. Fix it by add check for request size of other commands. Cc: stable@vger.kernel.org Fixes: 2b9b8f3b68ed ("ksmbd: validate command payload size") Acked-by: Namjae Jeon Signed-off-by: Long Li Signed-off-by: Steve French commit fb0d91991cedb51bc604c6b3915df75d8a59a4a3 Merge: f6a6916859626 0a8589055936d Author: Linus Torvalds Date: Sat Aug 5 18:45:18 2023 -0700 Merge tag 'ata-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata fix from Damien Le Moal: - Prevent the scsi disk driver from issuing a START STOP UNIT command for ATA devices during system resume as this causes various issues reported by multiple users. * tag 'ata-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata,scsi: do not issue START STOP UNIT on resume commit 95848dcb9d676738411a8ff70a9704039f1b3982 Author: Christoph Hellwig Date: Sat Aug 5 07:55:37 2023 +0200 zram: take device and not only bvec offset into account Commit af8b04c63708 ("zram: simplify bvec iteration in __zram_make_request") changed the bio iteration in zram to rely on the implicit capping to page boundaries in bio_for_each_segment. But it failed to care for the fact zram not only care about the page alignment of the bio payload, but also the page alignment into the device. For buffered I/O and swap those are the same, but for direct I/O or kernel internal I/O like XFS log buffer writes they can differ. Fix this by open coding bio_for_each_segment and limiting the bvec len so that it never crosses over a page alignment boundary in the device in addition to the payload boundary already taken care of by bio_iter_iovec. Cc: stable@vger.kernel.org Fixes: af8b04c63708 ("zram: simplify bvec iteration in __zram_make_request") Reported-by: Dusty Mabe Signed-off-by: Christoph Hellwig Acked-by: Sergey Senozhatsky Link: https://lore.kernel.org/r/20230805055537.147835-1-hch@lst.de Signed-off-by: Jens Axboe commit f6a691685962637e53371788fe2a72b171aedc68 Merge: 251a94f1f66e9 11260c3d608b5 Author: Linus Torvalds Date: Sat Aug 5 13:44:06 2023 -0700 Merge tag '6.5-rc4-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fix from Steve French: - Fix DFS interlink problem (different namespace) * tag '6.5-rc4-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix dfs link mount against w2k8 commit 251a94f1f66e909d75a774ac474a63bd9bc38382 Merge: 947c2a83584d3 86582e6189dd8 Author: Linus Torvalds Date: Sat Aug 5 13:16:17 2023 -0700 Merge tag 'powerpc-6.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix vmemmap altmap boundary check which could cause memory hotunplug failure - Create a dummy stackframe to fix ftrace stack unwind - Fix secondary thread bringup for Book3E ELFv2 kernels - Use early_ioremap/unmap() in via_calibrate_decr() Thanks to Aneesh Kumar K.V, Benjamin Gray, Christophe Leroy, David Hildenbrand, and Naveen N Rao. * tag 'powerpc-6.5-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/powermac: Use early_* IO variants in via_calibrate_decr() powerpc/64e: Fix secondary thread bringup for ELFv2 kernels powerpc/ftrace: Create a dummy stackframe to fix stack unwind powerpc/mm/altmap: Fix altmap boundary check commit 947c2a83584d3093efea1edf52430db47f11080f Merge: c9d26d8de10f7 99b2f159b6e76 Author: Linus Torvalds Date: Sat Aug 5 13:09:05 2023 -0700 Merge tag 'parisc-for-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc architecture fixes from Helge Deller: - early fixmap preallocation to fix boot failures on kernel >= 6.4 - remove DMA leftover code in parport_gsc - drop old comments and code style fixes * tag 'parisc-for-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: unaligned: Add required spaces after ',' parport: gsc: remove DMA leftover code parisc: pci-dma: remove unused and dead EISA code and comment parisc/mm: preallocate fixmap page tables at init commit 51a26bb02ae58c7db6b4156d7e1e39cd79008757 Merge: 77107b08f0f29 3cb11fe244d51 Author: Greg Kroah-Hartman Date: Sat Aug 5 08:35:14 2023 +0200 Merge tag 'icc-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-linus Georgi writes: interconnect fixes for v6.5-rc This contains a fix for a potential issue on some Qualcomm SoCs where bit-masks should have been used to configure the Bus Clock Manager hardware, instead of bandwidth units. - interconnect: qcom: Add support for mask-based BCMs - interconnect: qcom: sm8450: add enable_mask for bcm nodes - interconnect: qcom: sm8550: add enable_mask for bcm nodes - interconnect: qcom: sa8775p: add enable_mask for bcm nodes Signed-off-by: Georgi Djakov * tag 'icc-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc: interconnect: qcom: sa8775p: add enable_mask for bcm nodes interconnect: qcom: sm8550: add enable_mask for bcm nodes interconnect: qcom: sm8450: add enable_mask for bcm nodes interconnect: qcom: Add support for mask-based BCMs commit d25ddb7e788d34cf27ff1738d11a87cb4b67d446 Author: Remi Pommarel Date: Fri Aug 4 11:39:36 2023 +0200 batman-adv: Fix TT global entry leak when client roamed back When a client roamed back to a node before it got time to destroy the pending local entry (i.e. within the same originator interval) the old global one is directly removed from hash table and left as such. But because this entry had an extra reference taken at lookup (i.e using batadv_tt_global_hash_find) there is no way its memory will be reclaimed at any time causing the following memory leak: unreferenced object 0xffff0000073c8000 (size 18560): comm "softirq", pid 0, jiffies 4294907738 (age 228.644s) hex dump (first 32 bytes): 06 31 ac 12 c7 7a 05 00 01 00 00 00 00 00 00 00 .1...z.......... 2c ad be 08 00 80 ff ff 6c b6 be 08 00 80 ff ff ,.......l....... backtrace: [<00000000ee6e0ffa>] kmem_cache_alloc+0x1b4/0x300 [<000000000ff2fdbc>] batadv_tt_global_add+0x700/0xe20 [<00000000443897c7>] _batadv_tt_update_changes+0x21c/0x790 [<000000005dd90463>] batadv_tt_update_changes+0x3c/0x110 [<00000000a2d7fc57>] batadv_tt_tvlv_unicast_handler_v1+0xafc/0xe10 [<0000000011793f2a>] batadv_tvlv_containers_process+0x168/0x2b0 [<00000000b7cbe2ef>] batadv_recv_unicast_tvlv+0xec/0x1f4 [<0000000042aef1d8>] batadv_batman_skb_recv+0x25c/0x3a0 [<00000000bbd8b0a2>] __netif_receive_skb_core.isra.0+0x7a8/0xe90 [<000000004033d428>] __netif_receive_skb_one_core+0x64/0x74 [<000000000f39a009>] __netif_receive_skb+0x48/0xe0 [<00000000f2cd8888>] process_backlog+0x174/0x344 [<00000000507d6564>] __napi_poll+0x58/0x1f4 [<00000000b64ef9eb>] net_rx_action+0x504/0x590 [<00000000056fa5e4>] _stext+0x1b8/0x418 [<00000000878879d6>] run_ksoftirqd+0x74/0xa4 unreferenced object 0xffff00000bae1a80 (size 56): comm "softirq", pid 0, jiffies 4294910888 (age 216.092s) hex dump (first 32 bytes): 00 78 b1 0b 00 00 ff ff 0d 50 00 00 00 00 00 00 .x.......P...... 00 00 00 00 00 00 00 00 50 c8 3c 07 00 00 ff ff ........P.<..... backtrace: [<00000000ee6e0ffa>] kmem_cache_alloc+0x1b4/0x300 [<00000000d9aaa49e>] batadv_tt_global_add+0x53c/0xe20 [<00000000443897c7>] _batadv_tt_update_changes+0x21c/0x790 [<000000005dd90463>] batadv_tt_update_changes+0x3c/0x110 [<00000000a2d7fc57>] batadv_tt_tvlv_unicast_handler_v1+0xafc/0xe10 [<0000000011793f2a>] batadv_tvlv_containers_process+0x168/0x2b0 [<00000000b7cbe2ef>] batadv_recv_unicast_tvlv+0xec/0x1f4 [<0000000042aef1d8>] batadv_batman_skb_recv+0x25c/0x3a0 [<00000000bbd8b0a2>] __netif_receive_skb_core.isra.0+0x7a8/0xe90 [<000000004033d428>] __netif_receive_skb_one_core+0x64/0x74 [<000000000f39a009>] __netif_receive_skb+0x48/0xe0 [<00000000f2cd8888>] process_backlog+0x174/0x344 [<00000000507d6564>] __napi_poll+0x58/0x1f4 [<00000000b64ef9eb>] net_rx_action+0x504/0x590 [<00000000056fa5e4>] _stext+0x1b8/0x418 [<00000000878879d6>] run_ksoftirqd+0x74/0xa4 Releasing the extra reference from batadv_tt_global_hash_find even at roam back when batadv_tt_global_free is called fixes this memory leak. Cc: stable@vger.kernel.org Fixes: 068ee6e204e1 ("batman-adv: roaming handling mechanism redesign") Signed-off-by: Remi Pommarel Signed-off-by; Sven Eckelmann Signed-off-by: Simon Wunderlich commit c9d26d8de10f7c4decd10b6e75f5593c11ff9dfc Merge: 024ff300db339 ae9b14582ad03 Author: Linus Torvalds Date: Fri Aug 4 19:35:09 2023 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A few clk driver fixes for some SoC clk drivers: - Change a usleep() to udelay() to avoid scheduling while atomic in the Amlogic PLL code - Revert a patch to the Mediatek MT8183 driver that caused an out-of-bounds write - Return the right error value when devm_of_iomap() fails in imx93_clocks_probe() - Constrain the Kconfig for the fixed mmio clk so that it depends on HAS_IOMEM and can't be compiled on architectures such as s390" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM clk: imx93: Propagate correct error in imx93_clocks_probe() clk: mediatek: mt8183: Add back SSPM related clocks clk: meson: change usleep_range() to udelay() for atomic context commit a47e598fbd8617967e49d85c49c22f9fc642704c Author: Eric Dumazet Date: Thu Aug 3 16:30:21 2023 +0000 dccp: fix data-race around dp->dccps_mss_cache dccp_sendmsg() reads dp->dccps_mss_cache before locking the socket. Same thing in do_dccp_getsockopt(). Add READ_ONCE()/WRITE_ONCE() annotations, and change dccp_sendmsg() to check again dccps_mss_cache after socket is locked. Fixes: 7c657876b63c ("[DCCP]: Initial implementation") Reported-by: syzbot Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230803163021.2958262-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit fc2ea6ab0a73b58328c61237017e28ba49b3a21e Merge: ec935188399d8 511b90e392501 Author: Jakub Kicinski Date: Fri Aug 4 18:26:29 2023 -0700 Merge branch 'mptcp-more-fixes-for-v6-5' Matthieu Baerts says: ==================== mptcp: more fixes for v6.5 Here is a new batch of fixes related to MPTCP for v6.5 and older. Patches 1 and 2 fix issues with MPTCP Join selftest when manually launched with '-i' parameter to use 'ip mptcp' tool instead of the dedicated one (pm_nl_ctl). The issues have been there since v5.18. Thank you Andrea for your first contributions to MPTCP code in the upstream kernel! Patch 3 avoids corrupting the data stream when trying to reset connections that have fallen back to TCP. This can happen from v6.1. Patch 4 fixes a race when doing a disconnect() and an accept() in parallel on a listener socket. The issue only happens in rare cases if the user is really unlucky since a fix that landed in v6.3 but backported up to v6.1. ==================== Link: https://lore.kernel.org/r/20230803-upstream-net-20230803-misc-fixes-6-5-v1-0-6671b1ab11cc@tessares.net Signed-off-by: Jakub Kicinski commit 511b90e39250135a7f900f1c3afbce25543018a2 Author: Paolo Abeni Date: Thu Aug 3 18:27:30 2023 +0200 mptcp: fix disconnect vs accept race Despite commit 0ad529d9fd2b ("mptcp: fix possible divide by zero in recvmsg()"), the mptcp protocol is still prone to a race between disconnect() (or shutdown) and accept. The root cause is that the mentioned commit checks the msk-level flag, but mptcp_stream_accept() does acquire the msk-level lock, as it can rely directly on the first subflow lock. As reported by Christoph than can lead to a race where an msk socket is accepted after that mptcp_subflow_queue_clean() releases the listener socket lock and just before it takes destructive actions leading to the following splat: BUG: kernel NULL pointer dereference, address: 0000000000000012 PGD 5a4ca067 P4D 5a4ca067 PUD 37d4c067 PMD 0 Oops: 0000 [#1] PREEMPT SMP CPU: 2 PID: 10955 Comm: syz-executor.5 Not tainted 6.5.0-rc1-gdc7b257ee5dd #37 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:mptcp_stream_accept+0x1ee/0x2f0 include/net/inet_sock.h:330 Code: 0a 09 00 48 8b 1b 4c 39 e3 74 07 e8 bc 7c 7f fe eb a1 e8 b5 7c 7f fe 4c 8b 6c 24 08 eb 05 e8 a9 7c 7f fe 49 8b 85 d8 09 00 00 <0f> b6 40 12 88 44 24 07 0f b6 6c 24 07 bf 07 00 00 00 89 ee e8 89 RSP: 0018:ffffc90000d07dc0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff888037e8d020 RCX: ffff88803b093300 RDX: 0000000000000000 RSI: ffffffff833822c5 RDI: ffffffff8333896a RBP: 0000607f82031520 R08: ffff88803b093300 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000003e83 R12: ffff888037e8d020 R13: ffff888037e8c680 R14: ffff888009af7900 R15: ffff888009af6880 FS: 00007fc26d708640(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000012 CR3: 0000000066bc5001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: do_accept+0x1ae/0x260 net/socket.c:1872 __sys_accept4+0x9b/0x110 net/socket.c:1913 __do_sys_accept4 net/socket.c:1954 [inline] __se_sys_accept4 net/socket.c:1951 [inline] __x64_sys_accept4+0x20/0x30 net/socket.c:1951 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x47/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Address the issue by temporary removing the pending request socket from the accept queue, so that racing accept() can't touch them. After depleting the msk - the ssk still exists, as plain TCP sockets, re-insert them into the accept queue, so that later inet_csk_listen_stop() will complete the tcp socket disposal. Fixes: 2a6a870e44dd ("mptcp: stops worker on unaccepted sockets at listener close") Cc: stable@vger.kernel.org Reported-by: Christoph Paasch Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/423 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Link: https://lore.kernel.org/r/20230803-upstream-net-20230803-misc-fixes-6-5-v1-4-6671b1ab11cc@tessares.net Signed-off-by: Jakub Kicinski commit ff18f9ef30ee87740f741b964375d0cfb84e1ec2 Author: Paolo Abeni Date: Thu Aug 3 18:27:29 2023 +0200 mptcp: avoid bogus reset on fallback close Since the blamed commit, the MPTCP protocol unconditionally sends TCP resets on all the subflows on disconnect(). That fits full-blown MPTCP sockets - to implement the fastclose mechanism - but causes unexpected corruption of the data stream, caught as sporadic self-tests failures. Fixes: d21f83485518 ("mptcp: use fastclose on more edge scenarios") Cc: stable@vger.kernel.org Tested-by: Matthieu Baerts Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/419 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Link: https://lore.kernel.org/r/20230803-upstream-net-20230803-misc-fixes-6-5-v1-3-6671b1ab11cc@tessares.net Signed-off-by: Jakub Kicinski commit c8c101ae390a3e817369e94a6f12a1ddea420702 Author: Andrea Claudi Date: Thu Aug 3 18:27:28 2023 +0200 selftests: mptcp: join: fix 'implicit EP' test mptcp_join 'implicit EP' test currently fails when using ip mptcp: $ ./mptcp_join.sh -iI 001 implicit EP creation[fail] expected '10.0.2.2 10.0.2.2 id 1 implicit' found '10.0.2.2 id 1 rawflags 10 ' Error: too many addresses or duplicate one: -22. ID change is prevented[fail] expected '10.0.2.2 10.0.2.2 id 1 implicit' found '10.0.2.2 id 1 rawflags 10 ' modif is allowed[fail] expected '10.0.2.2 10.0.2.2 id 1 signal' found '10.0.2.2 id 1 signal ' This happens because of two reasons: - iproute v6.3.0 does not support the implicit flag, fixed with iproute2-next commit 3a2535a41854 ("mptcp: add support for implicit flag") - pm_nl_check_endpoint wrongly expects the ip address to be repeated two times in iproute output, and does not account for a final whitespace in it. This fixes the issue trimming the whitespace in the output string and removing the double address in the expected string. Fixes: 69c6ce7b6eca ("selftests: mptcp: add implicit endpoint test case") Cc: stable@vger.kernel.org Signed-off-by: Andrea Claudi Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Link: https://lore.kernel.org/r/20230803-upstream-net-20230803-misc-fixes-6-5-v1-2-6671b1ab11cc@tessares.net Signed-off-by: Jakub Kicinski commit aaf2123a5cf46dbd97f84b6eee80269758064d93 Author: Andrea Claudi Date: Thu Aug 3 18:27:27 2023 +0200 selftests: mptcp: join: fix 'delete and re-add' test mptcp_join 'delete and re-add' test fails when using ip mptcp: $ ./mptcp_join.sh -iI 002 delete and re-add before delete[ ok ] mptcp_info subflows=1 [ ok ] Error: argument "ADDRESS" is wrong: invalid for non-zero id address after delete[fail] got 2:2 subflows expected 1 This happens because endpoint delete includes an ip address while id is not 0, contrary to what is indicated in the ip mptcp man page: "When used with the delete id operation, an IFADDR is only included when the ID is 0." This fixes the issue using the $addr variable in pm_nl_del_endpoint() only when id is 0. Fixes: 34aa6e3bccd8 ("selftests: mptcp: add ip mptcp wrappers") Cc: stable@vger.kernel.org Signed-off-by: Andrea Claudi Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Link: https://lore.kernel.org/r/20230803-upstream-net-20230803-misc-fixes-6-5-v1-1-6671b1ab11cc@tessares.net Signed-off-by: Jakub Kicinski commit ec935188399d8f7f8618c7ec1c83eb6da8d3118f Merge: 8a98961777840 136a1b434bbb9 Author: Jakub Kicinski Date: Fri Aug 4 18:24:53 2023 -0700 Merge branch 'tunnels-fix-ipv4-pmtu-icmp-checksum' Florian Westphal says: ==================== tunnels: fix ipv4 pmtu icmp checksum The checksum of the generated ipv4 icmp pmtud message is only correct if the skb that causes the icmp error generation is linear. Fix this and add a selftest for this. ==================== Link: https://lore.kernel.org/r/20230803152653.29535-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 136a1b434bbb90c5e50831646ad0680c744c79bb Author: Florian Westphal Date: Thu Aug 3 17:26:50 2023 +0200 selftests: net: test vxlan pmtu exceptions with tcp TCP might get stuck if a nonlinear skb exceeds the path MTU, icmp error contains an incorrect icmp checksum in that case. Extend the existing test for vxlan to also send at least 1MB worth of data via TCP in addition to the existing 'large icmp packet adds route exception'. On my test VM this fails due to 0-size output file without "tunnels: fix kasan splat when generating ipv4 pmtu error". Signed-off-by: Florian Westphal Link: https://lore.kernel.org/r/20230803152653.29535-3-fw@strlen.de Signed-off-by: Jakub Kicinski commit 6a7ac3d20593865209dceb554d8b3f094c6bd940 Author: Florian Westphal Date: Thu Aug 3 17:26:49 2023 +0200 tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp error in response to a nonliner skb, we get BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220 Read of size 4 at addr ffff88811c50db00 by task iperf3/1691 CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309 [..] kasan_report+0x105/0x140 ip_compute_csum+0x134/0x220 iptunnel_pmtud_build_icmp+0x554/0x1020 skb_tunnel_check_pmtu+0x513/0xb80 vxlan_xmit_one+0x139e/0x2ef0 vxlan_xmit+0x1867/0x2760 dev_hard_start_xmit+0x1ee/0x4f0 br_dev_queue_push_xmit+0x4d1/0x660 [..] ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck. Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets") Signed-off-by: Florian Westphal Link: https://lore.kernel.org/r/20230803152653.29535-2-fw@strlen.de Signed-off-by: Jakub Kicinski commit 2746f13f6f1df7999001d6595b16f789ecc28ad1 Author: Biju Das Date: Tue Jul 25 18:51:40 2023 +0100 clk: Fix undefined reference to `clk_rate_exclusive_{get,put}' The COMMON_CLK config is not enabled in some of the architectures. This causes below build issues: pwm-rz-mtu3.c:(.text+0x114): undefined reference to `clk_rate_exclusive_put' pwm-rz-mtu3.c:(.text+0x32c): undefined reference to `clk_rate_exclusive_get' Fix these issues by moving clk_rate_exclusive_{get,put} inside COMMON_CLK code block, as clk.c is enabled by COMMON_CLK. Fixes: 55e9b8b7b806 ("clk: add clk_rate_exclusive api") Reported-by: kernel test robot Closes: https://lore.kernel.org/all/202307251752.vLfmmhYm-lkp@intel.com/ Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230725175140.361479-1-biju.das.jz@bp.renesas.com Signed-off-by: Stephen Boyd commit dd1df82ce27a05c7cf0bc5387978412e35fbdaaf Author: Francesco Dolcini Date: Sat Jul 29 00:26:39 2023 +0200 clk: keystone: syscon-clk: Fix audio refclk Audio REFCLK's are not working correctly, trying to use them lead to the following errors: [ 6.575277] of_clk_hw_onecell_get: invalid index 4294934528 [ 6.581515] wm8904 1-001a: Failed to get MCLK [ 6.586290] wm8904: probe of 1-001a failed with error -2 The issue is that Audio REFCLK has #clock-cells = 0 [1], while the driver is registering those clocks assuming they have one cells. Fix this by registering the clock with of_clk_hw_simple_get() when there is only one instance, e.g. "audio_refclk". [1] Documentation/devicetree/bindings/clock/ti,am62-audio-refclk.yaml Fixes: 6acab96ee337 ("clk: keystone: syscon-clk: Add support for audio refclk") Signed-off-by: Francesco Dolcini Link: https://lore.kernel.org/r/20230728222639.110409-1-francesco@dolcini.it [sboyd@kernel.org: Simplify if-return-else logic] Signed-off-by: Stephen Boyd commit 8a9896177784063d01068293caea3f74f6830ff6 Author: Eric Dumazet Date: Thu Aug 3 14:56:00 2023 +0000 net/packet: annotate data-races around tp->status Another syzbot report [1] is about tp->status lockless reads from __packet_get_status() [1] BUG: KCSAN: data-race in __packet_rcv_has_room / __packet_set_status write to 0xffff888117d7c080 of 8 bytes by interrupt on cpu 0: __packet_set_status+0x78/0xa0 net/packet/af_packet.c:407 tpacket_rcv+0x18bb/0x1a60 net/packet/af_packet.c:2483 deliver_skb net/core/dev.c:2173 [inline] __netif_receive_skb_core+0x408/0x1e80 net/core/dev.c:5337 __netif_receive_skb_one_core net/core/dev.c:5491 [inline] __netif_receive_skb+0x57/0x1b0 net/core/dev.c:5607 process_backlog+0x21f/0x380 net/core/dev.c:5935 __napi_poll+0x60/0x3b0 net/core/dev.c:6498 napi_poll net/core/dev.c:6565 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6698 __do_softirq+0xc1/0x265 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x57/0xa0 kernel/softirq.c:650 sysvec_apic_timer_interrupt+0x6d/0x80 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 smpboot_thread_fn+0x33c/0x4a0 kernel/smpboot.c:112 kthread+0x1d7/0x210 kernel/kthread.c:379 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 read to 0xffff888117d7c080 of 8 bytes by interrupt on cpu 1: __packet_get_status net/packet/af_packet.c:436 [inline] packet_lookup_frame net/packet/af_packet.c:524 [inline] __tpacket_has_room net/packet/af_packet.c:1255 [inline] __packet_rcv_has_room+0x3f9/0x450 net/packet/af_packet.c:1298 tpacket_rcv+0x275/0x1a60 net/packet/af_packet.c:2285 deliver_skb net/core/dev.c:2173 [inline] dev_queue_xmit_nit+0x38a/0x5e0 net/core/dev.c:2243 xmit_one net/core/dev.c:3574 [inline] dev_hard_start_xmit+0xcf/0x3f0 net/core/dev.c:3594 __dev_queue_xmit+0xefb/0x1d10 net/core/dev.c:4244 dev_queue_xmit include/linux/netdevice.h:3088 [inline] can_send+0x4eb/0x5d0 net/can/af_can.c:276 bcm_can_tx+0x314/0x410 net/can/bcm.c:302 bcm_tx_timeout_handler+0xdb/0x260 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x217/0x700 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0xd6/0x120 kernel/time/hrtimer.c:1766 __do_softirq+0xc1/0x265 kernel/softirq.c:571 run_ksoftirqd+0x17/0x20 kernel/softirq.c:939 smpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164 kthread+0x1d7/0x210 kernel/kthread.c:379 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 value changed: 0x0000000000000000 -> 0x0000000020000081 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 6.4.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Fixes: 69e3c75f4d54 ("net: TX_RING and packet mmap") Reported-by: syzbot Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Link: https://lore.kernel.org/r/20230803145600.2937518-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 024ff300db33968c133435a146d51ac22db27374 Merge: e661f98c82832 6ad0f2f91ad14 Author: Linus Torvalds Date: Fri Aug 4 17:16:14 2023 -0700 Merge tag 'hyperv-fixes-signed-20230804' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull hyperv fixes from Wei Liu: - Fix a bug in a python script for Hyper-V (Ani Sinha) - Workaround a bug in Hyper-V when IBT is enabled (Michael Kelley) - Fix an issue parsing MP table when Linux runs in VTL2 (Saurabh Sengar) - Several cleanup patches (Nischala Yelchuri, Kameron Carr, YueHaibing, ZhiHu) * tag 'hyperv-fixes-signed-20230804' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: Drivers: hv: vmbus: Remove unused extern declaration vmbus_ontimer() x86/hyperv: add noop functions to x86_init mpparse functions vmbus_testing: fix wrong python syntax for integer value comparison x86/hyperv: fix a warning in mshyperv.h x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction x86/hyperv: Improve code for referencing hyperv_pcpu_input_arg Drivers: hv: Change hv_free_hyperv_page() to take void * argument commit e661f98c82832ddb76423f57dffb4ba6256e0fc6 Merge: ea4f142ffa876 640c503d7dbd7 Author: Linus Torvalds Date: Fri Aug 4 16:04:37 2023 -0700 Merge tag 'riscv-for-linus-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - A pair of fixes for build-related failures in the selftests - A fix for a sparse warning in acpi_os_ioremap() - A fix to restore the kernel PA offset in vmcoreinfo, to fix crash handling * tag 'riscv-for-linus-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: Documentation: kdump: Add va_kernel_pa_offset for RISCV64 riscv: Export va_kernel_pa_offset in vmcoreinfo RISC-V: ACPI: Fix acpi_os_ioremap to return iomem address selftests: riscv: Fix compilation error with vstate_exec_nolibc.c selftests/riscv: fix potential build failure during the "emit_tests" step commit ea4f142ffa876ee4e7e99bbd8d666e0e81cbcc2c Merge: e6fda526d9db2 16e95a62eed18 Author: Linus Torvalds Date: Fri Aug 4 15:54:03 2023 -0700 Merge tag 'pm-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Fix a sparse warning triggered by the TPMI interface recently added to the Intel RAPL power capping driver (Zhang Rui)" * tag 'pm-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: powercap: intel_rapl: Fix a sparse warning in TPMI interface commit a94c16a2fda010866b8858a386a8bfbeba4f72c5 Author: Vladimir Oltean Date: Thu Aug 3 16:42:53 2023 +0300 net: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver remove When the tagging protocol in current use is "ocelot-8021q" and we unbind the driver, we see this splat: $ echo '0000:00:00.2' > /sys/bus/pci/drivers/fsl_enetc/unbind mscc_felix 0000:00:00.5 swp0: left promiscuous mode sja1105 spi2.0: Link is Down DSA: tree 1 torn down mscc_felix 0000:00:00.5 swp2: left promiscuous mode sja1105 spi2.2: Link is Down DSA: tree 3 torn down fsl_enetc 0000:00:00.2 eno2: left promiscuous mode mscc_felix 0000:00:00.5: Link is Down ------------[ cut here ]------------ RTNL: assertion failed at net/dsa/tag_8021q.c (409) WARNING: CPU: 1 PID: 329 at net/dsa/tag_8021q.c:409 dsa_tag_8021q_unregister+0x12c/0x1a0 Modules linked in: CPU: 1 PID: 329 Comm: bash Not tainted 6.5.0-rc3+ #771 pc : dsa_tag_8021q_unregister+0x12c/0x1a0 lr : dsa_tag_8021q_unregister+0x12c/0x1a0 Call trace: dsa_tag_8021q_unregister+0x12c/0x1a0 felix_tag_8021q_teardown+0x130/0x150 felix_teardown+0x3c/0xd8 dsa_tree_teardown_switches+0xbc/0xe0 dsa_unregister_switch+0x168/0x260 felix_pci_remove+0x30/0x60 pci_device_remove+0x4c/0x100 device_release_driver_internal+0x188/0x288 device_links_unbind_consumers+0xfc/0x138 device_release_driver_internal+0xe0/0x288 device_driver_detach+0x24/0x38 unbind_store+0xd8/0x108 drv_attr_store+0x30/0x50 ---[ end trace 0000000000000000 ]--- ------------[ cut here ]------------ RTNL: assertion failed at net/8021q/vlan_core.c (376) WARNING: CPU: 1 PID: 329 at net/8021q/vlan_core.c:376 vlan_vid_del+0x1b8/0x1f0 CPU: 1 PID: 329 Comm: bash Tainted: G W 6.5.0-rc3+ #771 pc : vlan_vid_del+0x1b8/0x1f0 lr : vlan_vid_del+0x1b8/0x1f0 dsa_tag_8021q_unregister+0x8c/0x1a0 felix_tag_8021q_teardown+0x130/0x150 felix_teardown+0x3c/0xd8 dsa_tree_teardown_switches+0xbc/0xe0 dsa_unregister_switch+0x168/0x260 felix_pci_remove+0x30/0x60 pci_device_remove+0x4c/0x100 device_release_driver_internal+0x188/0x288 device_links_unbind_consumers+0xfc/0x138 device_release_driver_internal+0xe0/0x288 device_driver_detach+0x24/0x38 unbind_store+0xd8/0x108 drv_attr_store+0x30/0x50 DSA: tree 0 torn down This was somewhat not so easy to spot, because "ocelot-8021q" is not the default tagging protocol, and thus, not everyone who tests the unbinding path may have switched to it beforehand. The default felix_tag_npi_teardown() does not require rtnl_lock() to be held. Fixes: 7c83a7c539ab ("net: dsa: add a second tagger for Ocelot switches based on tag_8021q") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20230803134253.2711124-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 17ebf8a4c38b5481c29623f5e003fdf7583947f9 Author: Xiang Yang Date: Thu Aug 3 07:24:38 2023 +0000 mptcp: fix the incorrect judgment for msk->cb_flags Coccicheck reports the error below: net/mptcp/protocol.c:3330:15-28: ERROR: test of a variable/field address Since the address of msk->cb_flags is used in __test_and_clear_bit, the address should not be NULL. The judgment for if (unlikely(msk->cb_flags)) will always be true, we should check the real value of msk->cb_flags here. Fixes: 65a569b03ca8 ("mptcp: optimize release_cb for the common case") Signed-off-by: Xiang Yang Reviewed-by: Matthieu Baerts Link: https://lore.kernel.org/r/20230803072438.1847500-1-xiangyang3@huawei.com Signed-off-by: Jakub Kicinski commit d5ad9aae13dcced333c1a7816ff0a4fbbb052466 Author: Mark Brown Date: Fri Aug 4 20:22:11 2023 +0100 selftests/rseq: Fix build with undefined __weak Commit 3bcbc20942db ("selftests/rseq: Play nice with binaries statically linked against glibc 2.35+") which is now in Linus' tree introduced uses of __weak but did nothing to ensure that a definition is provided for it resulting in build failures for the rseq tests: rseq.c:41:1: error: unknown type name '__weak' __weak ptrdiff_t __rseq_offset; ^ rseq.c:41:17: error: expected ';' after top level declarator __weak ptrdiff_t __rseq_offset; ^ ; rseq.c:42:1: error: unknown type name '__weak' __weak unsigned int __rseq_size; ^ rseq.c:43:1: error: unknown type name '__weak' __weak unsigned int __rseq_flags; Fix this by using the definition from tools/include compiler.h. Fixes: 3bcbc20942db ("selftests/rseq: Play nice with binaries statically linked against glibc 2.35+") Signed-off-by: Mark Brown Message-Id: <20230804-kselftest-rseq-build-v1-1-015830b66aa9@kernel.org> Signed-off-by: Paolo Bonzini commit 3bfc37d92687b4b19056998cebc02f94fbc81427 Author: Bjorn Helgaas Date: Fri Aug 4 11:54:43 2023 -0500 Revert "PCI: mvebu: Mark driver as BROKEN" b3574f579ece ("PCI: mvebu: Mark driver as BROKEN") made it impossible to enable the pci-mvebu driver. The driver does have known problems, but as Russell and Uwe reported, it does work in some configurations, so removing it broke some working setups. Revert b3574f579ece so pci-mvebu is available. Reported-by: Russell King (Oracle) Link: https://lore.kernel.org/r/ZMzicVQEyHyZzBOc@shell.armlinux.org.uk Reported-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230804134622.pmbymxtzxj2yfhri@pengutronix.de Signed-off-by: Bjorn Helgaas commit 5f1fc67f2cb8d3035d3acd273b48b97835af8afd Author: SeongJae Park Date: Sat Jul 29 20:37:32 2023 +0000 mm/damon/core: initialize damo_filter->list from damos_new_filter() damos_new_filter() is not initializing the list field of newly allocated filter object. However, DAMON sysfs interface and DAMON_RECLAIM are not initializing it after calling damos_new_filter(). As a result, accessing uninitialized memory is possible. Actually, adding multiple DAMOS filters via DAMON sysfs interface caused NULL pointer dereferencing. Initialize the field just after the allocation from damos_new_filter(). Link: https://lkml.kernel.org/r/20230729203733.38949-2-sj@kernel.org Fixes: 98def236f63c ("mm/damon/core: implement damos filter") Signed-off-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit f8654743a0e6909dc634cbfad6db6816f10f3399 Author: Ryusuke Konishi Date: Sat Jul 29 04:13:18 2023 +0900 nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer(). Previously, nilfs_evict_inode() could cause use-after-free read for nilfs_root if inodes are left in "garbage_list" and released by nilfs_dispose_list at the end of nilfs_detach_log_writer(), and this bug was fixed by commit 9b5a04ac3ad9 ("nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()"). However, it turned out that there is another possibility of UAF in the call path where mark_inode_dirty_sync() is called from iput(): nilfs_detach_log_writer() nilfs_dispose_list() iput() mark_inode_dirty_sync() __mark_inode_dirty() nilfs_dirty_inode() __nilfs_mark_inode_dirty() nilfs_load_inode_block() --> causes UAF of nilfs_root struct This can happen after commit 0ae45f63d4ef ("vfs: add support for a lazytime mount option"), which changed iput() to call mark_inode_dirty_sync() on its final reference if i_state has I_DIRTY_TIME flag and i_nlink is non-zero. This issue appears after commit 28a65b49eb53 ("nilfs2: do not write dirty data after degenerating to read-only") when using the syzbot reproducer, but the issue has potentially existed before. Fix this issue by adding a "purging flag" to the nilfs structure, setting that flag while disposing the "garbage_list" and checking it in __nilfs_mark_inode_dirty(). Unlike commit 9b5a04ac3ad9 ("nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()"), this patch does not rely on ns_writer to determine whether to skip operations, so as not to break recovery on mount. The nilfs_salvage_orphan_logs routine dirties the buffer of salvaged data before attaching the log writer, so changing __nilfs_mark_inode_dirty() to skip the operation when ns_writer is NULL will cause recovery write to fail. The purpose of using the cleanup-only flag is to allow for narrowing of such conditions. Link: https://lkml.kernel.org/r/20230728191318.33047-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi Reported-by: syzbot+74db8b3087f293d3a13a@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/000000000000b4e906060113fd63@google.com Fixes: 0ae45f63d4ef ("vfs: add support for a lazytime mount option") Tested-by: Ryusuke Konishi Cc: # 4.0+ Signed-off-by: Andrew Morton commit fac2650276eced3c94bcdbc21d0e5be637c1e582 Author: Johannes Weiner Date: Tue Aug 1 09:56:32 2023 -0400 selftests: cgroup: fix test_kmem_basic false positives This test fails routinely in our prod testing environment, and I can reproduce it locally as well. The test allocates dcache inside a cgroup, then drops the memory limit and checks that usage drops correspondingly. The reason it fails is because dentries are freed with an RCU delay - a debugging sleep shows that usage drops as expected shortly after. Insert a 1s sleep after dropping the limit. This should be good enough, assuming that machines running those tests are otherwise not very busy. Link: https://lkml.kernel.org/r/20230801135632.1768830-1-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Paul E. McKenney Cc: Michal Hocko Cc: Roman Gushchin Signed-off-by: Andrew Morton commit 17457784004c84178798432a029ab20e14f728b1 Author: Lorenzo Stoakes Date: Mon Jul 31 22:50:21 2023 +0100 fs/proc/kcore: reinstate bounce buffer for KCORE_TEXT regions Some architectures do not populate the entire range categorised by KCORE_TEXT, so we must ensure that the kernel address we read from is valid. Unfortunately there is no solution currently available to do so with a purely iterator solution so reinstate the bounce buffer in this instance so we can use copy_from_kernel_nofault() in order to avoid page faults when regions are unmapped. This change partly reverts commit 2e1c0170771e ("fs/proc/kcore: avoid bounce buffer for ktext data"), reinstating the bounce buffer, but adapts the code to continue to use an iterator. [lstoakes@gmail.com: correct comment to be strictly correct about reasoning] Link: https://lkml.kernel.org/r/525a3f14-74fa-4c22-9fca-9dab4de8a0c3@lucifer.local Link: https://lkml.kernel.org/r/20230731215021.70911-1-lstoakes@gmail.com Fixes: 2e1c0170771e ("fs/proc/kcore: avoid bounce buffer for ktext data") Signed-off-by: Lorenzo Stoakes Reported-by: Jiri Olsa Closes: https://lore.kernel.org/all/ZHc2fm+9daF6cgCE@krava Tested-by: Jiri Olsa Tested-by: Will Deacon Cc: Alexander Viro Cc: Ard Biesheuvel Cc: Baoquan He Cc: Catalin Marinas Cc: David Hildenbrand Cc: Jens Axboe Cc: Kefeng Wang Cc: Liu Shixin Cc: Matthew Wilcox Cc: Mike Galbraith Cc: Thorsten Leemhuis Cc: Uladzislau Rezki (Sony) Cc: Signed-off-by: Andrew Morton commit d1ef9dba07bf637995202d0efd29c2fea19e809c Author: Liam R. Howlett Date: Mon Jul 31 13:55:42 2023 -0400 MAINTAINERS: add maple tree mailing list There is a mailing list for the maple tree development. Add the list to the maple tree entry of the MAINTAINERS file so patches will be sent to interested parties. Link: https://lkml.kernel.org/r/20230731175542.1653200-1-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Signed-off-by: Andrew Morton commit 493614da0d4e8d8bb37c3c558e0c01de20344cff Author: Johannes Weiner Date: Mon Jul 31 13:24:50 2023 -0400 mm: compaction: fix endless looping over same migrate block During stress testing, the following situation was observed: 70 root 39 19 0 0 0 R 100.0 0.0 959:29.92 khugepaged 310936 root 20 0 84416 25620 512 R 99.7 1.5 642:37.22 hugealloc Tracing shows isolate_migratepages_block() endlessly looping over the first block in the DMA zone: hugealloc-310936 [001] ..... 237297.415718: mm_compaction_finished: node=0 zone=DMA order=9 ret=no_suitable_page hugealloc-310936 [001] ..... 237297.415718: mm_compaction_isolate_migratepages: range=(0x1 ~ 0x400) nr_scanned=513 nr_taken=0 hugealloc-310936 [001] ..... 237297.415718: mm_compaction_finished: node=0 zone=DMA order=9 ret=no_suitable_page hugealloc-310936 [001] ..... 237297.415718: mm_compaction_isolate_migratepages: range=(0x1 ~ 0x400) nr_scanned=513 nr_taken=0 hugealloc-310936 [001] ..... 237297.415718: mm_compaction_finished: node=0 zone=DMA order=9 ret=no_suitable_page hugealloc-310936 [001] ..... 237297.415718: mm_compaction_isolate_migratepages: range=(0x1 ~ 0x400) nr_scanned=513 nr_taken=0 hugealloc-310936 [001] ..... 237297.415718: mm_compaction_finished: node=0 zone=DMA order=9 ret=no_suitable_page hugealloc-310936 [001] ..... 237297.415718: mm_compaction_isolate_migratepages: range=(0x1 ~ 0x400) nr_scanned=513 nr_taken=0 The problem is that the functions tries to test and set the skip bit once on the block, to avoid skipping on its own skip-set, using pageblock_aligned() on the pfn as a test. But because this is the DMA zone which starts at pfn 1, this is never true for the first block, and the skip bit isn't set or tested at all. As a result, fast_find_migrateblock() returns the same pageblock over and over. If the pfn isn't pageblock-aligned, also check if it's the start of the zone to ensure test-and-set-exactly-once on unaligned ranges. Thanks to Vlastimil Babka for the help in debugging this. Link: https://lkml.kernel.org/r/20230731172450.1632195-1-hannes@cmpxchg.org Fixes: 90ed667c03fe ("Revert "Revert "mm/compaction: fix set skip in fast_find_migrateblock""") Signed-off-by: Johannes Weiner Reviewed-by: Vlastimil Babka Acked-by: Mel Gorman Reviewed-by: Baolin Wang Signed-off-by: Andrew Morton commit 65294de30cb8bc7659e445f7be2846af9ed35499 Author: Ayush Jain Date: Fri Jul 28 22:09:51 2023 +0530 selftests: mm: ksm: fix incorrect evaluation of parameter A missing break in kms_tests leads to kselftest hang when the parameter -s is used. In current code flow because of missing break in -s, -t parses args spilled from -s and as -t accepts only valid values as 0,1 so any arg in -s >1 or <0, gets in ksm_test failure This went undetected since, before the addition of option -t, the next case -M would immediately break out of the switch statement but that is no longer the case Add the missing break statement. ----Before---- ./ksm_tests -H -s 100 Invalid merge type ----After---- ./ksm_tests -H -s 100 Number of normal pages: 0 Number of huge pages: 50 Total size: 100 MiB Total time: 0.401732682 s Average speed: 248.922 MiB/s Link: https://lkml.kernel.org/r/20230728163952.4634-1-ayush.jain3@amd.com Fixes: 07115fcc15b4 ("selftests/mm: add new selftests for KSM") Signed-off-by: Ayush Jain Reviewed-by: David Hildenbrand Cc: Stefan Roesch Cc: Signed-off-by: Andrew Morton commit 32c877191e022b55fe3a374f3d7e9fb5741c514d Author: Mike Kravetz Date: Tue Jul 11 15:09:41 2023 -0700 hugetlb: do not clear hugetlb dtor until allocating vmemmap Patch series "Fix hugetlb free path race with memory errors". In the discussion of Jiaqi Yan's series "Improve hugetlbfs read on HWPOISON hugepages" the race window was discovered. https://lore.kernel.org/linux-mm/20230616233447.GB7371@monkey/ Freeing a hugetlb page back to low level memory allocators is performed in two steps. 1) Under hugetlb lock, remove page from hugetlb lists and clear destructor 2) Outside lock, allocate vmemmap if necessary and call low level free Between these two steps, the hugetlb page will appear as a normal compound page. However, vmemmap for tail pages could be missing. If a memory error occurs at this time, we could try to update page flags non-existant page structs. A much more detailed description is in the first patch. The first patch addresses the race window. However, it adds a hugetlb_lock lock/unlock cycle to every vmemmap optimized hugetlb page free operation. This could lead to slowdowns if one is freeing a large number of hugetlb pages. The second path optimizes the update_and_free_pages_bulk routine to only take the lock once in bulk operations. The second patch is technically not a bug fix, but includes a Fixes tag and Cc stable to avoid a performance regression. It can be combined with the first, but was done separately make reviewing easier. This patch (of 2): Freeing a hugetlb page and releasing base pages back to the underlying allocator such as buddy or cma is performed in two steps: - remove_hugetlb_folio() is called to remove the folio from hugetlb lists, get a ref on the page and remove hugetlb destructor. This all must be done under the hugetlb lock. After this call, the page can be treated as a normal compound page or a collection of base size pages. - update_and_free_hugetlb_folio() is called to allocate vmemmap if needed and the free routine of the underlying allocator is called on the resulting page. We can not hold the hugetlb lock here. One issue with this scheme is that a memory error could occur between these two steps. In this case, the memory error handling code treats the old hugetlb page as a normal compound page or collection of base pages. It will then try to SetPageHWPoison(page) on the page with an error. If the page with error is a tail page without vmemmap, a write error will occur when trying to set the flag. Address this issue by modifying remove_hugetlb_folio() and update_and_free_hugetlb_folio() such that the hugetlb destructor is not cleared until after allocating vmemmap. Since clearing the destructor requires holding the hugetlb lock, the clearing is done in remove_hugetlb_folio() if the vmemmap is present. This saves a lock/unlock cycle. Otherwise, destructor is cleared in update_and_free_hugetlb_folio() after allocating vmemmap. Note that this will leave hugetlb pages in a state where they are marked free (by hugetlb specific page flag) and have a ref count. This is not a normal state. The only code that would notice is the memory error code, and it is set up to retry in such a case. A subsequent patch will create a routine to do bulk processing of vmemmap allocation. This will eliminate a lock/unlock cycle for each hugetlb page in the case where we are freeing a large number of pages. Link: https://lkml.kernel.org/r/20230711220942.43706-1-mike.kravetz@oracle.com Link: https://lkml.kernel.org/r/20230711220942.43706-2-mike.kravetz@oracle.com Fixes: ad2fa3717b74 ("mm: hugetlb: alloc the vmemmap pages associated with each HugeTLB page") Signed-off-by: Mike Kravetz Reviewed-by: Muchun Song Tested-by: Naoya Horiguchi Cc: Axel Rasmussen Cc: James Houghton Cc: Jiaqi Yan Cc: Miaohe Lin Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton commit faeb2ff2c1c5cb60ce0da193580b256c941f99ca Author: Miaohe Lin Date: Thu Jul 27 19:56:42 2023 +0800 mm: memory-failure: avoid false hwpoison page mapped error info folio->_mapcount is overloaded in SLAB, so folio_mapped() has to be done after folio_test_slab() is checked. Otherwise slab folio might be treated as a mapped folio leading to false 'Someone maps the hwpoison page' error info. Link: https://lkml.kernel.org/r/20230727115643.639741-4-linmiaohe@huawei.com Fixes: 230ac719c500 ("mm/hwpoison: don't try to unpoison containment-failed pages") Signed-off-by: Miaohe Lin Reviewed-by: Matthew Wilcox (Oracle) Acked-by: Naoya Horiguchi Cc: Kefeng Wang Cc: Signed-off-by: Andrew Morton commit f29623e4a599c295cc8f518c8e4bb7848581a14d Author: Miaohe Lin Date: Thu Jul 27 19:56:41 2023 +0800 mm: memory-failure: fix potential unexpected return value from unpoison_memory() If unpoison_memory() fails to clear page hwpoisoned flag, return value ret is expected to be -EBUSY. But when get_hwpoison_page() returns 1 and fails to clear page hwpoisoned flag due to races, return value will be unexpected 1 leading to users being confused. And there's a code smell that the variable "ret" is used not only to save the return value of unpoison_memory(), but also the return value from get_hwpoison_page(). Make a further cleanup by using another auto-variable solely to save the return value of get_hwpoison_page() as suggested by Naoya. Link: https://lkml.kernel.org/r/20230727115643.639741-3-linmiaohe@huawei.com Fixes: bf181c582588 ("mm/hwpoison: fix unpoison_memory()") Signed-off-by: Miaohe Lin Cc: Kefeng Wang Cc: Matthew Wilcox (Oracle) Cc: Naoya Horiguchi Cc: Signed-off-by: Andrew Morton commit f985fc322063c73916a0d5b6b3fcc6db2ba5792c Author: Miaohe Lin Date: Thu Jul 27 19:56:40 2023 +0800 mm/swapfile: fix wrong swap entry type for hwpoisoned swapcache page Patch series "A few fixup patches for mm", v2. This series contains a few fixup patches to fix potential unexpected return value, fix wrong swap entry type for hwpoisoned swapcache page and so on. More details can be found in the respective changelogs. This patch (of 3): Hwpoisoned dirty swap cache page is kept in the swap cache and there's simple interception code in do_swap_page() to catch it. But when trying to swapoff, unuse_pte() will wrongly install a general sense of "future accesses are invalid" swap entry for hwpoisoned swap cache page due to unaware of such type of page. The user will receive SIGBUS signal without expected BUS_MCEERR_AR payload. BTW, typo 'hwposioned' is fixed. Link: https://lkml.kernel.org/r/20230727115643.639741-1-linmiaohe@huawei.com Link: https://lkml.kernel.org/r/20230727115643.639741-2-linmiaohe@huawei.com Fixes: 6b970599e807 ("mm: hwpoison: support recovery from ksm_might_need_to_copy()") Signed-off-by: Miaohe Lin Cc: Kefeng Wang Cc: Matthew Wilcox (Oracle) Cc: Naoya Horiguchi Cc: Signed-off-by: Andrew Morton commit cac7ea57a06016e4914848b707477fb07ee4ae1c Author: Colin Ian King Date: Thu Jul 27 17:09:30 2023 +0100 radix tree test suite: fix incorrect allocation size for pthreads Currently the pthread allocation for each array item is based on the size of a pthread_t pointer and should be the size of the pthread_t structure, so the allocation is under-allocating the correct size. Fix this by using the size of each element in the pthreads array. Static analysis cppcheck reported: tools/testing/radix-tree/regression1.c:180:2: warning: Size of pointer 'threads' used instead of size of its data. [pointerSize] Link: https://lkml.kernel.org/r/20230727160930.632674-1-colin.i.king@gmail.com Fixes: 1366c37ed84b ("radix tree test harness") Signed-off-by: Colin Ian King Cc: Konstantin Khlebnikov Cc: Matthew Wilcox (Oracle) Cc: Signed-off-by: Andrew Morton commit f443fd5af5dbd531f880d3645d5dd36976cf087f Author: David Howells Date: Wed Jul 26 11:57:56 2023 +0100 crypto, cifs: fix error handling in extract_iter_to_sg() Fix error handling in extract_iter_to_sg(). Pages need to be unpinned, not put in extract_user_to_sg() when handling IOVEC/UBUF sources. The bug may result in a warning like the following: WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:27 [inline] WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline] WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 raw_atomic_add include/linux/atomic/atomic-arch-fallback.h:537 [inline] WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 atomic_add include/linux/atomic/atomic-instrumented.h:105 [inline] WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 try_grab_page+0x108/0x160 mm/gup.c:252 ... pc : try_grab_page+0x108/0x160 mm/gup.c:229 lr : follow_page_pte+0x174/0x3e4 mm/gup.c:651 ... Call trace: __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:27 [inline] arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline] raw_atomic_add include/linux/atomic/atomic-arch-fallback.h:537 [inline] atomic_add include/linux/atomic/atomic-instrumented.h:105 [inline] try_grab_page+0x108/0x160 mm/gup.c:252 follow_pmd_mask mm/gup.c:734 [inline] follow_pud_mask mm/gup.c:765 [inline] follow_p4d_mask mm/gup.c:782 [inline] follow_page_mask+0x12c/0x2e4 mm/gup.c:839 __get_user_pages+0x174/0x30c mm/gup.c:1217 __get_user_pages_locked mm/gup.c:1448 [inline] __gup_longterm_locked+0x94/0x8f4 mm/gup.c:2142 internal_get_user_pages_fast+0x970/0xb60 mm/gup.c:3140 pin_user_pages_fast+0x4c/0x60 mm/gup.c:3246 iov_iter_extract_user_pages lib/iov_iter.c:1768 [inline] iov_iter_extract_pages+0xc8/0x54c lib/iov_iter.c:1831 extract_user_to_sg lib/scatterlist.c:1123 [inline] extract_iter_to_sg lib/scatterlist.c:1349 [inline] extract_iter_to_sg+0x26c/0x6fc lib/scatterlist.c:1339 hash_sendmsg+0xc0/0x43c crypto/algif_hash.c:117 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg+0x54/0x60 net/socket.c:748 ____sys_sendmsg+0x270/0x2ac net/socket.c:2494 ___sys_sendmsg+0x80/0xdc net/socket.c:2548 __sys_sendmsg+0x68/0xc4 net/socket.c:2577 __do_sys_sendmsg net/socket.c:2586 [inline] __se_sys_sendmsg net/socket.c:2584 [inline] __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2584 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:52 el0_svc_common.constprop.0+0x44/0xe4 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x38/0xa4 arch/arm64/kernel/syscall.c:191 el0_svc+0x2c/0xb0 arch/arm64/kernel/entry-common.c:647 el0t_64_sync_handler+0xc0/0xc4 arch/arm64/kernel/entry-common.c:665 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:591 Link: https://lkml.kernel.org/r/20571.1690369076@warthog.procyon.org.uk Fixes: 018584697533 ("netfs: Add a function to extract an iterator into a scatterlist") Reported-by: syzbot+9b82859567f2e50c123e@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-mm/000000000000273d0105ff97bf56@google.com/ Signed-off-by: David Howells Reviewed-by: David Hildenbrand Acked-by: Steve French Cc: Sven Schnelle Cc: Herbert Xu Cc: Jeff Layton Cc: Shyam Prasad N Cc: Rohith Surabattula Cc: Jens Axboe Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Matthew Wilcox Cc: Signed-off-by: Andrew Morton commit 4b5d1e47b69426c0f7491d97d73ad0152d02d437 Author: Andrew Yang Date: Fri Jul 21 14:37:01 2023 +0800 zsmalloc: fix races between modifications of fullness and isolated We encountered many kernel exceptions of VM_BUG_ON(zspage->isolated == 0) in dec_zspage_isolation() and BUG_ON(!pages[1]) in zs_unmap_object() lately. This issue only occurs when migration and reclamation occur at the same time. With our memory stress test, we can reproduce this issue several times a day. We have no idea why no one else encountered this issue. BTW, we switched to the new kernel version with this defect a few months ago. Since fullness and isolated share the same unsigned int, modifications of them should be protected by the same lock. [andrew.yang@mediatek.com: move comment] Link: https://lkml.kernel.org/r/20230727062910.6337-1-andrew.yang@mediatek.com Link: https://lkml.kernel.org/r/20230721063705.11455-1-andrew.yang@mediatek.com Fixes: c4549b871102 ("zsmalloc: remove zspage isolation for migration") Signed-off-by: Andrew Yang Reviewed-by: Sergey Senozhatsky Cc: AngeloGioacchino Del Regno Cc: Matthias Brugger Cc: Minchan Kim Cc: Sebastian Andrzej Siewior Cc: Signed-off-by: Andrew Morton commit e6fda526d9db2c7897dacb9daff8c80e13ce893d Merge: c8273a25864e7 69af56ae56a48 Author: Linus Torvalds Date: Fri Aug 4 12:11:40 2023 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: "More SVE/SME fixes for ptrace() and for the (potentially future) case where SME is implemented in hardware without SVE support" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/fpsimd: Sync and zero pad FPSIMD state for streaming SVE arm64/fpsimd: Sync FPSIMD state with SVE for SME only systems arm64/ptrace: Don't enable SVE when setting streaming SVE arm64/ptrace: Flush FP state when setting ZT0 arm64/fpsimd: Clear SME state in the target task when setting the VL commit c8273a25864e74ab66601459686d6f78b0eb666b Merge: 4142fc6743d39 c6abce60338aa Author: Linus Torvalds Date: Fri Aug 4 12:01:26 2023 -0700 Merge tag 'mtd/fixes-for-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd fixes from Miquel Raynal: "Raw NAND fixes: - fsl_upm: Fix an off-by one test in fun_exec_op() - Rockchip: - Align hwecc vs. raw page helper layouts - Fix oobfree offset and description - Meson: Fix OOB available bytes for ECC - Omap ELM: Fix incorrect type in assignment SPI-NOR fix: - Avoid holes in struct spi_mem_op Hyperbus fix: - Add Tudor as reviewer in MAINTAINERS SPI-NAND fixes: - Winbond and Toshiba: Fix ecc_get_status" * tag 'mtd/fixes-for-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op() mtd: spi-nor: avoid holes in struct spi_mem_op MAINTAINERS: Add myself as reviewer for HYPERBUS mtd: rawnand: rockchip: Align hwecc vs. raw page helper layouts mtd: rawnand: rockchip: fix oobfree offset and description mtd: rawnand: meson: fix OOB available bytes for ECC mtd: rawnand: omap_elm: Fix incorrect type in assignment mtd: spinand: winbond: Fix ecc_get_status mtd: spinand: toshiba: Fix ecc_get_status commit 4142fc6743d39271e712936d9fb284cd84cb6010 Merge: 4593f3c2c62c1 1958b0f95a35e Author: Linus Torvalds Date: Fri Aug 4 11:50:22 2023 -0700 Merge tag 'drm-fixes-2023-08-04' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Small set of fixes this week, i915 and a few misc ones. I didn't see an amd pull so maybe next week it'll have a few more on that driver. ttm: - NULL ptr deref fix panel: - add missing MODULE_DEVICE_TABLE imx/ipuv3: - timing fix i915: - Fix bug in getting msg length in AUX CH registers handler - Gen12 AUX invalidation fixes - Fix premature release of request's reusable memory" * tag 'drm-fixes-2023-08-04' of git://anongit.freedesktop.org/drm/drm: drm/panel: samsung-s6d7aa0: Add MODULE_DEVICE_TABLE drm/i915: Fix premature release of request's reusable memory drm/i915/gt: Support aux invalidation on all engines drm/i915/gt: Poll aux invalidation register bit on invalidation drm/i915/gt: Enable the CCS_FLUSH bit in the pipe control and in the CS drm/i915/gt: Rename flags with bit_group_X according to the datasheet drm/i915/gt: Ensure memory quiesced before invalidation drm/i915: Add the gen12_needs_ccs_aux_inv helper drm/i915/gt: Cleanup aux invalidation registers drm/i915/gvt: Fix bug in getting msg length in AUX CH registers handler drm/imx/ipuv3: Fix front porch adjustment upon hactive aligning drm/ttm: check null pointer before accessing when swapping commit 4593f3c2c62c1bcdf274038ef87b08a057531692 Merge: 797964253d358 e6e2843230799 Author: Linus Torvalds Date: Fri Aug 4 11:29:38 2023 -0700 Merge tag 'ceph-for-6.5-rc5' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "Two patches to improve RBD exclusive lock interaction with osd_request_timeout option and another fix to reduce the potential for erroneous blocklisting -- this time in CephFS. All going to stable" * tag 'ceph-for-6.5-rc5' of https://github.com/ceph/ceph-client: libceph: fix potential hang in ceph_osdc_notify() rbd: prevent busy loop when requesting exclusive lock ceph: defer stopping mdsc delayed_work commit 797964253d358cf8d705614dda394dbe30120223 Author: Linus Torvalds Date: Thu Aug 3 11:35:53 2023 -0700 file: reinstate f_pos locking optimization for regular files In commit 20ea1e7d13c1 ("file: always lock position for FMODE_ATOMIC_POS") we ended up always taking the file pos lock, because pidfd_getfd() could get a reference to the file even when it didn't have an elevated file count due to threading of other sharing cases. But Mateusz Guzik reports that the extra locking is actually measurable, so let's re-introduce the optimization, and only force the locking for directory traversal. Directories need the lock for correctness reasons, while regular files only need it for "POSIX semantics". Since pidfd_getfd() is about debuggers etc special things that are _way_ outside of POSIX, we can relax the rules for that case. Reported-by: Mateusz Guzik Cc: Christian Brauner Link: https://lore.kernel.org/linux-fsdevel/20230803095311.ijpvhx3fyrbkasul@f/ Signed-off-by: Linus Torvalds commit 251199f4b381de17feaf553757564871587f8123 Merge: 63dbc67cf4ed1 74158a8cad79d Author: Paolo Bonzini Date: Fri Aug 4 13:39:07 2023 -0400 Merge tag 'kvmarm-fixes-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.5, part #2 - Fixes for the configuration of SVE/SME traps when hVHE mode is in use - Allow use of pKVM on systems with FF-A implementations that are v1.0 compatible - Request/release percpu IRQs (arch timer, vGIC maintenance) correctly when pKVM is in use - Fix function prototype after __kvm_host_psci_cpu_entry() rename - Skip to the next instruction when emulating writes to TCR_EL1 on AmpereOne systems commit 63dbc67cf4ed11f94b2e8dde34b41438a3cb3d83 Author: Paolo Bonzini Date: Fri Aug 4 13:01:43 2023 -0400 KVM: SEV: remove ghcb variable declarations To avoid possible time-of-check/time-of-use issues, the GHCB should almost never be accessed outside dump_ghcb, sev_es_sync_to_ghcb and sev_es_sync_from_ghcb. The only legitimate uses are to set the exitinfo fields and to find the address of the scratch area embedded in the ghcb. Accessing ghcb_usage also goes through svm->sev_es.ghcb in sev_es_validate_vmgexit(), but that is because anyway the value is not used. Removing a shortcut variable that contains the value of svm->sev_es.ghcb makes these cases a bit more verbose, but it limits the chance of someone reading the ghcb by mistake. Signed-off-by: Paolo Bonzini commit 7588dbcebcbf0193ab5b76987396d0254270b04a Author: Paolo Bonzini Date: Fri Aug 4 12:56:36 2023 -0400 KVM: SEV: only access GHCB fields once A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the VMGEXIT handler recursively. sev_handle_vmgexit() maps the GHCB page using kvm_vcpu_map() and then fetches the exit code using ghcb_get_sw_exit_code(). Soon after, sev_es_validate_vmgexit() fetches the exit code again. Since the GHCB page is shared with the guest, the guest is able to quickly swap the values with another vCPU and hence bypass the validation. One vmexit code that can be rejected by sev_es_validate_vmgexit() is SVM_EXIT_VMGEXIT; if sev_handle_vmgexit() observes it in the second fetch, the call to svm_invoke_exit_handler() will invoke sev_handle_vmgexit() again recursively. To avoid the race, always fetch the GHCB data from the places where sev_es_sync_from_ghcb stores it. Exploiting recursions on linux kernel has been proven feasible in the past, but the impact is mitigated by stack guard pages (CONFIG_VMAP_STACK). Still, if an attacker manages to call the handler multiple times, they can theoretically trigger a stack overflow and cause a denial-of-service, or potentially guest-to-host escape in kernel configurations without stack guard pages. Note that winning the race reliably in every iteration is very tricky due to the very tight window of the fetches; depending on the compiler settings, they are often consecutive because of optimization and inlining. Tested by booting an SEV-ES RHEL9 guest. Fixes: CVE-2023-4155 Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT") Cc: stable@vger.kernel.org Reported-by: Andy Nguyen Signed-off-by: Paolo Bonzini commit 4e15a0ddc3ff40e8ea84032213976ecf774d7f77 Author: Paolo Bonzini Date: Fri Aug 4 12:42:45 2023 -0400 KVM: SEV: snapshot the GHCB before accessing it Validation of the GHCB is susceptible to time-of-check/time-of-use vulnerabilities. To avoid them, we would like to always snapshot the fields that are read in sev_es_validate_vmgexit(), and not use the GHCB anymore after it returns. This means: - invoking sev_es_sync_from_ghcb() before any GHCB access, including before sev_es_validate_vmgexit() - snapshotting all fields including the valid bitmap and the sw_scratch field, which are currently not caching anywhere. The valid bitmap is the first thing to be copied out of the GHCB; then, further accesses will use the copy in svm->sev_es. Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT") Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini commit c3bcc65d4d2e8292c435322cbc34c318d06b8b6c Author: Alexandre Ghiti Date: Tue Jul 4 14:18:37 2023 +0200 riscv: Start of DRAM should at least be aligned on PMD size for the direct mapping So that we do not end up mapping the whole linear mapping using 4K pages, which is slow at boot time, and also very likely at runtime. So make sure we align the start of DRAM on a PMD boundary. Signed-off-by: Alexandre Ghiti Reported-by: Song Shuai Fixes: 3335068f8721 ("riscv: Use PUD/P4D/PGD pages for the linear mapping") Tested-by: Song Shuai Link: https://lore.kernel.org/r/20230704121837.248976-1-alexghiti@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit f8069826eb4fe7ae7f769987abf527708354bfd5 Merge: 640c503d7dbd7 49af7a2cd5f67 Author: Palmer Dabbelt Date: Wed Aug 2 20:36:57 2023 -0700 Merge patch series "RISC-V: Fix a few kexec_file_load(2) failures" Petr Tesarik says: From: Petr Tesarik The kexec_file_load(2) syscall does not work at least in some kernel builds. For details see the relevant section in this blog post: https://sigillatum.tesarici.cz/2023-07-21-state-of-riscv64-kdump.html This patch series handles an additional relocation types, removes the need to implement a Global Offset Table (GOT) for the purgatory and fixes the placement of initrd. * b4-shazam-merge: riscv/kexec: load initrd high in available memory riscv/kexec: handle R_RISCV_CALL_PLT relocation type Link: https://lore.kernel.org/r/cover.1690365011.git.petr.tesarik.ext@huawei.com Signed-off-by: Palmer Dabbelt commit 49af7a2cd5f678217b8b4f86a29411aebebf3e78 Author: Torsten Duwe Date: Wed Jul 26 11:54:01 2023 +0200 riscv/kexec: load initrd high in available memory When initrd is loaded low, the secondary kernel fails like this: INITRD: 0xdc581000+0x00eef000 overlaps in-use memory region This initrd load address corresponds to the _end symbol, but the reservation is aligned on PMD_SIZE, as explained by a comment in setup_bootmem(). It is technically possible to align the initrd load address accordingly, leaving a hole between the end of kernel and the initrd, but it is much simpler to allocate the initrd top-down. Fixes: 838b3e28488f ("RISC-V: Load purgatory in kexec_file") Signed-off-by: Torsten Duwe Signed-off-by: Petr Tesarik Cc: stable@vger.kernel.org Reviewed-by: Conor Dooley Link: https://lore.kernel.org/all/67c8eb9eea25717c2c8208d9bfbfaa39e6e2a1c6.1690365011.git.petr.tesarik.ext@huawei.com/ Signed-off-by: Palmer Dabbelt commit d0b4f95a51038becce4bdab4789aa7ce59d4ea6e Author: Torsten Duwe Date: Wed Jul 26 11:53:59 2023 +0200 riscv/kexec: handle R_RISCV_CALL_PLT relocation type R_RISCV_CALL has been deprecated and replaced by R_RISCV_CALL_PLT. See Enum 18-19 in Table 3. Relocation types here: https://github.com/riscv-non-isa/riscv-elf-psabi-doc/blob/master/riscv-elf.adoc It was deprecated in ("Deprecated R_RISCV_CALL, prefer R_RISCV_CALL_PLT"): https://github.com/riscv-non-isa/riscv-elf-psabi-doc/commit/a0dced85018d7a0ec17023c9389cbd70b1dbc1b0 Recent tools (at least GNU binutils-2.40) already use R_RISCV_CALL_PLT. Kernels built with such binutils fail kexec_load_file(2) with: kexec_image: Unknown rela relocation: 19 kexec_image: Error loading purgatory ret=-8 The binary code at the call site remains the same, so tell arch_kexec_apply_relocations_add() to handle _PLT alike. Fixes: 838b3e28488f ("RISC-V: Load purgatory in kexec_file") Signed-off-by: Torsten Duwe Signed-off-by: Petr Tesarik Cc: Li Zhengyu Cc: stable@vger.kernel.org Reviewed-by: Conor Dooley Link: https://lore.kernel.org/all/b046b164af8efd33bbdb7d4003273bdf9196a5b0.1690365011.git.petr.tesarik.ext@huawei.com/ Signed-off-by: Palmer Dabbelt commit 3b816601e279756e781e6c4d9b3f3bd21a72ac67 Author: Benjamin Coddington Date: Fri Aug 4 10:52:20 2023 -0400 nfsd: Fix race to FREE_STATEID and cl_revoked We have some reports of linux NFS clients that cannot satisfy a linux knfsd server that always sets SEQ4_STATUS_RECALLABLE_STATE_REVOKED even though those clients repeatedly walk all their known state using TEST_STATEID and receive NFS4_OK for all. Its possible for revoke_delegation() to set NFS4_REVOKED_DELEG_STID, then nfsd4_free_stateid() finds the delegation and returns NFS4_OK to FREE_STATEID. Afterward, revoke_delegation() moves the same delegation to cl_revoked. This would produce the observed client/server effect. Fix this by ensuring that the setting of sc_type to NFS4_REVOKED_DELEG_STID and move to cl_revoked happens within the same cl_lock. This will allow nfsd4_free_stateid() to properly remove the delegation from cl_revoked. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2217103 Link: https://bugzilla.redhat.com/show_bug.cgi?id=2176575 Signed-off-by: Benjamin Coddington Cc: stable@vger.kernel.org # v4.17+ Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 69af56ae56a48a2522aad906c4461c6c7c092737 Author: Mark Brown Date: Thu Aug 3 19:33:23 2023 +0100 arm64/fpsimd: Sync and zero pad FPSIMD state for streaming SVE We have a function sve_sync_from_fpsimd_zeropad() which is used by the ptrace code to update the SVE state when the user writes to the the FPSIMD register set. Currently this checks that the task has SVE enabled but this will miss updates for tasks which have streaming SVE enabled if SVE has not been enabled for the thread, also do the conversion if the task has streaming SVE enabled. Fixes: e12310a0d30f ("arm64/sme: Implement ptrace support for streaming mode SVE registers") Signed-off-by: Mark Brown Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230803-arm64-fix-ptrace-ssve-no-sve-v1-3-49df214bfb3e@kernel.org Signed-off-by: Catalin Marinas commit 507ea5dd92d23fcf10e4d1a68a443c86a49753ed Author: Mark Brown Date: Thu Aug 3 19:33:22 2023 +0100 arm64/fpsimd: Sync FPSIMD state with SVE for SME only systems Currently we guard FPSIMD/SVE state conversions with a check for the system supporting SVE but SME only systems may need to sync streaming mode SVE state so add a check for SME support too. These functions are only used by the ptrace code. Fixes: e12310a0d30f ("arm64/sme: Implement ptrace support for streaming mode SVE registers") Signed-off-by: Mark Brown Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230803-arm64-fix-ptrace-ssve-no-sve-v1-2-49df214bfb3e@kernel.org Signed-off-by: Catalin Marinas commit 045aecdfcb2e060db142d83a0f4082380c465d2c Author: Mark Brown Date: Thu Aug 3 19:33:21 2023 +0100 arm64/ptrace: Don't enable SVE when setting streaming SVE Systems which implement SME without also implementing SVE are architecturally valid but were not initially supported by the kernel, unfortunately we missed one issue in the ptrace code. The SVE register setting code is shared between SVE and streaming mode SVE. When we set full SVE register state we currently enable TIF_SVE unconditionally, in the case where streaming SVE is being configured on a system that supports vanilla SVE this is not an issue since we always initialise enough state for both vector lengths but on a system which only support SME it will result in us attempting to restore the SVE vector length after having set streaming SVE registers. Fix this by making the enabling of SVE conditional on setting SVE vector state. If we set streaming SVE state and SVE was not already enabled this will result in a SVE access trap on next use of normal SVE, this will cause us to flush our register state but this is fine since the only way to trigger a SVE access trap would be to exit streaming mode which will cause the in register state to be flushed anyway. Fixes: e12310a0d30f ("arm64/sme: Implement ptrace support for streaming mode SVE registers") Signed-off-by: Mark Brown Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230803-arm64-fix-ptrace-ssve-no-sve-v1-1-49df214bfb3e@kernel.org Signed-off-by: Catalin Marinas commit dfe2aeb226fd5e19b0ee795f4f6ed8bc494c1534 Author: Tony Lindgren Date: Fri Aug 4 16:15:51 2023 +0300 serial: 8250: Fix oops for port->pm on uart_change_pm() Unloading a hardware specific 8250 driver can produce error "Unable to handle kernel paging request at virtual address" about ten seconds after unloading the driver. This happens on uart_hangup() calling uart_change_pm(). Turns out commit 04e82793f068 ("serial: 8250: Reinit port->pm on port specific driver unbind") was only a partial fix. If the hardware specific driver has initialized port->pm function, we need to clear port->pm too. Just reinitializing port->ops does not do this. Otherwise serial8250_pm() will call port->pm() instead of serial8250_do_pm(). Fixes: 04e82793f068 ("serial: 8250: Reinit port->pm on port specific driver unbind") Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20230804131553.52927-1-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit b05544884300e98512964103b33f8f87650ce887 Author: Andrea Righi Date: Tue Jul 11 09:19:14 2023 +0200 rust: fix bindgen build error with UBSAN_BOUNDS_STRICT With commit 2d47c6956ab3 ("ubsan: Tighten UBSAN_BOUNDS on GCC") if CONFIG_UBSAN is enabled and gcc supports -fsanitize=bounds-strict, we can trigger the following build error due to bindgen lacking support for this additional build option: BINDGEN rust/bindings/bindings_generated.rs error: unsupported argument 'bounds-strict' to option '-fsanitize=' Fix by adding -fsanitize=bounds-strict to the list of skipped gcc flags for bindgen. Fixes: 2d47c6956ab3 ("ubsan: Tighten UBSAN_BOUNDS on GCC") Signed-off-by: Andrea Righi Acked-by: Kees Cook Reviewed-by: Martin Rodriguez Reboredo Link: https://lore.kernel.org/r/20230711071914.133946-1-andrea.righi@canonical.com Signed-off-by: Miguel Ojeda commit 1d24eb2d536ba27ef938a6563ac8bfb49c738cc1 Author: Alice Ryhl Date: Thu Jul 6 09:46:15 2023 +0000 rust: delete `ForeignOwnable::borrow_mut` We discovered that the current design of `borrow_mut` is problematic. This patch removes it until a better solution can be found. Specifically, the current design gives you access to a `&mut T`, which lets you change where the `ForeignOwnable` points (e.g., with `core::mem::swap`). No upcoming user of this API intended to make that possible, making all of them unsound. Signed-off-by: Alice Ryhl Reviewed-by: Gary Guo Reviewed-by: Benno Lossin Reviewed-by: Martin Rodriguez Reboredo Fixes: 0fc4424d24a2 ("rust: types: introduce `ForeignOwnable`") Link: https://lore.kernel.org/r/20230706094615.3080784-1-aliceryhl@google.com Signed-off-by: Miguel Ojeda commit b3d8aa84bbfe9b58ccc5332cacf8ea17200af310 Author: Boqun Feng Date: Sat Jul 29 18:29:02 2023 -0700 rust: allocator: Prevent mis-aligned allocation Currently the rust allocator simply passes the size of the type Layout to krealloc(), and in theory the alignment requirement from the type Layout may be larger than the guarantee provided by SLAB, which means the allocated object is mis-aligned. Fix this by adjusting the allocation size to the nearest power of two, which SLAB always guarantees a size-aligned allocation. And because Rust guarantees that the original size must be a multiple of alignment and the alignment must be a power of two, then the alignment requirement is satisfied. Suggested-by: Vlastimil Babka Co-developed-by: "Andreas Hindborg (Samsung)" Signed-off-by: "Andreas Hindborg (Samsung)" Signed-off-by: Boqun Feng Cc: stable@vger.kernel.org # v6.1+ Acked-by: Vlastimil Babka Fixes: 247b365dc8dc ("rust: add `kernel` crate") Link: https://github.com/Rust-for-Linux/linux/issues/974 Link: https://lore.kernel.org/r/20230730012905.643822-2-boqun.feng@gmail.com [ Applied rewording of comment as discussed in the mailing list. ] Signed-off-by: Miguel Ojeda commit 77107b08f0f29c6e9d02c2e4bfcd6e1e0c57bdd5 Author: Esteban Blanc Date: Thu Jul 27 11:04:35 2023 +0200 misc: tps6594-esm: Disable ESM for rev 1 PMIC Due to a silicon bug, ESM on TPS6594 PMIC revision 1 is not working properly. This patch keeps SOC ESM disabled for such PMIC. Fixes: 875fdd0787e4 ("misc: tps6594-esm: Add driver for TI TPS6594 ESM") Co-developed-by: Julien Panis Signed-off-by: Julien Panis Signed-off-by: Esteban Blanc Link: https://lore.kernel.org/r/20230726-tps6594_fix_esm_for_v1-v1-1-2adfdcad31c2@baylibre.com Signed-off-by: Greg Kroah-Hartman commit 101bd907b4244a726980ee67f95ed9cafab6ff7a Author: Ricky WU Date: Tue Jul 25 09:10:54 2023 +0000 misc: rtsx: judge ASPM Mode to set PETXCFG Reg ASPM Mode is ASPM_MODE_CFG need to judge the value of clkreq_0 to set HIGH or LOW, if the ASPM Mode is ASPM_MODE_REG always set to HIGH during the initialization. Cc: stable@vger.kernel.org Signed-off-by: Ricky Wu Link: https://lore.kernel.org/r/52906c6836374c8cb068225954c5543a@realtek.com Signed-off-by: Greg Kroah-Hartman commit adb9743d6a08778b78d62d16b4230346d3508986 Author: Qi Zheng Date: Sun Jun 25 15:49:37 2023 +0000 binder: fix memory leak in binder_init() In binder_init(), the destruction of binder_alloc_shrinker_init() is not performed in the wrong path, which will cause memory leaks. So this commit introduces binder_alloc_shrinker_exit() and calls it in the wrong path to fix that. Signed-off-by: Qi Zheng Acked-by: Carlos Llamas Fixes: f2517eb76f1f ("android: binder: Add global lru shrinker to binder") Cc: stable Link: https://lore.kernel.org/r/20230625154937.64316-1-qi.zheng@linux.dev Signed-off-by: Greg Kroah-Hartman commit 63b93e70c862922fedb8d1045e89245bc984a898 Merge: bb6578bab876f 8a4629055ef55 Author: Greg Kroah-Hartman Date: Fri Aug 4 15:19:44 2023 +0200 Merge tag 'iio-fixes-for-6.5a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus Jonathan writes: 1st set of IIO fixes for 6.5 Usual mixed bag of fixes for recently introduced issues and ones from way back that have recently been noticed. * core - Avoid a device with no parent issues seen on the dummy example device. * adi,ad71145 - Drop ref now that dt-schema supports -nanoamp. * adi,ad7192 - Fix wrong bit set for enabling AC excitation and exposure of control on devices without the feature. * adi,admv1013 - Don't ignore errors from regulator_get_voltage(). * amlogic,meson-adc - Make sure clocks enabled early enough. * google,cros_ec - Fix undersized cros_ec_command allocation that resulted in a buffer overrun. * rohm,bu27008 - Fix truncation issue with scale format that prevents smallest value being set - Report intensity as unsigned. Previously large values would be interpretted as negative intensities (and odd concept). * rohm,bu27034 - Fix truncation issue with scale format that prevents smallest value being set. * st,lsm6dsx - Return an error code, not false (which is 0 and hence success) to indicate ACPI mount matrix retrieval failed due to no ACPI support. * ti,ina2xx - Avoid a NULL pointer dereference if fall back compatible is used. * tag 'iio-fixes-for-6.5a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: cros_ec: Fix the allocation size for cros_ec_command iio: imu: lsm6dsx: Fix mount matrix retrieval iio: adc: meson: fix core clock enable/disable moment iio: core: Prevent invalid memory access when there is no parent iio: frequency: admv1013: propagate errors from regulator_get_voltage() dt-bindings: iio: adi,ad74115: remove ref from -nanoamp iio: adc: ina2xx: avoid NULL pointer dereference on OF device match iio: light: bu27008: Fix intensity data type iio: light: bu27008: Fix scale format iio: light: bu27034: Fix scale format iio: adc: ad7192: Fix ac excitation feature commit bb6578bab876f7fb138f5099f833a265b11a60d7 Merge: ec3041b30133f aead78125a987 Author: Greg Kroah-Hartman Date: Fri Aug 4 15:17:53 2023 +0200 Merge tag 'counter-fixes-for-6.5b' of git://git.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-linus William writes: Second set of Counter fixes for 6.5 The I8254 Kconfig entry is repositioned to resolve a misplacement causing the "Counter support" submenu items to disappear in menuconfig. The tools/counter/Makefile clean recipe is adjusted to replace rmdir with an equivalent set of rm to prevent failure if someone tries to clean the counter directory without building it first. * tag 'counter-fixes-for-6.5b' of git://git.kernel.org/pub/scm/linux/kernel/git/wbg/counter: tools/counter: Makefile: Replace rmdir by rm to avoid make,clean failure counter: Fix menuconfig "Counter support" submenu entries disappearance commit 596a5123cc782d458b057eb3837e66535cd0befa Author: Mika Westerberg Date: Thu Jun 22 14:59:12 2023 +0300 thunderbolt: Fix memory leak in tb_handle_dp_bandwidth_request() The memory allocated in tb_queue_dp_bandwidth_request() needs to be released once the request is handled to avoid leaking it. Fixes: 6ce3563520be ("thunderbolt: Add support for DisplayPort bandwidth allocation mode") Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg commit ec3041b30133f92cfbce783e02239aa0853f8ab3 Merge: 5d0c230f1de8c 9b53a13422162 Author: Greg Kroah-Hartman Date: Fri Aug 4 15:17:29 2023 +0200 Merge tag 'counter-fixes-for-6.5a' of git://git.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-linus William writes: First set of Counter fixes for 6.5 In commit d428487471ba ("counter: i8254: Introduce the Intel 8254 interface library module"), the misplacement of the I8254 Kconfig entry results in the "Counter support" submenu items disappearing in menuconfig. A fix is provided to reposition the I8254 Kconfig entry to restore the intended submenu behavior. * tag 'counter-fixes-for-6.5a' of git://git.kernel.org/pub/scm/linux/kernel/git/wbg/counter: counter: Fix menuconfig "Counter support" submenu entries disappearance commit bbb4abb1bcfb5c25bc022ccecfea919286093b5d Author: Tony Lindgren Date: Fri Aug 4 15:35:44 2023 +0300 serial: 8250: Reinit port_id when adding back serial8250_isa_devs After fixing the serial core port device to use port->port_id instead of port->line, unloading a hardware specific 8250 port driver started producing an error for "sysfs: cannot create duplicate filename". This is happening as we are wrongly initializing port->port_id to zero when adding back serial8250_isa_devs instances, and the serial8250:0.0 sysfs entry may already exist. For serial8250 devices, we typically have multiple devices mapped to a single driver instance. For the serial8250_isa_devs instances, the port->port_id is the same as port->line. Let's fix the issue by re-initializing port_id when adding back the serial8250_isa_devs instances in serial8250_unregister_port(). Fixes: d962de6ae51f ("serial: core: Fix serial core port id to not use port->line") Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20230804123546.25293-1-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit 6be1a8d50b381ca022a79e47f2dc0d3aa698af14 Author: Tony Lindgren Date: Fri Aug 4 12:09:07 2023 +0300 serial: core: Fix kmemleak issue for serial core device remove Kmemleak reports issues for serial8250 ports after the hardware specific driver takes over on boot as noted by Tomi. The kerneldoc for device_initialize() says we must call device_put() after calling device_initialize(). We are calling device_put() on the error path, but are missing it from the device remove path. This causes release() to never get called for the devices on remove. Let's add the missing put_device() calls for both serial ctrl and port devices. Fixes: 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM") Reported-by: Tomi Valkeinen Signed-off-by: Tony Lindgren Tested-by: Tomi Valkeinen Link: https://lore.kernel.org/r/20230804090909.51529-1-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit 238500e2d67c0463ec83a43a083dc25db6520acd Author: Tony Lindgren Date: Fri Aug 4 13:20:40 2023 +0300 MAINTAINERS: Merge TTY layer and serial drivers Greg suggested we merge TTY layer and serial driver entries to avoid duplicates. Suggested-by: Greg Kroah-Hartman Acked-by: Ilpo Järvinen Acked-by: Jiri Slaby Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20230804102042.53576-1-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit 3ddaa6a274578e23745b7466346fc2650df8f959 Author: Elson Roy Serrao Date: Tue Aug 1 12:26:58 2023 -0700 usb: dwc3: Properly handle processing of pending events If dwc3 is runtime suspended we defer processing the event buffer until resume, by setting the pending_events flag. Set this flag before triggering resume to avoid race with the runtime resume callback. While handling the pending events, in addition to checking the event buffer we also need to process it. Handle this by explicitly calling dwc3_thread_interrupt(). Also balance the runtime pm get() operation that triggered this processing. Cc: stable@vger.kernel.org Fixes: fc8bb91bc83e ("usb: dwc3: implement runtime PM") Signed-off-by: Elson Roy Serrao Acked-by: Thinh Nguyen Reviewed-by: Roger Quadros Link: https://lore.kernel.org/r/20230801192658.19275-1-quic_eserrao@quicinc.com Signed-off-by: Greg Kroah-Hartman commit a6ff6e7a9dd69364547751db0f626a10a6d628d2 Author: Alan Stern Date: Wed Aug 2 13:49:02 2023 -0400 usb-storage: alauda: Fix uninit-value in alauda_check_media() Syzbot got KMSAN to complain about access to an uninitialized value in the alauda subdriver of usb-storage: BUG: KMSAN: uninit-value in alauda_transport+0x462/0x57f0 drivers/usb/storage/alauda.c:1137 CPU: 0 PID: 12279 Comm: usb-storage Not tainted 5.3.0-rc7+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x191/0x1f0 lib/dump_stack.c:113 kmsan_report+0x13a/0x2b0 mm/kmsan/kmsan_report.c:108 __msan_warning+0x73/0xe0 mm/kmsan/kmsan_instr.c:250 alauda_check_media+0x344/0x3310 drivers/usb/storage/alauda.c:460 The problem is that alauda_check_media() doesn't verify that its USB transfer succeeded before trying to use the received data. What should happen if the transfer fails isn't entirely clear, but a reasonably conservative approach is to pretend that no media is present. A similar problem exists in a usb_stor_dbg() call in alauda_get_media_status(). In this case, when an error occurs the call is redundant, because usb_stor_ctrl_transfer() already will print a debugging message. Finally, unrelated to the uninitialized memory access, is the fact that alauda_check_media() performs DMA to a buffer on the stack. Fortunately usb-storage provides a general purpose DMA-able buffer for uses like this. We'll use it instead. Reported-and-tested-by: syzbot+e7d46eb426883fb97efd@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/0000000000007d25ff059457342d@google.com/T/ Suggested-by: Christophe JAILLET Signed-off-by: Alan Stern Fixes: e80b0fade09e ("[PATCH] USB Storage: add alauda support") Cc: Link: https://lore.kernel.org/r/693d5d5e-f09b-42d0-8ed9-1f96cd30bcce@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit 8e21a620c7e6e00347ade1a6ed4967b359eada5a Author: Prashanth K Date: Tue Aug 1 14:33:52 2023 +0530 usb: common: usb-conn-gpio: Prevent bailing out if initial role is none Currently if we bootup a device without cable connected, then usb-conn-gpio won't call set_role() because last_role is same as current role. This happens since last_role gets initialised to zero during the probe. To avoid this, add a new flag initial_detection into struct usb_conn_info, which prevents bailing out during initial detection. Cc: # 5.4 Fixes: 4602f3bff266 ("usb: common: add USB GPIO based connection detection driver") Signed-off-by: Prashanth K Tested-by: AngeloGioacchino Del Regno Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/1690880632-12588-1-git-send-email-quic_prashk@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 65dadb2beeb7360232b09ebc4585b54475dfee06 Author: Alan Stern Date: Sat Jul 29 10:59:38 2023 -0400 USB: Gadget: core: Help prevent panic during UVC unconfigure Avichal Rakesh reported a kernel panic that occurred when the UVC gadget driver was removed from a gadget's configuration. The panic involves a somewhat complicated interaction between the kernel driver and a userspace component (as described in the Link tag below), but the analysis did make one thing clear: The Gadget core should accomodate gadget drivers calling usb_gadget_deactivate() as part of their unbind procedure. Currently this doesn't work. gadget_unbind_driver() calls driver->unbind() while holding the udc->connect_lock mutex, and usb_gadget_deactivate() attempts to acquire that mutex, which will result in a deadlock. The simple fix is for gadget_unbind_driver() to release the mutex when invoking the ->unbind() callback. There is no particular reason for it to be holding the mutex at that time, and the mutex isn't held while the ->bind() callback is invoked. So we'll drop the mutex before performing the unbind callback and reacquire it afterward. We'll also add a couple of comments to usb_gadget_activate() and usb_gadget_deactivate(). Because they run in process context they must not be called from a gadget driver's ->disconnect() callback, which (according to the kerneldoc for struct usb_gadget_driver in include/linux/usb/gadget.h) may run in interrupt context. This may help prevent similar bugs from arising in the future. Reported-and-tested-by: Avichal Rakesh Signed-off-by: Alan Stern Fixes: 286d9975a838 ("usb: gadget: udc: core: Prevent soft_connect_store() race") Link: https://lore.kernel.org/linux-usb/4d7aa3f4-22d9-9f5a-3d70-1bd7148ff4ba@google.com/ Cc: Badhri Jagan Sridharan Cc: Link: https://lore.kernel.org/r/48b2f1f1-0639-46bf-bbfc-98cb05a24914@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit ef7c4d8a90c64bac294363c6f67eb98246a162a2 Author: Heikki Krogerus Date: Mon Jul 31 16:12:10 2023 +0300 usb: typec: mux: intel: Add dependency on USB_COMMON This fixes an undefined reference to `usb_debug_root' issue when USB_COMMON is not enabled. Fixes: 0a453dc9f260 ("usb: typec: intel_pmc_mux: Expose IOM port status to debugfs") Reported-by: Randy Dunlap Closes: https://lore.kernel.org/lkml/c3bb8781-676d-2448-cfbb-62e29f1f570b@infradead.org/ Cc: Rajat Khandelwal Signed-off-by: Heikki Krogerus Tested-by: Randy Dunlap # build-tested Acked-by: Randy Dunlap Link: https://lore.kernel.org/r/20230731131210.43158-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 348359e7c232adc153ed7ec9a157f22d68d29860 Author: Christophe JAILLET Date: Tue Jul 18 23:40:05 2023 +0200 usb: typec: nb7vpq904m: Add an error handling path in nb7vpq904m_probe() In case of error in the nb7vpq904m_probe() probe function, some resources need to be freed, as already done in the remove function. Add the missing error handling path and adjust code accordingly. Fixes: 88d8f3ac9c67 ("usb: typec: add support for the nb7vpq904m Type-C Linear Redriver") Signed-off-by: Christophe JAILLET Reviewed-by: Neil Armstrong Acked-by: Heikki Krogerus Link: https://lore.kernel.org/r/9118954765821ea9f1179883602b4eca63e91749.1689716381.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman commit 5a5ccd61cfd76156cb3e0373c300c509d05448ce Author: RD Babiera Date: Wed Jul 26 02:09:02 2023 +0000 usb: typec: altmodes/displayport: Signal hpd when configuring pin assignment When connecting to some DisplayPort partners, the initial status update after entering DisplayPort Alt Mode notifies that the DFP_D/UFP_D is not in the connected state. This leads to sending a configure message that keeps the device in USB mode. The port partner then sets DFP_D/UFP_D to the connected state and HPD to high in the same Attention message. Currently, the HPD signal is dropped in order to handle configuration. This patch saves changes to the HPD signal when the device chooses to configure during dp_altmode_status_update, and invokes sysfs_notify if necessary for HPD after configuring. Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode") Cc: stable@vger.kernel.org Signed-off-by: RD Babiera Acked-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230726020903.1409072-1-rdbabiera@google.com Signed-off-by: Greg Kroah-Hartman commit 4270d2b4845e820b274702bfc2a7140f69e4d19d Author: Badhri Jagan Sridharan Date: Wed Jul 12 08:57:22 2023 +0000 usb: typec: tcpm: Fix response to vsafe0V event Do not transition to SNK_UNATTACHED state when receiving vsafe0v event while in SNK_HARD_RESET_WAIT_VBUS. Ignore VBUS off events as well as in some platforms VBUS off can be signalled more than once. [143515.364753] Requesting mux state 1, usb-role 2, orientation 2 [143515.365520] pending state change SNK_HARD_RESET_SINK_OFF -> SNK_HARD_RESET_SINK_ON @ 650 ms [rev3 HARD_RESET] [143515.632281] CC1: 0 -> 0, CC2: 3 -> 0 [state SNK_HARD_RESET_SINK_OFF, polarity 1, disconnected] [143515.637214] VBUS on [143515.664985] VBUS off [143515.664992] state change SNK_HARD_RESET_SINK_OFF -> SNK_HARD_RESET_WAIT_VBUS [rev3 HARD_RESET] [143515.665564] VBUS VSAFE0V [143515.665566] state change SNK_HARD_RESET_WAIT_VBUS -> SNK_UNATTACHED [rev3 HARD_RESET] Fixes: 28b43d3d746b ("usb: typec: tcpm: Introduce vsafe0v for vbus") Cc: Signed-off-by: Badhri Jagan Sridharan Acked-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230712085722.1414743-1-badhri@google.com Signed-off-by: Greg Kroah-Hartman commit 30c694fd4a99fbbc4115d180156ca01b60953371 Author: Martin Fuzzey Date: Fri Aug 4 10:34:30 2023 +0200 regulator: da9063: better fix null deref with partial DT Two versions of the original patch were sent but V1 was merged instead of V2 due to a mistake. So update to V2. The advantage of V2 is that it completely avoids dereferencing the pointer, even just to take the address, which may fix problems with some compilers. Both versions work on my gcc 9.4 but use the safer one. Fixes: 98e2dd5f7a8b ("regulator: da9063: fix null pointer deref with partial DT config") Signed-off-by: Martin Fuzzey Tested-by: Benjamin Bara Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230804083514.1887124-1-martin.fuzzey@flowbird.group Signed-off-by: Mark Brown commit 385311101538b071a487a9245e01349e3a68ed2c Author: Bard Liao Date: Fri Aug 4 11:47:34 2023 +0800 ASoC: max98363: don't return on success reading revision ID max98363_io_init needs to keep going when we read revision ID successfully. Fixes: 18c0af945fa3 ("ASoC: max98363: add soundwire amplifier driver") Signed-off-by: Bard Liao Reviewed-by: Pierre-Louis Bossart Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20230804034734.3848227-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 4d84f763f7e137be7eeab30cc7daa9449c9cb053 Merge: 788449ae57f42 f803ec63686de Author: Takashi Iwai Date: Fri Aug 4 13:53:15 2023 +0200 Merge tag 'asoc-fix-v6.5-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fix for v6.5 Not really a fix, but rather a licensing update for the fsl_micfil driver. commit 788449ae57f4273111b779bbcaad552b67f517d5 Author: dengxiang Date: Thu Aug 3 10:44:37 2023 +0800 ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. This patch adds a USB quirk for Mythware XA001AU USB interface. Signed-off-by: dengxiang Cc: Link: https://lore.kernel.org/r/20230803024437.370069-1-dengxiang@nfschina.com Signed-off-by: Takashi Iwai commit 1733d0be68ab1b89358a3b0471ef425fd61de7c5 Merge: 1696ec8654016 d7791cec2304a Author: David S. Miller Date: Fri Aug 4 10:00:17 2023 +0100 Merge branch 'at803x-wol' Li Yang says: ==================== fix at803x wol setting v3: Break long lines Add back error checking of phy_read v4: Disable WoL in 1588 register for AR8031 in probe ==================== Signed-off-by: David S. Miller commit d7791cec2304aea22eb2ada944e4d467302f5bfe Author: Li Yang Date: Wed Aug 2 14:13:47 2023 -0500 net: phy: at803x: remove set/get wol callbacks for AR8032 Since the AR8032 part does not support wol, remove related callbacks from it. Fixes: 5800091a2061 ("net: phy: at803x: add support for AR8032 PHY") Signed-off-by: Li Yang Cc: David Bauer Signed-off-by: David S. Miller commit e58f30246c35c126c7571065b33bee4b3b1d2ef8 Author: Li Yang Date: Wed Aug 2 14:13:46 2023 -0500 net: phy: at803x: fix the wol setting functions In commit 7beecaf7d507 ("net: phy: at803x: improve the WOL feature"), it seems not correct to use a wol_en bit in a 1588 Control Register which is only available on AR8031/AR8033(share the same phy_id) to determine if WoL is enabled. Change it back to use AT803X_INTR_ENABLE_WOL for determining the WoL status which is applicable on all chips supporting wol. Also update the at803x_set_wol() function to only update the 1588 register on chips having it. After this change, disabling wol at probe from commit d7cd5e06c9dd ("net: phy: at803x: disable WOL at probe") is no longer needed. Change it to just disable the WoL bit in 1588 register for AR8031/AR8033 to be aligned with AT803X_INTR_ENABLE_WOL in probe. Fixes: 7beecaf7d507 ("net: phy: at803x: improve the WOL feature") Signed-off-by: Li Yang Reviewed-by: Viorel Suman Reviewed-by: Wei Fang Reviewed-by: Russell King (Oracle) Signed-off-by: David S. Miller commit 3c6bd1b7e2043fb00ce6b622709d176609431406 Author: Neil Armstrong Date: Wed Aug 2 10:52:22 2023 +0200 Revert "drm/bridge: lt9611: Do not generate HFP/HBP/HSA and EOT packet" This reverts commit 8ddce13ae696 ("drm/bridge: lt9611: Do not generate HFP/HBP/HSA and EOT packet") to fix display regression on the Dragonboard 845c (SDM845) devboard. There's a mismatch on the real action of the following flags: - MIPI_DSI_MODE_VIDEO_NO_HSA - MIPI_DSI_MODE_VIDEO_NO_HFP - MIPI_DSI_MODE_VIDEO_NO_HBP which leads to a non-working display on qcom platforms. Cc: Marek Vasut Cc: Robert Foss Cc: Jagan Teki Cc: Dmitry Baryshkov Cc: Abhinav Kumar Fixes: 8ddce13ae696 ("drm/bridge: lt9611: Do not generate HFP/HBP/HSA and EOT packet") Reported-by: Amit Pundir Closes: https://lore.kernel.org/r/CAMi1Hd0TD=2z_=bcDrht3H_wiLvAFcv8Z-U_r_KUOoeMc6UMjw@mail.gmail.com/ Tested-by: Amit Pundir Acked-by: Dmitry Baryshkov #fix db845c [narmstrong: fixed commit message format] Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20230802-revert-do-not-generate-hfp-hbp-hsa-eot-packet-v1-1-f8a20084e15a@linaro.org commit a592ab6171bd943ce3b988bd271c79fe275a7bec Merge: 3e9dce80dbf91 688b419c57c13 Author: Jens Axboe Date: Thu Aug 3 20:03:42 2023 -0600 Merge tag 'nvme-6.5-2023-08-02' of git://git.infradead.org/nvme into block-6.5 Pull NVMe fixes from Keith: "nvme fixes for Linux 6.5 - Fixes for request_queue state (Ming) - Another uuid quirk (August)" * tag 'nvme-6.5-2023-08-02' of git://git.infradead.org/nvme: nvme-pci: add NVME_QUIRK_BOGUS_NID for Samsung PM9B1 256G and 512G nvme-rdma: fix potential unbalanced freeze & unfreeze nvme-tcp: fix potential unbalanced freeze & unfreeze nvme: fix possible hang when removing a controller during error recovery commit 1696ec8654016dad3b1baf6c024303e584400453 Author: Nathan Chancellor Date: Wed Aug 2 10:40:29 2023 -0700 mISDN: Update parameter type of dsp_cmx_send() When booting a kernel with CONFIG_MISDN_DSP=y and CONFIG_CFI_CLANG=y, there is a failure when dsp_cmx_send() is called indirectly from call_timer_fn(): [ 0.371412] CFI failure at call_timer_fn+0x2f/0x150 (target: dsp_cmx_send+0x0/0x530; expected type: 0x92ada1e9) The function pointer prototype that call_timer_fn() expects is void (*fn)(struct timer_list *) whereas dsp_cmx_send() has a parameter type of 'void *', which causes the control flow integrity checks to fail because the parameter types do not match. Change dsp_cmx_send()'s parameter type to be 'struct timer_list' to match the expected prototype. The argument is unused anyways, so this has no functional change, aside from avoiding the CFI failure. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202308020936.58787e6c-oliver.sang@intel.com Signed-off-by: Nathan Chancellor Reviewed-by: Sami Tolvanen Reviewed-by: Kees Cook Fixes: e313ac12eb13 ("mISDN: Convert timers to use timer_setup()") Link: https://lore.kernel.org/r/20230802-fix-dsp_cmx_send-cfi-failure-v1-1-2f2e79b0178d@kernel.org Signed-off-by: Jakub Kicinski commit 1958b0f95a35e4443573c4c3ec2efd89d2d00d82 Merge: 062ff85b11da6 0bc057eae2610 Author: Dave Airlie Date: Fri Aug 4 09:38:36 2023 +1000 Merge tag 'drm-intel-fixes-2023-08-03' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Fix bug in getting msg length in AUX CH registers handler [gvt] (Yan Zhao) - Gen12 AUX invalidation fixes [gt] (Andi Shyti, Jonathan Cavitt) - Fix premature release of request's reusable memory (Janusz Krzysztofik) - Merge tag 'gvt-fixes-2023-08-02' of https://github.com/intel/gvt-linux into drm-intel-fixes (Tvrtko Ursulin) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/ZMtkxWGuUKpaRMmo@tursulin-desk commit 062ff85b11da63ecccf7c17778ad225e7b5d06bf Merge: 5d0c230f1de8c c71b7aa8619a0 Author: Dave Airlie Date: Fri Aug 4 09:26:56 2023 +1000 Merge tag 'drm-misc-fixes-2023-08-03' of ssh://git.freedesktop.org/git/drm/drm-misc into drm-fixes A NULL pointer dereference fix for TTM, a timings fix for imx/ipuv3 and the addition of a MODULE_DEVICE_TABLE for the samsung-s6d7aa0 panel. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/ztfogof2dhtlvjwe73mvd2jp5kbldhkkav7k5culuseqblwpti@qfobohwx3c3j commit c1a515d3c0270628df8ae5f5118ba859b85464a2 Merge: 638c1913d2b01 07d2b820fd75b Author: Linus Torvalds Date: Thu Aug 3 15:47:39 2023 -0700 Merge tag 'perf-tools-fixes-for-v6.5-2-2023-08-03' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Arnaldo Carvalho de Melo: - Fix segfault in the powerpc specific arch_skip_callchain_idx function. The patch doing the reference count init/exit that went into 6.5 missed this function. - Fix regression reading the arm64 PMU cpu slots in sysfs, a patch removing some code duplication ended up duplicating the /sysfs prefix for these files. - Fix grouping of events related to topdown, addressing a regression on the CSV output produced by 'perf stat' noticed on the downstream tool toplev. - Fix the uprobe_from_different_cu 'perf test' entry, it is failing when gcc isn't available, so we need to check that and skip the test if it is not installed. * tag 'perf-tools-fixes-for-v6.5-2-2023-08-03' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf test parse-events: Test complex name has required event format perf pmus: Create placholder regardless of scanning core_only perf test uprobe_from_different_cu: Skip if there is no gcc perf parse-events: Only move force grouped evsels when sorting perf parse-events: When fixing group leaders always set the leader perf parse-events: Extra care around force grouped events perf callchain powerpc: Fix addr location init during arch_skip_callchain_idx function perf pmu arm64: Fix reading the PMU cpu slots in sysfs commit 638c1913d2b01ab48159f0723fbf98483579934f Merge: 999f6631866e9 ad64f5952ce3e Author: Linus Torvalds Date: Thu Aug 3 15:41:48 2023 -0700 Merge tag 'cxl-fixes-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull cxl fixes from Vishal Verma: - Fixup the Sanitixe device ABI that was merged for v6.5 to hide some sysfs files when the necessary support is missing. Update the ABI documentation around this as well. * tag 'cxl-fixes-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: cxl/memdev: Only show sanitize sysfs files when supported cxl/memdev: Document security state in kern-doc cxl/memdev: Improve sanitize ABI descriptions commit 999f6631866e9ea81add935b9c6ebaab0579d259 Merge: 7bafbd4027ae8 0765c5f293357 Author: Linus Torvalds Date: Thu Aug 3 14:00:02 2023 -0700 Merge tag 'net-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bpf and wireless. Nothing scary here. Feels like the first wave of regressions from v6.5 is addressed - one outstanding fix still to come in TLS for the sendpage rework. Current release - regressions: - udp: fix __ip_append_data()'s handling of MSG_SPLICE_PAGES - dsa: fix older DSA drivers using phylink Previous releases - regressions: - gro: fix misuse of CB in udp socket lookup - mlx5: unregister devlink params in case interface is down - Revert "wifi: ath11k: Enable threaded NAPI" Previous releases - always broken: - sched: cls_u32: fix match key mis-addressing - sched: bind logic fixes for cls_fw, cls_u32 and cls_route - add bound checks to a number of places which hand-parse netlink - bpf: disable preemption in perf_event_output helpers code - qed: fix scheduling in a tasklet while getting stats - avoid using APIs which are not hardirq-safe in couple of drivers, when we may be in a hard IRQ (netconsole) - wifi: cfg80211: fix return value in scan logic, avoid page allocator warning - wifi: mt76: mt7615: do not advertise 5 GHz on first PHY of MT7615D (DBDC) Misc: - drop handful of inactive maintainers, put some new in place" * tag 'net-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (98 commits) MAINTAINERS: update TUN/TAP maintainers test/vsock: remove vsock_perf executable on `make clean` tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen tcp_metrics: annotate data-races around tm->tcpm_net tcp_metrics: annotate data-races around tm->tcpm_vals[] tcp_metrics: annotate data-races around tm->tcpm_lock tcp_metrics: annotate data-races around tm->tcpm_stamp tcp_metrics: fix addr_same() helper prestera: fix fallback to previous version on same major version udp: Fix __ip_append_data()'s handling of MSG_SPLICE_PAGES net/mlx5e: Set proper IPsec source port in L4 selector net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio net/mlx5: fs_core: Make find_closest_ft more generic wifi: brcmfmac: Fix field-spanning write in brcmf_scan_params_v2_to_v1() vxlan: Fix nexthop hash size ip6mr: Fix skb_under_panic in ip6mr_cache_report() s390/qeth: Don't call dev_close/dev_open (DOWN/UP) net: tap_open(): set sk_uid from current_fsuid() net: tun_chr_open(): set sk_uid from current_fsuid() net: dcb: choose correct policy to parse DCB_ATTR_BCN ... commit 0765c5f293357ee43eca72e27c3547f9d99ac355 Author: Jakub Kicinski Date: Wed Aug 2 11:28:43 2023 -0700 MAINTAINERS: update TUN/TAP maintainers Willem and Jason have agreed to take over the maintainer duties for TUN/TAP, thank you! There's an existing entry for TUN/TAP which only covers the user mode Linux implementation. Since we haven't heard from Maxim on the list for almost a decade, extend that entry and take it over, rather than adding a new one. Acked-by: Willem de Bruijn Acked-by: Jason Wang Link: https://lore.kernel.org/r/20230802182843.4193099-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 3932f2272313fc79c3166cceb886c9697c00ff86 Merge: 0d48a84b31f5b 4c9fbff542974 Author: Jakub Kicinski Date: Thu Aug 3 11:22:53 2023 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Martin KaFai Lau says: ==================== pull-request: bpf 2023-08-03 We've added 5 non-merge commits during the last 7 day(s) which contain a total of 3 files changed, 37 insertions(+), 20 deletions(-). The main changes are: 1) Disable preemption in perf_event_output helpers code, from Jiri Olsa 2) Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing, from Lin Ma 3) Multiple warning splat fixes in cpumap from Hou Tao * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf, cpumap: Handle skb as well when clean up ptr_ring bpf, cpumap: Make sure kthread is running before map update returns bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing bpf: Disable preemption in bpf_event_output bpf: Disable preemption in bpf_perf_event_output ==================== Link: https://lore.kernel.org/r/20230803181429.994607-1-martin.lau@linux.dev Signed-off-by: Jakub Kicinski commit 4fdfaef71fced490835145631a795497646f4555 Author: Douglas Miller Date: Wed Aug 2 13:32:41 2023 -0400 IB/hfi1: Fix possible panic during hotplug remove During hotplug remove it is possible that the update counters work might be pending, and may run after memory has been freed. Cancel the update counters work before freeing memory. Fixes: 7724105686e7 ("IB/hfi1: add driver files") Signed-off-by: Douglas Miller Signed-off-by: Dennis Dalessandro Link: https://lore.kernel.org/r/169099756100.3927190.15284930454106475280.stgit@awfm-02.cornelisnetworks.com Signed-off-by: Leon Romanovsky commit 0d48a84b31f5beaded651a115f102c1d2e19a3a9 Merge: 3c50c8b240390 16e455a465fca Author: Jakub Kicinski Date: Thu Aug 3 11:05:46 2023 -0700 Merge tag 'wireless-2023-08-03' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Kalle Valo says: ==================== wireless fixes for v6.5 We did some house cleaning in MAINTAINERS file so several patches about that. Few regressions fixed and also fix some recently enabled memcpy() warnings. Only small commits and nothing special standing out. * tag 'wireless-2023-08-03' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: brcmfmac: Fix field-spanning write in brcmf_scan_params_v2_to_v1() wifi: ray_cs: Replace 1-element array with flexible array MAINTAINERS: add Jeff as ath10k, ath11k and ath12k maintainer MAINTAINERS: wifi: mark mlw8k as orphan MAINTAINERS: wifi: mark b43 as orphan MAINTAINERS: wifi: mark zd1211rw as orphan MAINTAINERS: wifi: mark wl3501 as orphan MAINTAINERS: wifi: mark rndis_wlan as orphan MAINTAINERS: wifi: mark ar5523 as orphan MAINTAINERS: wifi: mark cw1200 as orphan MAINTAINERS: wifi: atmel: mark as orphan MAINTAINERS: wifi: rtw88: change Ping as the maintainer Revert "wifi: ath6k: silence false positive -Wno-dangling-pointer warning on GCC 12" wifi: cfg80211: Fix return value in scan logic Revert "wifi: ath11k: Enable threaded NAPI" MAINTAINERS: Update mwifiex maintainer list wifi: mt76: mt7615: do not advertise 5 GHz on first phy of MT7615D (DBDC) ==================== Link: https://lore.kernel.org/r/20230803140058.57476C433C9@smtp.kernel.org Signed-off-by: Jakub Kicinski commit 3c50c8b240390907c9a33c86d25d850520db6dfa Author: Stefano Garzarella Date: Thu Aug 3 10:54:54 2023 +0200 test/vsock: remove vsock_perf executable on `make clean` We forgot to add vsock_perf to the rm command in the `clean` target, so now we have a left over after `make clean` in tools/testing/vsock. Fixes: 8abbffd27ced ("test/vsock: vsock_perf utility") Cc: AVKrasnov@sberdevices.ru Signed-off-by: Stefano Garzarella Reviewed-by: Simon Horman Tested-by: Simon Horman # build-tested Link: https://lore.kernel.org/r/20230803085454.30897-1-sgarzare@redhat.com Signed-off-by: Jakub Kicinski commit 374297e8350b7c3fba7dde438f3414ff05fcba04 Merge: b755c25fbcd56 ddf251fa2bc1d Author: Jakub Kicinski Date: Thu Aug 3 10:58:27 2023 -0700 Merge branch 'tcp_metrics-series-of-fixes' Eric Dumazet says: ==================== tcp_metrics: series of fixes This series contains a fix for addr_same() and various data-race annotations. We still have to address races over tm->tcpm_saddr and tm->tcpm_daddr later. ==================== Link: https://lore.kernel.org/r/20230802131500.1478140-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit ddf251fa2bc1d3699eec0bae6ed0bc373b8fda79 Author: Eric Dumazet Date: Wed Aug 2 13:15:00 2023 +0000 tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen Whenever tcpm_new() reclaims an old entry, tcpm_suck_dst() would overwrite data that could be read from tcp_fastopen_cache_get() or tcp_metrics_fill_info(). We need to acquire fastopen_seqlock to maintain consistency. For newly allocated objects, tcpm_new() can switch to kzalloc() to avoid an extra fastopen_seqlock acquisition. Fixes: 1fe4c481ba63 ("net-tcp: Fast Open client - cookie cache") Signed-off-by: Eric Dumazet Cc: Yuchung Cheng Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230802131500.1478140-7-edumazet@google.com Signed-off-by: Jakub Kicinski commit d5d986ce42c71a7562d32c4e21e026b0f87befec Author: Eric Dumazet Date: Wed Aug 2 13:14:59 2023 +0000 tcp_metrics: annotate data-races around tm->tcpm_net tm->tcpm_net can be read or written locklessly. Instead of changing write_pnet() and read_pnet() and potentially hurt performance, add the needed READ_ONCE()/WRITE_ONCE() in tm_net() and tcpm_new(). Fixes: 849e8a0ca8d5 ("tcp_metrics: Add a field tcpm_net and verify it matches on lookup") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230802131500.1478140-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8c4d04f6b443869d25e59822f7cec88d647028a9 Author: Eric Dumazet Date: Wed Aug 2 13:14:58 2023 +0000 tcp_metrics: annotate data-races around tm->tcpm_vals[] tm->tcpm_vals[] values can be read or written locklessly. Add needed READ_ONCE()/WRITE_ONCE() to document this, and force use of tcp_metric_get() and tcp_metric_set() Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Signed-off-by: Jakub Kicinski commit 285ce119a3c6c4502585936650143e54c8692788 Author: Eric Dumazet Date: Wed Aug 2 13:14:57 2023 +0000 tcp_metrics: annotate data-races around tm->tcpm_lock tm->tcpm_lock can be read or written locklessly. Add needed READ_ONCE()/WRITE_ONCE() to document this. Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230802131500.1478140-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 949ad62a5d5311d36fce2e14fe5fed3f936da51c Author: Eric Dumazet Date: Wed Aug 2 13:14:56 2023 +0000 tcp_metrics: annotate data-races around tm->tcpm_stamp tm->tcpm_stamp can be read or written locklessly. Add needed READ_ONCE()/WRITE_ONCE() to document this. Also constify tcpm_check_stamp() dst argument. Fixes: 51c5d0c4b169 ("tcp: Maintain dynamic metrics in local cache.") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230802131500.1478140-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit e6638094d7af6c7b9dcca05ad009e79e31b4f670 Author: Eric Dumazet Date: Wed Aug 2 13:14:55 2023 +0000 tcp_metrics: fix addr_same() helper Because v4 and v6 families use separate inetpeer trees (respectively net->ipv4.peers and net->ipv6.peers), inetpeer_addr_cmp(a, b) assumes a & b share the same family. tcp_metrics use a common hash table, where entries can have different families. We must therefore make sure to not call inetpeer_addr_cmp() if the families do not match. Fixes: d39d14ffa24c ("net: Add helper function to compare inetpeer addresses") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230802131500.1478140-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit b755c25fbcd568821a3bb0e0d5c2daa5fcb00bba Author: Jonas Gorski Date: Wed Aug 2 11:23:56 2023 +0200 prestera: fix fallback to previous version on same major version When both supported and previous version have the same major version, and the firmwares are missing, the driver ends in a loop requesting the same (previous) version over and over again: [ 76.327413] Prestera DX 0000:01:00.0: missing latest mrvl/prestera/mvsw_prestera_fw-v4.1.img firmware, fall-back to previous 4.0 version [ 76.339802] Prestera DX 0000:01:00.0: missing latest mrvl/prestera/mvsw_prestera_fw-v4.0.img firmware, fall-back to previous 4.0 version [ 76.352162] Prestera DX 0000:01:00.0: missing latest mrvl/prestera/mvsw_prestera_fw-v4.0.img firmware, fall-back to previous 4.0 version [ 76.364502] Prestera DX 0000:01:00.0: missing latest mrvl/prestera/mvsw_prestera_fw-v4.0.img firmware, fall-back to previous 4.0 version [ 76.376848] Prestera DX 0000:01:00.0: missing latest mrvl/prestera/mvsw_prestera_fw-v4.0.img firmware, fall-back to previous 4.0 version [ 76.389183] Prestera DX 0000:01:00.0: missing latest mrvl/prestera/mvsw_prestera_fw-v4.0.img firmware, fall-back to previous 4.0 version [ 76.401522] Prestera DX 0000:01:00.0: missing latest mrvl/prestera/mvsw_prestera_fw-v4.0.img firmware, fall-back to previous 4.0 version [ 76.413860] Prestera DX 0000:01:00.0: missing latest mrvl/prestera/mvsw_prestera_fw-v4.0.img firmware, fall-back to previous 4.0 version [ 76.426199] Prestera DX 0000:01:00.0: missing latest mrvl/prestera/mvsw_prestera_fw-v4.0.img firmware, fall-back to previous 4.0 version ... Fix this by inverting the check to that we aren't yet at the previous version, and also check the minor version. This also catches the case where both versions are the same, as it was after commit bb5dbf2cc64d ("net: marvell: prestera: add firmware v4.0 support"). With this fix applied: [ 88.499622] Prestera DX 0000:01:00.0: missing latest mrvl/prestera/mvsw_prestera_fw-v4.1.img firmware, fall-back to previous 4.0 version [ 88.511995] Prestera DX 0000:01:00.0: failed to request previous firmware: mrvl/prestera/mvsw_prestera_fw-v4.0.img [ 88.522403] Prestera DX: probe of 0000:01:00.0 failed with error -2 Fixes: 47f26018a414 ("net: marvell: prestera: try to load previous fw version") Signed-off-by: Jonas Gorski Acked-by: Elad Nachman Reviewed-by: Jesse Brandeburg Acked-by: Taras Chornyi Link: https://lore.kernel.org/r/20230802092357.163944-1-jonas.gorski@bisdn.de Signed-off-by: Jakub Kicinski commit 7bafbd4027ae86572f308c4ddf93120c90126332 Merge: 556c9424e271a 101df45e7ec36 Author: Linus Torvalds Date: Thu Aug 3 09:26:34 2023 -0700 Merge tag 'nfsd-6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fix from Chuck Lever: - Fix tmpfs splice read support * tag 'nfsd-6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: Fix reading via splice commit 556c9424e271abff7ada9196007418f7b8431c6e Merge: 5e0ba14595232 4da3c7183e186 Author: Linus Torvalds Date: Thu Aug 3 09:20:50 2023 -0700 Merge tag 'erofs-for-6.5-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: - Fix data corruption caused by insufficient decompression on deduplicated compressed extents - Drop a useless s_magic checking in erofs_kill_sb() * tag 'erofs-for-6.5-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: drop unnecessary WARN_ON() in erofs_kill_sb() erofs: fix wrong primary bvec selection on deduplicated extents commit 5e0ba145952328bf1a9c2f0be0bd59a9cc5a7b21 Merge: ec351c8f2e621 388acb471662c Author: Linus Torvalds Date: Thu Aug 3 09:06:38 2023 -0700 Merge tag 's390-6.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Heiko Carstens: - Split kernel large page mappings into 4k mappings in case debug pagealloc is enabled again. This got accidentally removed by commit bb1520d581a3 ("s390/mm: start kernel with DAT enabled") - Fix error handling in KVM's sthyi handling - Add missing include to s390's uapi ptrace.h - Update defconfigs * tag 's390-6.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/ptrace: add missing linux/const.h include KVM: s390: fix sthyi error handling s390: update defconfigs s390/vmem: split pages when debug pagealloc is enabled commit 421dabcad1c69e02a41c0d601aefbc29ee3f5368 Author: Arnd Bergmann Date: Thu Aug 3 16:33:48 2023 +0200 drm/nouveau: remove unused tu102_gr_load() function tu102_gr_load() is completely unused and can be removed to address this warning: drivers/gpu/drm/nouveau/dispnv50/disp.c:2517:1: error: no previous prototype for 'nv50_display_create' Another patch was sent in the meantime to mark the function static but that would just cause a different warning about an unused function. Fixes: 1cd97b5490c8 ("drm/nouveau/gr/tu102-: use sw_veid_bundle_init from firmware") Link: https://lore.kernel.org/all/CACO55tuaNOYphHyB9+ygi9AnXVuF49etsW7x2X5K5iEtFNAAyw@mail.gmail.com/ Link: https://lore.kernel.org/all/20230417210310.2443152-1-arnd@kernel.org/ Signed-off-by: Arnd Bergmann Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20230803143358.13563-1-arnd@kernel.org commit 89a65c3f170e5c3b05a626046c68354e2afd7912 Author: Mark Brown Date: Thu Aug 3 01:19:06 2023 +0100 arm64/ptrace: Flush FP state when setting ZT0 When setting ZT0 via ptrace we do not currently force a reload of the floating point register state from memory, do that to ensure that the newly set value gets loaded into the registers on next task execution. The function was templated off the function for FPSIMD which due to our providing the option of embedding a FPSIMD regset within the SVE regset does not directly include the flush. Fixes: f90b529bcbe5 ("arm64/sme: Implement ZT0 ptrace support") Signed-off-by: Mark Brown Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230803-arm64-fix-ptrace-zt0-flush-v1-1-72e854eaf96e@kernel.org Signed-off-by: Catalin Marinas commit c9bb40b7f786662e33d71afe236442b0b61f0446 Author: Mark Brown Date: Thu Aug 3 00:46:39 2023 +0100 arm64/fpsimd: Clear SME state in the target task when setting the VL When setting SME vector lengths we clear TIF_SME to reenable SME traps, doing a reallocation of the backing storage on next use. We do this using clear_thread_flag() which operates on the current thread, meaning that when setting the vector length via ptrace we may both not force traps for the target task and force a spurious flush of any SME state that the tracing task may have. Clear the flag in the target task. Fixes: e12310a0d30f ("arm64/sme: Implement ptrace support for streaming mode SVE registers") Reported-by: David Spickett Signed-off-by: Mark Brown Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230803-arm64-fix-ptrace-tif-sme-v1-1-88312fd6fbfd@kernel.org Signed-off-by: Catalin Marinas commit f803ec63686dec863a33cad87218d7d99c4b5e92 Author: Daniel Baluta Date: Thu Aug 3 10:26:38 2023 +0300 ASoC: fsl: micfil: Use dual license micfil code We need this in order to easily reuse register definitions and some functions with Sound Open Firmware driver. According to Documentation/process/license-rules.rst: "Dual BSD/GPL" The module is dual licensed under a GPL v2 variant or BSD license choice. The exact variant of the BSD license can only be determined via the license information in the corresponding source files. so use "Dual BSD/GPL" for license string. Signed-off-by: Shengjiu Wang Signed-off-by: Daniel Baluta Acked-by: Sascha Hauer Link: https://lore.kernel.org/r/20230803072638.640789-1-daniel.baluta@oss.nxp.com Signed-off-by: Mark Brown commit 5a78d5db9c90c9dc84212f40a5f2687b7cafc8ec Author: Bartosz Golaszewski Date: Tue Aug 1 21:09:51 2023 +0200 gpio: sim: mark the GPIO chip as a one that can sleep Simulated chips use a mutex for synchronization in driver callbacks so they must not be called from interrupt context. Set the can_sleep field of the GPIO chip to true to force users to only use threaded irqs. Fixes: cb8c474e79be ("gpio: sim: new testing module") Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Reviewed-by: Linus Walleij commit 99b2f159b6e76b84357eae6dc2a206871aa630d5 Author: hanyu001@208suo.com Date: Thu Jul 20 14:40:27 2023 +0800 parisc: unaligned: Add required spaces after ',' Fix checkpatch warnings: unaligned.c:475: ERROR: space required after that ',' Signed-off-by: Yu Han Signed-off-by: Helge Deller commit 2e1b1d7063a35ab6cf9984f9d5bc29829e1e8788 Author: Arnd Bergmann Date: Wed Jul 26 17:09:14 2023 +0200 parport: gsc: remove DMA leftover code This driver does not actually work with DMA mode, but still tries to call ISA DMA interface functions that are stubbed out on parisc, resulting in a W=1 build warning: drivers/parport/parport_gsc.c: In function 'parport_remove_chip': drivers/parport/parport_gsc.c:389:20: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] 389 | free_dma(p->dma); Remove the corresponding code as a prerequisite for turning on -Wempty-body by default in all kernels. Signed-off-by: Arnd Bergmann Signed-off-by: Helge Deller commit ce9ff57d393db86a34ba3f817d7fb886b7c278dc Author: Petr Tesarik Date: Wed Aug 2 18:33:21 2023 +0200 parisc: pci-dma: remove unused and dead EISA code and comment Clearly, this code isn't needed, but it gives a false positive when grepping the complete source tree for coherent_dma_mask. Signed-off-by: Petr Tesarik Signed-off-by: Helge Deller commit c2ff2b736c41cc63bb0aaec85cccfead9fbcfe92 Author: Mike Rapoport (IBM) Date: Thu Aug 3 09:24:04 2023 +0300 parisc/mm: preallocate fixmap page tables at init Christoph Biedl reported early OOM on recent kernels: swapper: page allocation failure: order:0, mode:0x100(__GFP_ZERO), nodemask=(null) CPU: 0 PID: 0 Comm: swapper Not tainted 6.3.0-rc4+ #16 Hardware name: 9000/785/C3600 Backtrace: [<10408594>] show_stack+0x48/0x5c [<10e152d8>] dump_stack_lvl+0x48/0x64 [<10e15318>] dump_stack+0x24/0x34 [<105cf7f8>] warn_alloc+0x10c/0x1c8 [<105d068c>] __alloc_pages+0xbbc/0xcf8 [<105d0e4c>] __get_free_pages+0x28/0x78 [<105ad10c>] __pte_alloc_kernel+0x30/0x98 [<10406934>] set_fixmap+0xec/0xf4 [<10411ad4>] patch_map.constprop.0+0xa8/0xdc [<10411bb0>] __patch_text_multiple+0xa8/0x208 [<10411d78>] patch_text+0x30/0x48 [<1041246c>] arch_jump_label_transform+0x90/0xcc [<1056f734>] jump_label_update+0xd4/0x184 [<1056fc9c>] static_key_enable_cpuslocked+0xc0/0x110 [<1056fd08>] static_key_enable+0x1c/0x2c [<1011362c>] init_mem_debugging_and_hardening+0xdc/0xf8 [<1010141c>] start_kernel+0x5f0/0xa98 [<10105da8>] start_parisc+0xb8/0xe4 Mem-Info: active_anon:0 inactive_anon:0 isolated_anon:0 active_file:0 inactive_file:0 isolated_file:0 unevictable:0 dirty:0 writeback:0 slab_reclaimable:0 slab_unreclaimable:0 mapped:0 shmem:0 pagetables:0 sec_pagetables:0 bounce:0 kernel_misc_reclaimable:0 free:0 free_pcp:0 free_cma:0 Node 0 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:0kB +writeback_tmp:0kB kernel_stack:0kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB +present:1048576kB managed:1039360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB 0 total pagecache pages 0 pages in swap cache Free swap = 0kB Total swap = 0kB 262144 pages RAM 0 pages HighMem/MovableOnly 2304 pages reserved Backtrace: [<10411d78>] patch_text+0x30/0x48 [<1041246c>] arch_jump_label_transform+0x90/0xcc [<1056f734>] jump_label_update+0xd4/0x184 [<1056fc9c>] static_key_enable_cpuslocked+0xc0/0x110 [<1056fd08>] static_key_enable+0x1c/0x2c [<1011362c>] init_mem_debugging_and_hardening+0xdc/0xf8 [<1010141c>] start_kernel+0x5f0/0xa98 [<10105da8>] start_parisc+0xb8/0xe4 Kernel Fault: Code=15 (Data TLB miss fault) at addr 0f7fe3c0 CPU: 0 PID: 0 Comm: swapper Not tainted 6.3.0-rc4+ #16 Hardware name: 9000/785/C3600 This happens because patching static key code temporarily maps it via fixmap and if it happens before page allocator is initialized set_fixmap() cannot allocate memory using pte_alloc_kernel(). Make sure that fixmap page tables are preallocated early so that pte_offset_kernel() in set_fixmap() never resorts to pte allocation. Signed-off-by: Mike Rapoport (IBM) Acked-by: Vlastimil Babka Signed-off-by: Helge Deller Tested-by: Christoph Biedl Tested-by: John David Anglin Cc: # v6.4+ commit 583893a66d731f5da010a3fa38a0460e05f0149b Author: Sanjay R Mehta Date: Wed Aug 2 06:11:49 2023 -0500 thunderbolt: Fix Thunderbolt 3 display flickering issue on 2nd hot plug onwards Previously, on unplug events, the TMU mode was disabled first followed by the Time Synchronization Handshake, irrespective of whether the tb_switch_tmu_rate_write() API was successful or not. However, this caused a problem with Thunderbolt 3 (TBT3) devices, as the TSPacketInterval bits were always enabled by default, leading the host router to assume that the device router's TMU was already enabled and preventing it from initiating the Time Synchronization Handshake. As a result, TBT3 monitors experienced display flickering from the second hot plug onwards. To address this issue, we have modified the code to only disable the Time Synchronization Handshake during TMU disable if the tb_switch_tmu_rate_write() function is successful. This ensures that the TBT3 devices function correctly and eliminates the display flickering issue. Co-developed-by: Sanath S Signed-off-by: Sanath S Signed-off-by: Sanjay R Mehta Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg commit e4060dad253352382b20420d8ef98daab24dbc17 Author: Lyude Paul Date: Fri Jul 28 18:58:57 2023 -0400 drm/nouveau/nvkm/dp: Add workaround to fix DP 1.3+ DPCD issues Currently we use the drm_dp_dpcd_read_caps() helper in the DRM side of nouveau in order to read the DPCD of a DP connector, which makes sure we do the right thing and also check for extended DPCD caps. However, it turns out we're not currently doing this on the nvkm side since we don't have access to the drm_dp_aux structure there - which means that the DRM side of the driver and the NVKM side can end up with different DPCD capabilities for the same connector. Ideally in order to fix this, we just want to use the drm_dp_read_dpcd_caps() helper in nouveau. That's not currently possible though, and is going to depend on having a bunch of the DP code moved out of nvkm and into the DRM side of things as part of the GSP enablement work. Until then however, let's workaround this problem by porting a copy of drm_dp_read_dpcd_caps() into NVKM - which should fix this issue. Signed-off-by: Lyude Paul Reviewed-by: Karol Herbst Link: https://gitlab.freedesktop.org/drm/nouveau/-/issues/211 Link: https://patchwork.freedesktop.org/patch/msgid/20230728225858.350581-1-lyude@redhat.com (cherry picked from commit cc4adf3a7323212f303bc9ff0f96346c44fcba06 in drm-misc-next) Cc: # 6.3+ Signed-off-by: Karol Herbst commit 1cb9e2ef66d53b020842b18762e30d0eb4384de8 Author: Karol Herbst Date: Thu Jun 22 17:20:17 2023 +0200 drm/nouveau/gr: enable memory loads on helper invocation on all channels We have a lurking bug where Fragment Shader Helper Invocations can't load from memory. But this is actually required in OpenGL and is causing random hangs or failures in random shaders. It is unknown how widespread this issue is, but shaders hitting this can end up with infinite loops. We enable those only on all Kepler and newer GPUs where we use our own Firmware. Nvidia's firmware provides a way to set a kernelspace controlled list of mmio registers in the gr space from push buffers via MME macros. v2: drop code for gm200 and newer. Cc: Ben Skeggs Cc: David Airlie Cc: nouveau@lists.freedesktop.org Cc: stable@vger.kernel.org # 4.19+ Signed-off-by: Karol Herbst Reviewed-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230622152017.2512101-1-kherbst@redhat.com commit e9d699af3f65d62cf195f0e7a039400093ab2af2 Author: Pin-yen Lin Date: Thu Jul 27 18:01:10 2023 +0800 drm/bridge: it6505: Check power state with it6505->powered in IRQ handler On system resume, the driver might call it6505_poweron directly if the runtime PM hasn't been enabled. In such case, pm_runtime_get_if_in_use will always return 0 because dev->power.runtime_status stays at RPM_SUSPENDED, and the IRQ will never be handled. Use it6505->powered from the driver struct fixes this because it always gets updated when it6505_poweron is called. Fixes: 5eb9a4314053 ("drm/bridge: it6505: Guard bridge power in IRQ handler") Signed-off-by: Pin-yen Lin Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20230727100131.2338127-1-treapking@chromium.org commit 7d695d83767cdb4288b101affef6d1d1bcf44d31 Author: Tony Lindgren Date: Thu Aug 3 10:10:32 2023 +0300 serial: core: Fix serial_base_match() after fixing controller port name While fixing DEVNAME to be more usable, I broke serial_base_match() as the ctrl and port prefix for device names seemed unnecessary. The prefixes are still needed by serial_base_match() to probe the serial base controller port, and serial tx is now broken. Let's fix the issue by checking against dev->type and drv->name instead of the prefixes that are no longer in the DEVNAME. Fixes: 1ef2c2df1199 ("serial: core: Fix serial core controller port name to show controller id") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202308021529.35b3ad6c-oliver.sang@intel.com Signed-off-by: Tony Lindgren Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/20230803071034.25571-1-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit 534fc31d09b706a16d83533e16b5dc855caf7576 Author: Ross Lagerwall Date: Thu Aug 3 08:41:22 2023 +0200 xen/netback: Fix buffer overrun triggered by unusual packet It is possible that a guest can send a packet that contains a head + 18 slots and yet has a len <= XEN_NETBACK_TX_COPY_LEN. This causes nr_slots to underflow in xenvif_get_requests() which then causes the subsequent loop's termination condition to be wrong, causing a buffer overrun of queue->tx_map_ops. Rework the code to account for the extra frag_overflow slots. This is CVE-2023-34319 / XSA-432. Fixes: ad7f402ae4f4 ("xen/netback: Ensure protocol headers don't fall in the non-linear area") Signed-off-by: Ross Lagerwall Reviewed-by: Paul Durrant Reviewed-by: Wei Liu Signed-off-by: Juergen Gross commit 0f71c9caf26726efea674646f566984e735cc3b9 Author: David Howells Date: Tue Aug 1 16:48:53 2023 +0100 udp: Fix __ip_append_data()'s handling of MSG_SPLICE_PAGES __ip_append_data() can get into an infinite loop when asked to splice into a partially-built UDP message that has more than the frag-limit data and up to the MTU limit. Something like: pipe(pfd); sfd = socket(AF_INET, SOCK_DGRAM, 0); connect(sfd, ...); send(sfd, buffer, 8161, MSG_CONFIRM|MSG_MORE); write(pfd[1], buffer, 8); splice(pfd[0], 0, sfd, 0, 0x4ffe0ul, 0); where the amount of data given to send() is dependent on the MTU size (in this instance an interface with an MTU of 8192). The problem is that the calculation of the amount to copy in __ip_append_data() goes negative in two places, and, in the second place, this gets subtracted from the length remaining, thereby increasing it. This happens when pagedlen > 0 (which happens for MSG_ZEROCOPY and MSG_SPLICE_PAGES), because the terms in: copy = datalen - transhdrlen - fraggap - pagedlen; then mostly cancel when pagedlen is substituted for, leaving just -fraggap. This causes: length -= copy + transhdrlen; to increase the length to more than the amount of data in msg->msg_iter, which causes skb_splice_from_iter() to be unable to fill the request and it returns less than 'copied' - which means that length never gets to 0 and we never exit the loop. Fix this by: (1) Insert a note about the dodgy calculation of 'copy'. (2) If MSG_SPLICE_PAGES, clear copy if it is negative from the above equation, so that 'offset' isn't regressed and 'length' isn't increased, which will mean that length and thus copy should match the amount left in the iterator. (3) When handling MSG_SPLICE_PAGES, give a warning and return -EIO if we're asked to splice more than is in the iterator. It might be better to not give the warning or even just give a 'short' write. [!] Note that this ought to also affect MSG_ZEROCOPY, but MSG_ZEROCOPY avoids the problem by simply assuming that everything asked for got copied, not just the amount that was in the iterator. This is a potential bug for the future. Fixes: 7ac7c987850c ("udp: Convert udp_sendpage() to use MSG_SPLICE_PAGES") Reported-by: syzbot+f527b971b4bdc8e79f9e@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/000000000000881d0606004541d1@google.com/ Signed-off-by: David Howells cc: David Ahern cc: Jens Axboe Reviewed-by: Willem de Bruijn Link: https://lore.kernel.org/r/1420063.1690904933@warthog.procyon.org.uk Signed-off-by: Jakub Kicinski commit a2d9831dab3ea9e2f45f37956d32fbdde6dc7053 Merge: 0756384fb1bd3 62da08331f1a2 Author: Jakub Kicinski Date: Wed Aug 2 18:38:45 2023 -0700 Merge branch 'mlx5-ipsec-fixes' Leon Romanovsky says: ==================== mlx5 IPsec fixes The following patches are combination of Jianbo's work on IPsec eswitch mode together with our internal review toward addition of TCP protocol selectors support to IPSec packet offload. Despite not-being fix, the first patch helps us to make second one more clear, so I'm asking to apply it anyway as part of this series. ==================== Link: https://lore.kernel.org/r/cover.1690803944.git.leonro@nvidia.com Signed-off-by: Jakub Kicinski commit 62da08331f1a2bef9d0148613133ce8e640a2f8d Author: Leon Romanovsky Date: Mon Jul 31 14:58:42 2023 +0300 net/mlx5e: Set proper IPsec source port in L4 selector Fix typo in setup_fte_upper_proto_match() where destination UDP port was used instead of source port. Fixes: a7385187a386 ("net/mlx5e: IPsec, support upper protocol selector field offload") Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/ffc024a4d192113103f392b0502688366ca88c1f.1690803944.git.leonro@nvidia.com Signed-off-by: Jakub Kicinski commit c635ca45a7a2023904a1f851e99319af7b87017d Author: Jianbo Liu Date: Mon Jul 31 14:58:41 2023 +0300 net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio In the cited commit, new type of FS_TYPE_PRIO_CHAINS fs_prio was added to support multiple parallel namespaces for multi-chains. And we skip all the flow tables under the fs_node of this type unconditionally, when searching for the next or previous flow table to connect for a new table. As this search function is also used for find new root table when the old one is being deleted, it will skip the entire FS_TYPE_PRIO_CHAINS fs_node next to the old root. However, new root table should be chosen from it if there is any table in it. Fix it by skipping only the flow tables in the same FS_TYPE_PRIO_CHAINS fs_node when finding the closest FT for a fs_node. Besides, complete the connecting from FTs of previous priority of prio because there should be multiple prevs after this fs_prio type is introduced. And also the next FT should be chosen from the first flow table next to the prio in the same FS_TYPE_PRIO_CHAINS fs_prio, if this prio is the first child. Fixes: 328edb499f99 ("net/mlx5: Split FDB fast path prio to multiple namespaces") Signed-off-by: Jianbo Liu Reviewed-by: Paul Blakey Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/7a95754df479e722038996c97c97b062b372591f.1690803944.git.leonro@nvidia.com Signed-off-by: Jakub Kicinski commit 618d28a535a0582617465d14e05f3881736a2962 Author: Jianbo Liu Date: Mon Jul 31 14:58:40 2023 +0300 net/mlx5: fs_core: Make find_closest_ft more generic As find_closest_ft_recursive is called to find the closest FT, the first parameter of find_closest_ft can be changed from fs_prio to fs_node. Thus this function is extended to find the closest FT for the nodes of any type, not only prios, but also the sub namespaces. Signed-off-by: Jianbo Liu Signed-off-by: Leon Romanovsky Link: https://lore.kernel.org/r/d3962c2b443ec8dde7a740dc742a1f052d5e256c.1690803944.git.leonro@nvidia.com Signed-off-by: Jakub Kicinski commit ec351c8f2e6211054e51e661589cddd1fe856425 Merge: a4e98a30bc958 d21afb098c510 Author: Linus Torvalds Date: Wed Aug 2 18:21:12 2023 -0700 Merge tag 'soc-fixes-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "A couple of platforms get a lone dts fix each: - SoCFPGA: Fix incorrect I2C property for SCL signal - Renesas: Fix interrupt names for MTU3 channels on RZ/G2L and RZ/V2L. - Juno/Vexpress: remove a dangling symlink - at91: sam9x60 SoC detection compatible strings - nspire: Fix arm primecell compatible string On the NXP i.MX platform, there multiple issues that get addressed: - A couple of ARM DTS fixes for i.MX6SLL usbphy and supported CPU frequency of sk-imx53 board - Add missing pull-up for imx8mn-var-som onboard PHY reset pinmux - A couple of imx8mm-venice fixes from Tim Harvey to diable disp_blk_ctrl - A couple of phycore-imx8mm fixes from Yashwanth Varakala to correct VPU label and gpio-line-names - Fix imx8mp-blk-ctrl driver to register HSIO PLL clock as bus_power_dev child, so that runtime PM can translate into the necessary GPC power domain action On the driver side, there are two fixes for tegra memory controller drivers addressing regressions from the merge window, a couple of minor correctness fixes for SCMI and SMCCC firmware, as well as a build fix for an lcd backlight driver" * tag 'soc-fixes-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (22 commits) backlight: corgi_lcd: fix missing prototype memory: tegra: make icc_set_bw return zero if BWMGR not supported arm64: dts: renesas: rzg2l: Update overfow/underflow IRQ names for MTU3 channels dt-bindings: serial: atmel,at91-usart: update compatible for sam9x60 ARM: dts: at91: sam9x60: fix the SOC detection ARM: dts: nspire: Fix arm primecell compatible string firmware: arm_scmi: Fix chan_free cleanup on SMC firmware: arm_scmi: Drop OF node reference in the transport channel setup soc: imx: imx8mp-blk-ctrl: register HSIO PLL clock as bus_power_dev child ARM: dts: nxp/imx: limit sk-imx53 supported frequencies firmware: arm_scmi: Fix signed error return values handling firmware: smccc: Fix use of uninitialised results structure arm64: dts: freescale: Fix VPU G2 clock arm64: dts: imx8mn-var-som: add missing pull-up for onboard PHY reset pinmux arm64: dts: phycore-imx8mm: Correction in gpio-line-names arm64: dts: phycore-imx8mm: Label typo-fix of VPU ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node arm64: dts: imx8mm-venice-gw7904: disable disp_blk_ctrl arm64: dts: imx8mm-venice-gw7903: disable disp_blk_ctrl arm64: dts: arm: Remove the dangling vexpress-v2m-rs1.dtsi symlink ... commit a4e98a30bc958694579dd5346aa6fcd38b5afe86 Merge: 4b954598a47ba 2356d198d2b4d Author: Linus Torvalds Date: Wed Aug 2 18:10:26 2023 -0700 Merge tag 'bitmap-6.5-rc5' of https://github.com:/norov/linux Pull bitmap fixes from Yury Norov: - Fix for bitmap documentation - Fix for kernel build under certain configurations * tag 'bitmap-6.5-rc5' of https://github.com:/norov/linux: lib/bitmap: workaround const_eval test build failure cpumask: eliminate kernel-doc warnings commit 6ad0f2f91ad14ba0a3c2990c054fd6fbe8100429 Author: YueHaibing Date: Tue Jul 25 22:21:08 2023 +0800 Drivers: hv: vmbus: Remove unused extern declaration vmbus_ontimer() Since commit 30fbee49b071 ("Staging: hv: vmbus: Get rid of the unused function vmbus_ontimer()") this is not used anymore, so can remove it. Signed-off-by: YueHaibing Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20230725142108.27280-1-yuehaibing@huawei.com Signed-off-by: Wei Liu commit 9e2d0c336524706fb327e9b87477f5f3337ad7a6 Author: Saurabh Sengar Date: Fri Jun 23 09:28:08 2023 -0700 x86/hyperv: add noop functions to x86_init mpparse functions Hyper-V can run VMs at different privilege "levels" known as Virtual Trust Levels (VTL). Sometimes, it chooses to run two different VMs at different levels but they share some of their address space. In such setups VTL2 (higher level VM) has visibility of all of the VTL0 (level 0) memory space. When the CONFIG_X86_MPPARSE is enabled for VTL2, the VTL2 kernel performs a search within the low memory to locate MP tables. However, in systems where VTL0 manages the low memory and may contain valid tables, this scanning can result in incorrect MP table information being provided to the VTL2 kernel, mistakenly considering VTL0's MP table as its own Add noop functions to avoid MP parse scan by VTL2. Signed-off-by: Saurabh Sengar Acked-by: Dave Hansen Link: https://lore.kernel.org/r/1687537688-5397-1-git-send-email-ssengar@linux.microsoft.com Signed-off-by: Wei Liu commit 640c503d7dbd7d34a62099c933f4db0ed77ccbec Author: Song Shuai Date: Mon Jul 24 18:09:17 2023 +0800 Documentation: kdump: Add va_kernel_pa_offset for RISCV64 RISC-V Linux exports "va_kernel_pa_offset" in vmcoreinfo to help Crash-utility translate the kernel virtual address correctly. Here adds the definition of "va_kernel_pa_offset". Fixes: 3335068f8721 ("riscv: Use PUD/P4D/PGD pages for the linear mapping") Link: https://lore.kernel.org/linux-riscv/20230724040649.220279-1-suagrfillet@gmail.com/ Signed-off-by: Song Shuai Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230724100917.309061-2-suagrfillet@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit fbe7d19d2b7fcbd38905ba9f691be8f245c6faa6 Author: Song Shuai Date: Mon Jul 24 18:09:16 2023 +0800 riscv: Export va_kernel_pa_offset in vmcoreinfo Since RISC-V Linux v6.4, the commit 3335068f8721 ("riscv: Use PUD/P4D/PGD pages for the linear mapping") changes phys_ram_base from the physical start of the kernel to the actual start of the DRAM. The Crash-utility's VTOP() still uses phys_ram_base and kernel_map.virt_addr to translate kernel virtual address, that failed the Crash with Linux v6.4 [1]. Export kernel_map.va_kernel_pa_offset in vmcoreinfo to help Crash translate the kernel virtual address correctly. Fixes: 3335068f8721 ("riscv: Use PUD/P4D/PGD pages for the linear mapping") Link: https://lore.kernel.org/linux-riscv/20230724040649.220279-1-suagrfillet@gmail.com/ [1] Signed-off-by: Song Shuai Reviewed-by: Xianting Tian  Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230724100917.309061-1-suagrfillet@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 568701fee36652a7660ed667a3980c945d8051e0 Author: Sunil V L Date: Mon Jul 24 15:33:46 2023 +0530 RISC-V: ACPI: Fix acpi_os_ioremap to return iomem address acpi_os_ioremap() currently is a wrapper to memremap() on RISC-V. But the callers of acpi_os_ioremap() expect it to return __iomem address and hence sparse tool reports a new warning. Fix this issue by type casting to __iomem type. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202307230357.egcTAefj-lkp@intel.com/ Fixes: a91a9ffbd3a5 ("RISC-V: Add support to build the ACPI core") Signed-off-by: Sunil V L Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230724100346.1302937-1-sunilvl@ventanamicro.com Signed-off-by: Palmer Dabbelt commit 25696067202f047e22c1562f1f56b0e2eb547d1a Author: Alexandre Ghiti Date: Thu Jul 13 13:58:29 2023 +0200 selftests: riscv: Fix compilation error with vstate_exec_nolibc.c The following error happens: In file included from vstate_exec_nolibc.c:2: /usr/include/riscv64-linux-gnu/sys/prctl.h:42:12: error: conflicting types for ‘prctl’; h ave ‘int(int, ...)’ 42 | extern int prctl (int __option, ...) __THROW; | ^~~~~ In file included from ./../../../../include/nolibc/nolibc.h:99, from : ./../../../../include/nolibc/sys.h:892:5: note: previous definition of ‘prctl’ with type ‘int(int, long unsigned int, long unsigned int, long unsigned int, long unsigned int) ’ 892 | int prctl(int option, unsigned long arg2, unsigned long arg3, | ^~~~~ Fix this by not including , which is not needed here since prctl syscall is directly called using its number. Fixes: 7cf6198ce22d ("selftests: Test RISC-V Vector prctl interface") Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230713115829.110421-1-alexghiti@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 8c82d2bf5944123d8e90d01bf27655497d9aa321 Author: John Hubbard Date: Wed Jul 12 12:35:14 2023 -0700 selftests/riscv: fix potential build failure during the "emit_tests" step The riscv selftests (which were modeled after the arm64 selftests) are improperly declaring the "emit_tests" target to depend upon the "all" target. This approach, when combined with commit 9fc96c7c19df ("selftests: error out if kernel header files are not yet built"), has caused build failures [1] on arm64, and is likely to cause similar failures for riscv. To fix this, simply remove the unnecessary "all" dependency from the emit_tests target. The dependency is still effectively honored, because again, invocation is via "install", which also depends upon "all". An alternative approach would be to harden the emit_tests target so that it can depend upon "all", but that's a lot more complicated and hard to get right, and doesn't seem worth it, especially given that emit_tests should probably not be overridden at all. [1] https://lore.kernel.org/20230710-kselftest-fix-arm64-v1-1-48e872844f25@kernel.org Fixes: 9fc96c7c19df ("selftests: error out if kernel header files are not yet built") Signed-off-by: John Hubbard Tested-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20230712193514.740033-1-jhubbard@nvidia.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 4b954598a47ba07034aab9af8ddd485bdc3d5b16 Merge: 79d65ee53b968 ff84772fd45d4 Author: Linus Torvalds Date: Wed Aug 2 11:43:06 2023 -0700 Merge tag 'exfat-for-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat fixes from Namjae Jeon: - Fix page allocation failure from allocation bitmap by using kvmalloc_array/kvfree - Add the check to validate if filename entries exceeds max filename length - Fix potential deadlock condition from dir_emit*() * tag 'exfat-for-6.5-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: release s_lock before calling dir_emit() exfat: check if filename entries exceeds max filename length exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree commit 11260c3d608b59231f4c228147a795ab21a10b33 Author: Paulo Alcantara Date: Wed Aug 2 13:43:03 2023 -0300 smb: client: fix dfs link mount against w2k8 Customer reported that they couldn't mount their DFS link that was seen by the client as a DFS interlink -- special form of DFS link where its single target may point to a different DFS namespace -- and it turned out that it was just a regular DFS link where its referral header flags missed the StorageServers bit thus making the client think it couldn't tree connect to target directly without requiring further referrals. When the DFS link referral header flags misses the StoraServers bit and its target doesn't respond to any referrals, then tree connect to it. Fixes: a1c0d00572fc ("cifs: share dfs connections and supers") Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 79d65ee53b968c006ad382a4d4c2dccd898706f9 Merge: 79e8328e5acbe d4e0265345778 Author: Linus Torvalds Date: Wed Aug 2 11:04:27 2023 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Three small fixes, all in drivers" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: pm80xx: Fix error return code in pm8001_pci_probe() scsi: zfcp: Defer fc_rport blocking until after ADISC response scsi: storvsc: Limit max_sectors for virtual Fibre Channel devices commit 79e8328e5acbe691bbde029a52c89d70dcbc22f3 Author: ndesaulniers@google.com Date: Tue Aug 1 15:22:17 2023 -0700 word-at-a-time: use the same return type for has_zero regardless of endianness Compiling big-endian targets with Clang produces the diagnostic: fs/namei.c:2173:13: warning: use of bitwise '|' with boolean operands [-Wbitwise-instead-of-logical] } while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants))); ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ || fs/namei.c:2173:13: note: cast one or both operands to int to silence this warning It appears that when has_zero was introduced, two definitions were produced with different signatures (in particular different return types). Looking at the usage in hash_name() in fs/namei.c, I suspect that has_zero() is meant to be invoked twice per while loop iteration; using logical-or would not update `bdata` when `a` did not have zeros. So I think it's preferred to always return an unsigned long rather than a bool than update the while loop in hash_name() to use a logical-or rather than bitwise-or. [ Also changed powerpc version to do the same - Linus ] Link: https://github.com/ClangBuiltLinux/linux/issues/1832 Link: https://lore.kernel.org/lkml/20230801-bitwise-v1-1-799bec468dc4@google.com/ Fixes: 36126f8f2ed8 ("word-at-a-time: make the interfaces truly generic") Debugged-by: Nathan Chancellor Signed-off-by: Nick Desaulniers Acked-by: Heiko Carstens Cc: Arnd Bergmann Signed-off-by: Linus Torvalds commit 86582e6189dd8f9f52c25d46c70fe5d111da6345 Author: Benjamin Gray Date: Thu Jul 6 11:08:16 2023 +1000 powerpc/powermac: Use early_* IO variants in via_calibrate_decr() On a powermac platform, via the call path: start_kernel() time_init() ppc_md.calibrate_decr() (pmac_calibrate_decr) via_calibrate_decr() ioremap() and iounmap() are called. The unmap can enable interrupts unexpectedly (cond_resched() in vunmap_pmd_range()), which causes a warning later in the boot sequence in start_kernel(). Use the early_* variants of these IO functions to prevent this. The issue is pre-existing, but is surfaced by commit 721255b9826b ("genirq: Use a maple tree for interrupt descriptor management"). Signed-off-by: Benjamin Gray Reviewed-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://msgid.link/20230706010816.72682-1-bgray@linux.ibm.com commit 16e455a465fca91907af0108f3d013150386df30 Author: Hans de Goede Date: Sat Jul 29 16:05:00 2023 +0200 wifi: brcmfmac: Fix field-spanning write in brcmf_scan_params_v2_to_v1() Using brcmfmac with 6.5-rc3 on a brcmfmac43241b4-sdio triggers a backtrace caused by the following field-spanning warning: memcpy: detected field-spanning write (size 120) of single field "¶ms_le->channel_list[0]" at drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1072 (size 2) The driver still works after this warning. The warning was introduced by the new field-spanning write checks which were enabled recently. Fix this by replacing the channel_list[1] declaration at the end of the struct with a flexible array declaration. Most users of struct brcmf_scan_params_le calculate the size to alloc using the size of the non flex-array part of the struct + needed extra space, so they do not care about sizeof(struct brcmf_scan_params_le). brcmf_notify_escan_complete() however uses the struct on the stack, expecting there to be room for at least 1 entry in the channel-list to store the special -1 abort channel-id. To make this work use an anonymous union with a padding member added + the actual channel_list flexible array. Cc: Kees Cook Signed-off-by: Hans de Goede Reviewed-by: Kees Cook Reviewed-by: Franky Lin Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230729140500.27892-1-hdegoede@redhat.com commit 0756384fb1bd38adb2ebcfd1307422f433a1d772 Author: Benjamin Poirier Date: Mon Jul 31 16:02:08 2023 -0400 vxlan: Fix nexthop hash size The nexthop code expects a 31 bit hash, such as what is returned by fib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash returned by skb_get_hash() can lead to problems related to the fact that 'int hash' is a negative number when the MSB is set. In the case of hash threshold nexthop groups, nexthop_select_path_hthr() will disproportionately select the first nexthop group entry. In the case of resilient nexthop groups, nexthop_select_path_res() may do an out of bounds access in nh_buckets[], for example: hash = -912054133 num_nh_buckets = 2 bucket_index = 65535 which leads to the following panic: BUG: unable to handle page fault for address: ffffc900025910c8 PGD 100000067 P4D 100000067 PUD 10026b067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 4 PID: 856 Comm: kworker/4:3 Not tainted 6.5.0-rc2+ #34 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:nexthop_select_path+0x197/0xbf0 Code: c1 e4 05 be 08 00 00 00 4c 8b 35 a4 14 7e 01 4e 8d 6c 25 00 4a 8d 7c 25 08 48 01 dd e8 c2 25 15 ff 49 8d 7d 08 e8 39 13 15 ff <4d> 89 75 08 48 89 ef e8 7d 12 15 ff 48 8b 5d 00 e8 14 55 2f 00 85 RSP: 0018:ffff88810c36f260 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000002000c0 RCX: ffffffffaf02dd77 RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffc900025910c8 RBP: ffffc900025910c0 R08: 0000000000000001 R09: fffff520004b2219 R10: ffffc900025910cf R11: 31392d2068736168 R12: 00000000002000c0 R13: ffffc900025910c0 R14: 00000000fffef608 R15: ffff88811840e900 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc900025910c8 CR3: 0000000129d00000 CR4: 0000000000750ee0 PKRU: 55555554 Call Trace: ? __die+0x23/0x70 ? page_fault_oops+0x1ee/0x5c0 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ? __pfx_page_fault_oops+0x10/0x10 ? search_bpf_extables+0xfe/0x1c0 ? fixup_exception+0x3b/0x470 ? exc_page_fault+0xf6/0x110 ? asm_exc_page_fault+0x26/0x30 ? nexthop_select_path+0x197/0xbf0 ? nexthop_select_path+0x197/0xbf0 ? lock_is_held_type+0xe7/0x140 vxlan_xmit+0x5b2/0x2340 ? __lock_acquire+0x92b/0x3370 ? __pfx_vxlan_xmit+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_register_lock_class+0x10/0x10 ? skb_network_protocol+0xce/0x2d0 ? dev_hard_start_xmit+0xca/0x350 ? __pfx_vxlan_xmit+0x10/0x10 dev_hard_start_xmit+0xca/0x350 __dev_queue_xmit+0x513/0x1e20 ? __pfx___dev_queue_xmit+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? mark_held_locks+0x44/0x90 ? skb_push+0x4c/0x80 ? eth_header+0x81/0xe0 ? __pfx_eth_header+0x10/0x10 ? neigh_resolve_output+0x215/0x310 ? ip6_finish_output2+0x2ba/0xc90 ip6_finish_output2+0x2ba/0xc90 ? lock_release+0x236/0x3e0 ? ip6_mtu+0xbb/0x240 ? __pfx_ip6_finish_output2+0x10/0x10 ? find_held_lock+0x83/0xa0 ? lock_is_held_type+0xe7/0x140 ip6_finish_output+0x1ee/0x780 ip6_output+0x138/0x460 ? __pfx_ip6_output+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_ip6_finish_output+0x10/0x10 NF_HOOK.constprop.0+0xc0/0x420 ? __pfx_NF_HOOK.constprop.0+0x10/0x10 ? ndisc_send_skb+0x2c0/0x960 ? __pfx_lock_release+0x10/0x10 ? __local_bh_enable_ip+0x93/0x110 ? lock_is_held_type+0xe7/0x140 ndisc_send_skb+0x4be/0x960 ? __pfx_ndisc_send_skb+0x10/0x10 ? mark_held_locks+0x65/0x90 ? find_held_lock+0x83/0xa0 ndisc_send_ns+0xb0/0x110 ? __pfx_ndisc_send_ns+0x10/0x10 addrconf_dad_work+0x631/0x8e0 ? lock_acquire+0x180/0x3f0 ? __pfx_addrconf_dad_work+0x10/0x10 ? mark_held_locks+0x24/0x90 process_one_work+0x582/0x9c0 ? __pfx_process_one_work+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 ? mark_held_locks+0x24/0x90 worker_thread+0x93/0x630 ? __kthread_parkme+0xdc/0x100 ? __pfx_worker_thread+0x10/0x10 kthread+0x1a5/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 RIP: 0000:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 0000:0000000000000000 EFLAGS: 00000000 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: CR2: ffffc900025910c8 ---[ end trace 0000000000000000 ]--- RIP: 0010:nexthop_select_path+0x197/0xbf0 Code: c1 e4 05 be 08 00 00 00 4c 8b 35 a4 14 7e 01 4e 8d 6c 25 00 4a 8d 7c 25 08 48 01 dd e8 c2 25 15 ff 49 8d 7d 08 e8 39 13 15 ff <4d> 89 75 08 48 89 ef e8 7d 12 15 ff 48 8b 5d 00 e8 14 55 2f 00 85 RSP: 0018:ffff88810c36f260 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000002000c0 RCX: ffffffffaf02dd77 RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffc900025910c8 RBP: ffffc900025910c0 R08: 0000000000000001 R09: fffff520004b2219 R10: ffffc900025910cf R11: 31392d2068736168 R12: 00000000002000c0 R13: ffffc900025910c0 R14: 00000000fffef608 R15: ffff88811840e900 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 0000000129d00000 CR4: 0000000000750ee0 PKRU: 55555554 Kernel panic - not syncing: Fatal exception in interrupt Kernel Offset: 0x2ca00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- Fix this problem by ensuring the MSB of hash is 0 using a right shift - the same approach used in fib_multipath_hash() and rt6_multipath_hash(). Fixes: 1274e1cc4226 ("vxlan: ecmp support for mac fdb entries") Signed-off-by: Benjamin Poirier Reviewed-by: Ido Schimmel Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 30e0191b16e8a58e4620fa3e2839ddc7b9d4281c Author: Yue Haibing Date: Tue Aug 1 14:43:18 2023 +0800 ip6mr: Fix skb_under_panic in ip6mr_cache_report() skbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:192! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:skb_panic+0x152/0x1d0 Call Trace: skb_push+0xc4/0xe0 ip6mr_cache_report+0xd69/0x19b0 reg_vif_xmit+0x406/0x690 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 vlan_dev_hard_start_xmit+0x3ab/0x5c0 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 neigh_connected_output+0x3ed/0x570 ip6_finish_output2+0x5b5/0x1950 ip6_finish_output+0x693/0x11c0 ip6_output+0x24b/0x880 NF_HOOK.constprop.0+0xfd/0x530 ndisc_send_skb+0x9db/0x1400 ndisc_send_rs+0x12a/0x6c0 addrconf_dad_completed+0x3c9/0xea0 addrconf_dad_work+0x849/0x1420 process_one_work+0xa22/0x16e0 worker_thread+0x679/0x10c0 ret_from_fork+0x28/0x60 ret_from_fork_asm+0x11/0x20 When setup a vlan device on dev pim6reg, DAD ns packet may sent on reg_vif_xmit(). reg_vif_xmit() ip6mr_cache_report() skb_push(skb, -skb_network_offset(pkt));//skb_network_offset(pkt) is 4 And skb_push declared as: void *skb_push(struct sk_buff *skb, unsigned int len); skb->data -= len; //0xffff88805f86a84c - 0xfffffffc = 0xffff887f5f86a850 skb->data is set to 0xffff887f5f86a850, which is invalid mem addr, lead to skb_push() fails. Fixes: 14fb64e1f449 ("[IPV6] MROUTE: Support PIM-SM (SSM).") Signed-off-by: Yue Haibing Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit 1cfef80d4c2b2c599189f36f36320b205d9447d9 Author: Alexandra Winter Date: Tue Aug 1 10:00:16 2023 +0200 s390/qeth: Don't call dev_close/dev_open (DOWN/UP) dev_close() and dev_open() are issued to change the interface state to DOWN or UP (dev->flags IFF_UP). When the netdev is set DOWN it loses e.g its Ipv6 addresses and routes. We don't want this in cases of device recovery (triggered by hardware or software) or when the qeth device is set offline. Setting a qeth device offline or online and device recovery actions call netif_device_detach() and/or netif_device_attach(). That will reset or set the LOWER_UP indication i.e. change the dev->state Bit __LINK_STATE_PRESENT. That is enough to e.g. cause bond failovers, and still preserves the interface settings that are handled by the network stack. Don't call dev_open() nor dev_close() from the qeth device driver. Let the network stack handle this. Fixes: d4560150cb47 ("s390/qeth: call dev_close() during recovery") Signed-off-by: Alexandra Winter Reviewed-by: Wenjia Zhang Signed-off-by: David S. Miller commit 666c135b2d859a00ee74c8645b2affacfae45421 Merge: 31d49ba033095 5c9241f3ceab3 Author: David S. Miller Date: Wed Aug 2 10:06:06 2023 +0100 Merge branch 'tun-tap-uid' Laszlo Ersek says: ==================== tun/tap: set sk_uid from current_fsuid() The original patches fixing CVE-2023-1076 are incorrect in my opinion. This small series fixes them up; see the individual commit messages for explanation. I have a very elaborate test procedure demonstrating the problem for both tun and tap; it involves libvirt, qemu, and "crash". I can share that procedure if necessary, but it's indeed quite long (I wrote it originally for our QE team). The patches in this series are supposed to "re-fix" CVE-2023-1076; given that said CVE is classified as Low Impact (CVSSv3=5.5), I'm posting this publicly, and not suggesting any embargo. Red Hat Product Security may assign a new CVE number later. I've tested the patches on top of v6.5-rc4, with "crash" built at commit c74f375e0ef7. Cc: Eric Dumazet Cc: Lorenzo Colitti Cc: Paolo Abeni Cc: Pietro Borrello Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org ==================== Signed-off-by: David S. Miller commit 5c9241f3ceab3257abe2923a59950db0dc8bb737 Author: Laszlo Ersek Date: Mon Jul 31 18:42:37 2023 +0200 net: tap_open(): set sk_uid from current_fsuid() Commit 66b2c338adce initializes the "sk_uid" field in the protocol socket (struct sock) from the "/dev/tapX" device node's owner UID. Per original commit 86741ec25462 ("net: core: Add a UID field to struct sock.", 2016-11-04), that's wrong: the idea is to cache the UID of the userspace process that creates the socket. Commit 86741ec25462 mentions socket() and accept(); with "tap", the action that creates the socket is open("/dev/tapX"). Therefore the device node's owner UID is irrelevant. In most cases, "/dev/tapX" will be owned by root, so in practice, commit 66b2c338adce has no observable effect: - before, "sk_uid" would be zero, due to undefined behavior (CVE-2023-1076), - after, "sk_uid" would be zero, due to "/dev/tapX" being owned by root. What matters is the (fs)UID of the process performing the open(), so cache that in "sk_uid". Cc: Eric Dumazet Cc: Lorenzo Colitti Cc: Paolo Abeni Cc: Pietro Borrello Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org Fixes: 66b2c338adce ("tap: tap_open(): correctly initialize socket uid") Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2173435 Signed-off-by: Laszlo Ersek Signed-off-by: David S. Miller commit 9bc3047374d5bec163e83e743709e23753376f0c Author: Laszlo Ersek Date: Mon Jul 31 18:42:36 2023 +0200 net: tun_chr_open(): set sk_uid from current_fsuid() Commit a096ccca6e50 initializes the "sk_uid" field in the protocol socket (struct sock) from the "/dev/net/tun" device node's owner UID. Per original commit 86741ec25462 ("net: core: Add a UID field to struct sock.", 2016-11-04), that's wrong: the idea is to cache the UID of the userspace process that creates the socket. Commit 86741ec25462 mentions socket() and accept(); with "tun", the action that creates the socket is open("/dev/net/tun"). Therefore the device node's owner UID is irrelevant. In most cases, "/dev/net/tun" will be owned by root, so in practice, commit a096ccca6e50 has no observable effect: - before, "sk_uid" would be zero, due to undefined behavior (CVE-2023-1076), - after, "sk_uid" would be zero, due to "/dev/net/tun" being owned by root. What matters is the (fs)UID of the process performing the open(), so cache that in "sk_uid". Cc: Eric Dumazet Cc: Lorenzo Colitti Cc: Paolo Abeni Cc: Pietro Borrello Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org Fixes: a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid") Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2173435 Signed-off-by: Laszlo Ersek Signed-off-by: David S. Miller commit c71b7aa8619a0c9700132d0733e33999fb614339 Author: Nikita Travkin Date: Wed Aug 2 11:41:22 2023 +0500 drm/panel: samsung-s6d7aa0: Add MODULE_DEVICE_TABLE The driver can be built as a module, however the lack of the MODULE_DEVICE_TABLE macro prevents it from being automatically probed from the DT in such case. Add the missed macro to make sure the module can load automatically. Fixes: 6810bb390282 ("drm/panel: Add Samsung S6D7AA0 panel controller driver") Signed-off-by: Nikita Travkin Acked-by: Artur Weber Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20230802-gt5-panel-dtable-v1-1-c0a765c175e2@trvn.ru commit 0a8589055936d8feb56477123a8373ac634018fa Author: Damien Le Moal Date: Mon Jul 24 13:23:14 2023 +0900 ata,scsi: do not issue START STOP UNIT on resume During system resume, ata_port_pm_resume() triggers ata EH to 1) Resume the controller 2) Reset and rescan the ports 3) Revalidate devices This EH execution is started asynchronously from ata_port_pm_resume(), which means that when sd_resume() is executed, none or only part of the above processing may have been executed. However, sd_resume() issues a START STOP UNIT to wake up the drive from sleep mode. This command is translated to ATA with ata_scsi_start_stop_xlat() and issued to the device. However, depending on the state of execution of the EH process and revalidation triggerred by ata_port_pm_resume(), two things may happen: 1) The START STOP UNIT fails if it is received before the controller has been reenabled at the beginning of the EH execution. This is visible with error messages like: ata10.00: device reported invalid CHS sector 0 sd 9:0:0:0: [sdc] Start/Stop Unit failed: Result: hostbyte=DID_OK driverbyte=DRIVER_OK sd 9:0:0:0: [sdc] Sense Key : Illegal Request [current] sd 9:0:0:0: [sdc] Add. Sense: Unaligned write command sd 9:0:0:0: PM: dpm_run_callback(): scsi_bus_resume+0x0/0x90 returns -5 sd 9:0:0:0: PM: failed to resume async: error -5 2) The START STOP UNIT command is received while the EH process is on-going, which mean that it is stopped and must wait for its completion, at which point the command is rather useless as the drive is already fully spun up already. This case results also in a significant delay in sd_resume() which is observable by users as the entire system resume completion is delayed. Given that ATA devices will be woken up by libata activity on resume, sd_resume() has no need to issue a START STOP UNIT command, which solves the above mentioned problems. Do not issue this command by introducing the new scsi_device flag no_start_on_resume and setting this flag to 1 in ata_scsi_dev_config(). sd_resume() is modified to issue a START STOP UNIT command only if this flag is not set. Reported-by: Paul Ausbeck Closes: https://bugzilla.kernel.org/show_bug.cgi?id=215880 Fixes: a19a93e4c6a9 ("scsi: core: pm: Rely on the device driver core for async power management") Signed-off-by: Damien Le Moal Tested-by: Tanner Watkins Tested-by: Paul Ausbeck Reviewed-by: Hannes Reinecke Reviewed-by: Bart Van Assche commit 27c146e3de9bb2ac31402660ccea43a374701e68 Merge: 06c2afb862f9d 34539b442b3bc Author: Tony Lindgren Date: Wed Aug 2 10:49:57 2023 +0300 Merge branch 'omap-for-v6.5/ti-sysc' into omap-for-v6.5/fixes Merge in a missed change into fixes. Signed-off-by: Tony Lindgren commit 0bc057eae2610c275361766a064a23cc2758f3ff Merge: a337b64f0d571 46d14e1709523 Author: Tvrtko Ursulin Date: Wed Aug 2 08:14:57 2023 +0100 Merge tag 'gvt-fixes-2023-08-02' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2023-08-02 - Fix bug to get AUX CH register message length (Yan) Signed-off-by: Tvrtko Ursulin From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/ZMnvf46JqgeIuTir@debian-scheme commit e6e2843230799230fc5deb8279728a7218b0d63c Author: Ilya Dryomov Date: Tue Aug 1 19:14:24 2023 +0200 libceph: fix potential hang in ceph_osdc_notify() If the cluster becomes unavailable, ceph_osdc_notify() may hang even with osd_request_timeout option set because linger_notify_finish_wait() waits for MWatchNotify NOTIFY_COMPLETE message with no associated OSD request in flight -- it's completely asynchronous. Introduce an additional timeout, derived from the specified notify timeout. While at it, switch both waits to killable which is more correct. Cc: stable@vger.kernel.org Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang Reviewed-by: Xiubo Li commit 9d01e07fd1bfb4daae156ab528aa196f5ac2b2bc Author: Ilya Dryomov Date: Tue Aug 1 19:14:24 2023 +0200 rbd: prevent busy loop when requesting exclusive lock Due to rbd_try_acquire_lock() effectively swallowing all but EBLOCKLISTED error from rbd_try_lock() ("request lock anyway") and rbd_request_lock() returning ETIMEDOUT error not only for an actual notify timeout but also when the lock owner doesn't respond, a busy loop inside of rbd_acquire_lock() between rbd_try_acquire_lock() and rbd_request_lock() is possible. Requesting the lock on EBUSY error (returned by get_lock_owner_info() if an incompatible lock or invalid lock owner is detected) makes very little sense. The same goes for ETIMEDOUT error (might pop up pretty much anywhere if osd_request_timeout option is set) and many others. Just fail I/O requests on rbd_dev->acquiring_list immediately on any error from rbd_try_lock(). Cc: stable@vger.kernel.org # 588159009d5b: rbd: retrieve and check lock owner twice before blocklisting Cc: stable@vger.kernel.org Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit 31d49ba033095f6e8158c60f69714a500922e0c3 Author: Lin Ma Date: Tue Aug 1 09:32:48 2023 +0800 net: dcb: choose correct policy to parse DCB_ATTR_BCN The dcbnl_bcn_setcfg uses erroneous policy to parse tb[DCB_ATTR_BCN], which is introduced in commit 859ee3c43812 ("DCB: Add support for DCB BCN"). Please see the comment in below code static int dcbnl_bcn_setcfg(...) { ... ret = nla_parse_nested_deprecated(..., dcbnl_pfc_up_nest, .. ) // !!! dcbnl_pfc_up_nest for attributes // DCB_PFC_UP_ATTR_0 to DCB_PFC_UP_ATTR_ALL in enum dcbnl_pfc_up_attrs ... for (i = DCB_BCN_ATTR_RP_0; i <= DCB_BCN_ATTR_RP_7; i++) { // !!! DCB_BCN_ATTR_RP_0 to DCB_BCN_ATTR_RP_7 in enum dcbnl_bcn_attrs ... value_byte = nla_get_u8(data[i]); ... } ... for (i = DCB_BCN_ATTR_BCNA_0; i <= DCB_BCN_ATTR_RI; i++) { // !!! DCB_BCN_ATTR_BCNA_0 to DCB_BCN_ATTR_RI in enum dcbnl_bcn_attrs ... value_int = nla_get_u32(data[i]); ... } ... } That is, the nla_parse_nested_deprecated uses dcbnl_pfc_up_nest attributes to parse nlattr defined in dcbnl_pfc_up_attrs. But the following access code fetch each nlattr as dcbnl_bcn_attrs attributes. By looking up the associated nla_policy for dcbnl_bcn_attrs. We can find the beginning part of these two policies are "same". static const struct nla_policy dcbnl_pfc_up_nest[...] = { [DCB_PFC_UP_ATTR_0] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_1] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_2] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_3] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_4] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_5] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_6] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_7] = {.type = NLA_U8}, [DCB_PFC_UP_ATTR_ALL] = {.type = NLA_FLAG}, }; static const struct nla_policy dcbnl_bcn_nest[...] = { [DCB_BCN_ATTR_RP_0] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_1] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_2] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_3] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_4] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_5] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_6] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_7] = {.type = NLA_U8}, [DCB_BCN_ATTR_RP_ALL] = {.type = NLA_FLAG}, // from here is somewhat different [DCB_BCN_ATTR_BCNA_0] = {.type = NLA_U32}, ... [DCB_BCN_ATTR_ALL] = {.type = NLA_FLAG}, }; Therefore, the current code is buggy and this nla_parse_nested_deprecated could overflow the dcbnl_pfc_up_nest and use the adjacent nla_policy to parse attributes from DCB_BCN_ATTR_BCNA_0. Hence use the correct policy dcbnl_bcn_nest to parse the nested tb[DCB_ATTR_BCN] TLV. Fixes: 859ee3c43812 ("DCB: Add support for DCB BCN") Signed-off-by: Lin Ma Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230801013248.87240-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski commit 1b0fc0345f2852ffe54fb9ae0e12e2ee69ad6a20 Author: Dave Hansen Date: Tue Aug 1 07:31:07 2023 -0700 Documentation/x86: Fix backwards on/off logic about YMM support These options clearly turn *off* XSAVE YMM support. Correct the typo. Reported-by: Ben Hutchings Fixes: 553a5c03e90a ("x86/speculation: Add force option to GDS mitigation") Signed-off-by: Dave Hansen commit e7e607bd00481745550389a29ecabe33e13d67cf Author: Xiubo Li Date: Tue Jul 25 12:03:59 2023 +0800 ceph: defer stopping mdsc delayed_work Flushing the dirty buffer may take a long time if the cluster is overloaded or if there is network issue. So we should ping the MDSs periodically to keep alive, else the MDS will blocklist the kclient. Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/61843 Signed-off-by: Xiubo Li Reviewed-by: Milind Changire Signed-off-by: Ilya Dryomov commit 4a4474e3bf8af318e556c6c9bfa9ce24103d5c8d Merge: 3ff1617450ece 08450ea98ae98 Author: Jakub Kicinski Date: Tue Aug 1 15:05:00 2023 -0700 Merge branch 'bnxt_en-2-xdp-bug-fixes' Michael Chan says: ==================== bnxt_en: 2 XDP bug fixes The first patch fixes XDP page pool logic on systems with page size >= 64K. The second patch fixes the max_mtu setting when an XDP program supporting multi buffers is attached. ==================== Link: https://lore.kernel.org/r/20230731142043.58855-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 08450ea98ae98d5a35145b675b76db616046ea11 Author: Michael Chan Date: Mon Jul 31 07:20:43 2023 -0700 bnxt_en: Fix max_mtu setting for multi-buf XDP The existing code does not allow the MTU to be set to the maximum even after an XDP program supporting multiple buffers is attached. Fix it to set the netdev->max_mtu to the maximum value if the attached XDP program supports mutiple buffers, regardless of the current MTU value. Also use a local variable dev instead of repeatedly using bp->dev. Fixes: 1dc4c557bfed ("bnxt: adding bnxt_xdp_build_skb to build skb from multibuffer xdp_buff") Reviewed-by: Somnath Kotur Reviewed-by: Ajit Khaparde Reviewed-by: Andy Gospodarek Signed-off-by: Michael Chan Link: https://lore.kernel.org/r/20230731142043.58855-3-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit f6974b4c2d8e1062b5a52228ee47293c15b4ee1e Author: Somnath Kotur Date: Mon Jul 31 07:20:42 2023 -0700 bnxt_en: Fix page pool logic for page size >= 64K The RXBD length field on all bnxt chips is 16-bit and so we cannot support a full page when the native page size is 64K or greater. The non-XDP (non page pool) code path has logic to handle this but the XDP page pool code path does not handle this. Add the missing logic to use page_pool_dev_alloc_frag() to allocate 32K chunks if the page size is 64K or greater. Fixes: 9f4b28301ce6 ("bnxt: XDP multibuffer enablement") Link: https://lore.kernel.org/netdev/20230728231829.235716-2-michael.chan@broadcom.com/ Reviewed-by: Andy Gospodarek Signed-off-by: Somnath Kotur Signed-off-by: Michael Chan Link: https://lore.kernel.org/r/20230731142043.58855-2-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 3ff1617450eceb290ac17120fc172815e09a93cf Author: Kuniyuki Iwashima Date: Mon Jul 31 11:15:53 2023 -0700 selftest: net: Assert on a proper value in so_incoming_cpu.c. Dan Carpenter reported an error spotted by Smatch. ./tools/testing/selftests/net/so_incoming_cpu.c:163 create_clients() error: uninitialized symbol 'ret'. The returned value of sched_setaffinity() should be checked with ASSERT_EQ(), but the value was not saved in a proper variable, resulting in an error above. Let's save the returned value of with sched_setaffinity(). Fixes: 6df96146b202 ("selftest: Add test for SO_INCOMING_CPU.") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-kselftest/fe376760-33b6-4fc9-88e8-178e809af1ac@moroto.mountain/ Signed-off-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230731181553.5392-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit f3bb7759a924713bc54d15f6d0d70733b5935fad Author: Mark Brown Date: Mon Jul 31 11:48:32 2023 +0100 net: netsec: Ignore 'phy-mode' on SynQuacer in DT mode As documented in acd7aaf51b20 ("netsec: ignore 'phy-mode' device property on ACPI systems") the SocioNext SynQuacer platform ships with firmware defining the PHY mode as RGMII even though the physical configuration of the PHY is for TX and RX delays. Since bbc4d71d63549bc ("net: phy: realtek: fix rtl8211e rx/tx delay config") this has caused misconfiguration of the PHY, rendering the network unusable. This was worked around for ACPI by ignoring the phy-mode property but the system is also used with DT. For DT instead if we're running on a SynQuacer force a working PHY mode, as well as the standard EDK2 firmware with DT there are also some of these systems that use u-boot and might not initialise the PHY if not netbooting. Newer firmware imagaes for at least EDK2 are available from Linaro so print a warning when doing this. Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver") Signed-off-by: Mark Brown Acked-by: Ard Biesheuvel Acked-by: Ilias Apalodimas Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230731-synquacer-net-v3-1-944be5f06428@kernel.org Signed-off-by: Jakub Kicinski commit 0b6291ad1940c403734312d0e453e8dac9148f69 Author: Yuanjun Gong Date: Mon Jul 31 17:05:35 2023 +0800 net: korina: handle clk prepare error in korina_probe() in korina_probe(), the return value of clk_prepare_enable() should be checked since it might fail. we can use devm_clk_get_optional_enabled() instead of devm_clk_get_optional() and clk_prepare_enable() to automatically handle the error. Fixes: e4cd854ec487 ("net: korina: Get mdio input clock via common clock framework") Signed-off-by: Yuanjun Gong Link: https://lore.kernel.org/r/20230731090535.21416-1-ruc_gongyuanjun@163.com Signed-off-by: Jakub Kicinski commit b99225b4fe297d07400f9e2332ecd7347b224f8d Author: Ross Maynard Date: Mon Jul 31 15:42:04 2023 +1000 USB: zaurus: Add ID for A-300/B-500/C-700 The SL-A300, B500/5600, and C700 devices no longer auto-load because of "usbnet: Remove over-broad module alias from zaurus." This patch adds IDs for those 3 devices. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217632 Fixes: 16adf5d07987 ("usbnet: Remove over-broad module alias from zaurus.") Signed-off-by: Ross Maynard Cc: stable@vger.kernel.org Acked-by: Greg Kroah-Hartman Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/69b5423b-2013-9fc9-9569-58e707d9bafb@bigpond.com Signed-off-by: Jakub Kicinski commit ef45e8400f5bb66b03cc949f76c80e2a118447de Author: Dan Carpenter Date: Mon Jul 31 10:42:32 2023 +0300 net: ll_temac: fix error checking of irq_of_parse_and_map() Most kernel functions return negative error codes but some irq functions return zero on error. In this code irq_of_parse_and_map(), returns zero and platform_get_irq() returns negative error codes. We need to handle both cases appropriately. Fixes: 8425c41d1ef7 ("net: ll_temac: Extend support to non-device-tree platforms") Signed-off-by: Dan Carpenter Acked-by: Esben Haabendal Reviewed-by: Yang Yingliang Reviewed-by: Harini Katakam Link: https://lore.kernel.org/r/3d0aef75-06e0-45a5-a2a6-2cc4738d4143@moroto.mountain Signed-off-by: Jakub Kicinski commit 688b419c57c13637d95d7879e165fff3dec581eb Author: August Wikerfors Date: Wed Nov 16 18:17:27 2022 +0100 nvme-pci: add NVME_QUIRK_BOGUS_NID for Samsung PM9B1 256G and 512G The Samsung PM9B1 512G SSD found in some Lenovo Yoga 7 14ARB7 laptop units reports eui as 0001000200030004 when resuming from s2idle, causing the device to be removed with this error in dmesg: nvme nvme0: identifiers changed for nsid 1 To fix this, add a quirk to ignore namespace identifiers for this device. Signed-off-by: August Wikerfors Signed-off-by: Keith Busch commit 388acb471662c273d94163a8502f09668f380686 Author: Heiko Carstens Date: Mon Jul 31 20:39:26 2023 +0200 s390/ptrace: add missing linux/const.h include Adrian Reber reported the following CRIU build bug after commit b8af5999779d ("s390/ptrace: make all psw related defines also available for asm"): compel/arch/s390/src/lib/infect.c: In function 'arch_can_dump_task': compel/arch/s390/src/lib/infect.c:523:25: error: 'UL' undeclared (first use in this function) 523 | if (psw->mask & PSW_MASK_RI) { | ^~~~~~~~~~~ Add the missing linux/const.h include to fix this. Reported-by: Adrian Reber Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2225745 Link: https://github.com/checkpoint-restore/criu/pull/2232 Tested-by: Adrian Reber Fixes: b8af5999779d ("s390/ptrace: make all psw related defines also available for asm") Link: https://lore.kernel.org/r/20230731183926.330932-1-hca@linux.ibm.com Signed-off-by: Heiko Carstens commit 1d7dd5aa35474e553b8671b58579e0749b560779 Author: Kees Cook Date: Fri Jul 28 16:13:02 2023 -0700 wifi: ray_cs: Replace 1-element array with flexible array The trailing array member of struct tx_buf was defined as a 1-element array, but used as a flexible array. This was resulting in build warnings: In function 'fortify_memset_chk', inlined from 'memset_io' at /kisskb/src/arch/mips/include/asm/io.h:486:2, inlined from 'build_auth_frame' at /kisskb/src/drivers/net/wireless/legacy/ray_cs.c:2697:2: /kisskb/src/include/linux/fortify-string.h:493:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] 493 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Replace it with an actual flexible array. Binary difference comparison shows a single change in output: │ drivers/net/wireless/legacy/ray_cs.c:883 │ lea 0x1c(%rbp),%r13d │ - cmp $0x7c3,%r13d │ + cmp $0x7c4,%r13d This is from: if (len + TX_HEADER_LENGTH > TX_BUF_SIZE) { specifically: #define TX_BUF_SIZE (2048 - sizeof(struct tx_msg)) This appears to have been originally buggy, so the change is correct. Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/all/88f83d73-781d-bdc-126-aa629cb368c@linux-m68k.org Cc: Kalle Valo Cc: linux-wireless@vger.kernel.org Signed-off-by: Kees Cook Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230728231245.never.309-kees@kernel.org commit 16e95a62eed18864aecac404f1e4eed764c363f2 Author: Zhang Rui Date: Tue Jul 25 13:39:12 2023 +0800 powercap: intel_rapl: Fix a sparse warning in TPMI interface Depends on the interface used, the RAPL registers can be either MSR indexes or memory mapped IO addresses. Current RAPL common code uses u64 to save both MSR and memory mapped IO registers. With this, when handling register address with an __iomem annotation, it triggers a sparse warning like below: sparse warnings: (new ones prefixed by >>) >> drivers/powercap/intel_rapl_tpmi.c:141:41: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected unsigned long long [usertype] *tpmi_rapl_regs @@ got void [noderef] __iomem * @@ drivers/powercap/intel_rapl_tpmi.c:141:41: sparse: expected unsigned long long [usertype] *tpmi_rapl_regs drivers/powercap/intel_rapl_tpmi.c:141:41: sparse: got void [noderef] __iomem * Fix the problem by using a union to save the registers instead. Suggested-by: David Laight Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202307031405.dy3druuy-lkp@intel.com/ Tested-by: Wang Wendy Signed-off-by: Zhang Rui [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit 2dc0bc1138eecc88b2c376ccb0b0acb215c25a5c Author: Michael Ellerman Date: Tue Aug 1 20:26:50 2023 +1000 powerpc/64e: Fix secondary thread bringup for ELFv2 kernels When booting on e6500 with an ELF v2 ABI kernel, the secondary threads do not start correctly: [ 0.051118] smp: Bringing up secondary CPUs ... [ 5.072700] Processor 1 is stuck. This occurs because the startup code is written to use function descriptors when loading the entry point for the secondary threads. When building with ELF v2 ABI there are no function descriptors, and the code loads junk values for the entry point address. Fix it by using ppc_function_entry() in C, and DOTSYM() in asm, both of which work correctly for ELF v2 ABI as well as ELF v1 ABI kernels. Fixes: 8c5fa3b5c4df ("powerpc/64: Make ELFv2 the default for big-endian builds") Signed-off-by: Michael Ellerman Link: https://msgid.link/20230801102650.48705-1-mpe@ellerman.id.au commit f3ec2b5d879ef5bbcb24678914641343cb6399a2 Author: Leon Romanovsky Date: Mon Jul 31 14:38:27 2023 +0300 xfrm: don't skip free of empty state in acquire policy In destruction flow, the assignment of NULL to xso->dev caused to skip of xfrm_dev_state_free() call, which was called in xfrm_state_put(to_put) routine. Instead of open-coded variant of xfrm_dev_state_delete() and xfrm_dev_state_free(), let's use them directly. Fixes: f8a70afafc17 ("xfrm: add TX datapath support for IPsec packet offload mode") Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 982c3aca8bac8ae38acdc940e4f1ecec3bffc623 Author: Leon Romanovsky Date: Mon Jul 31 14:38:26 2023 +0300 xfrm: delete offloaded policy The policy memory was released but not HW driver data. Add call to xfrm_dev_policy_delete(), so drivers will have a chance to release their resources. Fixes: 919e43fad516 ("xfrm: add an interface to offload policy") Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit a337b64f0d5717248a0c894e2618e658e6a9de9f Author: Janusz Krzysztofik Date: Thu Jul 20 11:35:44 2023 +0200 drm/i915: Fix premature release of request's reusable memory Infinite waits for completion of GPU activity have been observed in CI, mostly inside __i915_active_wait(), triggered by igt@gem_barrier_race or igt@perf@stress-open-close. Root cause analysis, based of ftrace dumps generated with a lot of extra trace_printk() calls added to the code, revealed loops of request dependencies being accidentally built, preventing the requests from being processed, each waiting for completion of another one's activity. After we substitute a new request for a last active one tracked on a timeline, we set up a dependency of our new request to wait on completion of current activity of that previous one. While doing that, we must take care of keeping the old request still in memory until we use its attributes for setting up that await dependency, or we can happen to set up the await dependency on an unrelated request that already reuses the memory previously allocated to the old one, already released. Combined with perf adding consecutive kernel context remote requests to different user context timelines, unresolvable loops of await dependencies can be built, leading do infinite waits. We obtain a pointer to the previous request to wait upon when we substitute it with a pointer to our new request in an active tracker, e.g. in intel_timeline.last_request. In some processing paths we protect that old request from being freed before we use it by getting a reference to it under RCU protection, but in others, e.g. __i915_request_commit() -> __i915_request_add_to_timeline() -> __i915_request_ensure_ordering(), we don't. But anyway, since the requests' memory is SLAB_FAILSAFE_BY_RCU, that RCU protection is not sufficient against reuse of memory. We could protect i915_request's memory from being prematurely reused by calling its release function via call_rcu() and using rcu_read_lock() consequently, as proposed in v1. However, that approach leads to significant (up to 10 times) increase of SLAB utilization by i915_request SLAB cache. Another potential approach is to take a reference to the previous active fence. When updating an active fence tracker, we first lock the new fence, substitute a pointer of the current active fence with the new one, then we lock the substituted fence. With this approach, there is a time window after the substitution and before the lock when the request can be concurrently released by an interrupt handler and its memory reused, then we may happen to lock and return a new, unrelated request. Always get a reference to the current active fence first, before replacing it with a new one. Having it protected from premature release and reuse, lock it and then replace with the new one but only if not yet signalled via a potential concurrent interrupt nor replaced with another one by a potential concurrent thread, otherwise retry, starting from getting a reference to the new current one. Adjust users to not get a reference to the previous active fence themselves and always put the reference got by __i915_active_fence_set() when no longer needed. v3: Fix lockdep splat reports and other issues caused by incorrect use of try_cmpxchg() (use (cmpxchg() != prev) instead) v2: Protect request's memory by getting a reference to it in favor of delegating its release to call_rcu() (Chris) Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8211 Fixes: df9f85d8582e ("drm/i915: Serialise i915_active_fence_set() with itself") Suggested-by: Chris Wilson Signed-off-by: Janusz Krzysztofik Cc: # v5.6+ Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/20230720093543.832147-2-janusz.krzysztofik@linux.intel.com (cherry picked from commit 946e047a3d88d46d15b5c5af0414098e12b243f7) Signed-off-by: Tvrtko Ursulin commit 6a35f22d222528e1b157c6978c9424d2f8cbe0a1 Author: Andi Shyti Date: Tue Jul 25 02:19:50 2023 +0200 drm/i915/gt: Support aux invalidation on all engines Perform some refactoring with the purpose of keeping in one single place all the operations around the aux table invalidation. With this refactoring add more engines where the invalidation should be performed. Fixes: 972282c4cf24 ("drm/i915/gen12: Add aux table invalidate for all engines") Signed-off-by: Andi Shyti Cc: Jonathan Cavitt Cc: Matt Roper Cc: # v5.8+ Reviewed-by: Andrzej Hajda Link: https://patchwork.freedesktop.org/patch/msgid/20230725001950.1014671-8-andi.shyti@linux.intel.com (cherry picked from commit 76ff7789d6e63d1a10b3b58f5c70b2e640c7a880) Signed-off-by: Tvrtko Ursulin commit 0fde2f23516a00fd90dfb980b66b4665fcbfa659 Author: Jonathan Cavitt Date: Tue Jul 25 02:19:49 2023 +0200 drm/i915/gt: Poll aux invalidation register bit on invalidation For platforms that use Aux CCS, wait for aux invalidation to complete by checking the aux invalidation register bit is cleared. Fixes: 972282c4cf24 ("drm/i915/gen12: Add aux table invalidate for all engines") Signed-off-by: Jonathan Cavitt Signed-off-by: Andi Shyti Cc: # v5.8+ Reviewed-by: Nirmoy Das Reviewed-by: Andrzej Hajda Reviewed-by: Matt Roper Link: https://patchwork.freedesktop.org/patch/msgid/20230725001950.1014671-7-andi.shyti@linux.intel.com (cherry picked from commit d459c86f00aa98028d155a012c65dc42f7c37e76) Signed-off-by: Tvrtko Ursulin commit 824df77ab2107d8d4740b834b276681a41ae1ac8 Author: Andi Shyti Date: Tue Jul 25 02:19:48 2023 +0200 drm/i915/gt: Enable the CCS_FLUSH bit in the pipe control and in the CS Enable the CCS_FLUSH bit 13 in the control pipe for render and compute engines in platforms starting from Meteor Lake (BSPEC 43904 and 47112). For the copy engine add MI_FLUSH_DW_CCS (bit 16) in the command streamer. Fixes: 972282c4cf24 ("drm/i915/gen12: Add aux table invalidate for all engines") Requires: 8da173db894a ("drm/i915/gt: Rename flags with bit_group_X according to the datasheet") Signed-off-by: Andi Shyti Cc: Jonathan Cavitt Cc: Nirmoy Das Cc: # v5.8+ Reviewed-by: Matt Roper Reviewed-by: Andrzej Hajda Reviewed-by: Nirmoy Das Link: https://patchwork.freedesktop.org/patch/msgid/20230725001950.1014671-6-andi.shyti@linux.intel.com (cherry picked from commit b70df82b428774875c7c56d3808102165891547c) Signed-off-by: Tvrtko Ursulin commit 592b228f12e15867a63e3a6eeeb54c5c12662a62 Author: Andi Shyti Date: Tue Jul 25 02:19:47 2023 +0200 drm/i915/gt: Rename flags with bit_group_X according to the datasheet In preparation of the next patch align with the datasheet (BSPEC 47112) with the naming of the pipe control set of flag values. The variable "flags" in gen12_emit_flush_rcs() is applied as a set of flags called Bit Group 1. Define also the Bit Group 0 as bit_group_0 where currently only PIPE_CONTROL0_HDC_PIPELINE_FLUSH bit is set. Signed-off-by: Andi Shyti Cc: # v5.8+ Reviewed-by: Matt Roper Reviewed-by: Andrzej Hajda Reviewed-by: Nirmoy Das Link: https://patchwork.freedesktop.org/patch/msgid/20230725001950.1014671-5-andi.shyti@linux.intel.com (cherry picked from commit f2dcd21d5a22e13f2fbfe7ab65149038b93cf2ff) Signed-off-by: Tvrtko Ursulin commit 78a6ccd65fa3a7cc697810db079cc4b84dff03d5 Author: Jonathan Cavitt Date: Tue Jul 25 02:19:46 2023 +0200 drm/i915/gt: Ensure memory quiesced before invalidation All memory traffic must be quiesced before requesting an aux invalidation on platforms that use Aux CCS. Fixes: 972282c4cf24 ("drm/i915/gen12: Add aux table invalidate for all engines") Requires: a2a4aa0eef3b ("drm/i915: Add the gen12_needs_ccs_aux_inv helper") Signed-off-by: Jonathan Cavitt Signed-off-by: Andi Shyti Cc: # v5.8+ Reviewed-by: Nirmoy Das Reviewed-by: Andrzej Hajda Link: https://patchwork.freedesktop.org/patch/msgid/20230725001950.1014671-4-andi.shyti@linux.intel.com (cherry picked from commit ad8ebf12217e451cd19804b1c3e97ad56491c74a) Signed-off-by: Tvrtko Ursulin commit b2f59e9026038a5bbcbc0019fa58f963138211ee Author: Andi Shyti Date: Tue Jul 25 02:19:45 2023 +0200 drm/i915: Add the gen12_needs_ccs_aux_inv helper We always assumed that a device might either have AUX or FLAT CCS, but this is an approximation that is not always true, e.g. PVC represents an exception. Set the basis for future finer selection by implementing a boolean gen12_needs_ccs_aux_inv() function that tells whether aux invalidation is needed or not. Currently PVC is the only exception to the above mentioned rule. Requires: 059ae7ae2a1c ("drm/i915/gt: Cleanup aux invalidation registers") Signed-off-by: Andi Shyti Cc: Matt Roper Cc: Jonathan Cavitt Cc: # v5.8+ Reviewed-by: Matt Roper Reviewed-by: Andrzej Hajda Reviewed-by: Nirmoy Das Link: https://patchwork.freedesktop.org/patch/msgid/20230725001950.1014671-3-andi.shyti@linux.intel.com (cherry picked from commit c827655b87ad201ebe36f2e28d16b5491c8f7801) Signed-off-by: Tvrtko Ursulin commit d14560ac1b595aa2e792365e91fea6aeaee66c2b Author: Andi Shyti Date: Tue Jul 25 02:19:44 2023 +0200 drm/i915/gt: Cleanup aux invalidation registers Fix the 'NV' definition postfix that is supposed to be INV. Take the chance to also order properly the registers based on their address and call the GEN12_GFX_CCS_AUX_INV address as GEN12_CCS_AUX_INV like all the other similar registers. Remove also VD1, VD3 and VE1 registers that don't exist and add BCS0 and CCS0. Signed-off-by: Andi Shyti Cc: # v5.8+ Reviewed-by: Nirmoy Das Reviewed-by: Andrzej Hajda Link: https://patchwork.freedesktop.org/patch/msgid/20230725001950.1014671-2-andi.shyti@linux.intel.com (cherry picked from commit 2f0b927d3ca3440445975ebde27f3df1c3ed6f76) Signed-off-by: Tvrtko Ursulin commit 4da3c7183e186afe8196160f16d5a0248a24e45d Author: Gao Xiang Date: Tue Aug 1 09:47:37 2023 +0800 erofs: drop unnecessary WARN_ON() in erofs_kill_sb() Previously, .kill_sb() will be called only after fill_super fails. It will be changed [1]. Besides, checking for s_magic in erofs_kill_sb() is unnecessary from any point of view. Let's get rid of it now. [1] https://lore.kernel.org/r/20230731-flugbereit-wohnlage-78acdf95ab7e@brauner Signed-off-by: Gao Xiang Reviewed-by: Christoph Hellwig Acked-by: Christian Brauner Link: https://lore.kernel.org/r/20230801014737.28614-1-hsiangkao@linux.alibaba.com commit 94c43de73521d8ed7ebcfc6191d9dace1cbf7caa Author: Gao Xiang Date: Wed Jul 19 14:54:59 2023 +0800 erofs: fix wrong primary bvec selection on deduplicated extents When handling deduplicated compressed data, there can be multiple decompressed extents pointing to the same compressed data in one shot. In such cases, the bvecs which belong to the longest extent will be selected as the primary bvecs for real decompressors to decode and the other duplicated bvecs will be directly copied from the primary bvecs. Previously, only relative offsets of the longest extent were checked to decompress the primary bvecs. On rare occasions, it can be incorrect if there are several extents with the same start relative offset. As a result, some short bvecs could be selected for decompression and then cause data corruption. For example, as Shijie Sun reported off-list, considering the following extents of a file: 117: 903345.. 915250 | 11905 : 385024.. 389120 | 4096 ... 119: 919729.. 930323 | 10594 : 385024.. 389120 | 4096 ... 124: 968881.. 980786 | 11905 : 385024.. 389120 | 4096 The start relative offset is the same: 2225, but extent 119 (919729.. 930323) is shorter than the others. Let's restrict the bvec length in addition to the start offset if bvecs are not full. Reported-by: Shijie Sun Fixes: 5c2a64252c5d ("erofs: introduce partial-referenced pclusters") Tested-by Shijie Sun Reviewed-by: Yue Hu Reviewed-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20230719065459.60083-1-hsiangkao@linux.alibaba.com commit 13d2618b48f15966d1adfe1ff6a1985f5eef40ba Author: Tomas Glozar Date: Fri Jul 28 08:44:11 2023 +0200 bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire Disabling preemption in sock_map_sk_acquire conflicts with GFP_ATOMIC allocation later in sk_psock_init_link on PREEMPT_RT kernels, since GFP_ATOMIC might sleep on RT (see bpf: Make BPF and PREEMPT_RT co-exist patchset notes for details). This causes calling bpf_map_update_elem on BPF_MAP_TYPE_SOCKMAP maps to BUG (sleeping function called from invalid context) on RT kernels. preempt_disable was introduced together with lock_sk and rcu_read_lock in commit 99ba2b5aba24e ("bpf: sockhash, disallow bpf_tcp_close and update in parallel"), probably to match disabled migration of BPF programs, and is no longer necessary. Remove preempt_disable to fix BUG in sock_map_update_common on RT. Signed-off-by: Tomas Glozar Reviewed-by: Jakub Sitnicki Link: https://lore.kernel.org/all/20200224140131.461979697@linutronix.de/ Fixes: 99ba2b5aba24 ("bpf: sockhash, disallow bpf_tcp_close and update in parallel") Reviewed-by: John Fastabend Link: https://lore.kernel.org/r/20230728064411.305576-1-tglozar@redhat.com Signed-off-by: Paolo Abeni commit 1ef2c2df11997b8135f34adcf2c200d3b4aacbe9 Author: Tony Lindgren Date: Tue Jul 25 08:42:12 2023 +0300 serial: core: Fix serial core controller port name to show controller id We are missing the serial core controller id for the serial core port name. Let's fix the issue for sane sysfs output, and to avoid issues addressing serial ports later on. And as we're now showing the controller id, the "ctrl" and "port" prefix for the DEVNAME become useless, we can just drop them. Let's standardize on DEVNAME:0 for controller name, where 0 is the controller id. And DEVNAME:0.0 for port name, where 0.0 are the controller id and port id. This makes the sysfs output nicer, on qemu for example: $ ls /sys/bus/serial-base/devices 00:04:0 serial8250:0 serial8250:0.2 00:04:0.0 serial8250:0.1 serial8250:0.3 Fixes: 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM") Reported-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Signed-off-by: Tony Lindgren Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230725054216.45696-4-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit d962de6ae51f9b76ad736220077cda83084090b1 Author: Tony Lindgren Date: Tue Jul 25 08:42:11 2023 +0300 serial: core: Fix serial core port id to not use port->line The serial core port id should be serial core controller specific port instance, which is not always the port->line index. For example, 8250 driver maps a number of legacy ports, and when a hardware specific device driver takes over, we typically have one driver instance for each port. Let's instead add port->port_id to keep track serial ports mapped to each serial core controller instance. Currently this is only a cosmetic issue for the serial core port device names. The issue can be noticed looking at /sys/bus/serial-base/devices for example though. Let's fix the issue to avoid port addressing issues later on. Fixes: 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM") Reviewed-by: Andy Shevchenko Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20230725054216.45696-3-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit 83c35180abfdfb22f3d7703b0c85ad2d442ed2c5 Author: Tony Lindgren Date: Tue Jul 25 08:42:10 2023 +0300 serial: core: Controller id cannot be negative The controller id cannot be negative. Let's fix the ctrl_id in preparation for adding port_id to fix the device name. Fixes: 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM") Reported-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20230725054216.45696-2-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit 282069845af388b08d622ad192b831dcd0549c62 Author: Sherry Sun Date: Tue Aug 1 10:23:04 2023 +0800 tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms Do not read the data register to clear the error flags for lpuart32 platforms, the additional read may cause the receive FIFO underflow since the DMA has already read the data register. Actually all lpuart32 platforms support write 1 to clear those error bits, let's use this method to better clear the error flags. Fixes: 42b68768e51b ("serial: fsl_lpuart: DMA support for 32-bit variant") Cc: stable Signed-off-by: Sherry Sun Link: https://lore.kernel.org/r/20230801022304.24251-1-sherry.sun@nxp.com Signed-off-by: Greg Kroah-Hartman commit 07d2b820fd75b96f550c93503f19c8cfcbc577cf Author: Ian Rogers Date: Thu Jul 6 11:37:05 2023 -0700 perf test parse-events: Test complex name has required event format test__checkevent_complex_name will use an "event" format which if not present, such as with a placeholder PMU, will cause test failures. Skip the test in this case to avoid failures in restricted environments. Add perf_pmu__has_format utility as a general PMU utility. Fixes: 628eaa4e877af823 ("perf pmus: Add placeholder core PMU") Signed-off-by: Ian Rogers Tested-by: Thomas Richter Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Rob Herring Link: https://lore.kernel.org/r/20230706183705.601412-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 34bc65d6d831200194c0b9a30fb8fe47faaf83d6 Author: Ian Rogers Date: Thu Jul 6 11:37:04 2023 -0700 perf pmus: Create placholder regardless of scanning core_only If scanning all PMUs the placeholder is still necessary if no core PMU is found. This situation occurs in perf test's parse-events test, when uncore events appear before core. Fixes: 628eaa4e877af823 ("perf pmus: Add placeholder core PMU") Signed-off-by: Ian Rogers Tested-by: Thomas Richter Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Rob Herring Link: https://lore.kernel.org/r/20230706183705.601412-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 46d14e17095237007b59f56aae2d81ae2dcb0f93 Author: Yan Zhao Date: Mon Jul 31 19:20:33 2023 +0800 drm/i915/gvt: Fix bug in getting msg length in AUX CH registers handler Msg length should be obtained from value written to AUX_CH_CTL register rather than from enum type of the register. Commit 0cad796a2269 ("drm/i915: Use REG_BIT() & co. for AUX CH registers") incorrectly calculates the msg_length from reg type and yields below warning in intel_gvt_i2c_handle_aux_ch_write(): "i915 0000:00:02.0: drm_WARN_ON(msg_length != 4)". Fixes: 0cad796a2269 ("drm/i915: Use REG_BIT() & co. for AUX CH registers") Signed-off-by: Yan Zhao Signed-off-by: Zhenyu Wang Link: http://patchwork.freedesktop.org/patch/msgid/20230731112033.7275-1-yan.y.zhao@intel.com Reviewed-by: Zhenyu Wang commit c5ccff70501d92db445a135fa49cf9bc6b98c444 Merge: 611e1b016c7be b80b829e9e2c1 Author: Jakub Kicinski Date: Mon Jul 31 20:10:39 2023 -0700 Merge branch 'net-sched-bind-logic-fixes-for-cls_fw-cls_u32-and-cls_route' valis says: ==================== net/sched Bind logic fixes for cls_fw, cls_u32 and cls_route Three classifiers (cls_fw, cls_u32 and cls_route) always copy tcf_result struct into the new instance of the filter on update. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. This patch set fixes this issue in all affected classifiers by no longer copying the tcf_result struct from the old filter. ==================== Link: https://lore.kernel.org/r/20230729123202.72406-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8 Author: valis Date: Sat Jul 29 08:32:02 2023 -0400 net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. Fix this by no longer copying the tcf_result struct from the old filter. Fixes: 1109c00547fc ("net: sched: RCU cls_route") Reported-by: valis Reported-by: Bing-Jhong Billy Jheng Signed-off-by: valis Signed-off-by: Jamal Hadi Salim Reviewed-by: Victor Nogueira Reviewed-by: Pedro Tammela Reviewed-by: M A Ramdhan Link: https://lore.kernel.org/r/20230729123202.72406-4-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 76e42ae831991c828cffa8c37736ebfb831ad5ec Author: valis Date: Sat Jul 29 08:32:01 2023 -0400 net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. Fix this by no longer copying the tcf_result struct from the old filter. Fixes: e35a8ee5993b ("net: sched: fw use RCU") Reported-by: valis Reported-by: Bing-Jhong Billy Jheng Signed-off-by: valis Signed-off-by: Jamal Hadi Salim Reviewed-by: Victor Nogueira Reviewed-by: Pedro Tammela Reviewed-by: M A Ramdhan Link: https://lore.kernel.org/r/20230729123202.72406-3-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81 Author: valis Date: Sat Jul 29 08:32:00 2023 -0400 net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. Fix this by no longer copying the tcf_result struct from the old filter. Fixes: de5df63228fc ("net: sched: cls_u32 changes to knode must appear atomic to readers") Reported-by: valis Reported-by: M A Ramdhan Signed-off-by: valis Signed-off-by: Jamal Hadi Salim Reviewed-by: Victor Nogueira Reviewed-by: Pedro Tammela Reviewed-by: M A Ramdhan Link: https://lore.kernel.org/r/20230729123202.72406-2-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit 4c9fbff54297471d4e2bbfe9c27e80067c722eae Merge: bcc29b7f5af67 7c62b75cd1a79 Author: Martin KaFai Lau Date: Mon Jul 31 15:37:13 2023 -0700 Merge branch 'Two fixes for cpu-map' Hou Tao says: ==================== The patchset fixes two reported warning in cpu-map when running xdp_redirect_cpu and some RT threads concurrently. Patch #1 fixes the warning in __cpu_map_ring_cleanup() when kthread is stopped prematurely. Patch #2 fixes the warning in __xdp_return() when there are pending skbs in ptr_ring. Please see individual patches for more details. And comments are always welcome. ==================== Signed-off-by: Martin KaFai Lau commit 7c62b75cd1a792e14b037fa4f61f9b18914e7de1 Author: Hou Tao Date: Sat Jul 29 17:51:07 2023 +0800 bpf, cpumap: Handle skb as well when clean up ptr_ring The following warning was reported when running xdp_redirect_cpu with both skb-mode and stress-mode enabled: ------------[ cut here ]------------ Incorrect XDP memory type (-2128176192) usage WARNING: CPU: 7 PID: 1442 at net/core/xdp.c:405 Modules linked in: CPU: 7 PID: 1442 Comm: kworker/7:0 Tainted: G 6.5.0-rc2+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Workqueue: events __cpu_map_entry_free RIP: 0010:__xdp_return+0x1e4/0x4a0 ...... Call Trace: ? show_regs+0x65/0x70 ? __warn+0xa5/0x240 ? __xdp_return+0x1e4/0x4a0 ...... xdp_return_frame+0x4d/0x150 __cpu_map_entry_free+0xf9/0x230 process_one_work+0x6b0/0xb80 worker_thread+0x96/0x720 kthread+0x1a5/0x1f0 ret_from_fork+0x3a/0x70 ret_from_fork_asm+0x1b/0x30 The reason for the warning is twofold. One is due to the kthread cpu_map_kthread_run() is stopped prematurely. Another one is __cpu_map_ring_cleanup() doesn't handle skb mode and treats skbs in ptr_ring as XDP frames. Prematurely-stopped kthread will be fixed by the preceding patch and ptr_ring will be empty when __cpu_map_ring_cleanup() is called. But as the comments in __cpu_map_ring_cleanup() said, handling and freeing skbs in ptr_ring as well to "catch any broken behaviour gracefully". Fixes: 11941f8a8536 ("bpf: cpumap: Implement generic cpumap") Signed-off-by: Hou Tao Acked-by: Jesper Dangaard Brouer Link: https://lore.kernel.org/r/20230729095107.1722450-3-houtao@huaweicloud.com Signed-off-by: Martin KaFai Lau commit 640a604585aa30f93e39b17d4d6ba69fcb1e66c9 Author: Hou Tao Date: Sat Jul 29 17:51:06 2023 +0800 bpf, cpumap: Make sure kthread is running before map update returns The following warning was reported when running stress-mode enabled xdp_redirect_cpu with some RT threads: ------------[ cut here ]------------ WARNING: CPU: 4 PID: 65 at kernel/bpf/cpumap.c:135 CPU: 4 PID: 65 Comm: kworker/4:1 Not tainted 6.5.0-rc2+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Workqueue: events cpu_map_kthread_stop RIP: 0010:put_cpu_map_entry+0xda/0x220 ...... Call Trace: ? show_regs+0x65/0x70 ? __warn+0xa5/0x240 ...... ? put_cpu_map_entry+0xda/0x220 cpu_map_kthread_stop+0x41/0x60 process_one_work+0x6b0/0xb80 worker_thread+0x96/0x720 kthread+0x1a5/0x1f0 ret_from_fork+0x3a/0x70 ret_from_fork_asm+0x1b/0x30 The root cause is the same as commit 436901649731 ("bpf: cpumap: Fix memory leak in cpu_map_update_elem"). The kthread is stopped prematurely by kthread_stop() in cpu_map_kthread_stop(), and kthread() doesn't call cpu_map_kthread_run() at all but XDP program has already queued some frames or skbs into ptr_ring. So when __cpu_map_ring_cleanup() checks the ptr_ring, it will find it was not emptied and report a warning. An alternative fix is to use __cpu_map_ring_cleanup() to drop these pending frames or skbs when kthread_stop() returns -EINTR, but it may confuse the user, because these frames or skbs have been handled correctly by XDP program. So instead of dropping these frames or skbs, just make sure the per-cpu kthread is running before __cpu_map_entry_alloc() returns. After apply the fix, the error handle for kthread_stop() will be unnecessary because it will always return 0, so just remove it. Fixes: 6710e1126934 ("bpf: introduce new bpf cpu map type BPF_MAP_TYPE_CPUMAP") Signed-off-by: Hou Tao Reviewed-by: Pu Lehui Acked-by: Jesper Dangaard Brouer Link: https://lore.kernel.org/r/20230729095107.1722450-2-houtao@huaweicloud.com Signed-off-by: Martin KaFai Lau commit 611e1b016c7beceec5ae82ac62d4a7ca224c8f9d Author: Michal Schmidt Date: Sat Jul 29 17:15:16 2023 +0200 octeon_ep: initialize mbox mutexes The two mbox-related mutexes are destroyed in octep_ctrl_mbox_uninit(), but the corresponding mutex_init calls were missing. A "DEBUG_LOCKS_WARN_ON(lock->magic != lock)" warning was emitted with CONFIG_DEBUG_MUTEXES on. Initialize the two mutexes in octep_ctrl_mbox_init(). Fixes: 577f0d1b1c5f ("octeon_ep: add separate mailbox command and response queues") Signed-off-by: Michal Schmidt Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230729151516.24153-1-mschmidt@redhat.com Signed-off-by: Jakub Kicinski commit 37b61cda9c1606cd8b6445d900ca9dc03185e8b6 Author: Jakub Kicinski Date: Fri Jul 28 13:50:20 2023 -0700 bnxt: don't handle XDP in netpoll Similarly to other recently fixed drivers make sure we don't try to access XDP or page pool APIs when NAPI budget is 0. NAPI budget of 0 may mean that we are in netpoll. This may result in running software IRQs in hard IRQ context, leading to deadlocks or crashes. To make sure bnapi->tx_pkts don't get wiped without handling the events, move clearing the field into the handler itself. Remember to clear tx_pkts after reset (bnxt_enable_napi()) as it's technically possible that netpoll will accumulate some tx_pkts and then a reset will happen, leaving tx_pkts out of sync with reality. Fixes: 322b87ca55f2 ("bnxt_en: add page_pool support") Reviewed-by: Andy Gospodarek Reviewed-by: Michael Chan Link: https://lore.kernel.org/r/20230728205020.2784844-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4b31fd4d77ffa430d0b74ba1885ea0a41594f202 Author: Rafal Rogalski Date: Fri Jul 28 10:12:43 2023 -0700 ice: Fix RDMA VSI removal during queue rebuild During qdisc create/delete, it is necessary to rebuild the queue of VSIs. An error occurred because the VSIs created by RDMA were still active. Added check if RDMA is active. If yes, it disallows qdisc changes and writes a message in the system logs. Fixes: 348048e724a0 ("ice: Implement iidc operations") Signed-off-by: Rafal Rogalski Signed-off-by: Mateusz Palczewski Signed-off-by: Kamil Maziarz Tested-by: Bharathi Sreenivas Signed-off-by: Tony Nguyen Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20230728171243.2446101-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 55c1528f9b97ff3b7efad73e8f79627fc2efb298 Author: Edward Cree Date: Fri Jul 28 17:55:28 2023 +0100 sfc: fix field-spanning memcpy in selftest Add a struct_group for the whole packet body so we can copy it in one go without triggering FORTIFY_SOURCE complaints. Fixes: cf60ed469629 ("sfc: use padding to fix alignment in loopback test") Fixes: 30c24dd87f3f ("sfc: siena: use padding to fix alignment in loopback test") Fixes: 1186c6b31ee1 ("sfc: falcon: use padding to fix alignment in loopback test") Reviewed-by: Andy Moreton Tested-by: Andy Moreton Signed-off-by: Edward Cree Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230728165528.59070-1-edward.cree@amd.com Signed-off-by: Jakub Kicinski commit d4480c9bb9258db9ddf2e632f6ef81e96b41089c Author: Martin Kohn Date: Thu Jul 27 20:00:43 2023 +0000 net: usb: qmi_wwan: add Quectel EM05GV2 Add support for Quectel EM05GV2 (G=global) with vendor ID 0x2c7c and product ID 0x030e Enabling DTR on this modem was necessary to ensure stable operation. Patch for usb: serial: option: is also in progress. T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=030e Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Martin Kohn Link: https://lore.kernel.org/r/AM0PR04MB57648219DE893EE04FA6CC759701A@AM0PR04MB5764.eurprd04.prod.outlook.com Signed-off-by: Jakub Kicinski commit 9426d3cef5000824e5f24f80ed5f42fb935f2488 Author: Tony Battersby Date: Mon Jul 24 14:25:40 2023 -0400 scsi: core: Fix legacy /proc parsing buffer overflow (lightly modified commit message mostly by Linus Torvalds) The parsing code for /proc/scsi/scsi is disgusting and broken. We should have just used 'sscanf()' or something simple like that, but the logic may actually predate our kernel sscanf library routine for all I know. It certainly predates both git and BK histories. And we can't change it to be something sane like that now, because the string matching at the start is done case-insensitively, and the separator parsing between numbers isn't done at all, so *any* separator will work, including a possible terminating NUL character. This interface is root-only, and entirely for legacy use, so there is absolutely no point in trying to tighten up the parsing. Because any separator has traditionally worked, it's entirely possible that people have used random characters rather than the suggested space. So don't bother to try to pretty it up, and let's just make a minimal patch that can be back-ported and we can forget about this whole sorry thing for another two decades. Just make it at least not read past the end of the supplied data. Link: https://lore.kernel.org/linux-scsi/b570f5fe-cb7c-863a-6ed9-f6774c219b88@cybernetics.com/ Cc: Linus Torvalds Cc: Martin K Petersen Cc: James Bottomley Cc: Willy Tarreau Cc: stable@kernel.org Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Tony Battersby Signed-off-by: Martin K Petersen commit 8366d1f1249a0d0bba41d0bd1298d63e5d34c7f7 Author: Alexandra Diupina Date: Fri Jul 28 15:35:21 2023 +0300 scsi: 53c700: Check that command slot is not NULL Add a check for the command slot value to avoid dereferencing a NULL pointer. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Co-developed-by: Vladimir Telezhnikov Signed-off-by: Vladimir Telezhnikov Signed-off-by: Alexandra Diupina Link: https://lore.kernel.org/r/20230728123521.18293-1-adiupina@astralinux.ru Signed-off-by: Martin K. Petersen commit 5a43b07a87835660f91d88a4db11abfea8c523b7 Author: Karan Tilak Kumar Date: Thu Jul 27 12:39:19 2023 -0700 scsi: fnic: Replace return codes in fnic_clean_pending_aborts() fnic_clean_pending_aborts() was returning a non-zero value irrespective of failure or success. This caused the caller of this function to assume that the device reset had failed, even though it would succeed in most cases. As a consequence, a successful device reset would escalate to host reset. Reviewed-by: Sesidhar Baddela Tested-by: Karan Tilak Kumar Signed-off-by: Karan Tilak Kumar Link: https://lore.kernel.org/r/20230727193919.2519-1-kartilak@cisco.com Signed-off-by: Martin K. Petersen commit 175544ad48cbf56affeef2a679c6a4d4fb1e2881 Author: Michael Kelley Date: Fri Jul 28 21:59:24 2023 -0700 scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Hyper-V provides the ability to connect Fibre Channel LUNs to the host system and present them in a guest VM as a SCSI device. I/O to the vFC device is handled by the storvsc driver. The storvsc driver includes a partial integration with the FC transport implemented in the generic portion of the Linux SCSI subsystem so that FC attributes can be displayed in /sys. However, the partial integration means that some aspects of vFC don't work properly. Unfortunately, a full and correct integration isn't practical because of limitations in what Hyper-V provides to the guest. In particular, in the context of Hyper-V storvsc, the FC transport timeout function fc_eh_timed_out() causes a kernel panic because it can't find the rport and dereferences a NULL pointer. The original patch that added the call from storvsc_eh_timed_out() to fc_eh_timed_out() is faulty in this regard. In many cases a timeout is due to a transient condition, so the situation can be improved by just continuing to wait like with other I/O requests issued by storvsc, and avoiding the guaranteed panic. For a permanent failure, continuing to wait may result in a hung thread instead of a panic, which again may be better. So fix the panic by removing the storvsc call to fc_eh_timed_out(). This allows storvsc to keep waiting for a response. The change has been tested by users who experienced a panic in fc_eh_timed_out() due to transient timeouts, and it solves their problem. In the future we may want to deprecate the vFC functionality in storvsc since it can't be fully fixed. But it has current users for whom it is working well enough, so it should probably stay for a while longer. Fixes: 3930d7309807 ("scsi: storvsc: use default I/O timeout handler for FC devices") Cc: stable@vger.kernel.org Signed-off-by: Michael Kelley Link: https://lore.kernel.org/r/1690606764-79669-1-git-send-email-mikelley@microsoft.com Signed-off-by: Martin K. Petersen commit 6d4cc57630a867a944483fdf7f8a060d2bbebdb9 Author: Konrad Dybcio Date: Tue Jun 27 18:24:17 2023 +0200 arm64: dts: qcom: sc7180: Fix DSI0_PHY reg-names Commit 2b616f86d51b ("arm64: dts: qcom: sc7180: rename labels for DSI nodes") broke reg-names, possibly with search-and-replace. Fix it. Fixes: 2b616f86d51b ("arm64: dts: qcom: sc7180: rename labels for DSI nodes") Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230627-topic-more_bindings-v1-1-6b4b6cd081e5@linaro.org Signed-off-by: Bjorn Andersson commit 1cd0302be5645420f73090aee26fa787287e1096 Author: Simon Trimmer Date: Fri Jul 28 12:13:45 2023 +0100 ACPI: scan: Create platform device for CS35L56 The ACPI device CSC3556 is a Cirrus Logic CS35L56 mono amplifier which is used in multiples, and can be connected either to I2C or SPI. There will be multiple instances under the same Device() node. Add it to ignore_serial_bus_ids and handle it in the serial-multi-instantiate driver. There can be a 5th I2cSerialBusV2, but this is an alias address and doesn't represent a real device. Ignore this by having a dummy 5th entry in the serial-multi-instantiate instance list with the name of a non-existent driver, on the same pattern as done for bsg2150. Signed-off-by: Simon Trimmer Signed-off-by: Richard Fitzgerald Acked-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/20230728111345.7224-1-rf@opensource.cirrus.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 785c00993dc4c4bb2f7b0f3a3f29c03a6f7aab2e Author: Yang Li Date: Thu Jul 27 09:43:15 2023 +0800 platform/x86/amd/pmf: Fix unsigned comparison with less than zero The return value from the call to amd_pmf_get_pprof_modes() is int. However, the return value is being assigned to an unsigned char variable 'mode', so making 'mode' an int. silence the warning: ./drivers/platform/x86/amd/pmf/sps.c:183:5-9: WARNING: Unsigned expression compared with zero: mode < 0 Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=5995 Signed-off-by: Yang Li Link: https://lore.kernel.org/r/20230727014315.51375-1-yang.lee@linux.alibaba.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit bc2e67ac3eb57a8d4f4d0022616e550aada50e7b Author: Uwe Kleine-König Date: Fri Jul 28 16:58:23 2023 +0200 fbdev: ssd1307fb: Print the PWM's label instead of its number struct pwm_device::pwm is a write-only variable in the pwm core and used nowhere apart from this and another dev_dbg. So it isn't useful to identify the used PWM. Emit the PWM's label instead in the debug message. Signed-off-by: Uwe Kleine-König Reviewed-by: Javier Martinez Canillas Signed-off-by: Helge Deller commit 0872b2c0abc0e84ac82472959c8e14e35277549c Author: Yuanjun Gong Date: Fri Jul 28 01:03:18 2023 +0800 fbdev: mmp: fix value check in mmphw_probe() in mmphw_probe(), check the return value of clk_prepare_enable() and return the error code if clk_prepare_enable() returns an unexpected value. Fixes: d63028c38905 ("video: mmp display controller support") Signed-off-by: Yuanjun Gong Signed-off-by: Helge Deller commit 43a1120c0578791a7cdac1978406d9bf486001d9 Author: Atul Raut Date: Sun Jul 30 19:18:08 2023 -0700 fbdev: amifb: Replace zero-length arrays with DECLARE_FLEX_ARRAY() helper Replacing zero-length arrays with C99 flexible-array members because they are deprecated. Use the new DECLARE_FLEX_ARRAY() auxiliary macro instead of defining a zero-length array. This fixes warnings such as: ./drivers/video/fbdev/amifb.c:690:6-10: WARNING use flexible-array member instead Signed-off-by: Atul Raut Signed-off-by: Helge Deller commit 1e7417c188d0a83fb385ba2dbe35fd2563f2b6f3 Author: Duoming Zhou Date: Wed Jul 26 16:14:07 2023 +0800 net: usb: lan78xx: reorder cleanup operations to avoid UAF bugs The timer dev->stat_monitor can schedule the delayed work dev->wq and the delayed work dev->wq can also arm the dev->stat_monitor timer. When the device is detaching, the net_device will be deallocated. but the net_device private data could still be dereferenced in delayed work or timer handler. As a result, the UAF bugs will happen. One racy situation is shown below: (Thread 1) | (Thread 2) lan78xx_stat_monitor() | ... | lan78xx_disconnect() lan78xx_defer_kevent() | ... ... | cancel_delayed_work_sync(&dev->wq); schedule_delayed_work() | ... (wait some time) | free_netdev(net); //free net_device lan78xx_delayedwork() | //use net_device private data | dev-> //use | Although we use cancel_delayed_work_sync() to cancel the delayed work in lan78xx_disconnect(), it could still be scheduled in timer handler lan78xx_stat_monitor(). Another racy situation is shown below: (Thread 1) | (Thread 2) lan78xx_delayedwork | mod_timer() | lan78xx_disconnect() | cancel_delayed_work_sync() (wait some time) | if (timer_pending(&dev->stat_monitor)) | del_timer_sync(&dev->stat_monitor); lan78xx_stat_monitor() | ... lan78xx_defer_kevent() | free_netdev(net); //free //use net_device private data| dev-> //use | Although we use del_timer_sync() to delete the timer, the function timer_pending() returns 0 when the timer is activated. As a result, the del_timer_sync() will not be executed and the timer could be re-armed. In order to mitigate this bug, We use timer_shutdown_sync() to shutdown the timer and then use cancel_delayed_work_sync() to cancel the delayed work. As a result, the net_device could be deallocated safely. What's more, the dev->flags is set to EVENT_DEV_DISCONNECT in lan78xx_disconnect(). But it could still be set to EVENT_STAT_UPDATE in lan78xx_stat_monitor(). So this patch put the set_bit() behind timer_shutdown_sync(). Fixes: 77dfff5bb7e2 ("lan78xx: Fix race condition in disconnect handling") Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller commit 186b169cf1e4be85aa212a893ea783a543400979 Author: Michael Guralnik Date: Wed Jul 19 12:02:41 2023 +0300 RDMA/umem: Set iova in ODP flow Fixing the ODP registration flow to set the iova correctly. The calculation in ib_umem_num_dma_blocks() function assumes the iova of the umem is set correctly. When iova is not set, the calculation in ib_umem_num_dma_blocks() is equivalent to length/page_size, which is true only when memory is aligned. For unaligned memory, iova must be set for the ALIGN() in the ib_umem_num_dma_blocks() to take effect and return a correct value. mlx5_ib uses ib_umem_num_dma_blocks() to decide the mkey size to use for the MR. Without this fix, when registering unaligned ODP MR, a wrong size mkey might be chosen and this might cause the UMR to fail. UMR would fail over insufficient size to update the mkey translation: infiniband mlx5_0: dump_cqe:273:(pid 0): dump error cqe 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00000030: 00 00 00 00 0f 00 78 06 25 00 00 58 00 da ac d2 infiniband mlx5_0: mlx5_ib_post_send_wait:806:(pid 20311): reg umr failed (6) infiniband mlx5_0: pagefault_real_mr:661:(pid 20311): Failed to update mkey page tables Fixes: f0093fb1a7cb ("RDMA/mlx5: Move mlx5_ib_cont_pages() to the creation of the mlx5_ib_mr") Fixes: a665aca89a41 ("RDMA/umem: Split ib_umem_num_pages() into ib_umem_num_dma_blocks()") Signed-off-by: Artemy Kovalyov Signed-off-by: Michael Guralnik Link: https://lore.kernel.org/r/3d4be7ca2155bf239dd8c00a2d25974a92c26ab8.1689757344.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 8469c7f5472fe5f77fc31c8f10f23d5aad987231 Author: Rafał Miłecki Date: Sat Jul 29 13:10:45 2023 +0200 dt-bindings: net: mediatek,net: fixup MAC binding 1. Use unevaluatedProperties It's needed to allow ethernet-controller.yaml properties work correctly. 2. Drop unneeded phy-handle/phy-mode 3. Don't require phy-handle Some SoCs may use fixed link. For in-kernel MT7621 DTS files this fixes following errors: arch/mips/boot/dts/ralink/mt7621-tplink-hc220-g5-v1.dtb: ethernet@1e100000: mac@0: 'fixed-link' does not match any of the regexes: 'pinctrl-[0-9]+' From schema: Documentation/devicetree/bindings/net/mediatek,net.yaml arch/mips/boot/dts/ralink/mt7621-tplink-hc220-g5-v1.dtb: ethernet@1e100000: mac@0: 'phy-handle' is a required property From schema: Documentation/devicetree/bindings/net/mediatek,net.yaml arch/mips/boot/dts/ralink/mt7621-tplink-hc220-g5-v1.dtb: ethernet@1e100000: mac@1: 'fixed-link' does not match any of the regexes: 'pinctrl-[0-9]+' From schema: Documentation/devicetree/bindings/net/mediatek,net.yaml arch/mips/boot/dts/ralink/mt7621-tplink-hc220-g5-v1.dtb: ethernet@1e100000: mac@1: 'phy-handle' is a required property From schema: Documentation/devicetree/bindings/net/mediatek,net.yaml Signed-off-by: Rafał Miłecki Reviewed-by: Krzysztof Kozlowski Signed-off-by: David S. Miller commit e739718444f7bf2fa3d70d101761ad83056ca628 Author: Kuniyuki Iwashima Date: Fri Jul 28 17:07:05 2023 -0700 net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. syzkaller found zero division error [0] in div_s64_rem() called from get_cycle_time_elapsed(), where sched->cycle_time is the divisor. We have tests in parse_taprio_schedule() so that cycle_time will never be 0, and actually cycle_time is not 0 in get_cycle_time_elapsed(). The problem is that the types of divisor are different; cycle_time is s64, but the argument of div_s64_rem() is s32. syzkaller fed this input and 0x100000000 is cast to s32 to be 0. @TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME={0xc, 0x8, 0x100000000} We use s64 for cycle_time to cast it to ktime_t, so let's keep it and set max for cycle_time. While at it, we prevent overflow in setup_txtime() and add another test in parse_taprio_schedule() to check if cycle_time overflows. Also, we add a new tdc test case for this issue. [0]: divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 1 PID: 103 Comm: kworker/1:3 Not tainted 6.5.0-rc1-00330-g60cc1f7d0605 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:div_s64_rem include/linux/math64.h:42 [inline] RIP: 0010:get_cycle_time_elapsed net/sched/sch_taprio.c:223 [inline] RIP: 0010:find_entry_to_transmit+0x252/0x7e0 net/sched/sch_taprio.c:344 Code: 3c 02 00 0f 85 5e 05 00 00 48 8b 4c 24 08 4d 8b bd 40 01 00 00 48 8b 7c 24 48 48 89 c8 4c 29 f8 48 63 f7 48 99 48 89 74 24 70 <48> f7 fe 48 29 d1 48 8d 04 0f 49 89 cc 48 89 44 24 20 49 8d 85 10 RSP: 0018:ffffc90000acf260 EFLAGS: 00010206 RAX: 177450e0347560cf RBX: 0000000000000000 RCX: 177450e0347560cf RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000100000000 RBP: 0000000000000056 R08: 0000000000000000 R09: ffffed10020a0934 R10: ffff8880105049a7 R11: ffff88806cf3a520 R12: ffff888010504800 R13: ffff88800c00d800 R14: ffff8880105049a0 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0edf84f0e8 CR3: 000000000d73c002 CR4: 0000000000770ee0 PKRU: 55555554 Call Trace: get_packet_txtime net/sched/sch_taprio.c:508 [inline] taprio_enqueue_one+0x900/0xff0 net/sched/sch_taprio.c:577 taprio_enqueue+0x378/0xae0 net/sched/sch_taprio.c:658 dev_qdisc_enqueue+0x46/0x170 net/core/dev.c:3732 __dev_xmit_skb net/core/dev.c:3821 [inline] __dev_queue_xmit+0x1b2f/0x3000 net/core/dev.c:4169 dev_queue_xmit include/linux/netdevice.h:3088 [inline] neigh_resolve_output net/core/neighbour.c:1552 [inline] neigh_resolve_output+0x4a7/0x780 net/core/neighbour.c:1532 neigh_output include/net/neighbour.h:544 [inline] ip6_finish_output2+0x924/0x17d0 net/ipv6/ip6_output.c:135 __ip6_finish_output+0x620/0xaa0 net/ipv6/ip6_output.c:196 ip6_finish_output net/ipv6/ip6_output.c:207 [inline] NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x206/0x410 net/ipv6/ip6_output.c:228 dst_output include/net/dst.h:458 [inline] NF_HOOK.constprop.0+0xea/0x260 include/linux/netfilter.h:303 ndisc_send_skb+0x872/0xe80 net/ipv6/ndisc.c:508 ndisc_send_ns+0xb5/0x130 net/ipv6/ndisc.c:666 addrconf_dad_work+0xc14/0x13f0 net/ipv6/addrconf.c:4175 process_one_work+0x92c/0x13a0 kernel/workqueue.c:2597 worker_thread+0x60f/0x1240 kernel/workqueue.c:2748 kthread+0x2fe/0x3f0 kernel/kthread.c:389 ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308 Modules linked in: Fixes: 4cfd5779bd6e ("taprio: Add support for txtime-assist mode") Reported-by: syzkaller Signed-off-by: Kuniyuki Iwashima Co-developed-by: Eric Dumazet Co-developed-by: Pedro Tammela Acked-by: Vinicius Costa Gomes Signed-off-by: David S. Miller commit 5e2424708da7207087934c5c75211e8584d553a0 Author: Lin Ma Date: Sun Jul 23 15:41:10 2023 +0800 xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH The previous commit 4e484b3e969b ("xfrm: rate limit SA mapping change message to user space") added one additional attribute named XFRMA_MTIMER_THRESH and described its type at compat_policy (net/xfrm/xfrm_compat.c). However, the author forgot to also describe the nla_policy at xfrma_policy (net/xfrm/xfrm_user.c). Hence, this suppose NLA_U32 (4 bytes) value can be faked as empty (0 bytes) by a malicious user, which leads to 4 bytes overflow read and heap information leak when parsing nlattrs. To exploit this, one malicious user can spray the SLUB objects and then leverage this 4 bytes OOB read to leak the heap data into x->mapping_maxage (see xfrm_update_ae_params(...)), and leak it to userspace via copy_to_user_state_extra(...). The above bug is assigned CVE-2023-3773. To fix it, this commit just completes the nla_policy description for XFRMA_MTIMER_THRESH, which enforces the length check and avoids such OOB read. Fixes: 4e484b3e969b ("xfrm: rate limit SA mapping change message to user space") Signed-off-by: Lin Ma Reviewed-by: Simon Horman Reviewed-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 00374d9b6d9f932802b55181be9831aa948e5b7c Author: Lin Ma Date: Fri Jul 21 22:51:03 2023 +0800 xfrm: add NULL check in xfrm_update_ae_params Normally, x->replay_esn and x->preplay_esn should be allocated at xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the xfrm_update_ae_params(...) is okay to update them. However, the current implementation of xfrm_new_ae(...) allows a malicious user to directly dereference a NULL pointer and crash the kernel like below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4 RIP: 0010:memcpy_orig+0xad/0x140 Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c RSP: 0018:ffff888008f57658 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571 RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818 R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000 FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0 Call Trace: ? __die+0x1f/0x70 ? page_fault_oops+0x1e8/0x500 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ? __pfx_page_fault_oops+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? fixup_exception+0x36/0x460 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? exc_page_fault+0x5e/0xc0 ? asm_exc_page_fault+0x26/0x30 ? xfrm_update_ae_params+0xd1/0x260 ? memcpy_orig+0xad/0x140 ? __pfx__raw_spin_lock_bh+0x10/0x10 xfrm_update_ae_params+0xe7/0x260 xfrm_new_ae+0x298/0x4e0 ? __pfx_xfrm_new_ae+0x10/0x10 ? __pfx_xfrm_new_ae+0x10/0x10 xfrm_user_rcv_msg+0x25a/0x410 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __alloc_skb+0xcf/0x210 ? stack_trace_save+0x90/0xd0 ? filter_irq_stacks+0x1c/0x70 ? __stack_depot_save+0x39/0x4e0 ? __kasan_slab_free+0x10a/0x190 ? kmem_cache_free+0x9c/0x340 ? netlink_recvmsg+0x23c/0x660 ? sock_recvmsg+0xeb/0xf0 ? __sys_recvfrom+0x13c/0x1f0 ? __x64_sys_recvfrom+0x71/0x90 ? do_syscall_64+0x3f/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc ? copyout+0x3e/0x50 netlink_rcv_skb+0xd6/0x210 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_sock_has_perm+0x10/0x10 ? mutex_lock+0x8d/0xe0 ? __pfx_mutex_lock+0x10/0x10 xfrm_netlink_rcv+0x44/0x50 netlink_unicast+0x36f/0x4c0 ? __pfx_netlink_unicast+0x10/0x10 ? netlink_recvmsg+0x500/0x660 netlink_sendmsg+0x3b7/0x700 This Null-ptr-deref bug is assigned CVE-2023-3772. And this commit adds additional NULL check in xfrm_update_ae_params to fix the NPD. Fixes: d8647b79c3b7 ("xfrm: Add user interface for esn and big anti-replay windows") Signed-off-by: Lin Ma Reviewed-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 101df45e7ec36f470559c8fdab8e272cb991ef42 Author: David Howells Date: Thu Jul 27 17:21:17 2023 +0100 nfsd: Fix reading via splice nfsd_splice_actor() has a clause in its loop that chops up a compound page into individual pages such that if the same page is seen twice in a row, it is discarded the second time. This is a problem with the advent of shmem_splice_read() as that inserts zero_pages into the pipe in lieu of pages that aren't present in the pagecache. Fix this by assuming that the last page is being extended only if the currently stored length + starting offset is not currently on a page boundary. This can be tested by NFS-exporting a tmpfs filesystem on the test machine and truncating it to more than a page in size (eg. truncate -s 8192) and then reading it by NFS. The first page will be all zeros, but thereafter garbage will be read. Note: I wonder if we can ever get a situation now where we get a splice that gives us contiguous parts of a page in separate actor calls. As NFSD can only be splicing from a file (I think), there are only three sources of the page: copy_splice_read(), shmem_splice_read() and file_splice_read(). The first allocates pages for the data it reads, so the problem cannot occur; the second should never see a partial page; and the third waits for each page to become available before we're allowed to read from it. Fixes: bd194b187115 ("shmem: Implement splice-read") Reported-by: Chuck Lever Signed-off-by: David Howells Reviewed-by: Jeff Layton Reviewed-by: NeilBrown cc: Hugh Dickins cc: Jens Axboe cc: Matthew Wilcox cc: linux-nfs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: linux-mm@kvack.org Signed-off-by: Chuck Lever commit 5d0c230f1de8c7515b6567d9afba1f196fb4e2f4 Author: Linus Torvalds Date: Sun Jul 30 13:23:47 2023 -0700 Linux 6.5-rc4 commit d5bb4b89ac6996fe51a3ab63fdb25e15743e4351 Merge: 3dfe6886f9696 cc71c42b3dc10 Author: Linus Torvalds Date: Sun Jul 30 12:54:31 2023 -0700 Merge tag 'spi-fix-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A bunch of fixes for the Qualcomm QSPI driver, fixing multiple issues with the newly added DMA mode - it had a number of issues exposed when tested in a wider range of use cases, both race condition style issues and issues with different inputs to those that had been used in test" * tag 'spi-fix-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-qcom-qspi: Add mem_ops to avoid PIO for badly sized reads spi: spi-qcom-qspi: Fallback to PIO for xfers that aren't multiples of 4 bytes spi: spi-qcom-qspi: Add DMA_CHAIN_DONE to ALL_IRQS spi: spi-qcom-qspi: Call dma_wmb() after setting up descriptors spi: spi-qcom-qspi: Use GFP_ATOMIC flag while allocating for descriptor spi: spi-qcom-qspi: Ignore disabled interrupts' status in isr commit 3dfe6886f96969c46afc42f9ba2791103b7b47c0 Merge: 88f66f13ea510 67cb608838e0a Author: Linus Torvalds Date: Sun Jul 30 12:52:05 2023 -0700 Merge tag 'regulator-fix-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of small fixes for the the mt6358 driver, fixing error reporting and a bootstrapping issue" * tag 'regulator-fix-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: mt6358: Fix incorrect VCN33 sync error message regulator: mt6358: Sync VCN33_* enable status after checking ID commit 88f66f13ea51029280d3f91feafb6d66296c95d0 Merge: e6d34ced01bc3 7f2327666a908 Author: Linus Torvalds Date: Sun Jul 30 11:57:51 2023 -0700 Merge tag 'usb-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a set of USB driver fixes for 6.5-rc4. Include in here are: - new USB serial device ids - dwc3 driver fixes for reported issues - typec driver fixes for reported problems - gadget driver fixes - reverts of some problematic USB changes that went into -rc1 All of these have been in linux-next with no reported problems" * tag 'usb-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (24 commits) usb: misc: ehset: fix wrong if condition usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy usb: cdns3: fix incorrect calculation of ep_buf_size when more than one config usb: gadget: call usb_gadget_check_config() to verify UDC capability usb: typec: Use sysfs_emit_at when concatenating the string usb: typec: Iterate pds array when showing the pd list usb: typec: Set port->pd before adding device for typec_port usb: typec: qcom: fix return value check in qcom_pmic_typec_probe() Revert "usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()" Revert "usb: xhci: tegra: Fix error check" USB: gadget: Fix the memory leak in raw_gadget driver usb: gadget: core: remove unbalanced mutex_unlock in usb_gadget_activate Revert "usb: dwc3: core: Enable AutoRetry feature in the controller" Revert "xhci: add quirk for host controllers that don't update endpoint DCS" USB: quirks: add quirk for Focusrite Scarlett usb: xhci-mtk: set the dma max_seg_size MAINTAINERS: drop invalid usb/cdns3 Reviewer e-mail usb: dwc3: don't reset device side if dwc3 was configured as host-only usb: typec: ucsi: move typec_set_mode(TYPEC_STATE_SAFE) to ucsi_unregister_partner() usb: ohci-at91: Fix the unhandle interrupt when resume ... commit e6d34ced01bc3aaad616b9446bbaa96cd04617c4 Merge: 3d6b77a8d4b46 748c5ea8b8796 Author: Linus Torvalds Date: Sun Jul 30 11:51:36 2023 -0700 Merge tag 'tty-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are some small TTY and serial driver fixes for 6.5-rc4 for some reported problems. Included in here is: - TIOCSTI fix for braille readers - documentation fix for minor numbers - MAINTAINERS update for new serial files in -rc1 - minor serial driver fixes for reported problems All of these have been in linux-next with no reported problems" * tag 'tty-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: 8250_dw: Preserve original value of DLF register tty: serial: sh-sci: Fix sleeping in atomic context serial: sifive: Fix sifive_serial_console_setup() section Documentation: devices.txt: reconcile serial/ucc_uart minor numers MAINTAINERS: Update TTY layer for lists and recently added files tty: n_gsm: fix UAF in gsm_cleanup_mux TIOCSTI: always enable for CAP_SYS_ADMIN commit 3d6b77a8d4b4603c243ab2ee0f04f74f122d576a Merge: cf270e7b75147 5f1c7031e044c Author: Linus Torvalds Date: Sun Jul 30 11:47:56 2023 -0700 Merge tag 'staging-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are three small staging driver fixes for 6.5-rc4 that resolve some reported problems. These fixes are: - fix for an old bug in the r8712 driver - fbtft driver fix for a spi device - potential overflow fix in the ks7010 driver All of these have been in linux-next with no reported problems" * tag 'staging-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() staging: fbtft: ili9341: use macro FBTFT_REGISTER_SPI_DRIVER staging: r8712: Fix memory leak in _r8712_init_xmit_priv() commit cf270e7b751478a0834acdc6068edc58fead82cd Merge: b0b9850e7d53a f8ea950210228 Author: Linus Torvalds Date: Sun Jul 30 11:44:00 2023 -0700 Merge tag 'char-misc-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char driver and Documentation fixes from Greg KH: "Here is a char driver fix and some documentation updates for 6.5-rc4 that contain the following changes: - sram/genalloc bugfix for reported problem - security-bugs.rst update based on recent discussions - embargoed-hardware-issues minor cleanups and then partial revert for the project/company lists All of these have been in linux-next for a while with no reported problems, and the documentation updates have all been reviewed by the relevant developers" * tag 'char-misc-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: misc/genalloc: Name subpools by of_node_full_name() Documentation: embargoed-hardware-issues.rst: add AMD to the list Documentation: embargoed-hardware-issues.rst: clean out empty and unused entries Documentation: security-bugs.rst: clarify CVE handling Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group commit b0b9850e7d53aec13ef12a485e5a301774d9132e Merge: 98a05fe8cd5e0 de02f2ac5d8cf Author: Linus Torvalds Date: Sun Jul 30 11:27:22 2023 -0700 Merge tag 'probes-fixes-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probe fixes from Masami Hiramatsu: - probe-events: add NULL check for some BTF API calls which can return error code and NULL. - ftrace selftests: check fprobe and kprobe event correctly. This fixes a miss condition of the test command. - kprobes: do not allow probing functions that start with "__cfi_" or "__pfx_" since those are auto generated for kernel CFI and not executed. * tag 'probes-fixes-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: kprobes: Prohibit probing on CFI preamble symbol selftests/ftrace: Fix to check fprobe event eneblement tracing/probes: Fix to add NULL check for BTF APIs commit 98a05fe8cd5e0afe2b4c52b5013b53c44d615148 Merge: c959e90094d6d 5a7591176c47c Author: Linus Torvalds Date: Sun Jul 30 11:19:08 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "x86: - Do not register IRQ bypass consumer if posted interrupts not supported - Fix missed device interrupt due to non-atomic update of IRR - Use GFP_KERNEL_ACCOUNT for pid_table in ipiv - Make VMREAD error path play nice with noinstr - x86: Acquire SRCU read lock when handling fastpath MSR writes - Support linking rseq tests statically against glibc 2.35+ - Fix reference count for stats file descriptors - Detect userspace setting invalid CR0 Non-KVM: - Remove coccinelle script that has caused multiple confusion ("debugfs, coccinelle: check for obsolete DEFINE_SIMPLE_ATTRIBUTE() usage", acked by Greg)" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (21 commits) KVM: selftests: Expand x86's sregs test to cover illegal CR0 values KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest KVM: x86: Disallow KVM_SET_SREGS{2} if incoming CR0 is invalid Revert "debugfs, coccinelle: check for obsolete DEFINE_SIMPLE_ATTRIBUTE() usage" KVM: selftests: Verify stats fd is usable after VM fd has been closed KVM: selftests: Verify stats fd can be dup()'d and read KVM: selftests: Verify userspace can create "redundant" binary stats files KVM: selftests: Explicitly free vcpus array in binary stats test KVM: selftests: Clean up stats fd in common stats_test() helper KVM: selftests: Use pread() to read binary stats header KVM: Grab a reference to KVM for VM and vCPU stats file descriptors selftests/rseq: Play nice with binaries statically linked against glibc 2.35+ Revert "KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid" KVM: x86: Acquire SRCU read lock when handling fastpath MSR writes KVM: VMX: Use vmread_error() to report VM-Fail in "goto" path KVM: VMX: Make VMREAD error path play nice with noinstr KVM: x86/irq: Conditionally register IRQ bypass consumer again KVM: X86: Use GFP_KERNEL_ACCOUNT for pid_table in ipiv KVM: x86: check the kvm_cpu_get_interrupt result before using it KVM: x86: VMX: set irr_pending in kvm_apic_update_irr ... commit c959e90094d6db8ee1bfbe1a9c571fbd35d4daac Merge: d410b62e45ed9 f7853c3424180 Author: Linus Torvalds Date: Sun Jul 30 11:12:32 2023 -0700 Merge tag 'locking_urgent_for_v6.5_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Borislav Petkov: - Fix a rtmutex race condition resulting from sharing of the sort key between the lock waiters and the PI chain tree (->pi_waiters) of a task by giving each tree their own sort key * tag 'locking_urgent_for_v6.5_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/rtmutex: Fix task->pi_waiters integrity commit d410b62e45ed9702593fb3ddc45cde3d3f277c9b Merge: eb9fe1791ba87 fd470a8beed88 Author: Linus Torvalds Date: Sun Jul 30 11:05:35 2023 -0700 Merge tag 'x86_urgent_for_v6.5_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - AMD's automatic IBRS doesn't enable cross-thread branch target injection protection (STIBP) for user processes. Enable STIBP on such systems. - Do not delete (but put the ref instead) of AMD MCE error thresholding sysfs kobjects when destroying them in order not to delete the kernfs pointer prematurely - Restore annotation in ret_from_fork_asm() in order to fix kthread stack unwinding from being marked as unreliable and thus breaking livepatching * tag 'x86_urgent_for_v6.5_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled x86/MCE/AMD: Decrement threshold_bank refcount when removing threshold blocks x86: Fix kthread unwind commit eb9fe1791ba87ec95a0408b7074f2400459aa1e4 Merge: d31e3792919e5 de99090852107 Author: Linus Torvalds Date: Sun Jul 30 10:59:19 2023 -0700 Merge tag 'irq_urgent_for_v6.5_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Borislav Petkov: - Work around an erratum on GIC700, where a race between a CPU handling a wake-up interrupt, a change of affinity, and another CPU going to sleep can result in a lack of wake-up event on the next interrupt - Fix the locking required on a VPE for GICv4 - Enable Rockchip 3588001 erratum workaround for RK3588S - Fix the irq-bcm6345-l1 assumtions of the boot CPU always be the first CPU in the system * tag 'irq_urgent_for_v6.5_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic-v3: Workaround for GIC-700 erratum 2941627 irqchip/gic-v3: Enable Rockchip 3588001 erratum workaround for RK3588S irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation irq-bcm6345-l1: Do not assume a fixed block to cpu mapping commit 0a2b96e42a0284c4fc03022236f656a085ca714a Author: Xiaolei Wang Date: Wed Jul 26 15:57:47 2023 +0800 ARM: dts: imx: Set default tuning step for imx6sx usdhc If the tuning step is not set, the tuning step is set to 1. For some sd cards, the following Tuning timeout will occur. Tuning failed, falling back to fixed sampling clock So set the default tuning step. This refers to the NXP vendor's commit below: https://github.com/nxp-imx/linux-imx/blob/lf-6.1.y/ arch/arm/boot/dts/imx6sx.dtsi#L1108-L1109 Fixes: 1e336aa0c025 ("mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting") Signed-off-by: Xiaolei Wang Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit f02b53375e8f14b4c27a14f6e4fb6e89914fdc29 Author: Fabio Estevam Date: Tue Jul 25 20:26:28 2023 -0300 arm64: dts: imx8mm: Drop CSI1 PHY reference clock configuration The CSI1 PHY reference clock is limited to 125 MHz according to: i.MX 8M Mini Applications Processor Reference Manual, Rev. 3, 11/2020 Table 5-1. Clock Root Table (continued) / page 307 Slice Index n = 123 . Currently the IMX8MM_CLK_CSI1_PHY_REF clock is configured to be fed directly from 1 GHz PLL2 , which overclocks them. Instead, drop the configuration altogether, which defaults the clock to 24 MHz REF clock input, which for the PHY reference clock is just fine. Based on a patch from Marek Vasut for the imx8mn. Fixes: e523b7c54c05 ("arm64: dts: imx8mm: Add CSI nodes") Signed-off-by: Fabio Estevam Reviewed-by: Marek Vasut Reviewed-by: Marco Felsch Reviewed-by: Adam Ford Signed-off-by: Shawn Guo commit 926c733508ddb9ec10e28a403f67feb0e38fad0d Author: Marek Vasut Date: Tue Jul 25 00:22:47 2023 +0200 arm64: dts: imx8mn: Drop CSI1 PHY reference clock configuration The CSI1 PHY reference clock are limited to 125 MHz according to: i.MX 8M Nano Applications Processor Reference Manual, Rev. 2, 07/2022 Table 5-1. Clock Root Table (continued) / page 319 Slice Index n = 123 . Currently those IMX8MN_CLK_CSI1_PHY_REF clock are configured to be fed directly from 1 GHz PLL2 , which overclocks them . Instead, drop the configuration altogether, which defaults the clock to 24 MHz REF clock input, which for the PHY reference clock is just fine. Fixes: ae9279f301b5 ("arm64: dts: imx8mn: Add CSI and ISI Nodes") Signed-off-by: Marek Vasut Reviewed-by: Marco Felsch Reviewed-by: Adam Ford Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit be18293e47cbca7c6acee9231fc851601d69563a Author: Xiaolei Wang Date: Mon Jul 24 23:45:10 2023 +0800 ARM: dts: imx: Set default tuning step for imx7d usdhc If the tuning step is not set, the tuning step is set to 1. For some sd cards, the following Tuning timeout will occur. Tuning failed, falling back to fixed sampling clock mmc0: Tuning failed, falling back to fixed sampling clock So set the default tuning step. This refers to the NXP vendor's commit below: https://github.com/nxp-imx/linux-imx/blob/lf-6.1.y/ arch/arm/boot/dts/imx7s.dtsi#L1216-L1217 Fixes: 1e336aa0c025 ("mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting") Signed-off-by: Xiaolei Wang Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit 762b700982a1e0f562184363f19860c3b9bdd0bf Author: Andrej Picej Date: Wed Jul 19 13:43:26 2023 +0200 ARM: dts: imx6: phytec: fix RTC interrupt level RTC interrupt level should be set to "LOW". This was revealed by the introduction of commit: f181987ef477 ("rtc: m41t80: use IRQ flags obtained from fwnode") which changed the way IRQ type is obtained. Signed-off-by: Andrej Picej Reviewed-by: Stefan Riedmüller Fixes: 800d595151bb ("ARM: dts: imx6: Add initial support for phyBOARD-Mira") Signed-off-by: Shawn Guo commit d31e3792919e5c97d572c8a27a5a7c1eb9de5aca Merge: b88e123cc0b53 a171eb5cac427 Author: Linus Torvalds Date: Sat Jul 29 20:49:13 2023 -0700 Merge tag '6.5-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: "Four small SMB3 client fixes: - two reconnect fixes (to address the case where non-default iocharset gets incorrectly overridden at reconnect with the default charset) - fix for NTLMSSP_AUTH request setting a flag incorrectly) - Add missing check for invalid tlink (tree connection) in ioctl" * tag '6.5-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: add missing return value check for cifs_sb_tlink smb3: do not set NTLMSSP_VERSION flag for negotiate not auth request cifs: fix charset issue in reconnection fs/nls: make load_nls() take a const parameter commit b88e123cc0b53e32b0a20700e4815a28895e6b47 Merge: 1f2190d6b7112 dea499781a115 Author: Linus Torvalds Date: Sat Jul 29 20:40:43 2023 -0700 Merge tag 'trace-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix to /sys/kernel/tracing/per_cpu/cpu*/stats read and entries. If a resize shrinks the buffer it clears the read count to notify readers that they need to reset. But the read count is also used for accounting and this causes the numbers to be off. Instead, create a separate variable to use to notify readers to reset. - Fix the ref counts of the "soft disable" mode. The wrong value was used for testing if soft disable mode should be enabled or disable, but instead, just change the logic to do the enable and disable in place when the SOFT_MODE is set or cleared. - Several kernel-doc fixes - Removal of unused external declarations * tag 'trace-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix warning in trace_buffered_event_disable() ftrace: Remove unused extern declarations tracing: Fix kernel-doc warnings in trace_seq.c tracing: Fix kernel-doc warnings in trace_events_trigger.c tracing/synthetic: Fix kernel-doc warnings in trace_events_synth.c ring-buffer: Fix kernel-doc warnings in ring_buffer.c ring-buffer: Fix wrong stat of cpu_buffer->read commit f6dfa9f882a7819127343b30eaa24ebdd1950f49 Author: Fabio Estevam Date: Wed Jul 12 08:52:59 2023 -0300 ARM: dts: imx6sx: Remove LDB endpoint Remove the LDB endpoint description from the common imx6sx.dtsi as it causes regression for boards that has the LCDIF connected directly to a parallel display. Let the LDB endpoint be described in the board devicetree file instead. Cc: stable@vger.kernel.org Fixes: b74edf626c4f ("ARM: dts: imx6sx: Add LDB support") Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo commit 1f2190d6b7112d22d3f8dfeca16a2f6a2f51444e Author: Sven Joachim Date: Thu Jul 27 22:00:41 2023 +0200 arch/*/configs/*defconfig: Replace AUTOFS4_FS by AUTOFS_FS Commit a2225d931f75 ("autofs: remove left-over autofs4 stubs") promised the removal of the fs/autofs/Kconfig fragment for AUTOFS4_FS within a couple of releases, but five years later this still has not happened yet, and AUTOFS4_FS is still enabled in 63 defconfigs. Get rid of it mechanically: git grep -l CONFIG_AUTOFS4_FS -- '*defconfig' | xargs sed -i 's/AUTOFS4_FS/AUTOFS_FS/' Also just remove the AUTOFS4_FS config option stub. Anybody who hasn't regenerated their config file in the last five years will need to just get the new name right when they do. Signed-off-by: Sven Joachim Acked-by: Ian Kent Signed-off-by: Linus Torvalds commit 37e3cecb4cdfbc99aaa1da2175681aac1d8a7f6d Merge: 7938cd1543687 8bf43be799d4b Author: David S. Miller Date: Sat Jul 29 18:13:41 2023 +0100 Merge branch 'net-data-races' Eric Dumazet says: ==================== net: annotate data-races This series was inspired by a syzbot/KCSAN report. This will later also permit some optimizations, like not having to lock the socket while reading/writing some of its fields. ==================== Signed-off-by: David S. Miller commit 8bf43be799d4b242ea552a14db10456446be843e Author: Eric Dumazet Date: Fri Jul 28 15:03:18 2023 +0000 net: annotate data-races around sk->sk_priority sk_getsockopt() runs locklessly. This means sk->sk_priority can be read while other threads are changing its value. Other reads also happen without socket lock being held. Add missing annotations where needed. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit e5f0d2dd3c2faa671711dac6d3ff3cef307bcfe3 Author: Eric Dumazet Date: Fri Jul 28 15:03:17 2023 +0000 net: add missing data-race annotation for sk_ll_usec In a prior commit I forgot that sk_getsockopt() reads sk->sk_ll_usec without holding a lock. Fixes: 0dbffbb5335a ("net: annotate data race around sk_ll_usec") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 11695c6e966b0ec7ed1d16777d294cef865a5c91 Author: Eric Dumazet Date: Fri Jul 28 15:03:16 2023 +0000 net: add missing data-race annotations around sk->sk_peek_off sk_getsockopt() runs locklessly, thus we need to annotate the read of sk->sk_peek_off. While we are at it, add corresponding annotations to sk_set_peek_off() and unix_set_peek_off(). Fixes: b9bb53f3836f ("sock: convert sk_peek_offset functions to WRITE_ONCE") Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Signed-off-by: David S. Miller commit 3c5b4d69c358a9275a8de98f87caf6eda644b086 Author: Eric Dumazet Date: Fri Jul 28 15:03:15 2023 +0000 net: annotate data-races around sk->sk_mark sk->sk_mark is often read while another thread could change the value. Fixes: 4a19ec5800fc ("[NET]: Introducing socket mark socket option.") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit b4b553253091cafe9ec38994acf42795e073bef5 Author: Eric Dumazet Date: Fri Jul 28 15:03:14 2023 +0000 net: add missing READ_ONCE(sk->sk_rcvbuf) annotation In a prior commit, I forgot to change sk_getsockopt() when reading sk->sk_rcvbuf locklessly. Fixes: ebb3b78db7bf ("tcp: annotate sk->sk_rcvbuf lockless reads") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 74bc084327c643499474ba75df485607da37dd6e Author: Eric Dumazet Date: Fri Jul 28 15:03:13 2023 +0000 net: add missing READ_ONCE(sk->sk_sndbuf) annotation In a prior commit, I forgot to change sk_getsockopt() when reading sk->sk_sndbuf locklessly. Fixes: e292f05e0df7 ("tcp: annotate sk->sk_sndbuf lockless reads") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit 285975dd674258ccb33e77a1803e8f2015e67105 Author: Eric Dumazet Date: Fri Jul 28 15:03:12 2023 +0000 net: annotate data-races around sk->sk_{rcv|snd}timeo sk_getsockopt() runs without locks, we must add annotations to sk->sk_rcvtimeo and sk->sk_sndtimeo. In the future we might allow fetching these fields before we lock the socket in TCP fast path. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit e6d12bdb435d23ff6c1890c852d85408a2f496ee Author: Eric Dumazet Date: Fri Jul 28 15:03:11 2023 +0000 net: add missing READ_ONCE(sk->sk_rcvlowat) annotation In a prior commit, I forgot to change sk_getsockopt() when reading sk->sk_rcvlowat locklessly. Fixes: eac66402d1c3 ("net: annotate sk->sk_rcvlowat lockless reads") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit ea7f45ef77b39e72244d282e47f6cb1ef4135cd2 Author: Eric Dumazet Date: Fri Jul 28 15:03:10 2023 +0000 net: annotate data-races around sk->sk_max_pacing_rate sk_getsockopt() runs locklessly. This means sk->sk_max_pacing_rate can be read while other threads are changing its value. Fixes: 62748f32d501 ("net: introduce SO_MAX_PACING_RATE") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit c76a0328899bbe226f8adeb88b8da9e4167bd316 Author: Eric Dumazet Date: Fri Jul 28 15:03:09 2023 +0000 net: annotate data-race around sk->sk_txrehash sk_getsockopt() runs locklessly. This means sk->sk_txrehash can be read while other threads are changing its value. Other locations were handled in commit cb6cd2cec799 ("tcp: Change SYN ACK retransmit behaviour to account for rehash") Fixes: 26859240e4ee ("txhash: Add socket option to control TX hash rethink behavior") Signed-off-by: Eric Dumazet Cc: Akhmat Karakotov Signed-off-by: David S. Miller commit fe11fdcb4207907d80cda2e73777465d68131e66 Author: Eric Dumazet Date: Fri Jul 28 15:03:08 2023 +0000 net: annotate data-races around sk->sk_reserved_mem sk_getsockopt() runs locklessly. This means sk->sk_reserved_mem can be read while other threads are changing its value. Add missing annotations where they are needed. Fixes: 2bb2f5fb21b0 ("net: add new socket option SO_RESERVE_MEM") Signed-off-by: Eric Dumazet Cc: Wei Wang Signed-off-by: David S. Miller commit 7938cd15436873f649f31cb867bac2d88ca564d0 Author: Richard Gobert Date: Thu Jul 27 17:33:56 2023 +0200 net: gro: fix misuse of CB in udp socket lookup This patch fixes a misuse of IP{6}CB(skb) in GRO, while calling to `udp6_lib_lookup2` when handling udp tunnels. `udp6_lib_lookup2` fetch the device from CB. The fix changes it to fetch the device from `skb->dev`. l3mdev case requires special attention since it has a master and a slave device. Fixes: a6024562ffd7 ("udp: Add GRO functions to UDP socket") Reported-by: Gal Pressman Signed-off-by: Richard Gobert Reviewed-by: David Ahern Signed-off-by: David S. Miller commit e346e231b42bcae6822a6326acfb7b741e9e6026 Author: Konstantin Khorenko Date: Thu Jul 27 18:26:09 2023 +0300 qed: Fix scheduling in a tasklet while getting stats Here we've got to a situation when tasklet called usleep_range() in PTT acquire logic, thus welcome to the "scheduling while atomic" BUG(). BUG: scheduling while atomic: swapper/24/0/0x00000100 [] schedule+0x29/0x70 [] schedule_hrtimeout_range_clock+0xb2/0x150 [] schedule_hrtimeout_range+0x13/0x20 [] usleep_range+0x4f/0x70 [] qed_ptt_acquire+0x38/0x100 [qed] [] _qed_get_vport_stats+0x458/0x580 [qed] [] qed_get_vport_stats+0x1c/0xd0 [qed] [] qed_get_protocol_stats+0x93/0x100 [qed] qed_mcp_send_protocol_stats case MFW_DRV_MSG_GET_LAN_STATS: case MFW_DRV_MSG_GET_FCOE_STATS: case MFW_DRV_MSG_GET_ISCSI_STATS: case MFW_DRV_MSG_GET_RDMA_STATS: [] qed_mcp_handle_events+0x2d8/0x890 [qed] qed_int_assertion qed_int_attentions [] qed_int_sp_dpc+0xa50/0xdc0 [qed] [] tasklet_action+0x83/0x140 [] __do_softirq+0x125/0x2bb [] call_softirq+0x1c/0x30 [] do_softirq+0x65/0xa0 [] irq_exit+0x105/0x110 [] do_IRQ+0x56/0xf0 Fix this by making caller to provide the context whether it could be in atomic context flow or not when getting stats from QED driver. QED driver based on the context provided decide to schedule out or not when acquiring the PTT BAR window. We faced the BUG_ON() while getting vport stats, but according to the code same issue could happen for fcoe and iscsi statistics as well, so fixing them too. Fixes: 6c75424612a7 ("qed: Add support for NCSI statistics.") Fixes: 1e128c81290a ("qed: Add support for hardware offloaded FCoE.") Fixes: 2f2b2614e893 ("qed: Provide iSCSI statistics to management") Cc: Sudarsana Kalluru Cc: David Miller Cc: Manish Chopra Signed-off-by: Konstantin Khorenko Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 8d7ae22ae9f8c8a4407f8e993df64440bdbd0cee Author: Lukasz Majewski Date: Thu Jul 27 10:13:42 2023 +0200 net: dsa: microchip: KSZ9477 register regmap alignment to 32 bit boundaries The commit (SHA1: 5c844d57aa7894154e49cf2fc648bfe2f1aefc1c) provided code to apply "Module 6: Certain PHY registers must be written as pairs instead of singly" errata for KSZ9477 as this chip for certain PHY registers (0xN120 to 0xN13F, N=1,2,3,4,5) must be accesses as 32 bit words instead of 16 or 8 bit access. Otherwise, adjacent registers (no matter if reserved or not) are overwritten with 0x0. Without this patch some registers (e.g. 0x113c or 0x1134) required for 32 bit access are out of valid regmap ranges. As a result, following error is observed and KSZ9477 is not properly configured: ksz-switch spi1.0: can't rmw 32bit reg 0x113c: -EIO ksz-switch spi1.0: can't rmw 32bit reg 0x1134: -EIO ksz-switch spi1.0 lan1 (uninitialized): failed to connect to PHY: -EIO ksz-switch spi1.0 lan1 (uninitialized): error -5 setting up PHY for tree 0, switch 0, port 0 The solution is to modify regmap_reg_range to allow accesses with 4 bytes boundaries. Signed-off-by: Lukasz Majewski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit a0b1b2055be34c0ec1371764d040164cde1ead79 Author: Thierry Reding Date: Wed Jul 26 18:32:00 2023 +0200 net: stmmac: tegra: Properly allocate clock bulk data The clock data is an array of struct clk_bulk_data, so make sure to allocate enough memory. Fixes: d8ca113724e7 ("net: stmmac: tegra: Add MGBE support") Signed-off-by: Thierry Reding Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 12214540ad87ce824a8a791a3f063e6121ec5b66 Merge: ffabf7c731765 1e74ae32805b6 Author: Linus Torvalds Date: Sat Jul 29 08:59:25 2023 -0700 Merge tag 'loongarch-fixes-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Some bug fixes for build system, builtin cmdline handling, bpf and {copy, clear}_user, together with a trivial cleanup" * tag 'loongarch-fixes-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: Cleanup __builtin_constant_p() checking for cpu_has_* LoongArch: BPF: Fix check condition to call lu32id in move_imm() LoongArch: BPF: Enable bpf_probe_read{, str}() on LoongArch LoongArch: Fix return value underflow in exception path LoongArch: Fix CMDLINE_EXTEND and CMDLINE_BOOTLOADER handling LoongArch: Fix module relocation error with binutils 2.41 LoongArch: Only fiddle with CHECKFLAGS if `need-compiler' commit 5a7591176c47cce363c1eed704241e5d1c42c5a6 Author: Sean Christopherson Date: Tue Jun 13 13:30:37 2023 -0700 KVM: selftests: Expand x86's sregs test to cover illegal CR0 values Add coverage to x86's set_sregs_test to verify KVM rejects vendor-agnostic illegal CR0 values, i.e. CR0 values whose legality doesn't depend on the current VMX mode. KVM historically has neglected to reject bad CR0s from userspace, i.e. would happily accept a completely bogus CR0 via KVM_SET_SREGS{2}. Punt VMX specific subtests to future work, as they would require quite a bit more effort, and KVM gets coverage for CR0 checks in general through other means, e.g. KVM-Unit-Tests. Signed-off-by: Sean Christopherson Message-Id: <20230613203037.1968489-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit c4abd7352023aa96114915a0bb2b88016a425cda Author: Sean Christopherson Date: Tue Jun 13 13:30:36 2023 -0700 KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest Stuff CR0 and/or CR4 to be compliant with a restricted guest if and only if KVM itself is not configured to utilize unrestricted guests, i.e. don't stuff CR0/CR4 for a restricted L2 that is running as the guest of an unrestricted L1. Any attempt to VM-Enter a restricted guest with invalid CR0/CR4 values should fail, i.e. in a nested scenario, KVM (as L0) should never observe a restricted L2 with incompatible CR0/CR4, since nested VM-Enter from L1 should have failed. And if KVM does observe an active, restricted L2 with incompatible state, e.g. due to a KVM bug, fudging CR0/CR4 instead of letting VM-Enter fail does more harm than good, as KVM will often neglect to undo the side effects, e.g. won't clear rmode.vm86_active on nested VM-Exit, and thus the damage can easily spill over to L1. On the other hand, letting VM-Enter fail due to bad guest state is more likely to contain the damage to L2 as KVM relies on hardware to perform most guest state consistency checks, i.e. KVM needs to be able to reflect a failed nested VM-Enter into L1 irrespective of (un)restricted guest behavior. Cc: Jim Mattson Cc: stable@vger.kernel.org Fixes: bddd82d19e2e ("KVM: nVMX: KVM needs to unset "unrestricted guest" VM-execution control in vmcs02 if vmcs12 doesn't set it") Signed-off-by: Sean Christopherson Message-Id: <20230613203037.1968489-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 26a0652cb453c72f6aab0974bc4939e9b14f886b Author: Sean Christopherson Date: Tue Jun 13 13:30:35 2023 -0700 KVM: x86: Disallow KVM_SET_SREGS{2} if incoming CR0 is invalid Reject KVM_SET_SREGS{2} with -EINVAL if the incoming CR0 is invalid, e.g. due to setting bits 63:32, illegal combinations, or to a value that isn't allowed in VMX (non-)root mode. The VMX checks in particular are "fun" as failure to disallow Real Mode for an L2 that is configured with unrestricted guest disabled, when KVM itself has unrestricted guest enabled, will result in KVM forcing VM86 mode to virtual Real Mode for L2, but then fail to unwind the related metadata when synthesizing a nested VM-Exit back to L1 (which has unrestricted guest enabled). Opportunistically fix a benign typo in the prototype for is_valid_cr4(). Cc: stable@vger.kernel.org Reported-by: syzbot+5feef0b9ee9c8e9e5689@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000f316b705fdf6e2b4@google.com Signed-off-by: Sean Christopherson Message-Id: <20230613203037.1968489-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 880218361c10d6dd7f99423d621112b8770fc32f Author: Sean Christopherson Date: Wed Jul 26 13:29:20 2023 -0700 Revert "debugfs, coccinelle: check for obsolete DEFINE_SIMPLE_ATTRIBUTE() usage" Remove coccinelle's recommendation to use DEFINE_DEBUGFS_ATTRIBUTE() instead of DEFINE_SIMPLE_ATTRIBUTE(). Regardless of whether or not the "significant overhead" incurred by debugfs_create_file() is actually meaningful, warnings from the script have led to a rash of low-quality patches that have sowed confusion and consumed maintainer time for little to no benefit. There have been no less than four attempts to "fix" KVM, and a quick search on lore shows that KVM is not alone. This reverts commit 5103068eaca290f890a30aae70085fac44cecaf6. Link: https://lore.kernel.org/all/87tu2nbnz3.fsf@mpe.ellerman.id.au Link: https://lore.kernel.org/all/c0b98151-16b6-6d8f-1765-0f7d46682d60@redhat.com Link: https://lkml.kernel.org/r/20230706072954.4881-1-duminjie%40vivo.com Link: https://lore.kernel.org/all/Y2FsbufV00jbyF0B@google.com Link: https://lore.kernel.org/all/Y2ENJJ1YiSg5oHiy@orome Link: https://lore.kernel.org/all/7560b350e7b23786ce712118a9a504356ff1cca4.camel@kernel.org Suggested-by: Paolo Bonzini Acked-by: Greg Kroah-Hartman Signed-off-by: Sean Christopherson Message-Id: <20230726202920.507756-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 211c0189ea18648a0cf23dea9f4ed745bc9252f6 Author: Sean Christopherson Date: Tue Jul 11 16:01:31 2023 -0700 KVM: selftests: Verify stats fd is usable after VM fd has been closed Verify that VM and vCPU binary stats files are usable even after userspace has put its last direct reference to the VM. This is a regression test for a UAF bug where KVM didn't gift the stats files a reference to the VM. Signed-off-by: Sean Christopherson Message-Id: <20230711230131.648752-8-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 65f1f57f35e5e833c879a7afb9c862c603695917 Author: Sean Christopherson Date: Tue Jul 11 16:01:30 2023 -0700 KVM: selftests: Verify stats fd can be dup()'d and read Expand the binary stats test to verify that a stats fd can be dup()'d and read, to (very) roughly simulate userspace passing around the file. Adding the dup() test is primarily an intermediate step towards verifying that userspace can read VM/vCPU stats before _and_ after userspace closes its copy of the VM fd; the dup() test itself is only mildly interesting. Signed-off-by: Sean Christopherson Message-Id: <20230711230131.648752-7-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 47d1be8a78fb587fe5a8f0873244476700171403 Author: Sean Christopherson Date: Tue Jul 11 16:01:29 2023 -0700 KVM: selftests: Verify userspace can create "redundant" binary stats files Verify that KVM doesn't artificially limit KVM_GET_STATS_FD to a single file per VM/vCPU. There's no known use case for getting multiple stats fds, but it should work, and more importantly creating multiple files will make it easier to test that KVM correct manages VM refcounts for stats files. Signed-off-by: Sean Christopherson Message-Id: <20230711230131.648752-6-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 33b02704071b0972a62ec32516847f91cab6cb8f Author: Sean Christopherson Date: Tue Jul 11 16:01:28 2023 -0700 KVM: selftests: Explicitly free vcpus array in binary stats test Explicitly free the all-encompassing vcpus array in the binary stats test so that the test is consistent with respect to freeing all dynamically allocated resources (versus letting them be freed on exit). Signed-off-by: Sean Christopherson Message-Id: <20230711230131.648752-5-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 87d53582bc8be30a11654a45fac0a257ed830ea8 Author: Sean Christopherson Date: Tue Jul 11 16:01:27 2023 -0700 KVM: selftests: Clean up stats fd in common stats_test() helper Move the stats fd cleanup code into stats_test() and drop the superfluous vm_stats_test() and vcpu_stats_test() helpers in order to decouple creation of the stats file from consuming/testing the file (deduping code is a bonus). This will make it easier to test various edge cases related to stats, e.g. that userspace can dup() a stats fd, that userspace can have multiple stats files for a singleVM/vCPU, etc. Signed-off-by: Sean Christopherson Message-Id: <20230711230131.648752-4-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 625646aede90554fed8d46fd0e081238e071ac5e Author: Sean Christopherson Date: Tue Jul 11 16:01:26 2023 -0700 KVM: selftests: Use pread() to read binary stats header Use pread() with an explicit offset when reading the header and the header name for a binary stats fd so that the common helper and the binary stats test don't subtly rely on the file effectively being untouched, e.g. to allow multiple reads of the header, name, etc. Signed-off-by: Sean Christopherson Message-Id: <20230711230131.648752-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit eed3013faa401aae662398709410a59bb0646e32 Author: Sean Christopherson Date: Tue Jul 11 16:01:25 2023 -0700 KVM: Grab a reference to KVM for VM and vCPU stats file descriptors Grab a reference to KVM prior to installing VM and vCPU stats file descriptors to ensure the underlying VM and vCPU objects are not freed until the last reference to any and all stats fds are dropped. Note, the stats paths manually invoke fd_install() and so don't need to grab a reference before creating the file. Fixes: ce55c049459c ("KVM: stats: Support binary stats retrieval for a VCPU") Fixes: fcfe1baeddbf ("KVM: stats: Support binary stats retrieval for a VM") Reported-by: Zheng Zhang Closes: https://lore.kernel.org/all/CAC_GQSr3xzZaeZt85k_RCBd5kfiOve8qXo7a81Cq53LuVQ5r=Q@mail.gmail.com Cc: stable@vger.kernel.org Cc: Kees Cook Signed-off-by: Sean Christopherson Reviewed-by: Kees Cook Message-Id: <20230711230131.648752-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 3bcbc20942db5d738221cca31a928efc09827069 Author: Sean Christopherson Date: Fri Jul 21 15:33:52 2023 -0700 selftests/rseq: Play nice with binaries statically linked against glibc 2.35+ To allow running rseq and KVM's rseq selftests as statically linked binaries, initialize the various "trampoline" pointers to point directly at the expect glibc symbols, and skip the dlysm() lookups if the rseq size is non-zero, i.e. the binary is statically linked *and* the libc registered its own rseq. Define weak versions of the symbols so as not to break linking against libc versions that don't support rseq in any capacity. The KVM selftests in particular are often statically linked so that they can be run on targets with very limited runtime environments, i.e. test machines. Fixes: 233e667e1ae3 ("selftests/rseq: Uplift rseq selftests for compatibility with glibc-2.35") Cc: Aaron Lewis Cc: kvm@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-Id: <20230721223352.2333911-1-seanjc@google.com> Signed-off-by: Paolo Bonzini commit b439eb8ab578557263815ba8581d02c1b730e348 Author: Sean Christopherson Date: Fri Jul 21 15:43:37 2023 -0700 Revert "KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid" Now that handle_fastpath_set_msr_irqoff() acquires kvm->srcu, i.e. allows dereferencing memslots during WRMSR emulation, drop the requirement that "next RIP" is valid. In hindsight, acquiring kvm->srcu would have been a better fix than avoiding the pastpath, but at the time it was thought that accessing SRCU-protected data in the fastpath was a one-off edge case. This reverts commit 5c30e8101e8d5d020b1d7119117889756a6ed713. Signed-off-by: Sean Christopherson Message-Id: <20230721224337.2335137-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 3f2739bd1e0b7e9669333852b4e618294d5a1e54 Author: Sean Christopherson Date: Fri Jul 21 15:43:36 2023 -0700 KVM: x86: Acquire SRCU read lock when handling fastpath MSR writes Temporarily acquire kvm->srcu for read when potentially emulating WRMSR in the VM-Exit fastpath handler, as several of the common helpers used during emulation expect the caller to provide SRCU protection. E.g. if the guest is counting instructions retired, KVM will query the PMU event filter when stepping over the WRMSR. dump_stack+0x85/0xdf lockdep_rcu_suspicious+0x109/0x120 pmc_event_is_allowed+0x165/0x170 kvm_pmu_trigger_event+0xa5/0x190 handle_fastpath_set_msr_irqoff+0xca/0x1e0 svm_vcpu_run+0x5c3/0x7b0 [kvm_amd] vcpu_enter_guest+0x2108/0x2580 Alternatively, check_pmu_event_filter() could acquire kvm->srcu, but this isn't the first bug of this nature, e.g. see commit 5c30e8101e8d ("KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid"). Providing protection for the entirety of WRMSR emulation will allow reverting the aforementioned commit, and will avoid having to play whack-a-mole when new uses of SRCU-protected structures are inevitably added in common emulation helpers. Fixes: dfdeda67ea2d ("KVM: x86/pmu: Prevent the PMU from counting disallowed events") Reported-by: Greg Thelen Reported-by: Aaron Lewis Signed-off-by: Sean Christopherson Message-Id: <20230721224337.2335137-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit a062dad7ec4b91473e2e82c4e03cbee953189a87 Author: Sean Christopherson Date: Fri Jul 21 16:56:37 2023 -0700 KVM: VMX: Use vmread_error() to report VM-Fail in "goto" path Use vmread_error() to report VM-Fail on VMREAD for the "asm goto" case, now that trampoline case has yet another wrapper around vmread_error() to play nice with instrumentation. Signed-off-by: Sean Christopherson Message-Id: <20230721235637.2345403-3-seanjc@google.com> Signed-off-by: Paolo Bonzini commit c20d403fd04c20959b7e6669868372f433947e5f Author: Sean Christopherson Date: Fri Jul 21 16:56:36 2023 -0700 KVM: VMX: Make VMREAD error path play nice with noinstr Mark vmread_error_trampoline() as noinstr, and add a second trampoline for the CONFIG_CC_HAS_ASM_GOTO_OUTPUT=n case to enable instrumentation when handling VM-Fail on VMREAD. VMREAD is used in various noinstr flows, e.g. immediately after VM-Exit, and objtool rightly complains that the call to the error trampoline leaves a no-instrumentation section without annotating that it's safe to do so. vmlinux.o: warning: objtool: vmx_vcpu_enter_exit+0xc9: call to vmread_error_trampoline() leaves .noinstr.text section Note, strictly speaking, enabling instrumentation in the VM-Fail path isn't exactly safe, but if VMREAD fails the kernel/system is likely hosed anyways, and logging that there is a fatal error is more important than *maybe* encountering slightly unsafe instrumentation. Reported-by: Su Hui Signed-off-by: Sean Christopherson Message-Id: <20230721235637.2345403-2-seanjc@google.com> Signed-off-by: Paolo Bonzini commit 5e1fe4a21c0c2a69419d97d62d3213e8f843920d Author: Like Xu Date: Mon Jul 24 19:12:36 2023 +0800 KVM: x86/irq: Conditionally register IRQ bypass consumer again As was attempted commit 14717e203186 ("kvm: Conditionally register IRQ bypass consumer"): "if we don't support a mechanism for bypassing IRQs, don't register as a consumer. Initially this applied to AMD processors, but when AVIC support was implemented for assigned devices, kvm_arch_has_irq_bypass() was always returning true. We can still skip registering the consumer where enable_apicv or posted-interrupts capability is unsupported or globally disabled. This eliminates meaningless dev_info()s when the connect fails between producer and consumer", such as on Linux hosts where enable_apicv or posted-interrupts capability is unsupported or globally disabled. Cc: Alex Williamson Reported-by: Yong He Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217379 Signed-off-by: Like Xu Message-Id: <20230724111236.76570-1-likexu@tencent.com> Signed-off-by: Paolo Bonzini commit fd1815ea709e414f83a06e4cf13ade4a49dd0fda Author: Peng Hao Date: Fri Jul 28 14:49:48 2023 +0800 KVM: X86: Use GFP_KERNEL_ACCOUNT for pid_table in ipiv The pid_table of ipiv is the persistent memory allocated by per-vcpu, which should be counted into the memory cgroup. Signed-off-by: Peng Hao Message-Id: Signed-off-by: Paolo Bonzini commit bf672720e83cf04c007aa11c242229e70985135b Author: Maxim Levitsky Date: Wed Jul 26 16:59:45 2023 +0300 KVM: x86: check the kvm_cpu_get_interrupt result before using it The code was blindly assuming that kvm_cpu_get_interrupt never returns -1 when there is a pending interrupt. While this should be true, a bug in KVM can still cause this. If -1 is returned, the code before this patch was converting it to 0xFF, and 0xFF interrupt was injected to the guest, which results in an issue which was hard to debug. Add WARN_ON_ONCE to catch this case and skip the injection if this happens again. Signed-off-by: Maxim Levitsky Message-Id: <20230726135945.260841-4-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit cff540ebef38303a4cabf4b8bb49317be01b4b0f Author: Maxim Levitsky Date: Wed Jul 26 16:59:44 2023 +0300 KVM: x86: VMX: set irr_pending in kvm_apic_update_irr When the APICv is inhibited, the irr_pending optimization is used. Therefore, when kvm_apic_update_irr sets bits in the IRR, it must set irr_pending to true as well. Signed-off-by: Maxim Levitsky Message-Id: <20230726135945.260841-3-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit 514946d1436341bae57f647ee633cef5edb19ee2 Author: Maxim Levitsky Date: Wed Jul 26 16:59:43 2023 +0300 KVM: x86: VMX: __kvm_apic_update_irr must update the IRR atomically If APICv is inhibited, then IPIs from peer vCPUs are done by atomically setting bits in IRR. This means, that when __kvm_apic_update_irr copies PIR to IRR, it has to modify IRR atomically as well. Signed-off-by: Maxim Levitsky Message-Id: <20230726135945.260841-2-mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini commit de02f2ac5d8cfb311f44f2bf144cc20002f1fbbd Author: Masami Hiramatsu (Google) Date: Tue Jul 11 10:50:47 2023 +0900 kprobes: Prohibit probing on CFI preamble symbol Do not allow to probe on "__cfi_" or "__pfx_" started symbol, because those are used for CFI and not executed. Probing it will break the CFI. Link: https://lore.kernel.org/all/168904024679.116016.18089228029322008512.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit 3bbbe97ad83db8d9df06daf027b0840188de625d Author: Borislav Petkov (AMD) Date: Fri Jul 28 23:03:22 2023 +0200 x86/srso: Add a forgotten NOENDBR annotation Fix: vmlinux.o: warning: objtool: .export_symbol+0x29e40: data relocation to !ENDBR: srso_untrain_ret_alias+0x0 Reported-by: Linus Torvalds Signed-off-by: Borislav Petkov (AMD) commit 0c02cc576eac161601927b41634f80bfd55bfa9e Author: Heiko Carstens Date: Thu Jul 27 20:29:39 2023 +0200 KVM: s390: fix sthyi error handling Commit 9fb6c9b3fea1 ("s390/sthyi: add cache to store hypervisor info") added cache handling for store hypervisor info. This also changed the possible return code for sthyi_fill(). Instead of only returning a condition code like the sthyi instruction would do, it can now also return a negative error value (-ENOMEM). handle_styhi() was not changed accordingly. In case of an error, the negative error value would incorrectly injected into the guest PSW. Add proper error handling to prevent this, and update the comment which describes the possible return values of sthyi_fill(). Fixes: 9fb6c9b3fea1 ("s390/sthyi: add cache to store hypervisor info") Reviewed-by: Christian Borntraeger Link: https://lore.kernel.org/r/20230727182939.2050744-1-hca@linux.ibm.com Signed-off-by: Heiko Carstens commit 238ec850b95a02dcdff3edc86781aa913549282f Author: Josh Poimboeuf Date: Fri Jul 28 17:28:43 2023 -0500 x86/srso: Fix return thunks in generated code Set X86_FEATURE_RETHUNK when enabling the SRSO mitigation so that generated code (e.g., ftrace, static call, eBPF) generates "jmp __x86_return_thunk" instead of RET. [ bp: Add a comment. ] Fixes: fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation") Signed-off-by: Josh Poimboeuf Signed-off-by: Borislav Petkov (AMD) commit 8a4629055ef55177b5b63dab1ecce676bd8cccdd Author: Yiyuan Guo Date: Fri Jun 30 22:37:19 2023 +0800 iio: cros_ec: Fix the allocation size for cros_ec_command The struct cros_ec_command contains several integer fields and a trailing array. An allocation size neglecting the integer fields can lead to buffer overrun. Reviewed-by: Tzung-Bi Shih Signed-off-by: Yiyuan Guo Fixes: 974e6f02e27e ("iio: cros_ec_sensors_core: Add common functions for the ChromeOS EC Sensor Hub.") Link: https://lore.kernel.org/r/20230630143719.1513906-1-yguoaz@gmail.com Cc: Signed-off-by: Jonathan Cameron commit 238353088e9b28d61f58994aa058d736fc306614 Author: James Clark Date: Tue Jul 25 11:58:26 2023 +0100 scripts/kallsyms: Fix build failure by setting errno before calling getline() getline() returns -1 at EOF as well as on error. It also doesn't set errno to 0 on success, so initialize it to 0 before using errno to check for an error condition. See the paragraph here [1]: For some system calls and library functions (e.g., getpriority(2)), -1 is a valid return on success. In such cases, a successful return can be distinguished from an error return by setting errno to zero before the call, and then, if the call returns a status that indicates that an error may have occurred, checking to see if errno has a nonzero value. Bear has a bug [2] that launches processes with errno set and causes the following build failure: $ bear -- make LLVM=1 ... LD .tmp_vmlinux.kallsyms1 NM .tmp_vmlinux.kallsyms1.syms KSYMS .tmp_vmlinux.kallsyms1.S read_symbol: Invalid argument [1]: https://linux.die.net/man/3/errno [2]: https://github.com/rizsotto/Bear/issues/469 Fixes: 1c975da56a6f ("scripts/kallsyms: remove KSYM_NAME_LEN_BUFFER") Reviewed-by: Miguel Ojeda Signed-off-by: James Clark Signed-off-by: Masahiro Yamada commit 56c6be35fcbed54279df0a2c9e60480a61841d6f Author: Chengfeng Ye Date: Thu Jul 27 08:56:19 2023 +0000 mISDN: hfcpci: Fix potential deadlock on &hc->lock As &hc->lock is acquired by both timer _hfcpci_softirq() and hardirq hfcpci_int(), the timer should disable irq before lock acquisition otherwise deadlock could happen if the timmer is preemtped by the hadr irq. Possible deadlock scenario: hfcpci_softirq() (timer) -> _hfcpci_softirq() -> spin_lock(&hc->lock); -> hfcpci_int() -> spin_lock(&hc->lock); (deadlock here) This flaw was found by an experimental static analysis tool I am developing for irq-related deadlock. The tentative patch fixes the potential deadlock by spin_lock_irq() in timer. Fixes: b36b654a7e82 ("mISDN: Create /sys/class/mISDN") Signed-off-by: Chengfeng Ye Link: https://lore.kernel.org/r/20230727085619.7419-1-dg573847474@gmail.com Signed-off-by: Jakub Kicinski commit ffabf7c731765da3dbfaffa4ed58b51ae9c2e650 Merge: 122e7943b252f 3ac873c76d79f Author: Linus Torvalds Date: Fri Jul 28 18:31:18 2023 -0700 Merge tag 'ata-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata fixes from Damien Le Moal: - Fix error message output in the pata_arasan_cf driver (Minjie) - Fix invalid error return in the pata_octeon_cf driver initialization (Yingliang) - Fix a compilation warning due to a missing static function declaration in the pata_ns87415 driver (Arnd) - Fix the condition evaluating when to fetch sense data for successful completions, which should be done only when command duration limits are being used (Niklas) * tag 'ata-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: libata-core: fix when to fetch sense data for successful commands ata: pata_ns87415: mark ns87560_tf_read static ata: pata_octeon_cf: fix error return code in octeon_cf_probe() ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer() commit e68409db995380d1badacba41ff24996bd396171 Author: Jamal Hadi Salim Date: Wed Jul 26 09:51:51 2023 -0400 net: sched: cls_u32: Fix match key mis-addressing A match entry is uniquely identified with an "address" or "path" in the form of: hashtable ID(12b):bucketid(8b):nodeid(12b). When creating table match entries all of hash table id, bucket id and node (match entry id) are needed to be either specified by the user or reasonable in-kernel defaults are used. The in-kernel default for a table id is 0x800(omnipresent root table); for bucketid it is 0x0. Prior to this fix there was none for a nodeid i.e. the code assumed that the user passed the correct nodeid and if the user passes a nodeid of 0 (as Mingi Cho did) then that is what was used. But nodeid of 0 is reserved for identifying the table. This is not a problem until we dump. The dump code notices that the nodeid is zero and assumes it is referencing a table and therefore references table struct tc_u_hnode instead of what was created i.e match entry struct tc_u_knode. Ming does an equivalent of: tc filter add dev dummy0 parent 10: prio 1 handle 0x1000 \ protocol ip u32 match ip src 10.0.0.1/32 classid 10:1 action ok Essentially specifying a table id 0, bucketid 1 and nodeid of zero Tableid 0 is remapped to the default of 0x800. Bucketid 1 is ignored and defaults to 0x00. Nodeid was assumed to be what Ming passed - 0x000 dumping before fix shows: ~$ tc filter ls dev dummy0 parent 10: filter protocol ip pref 1 u32 chain 0 filter protocol ip pref 1 u32 chain 0 fh 800: ht divisor 1 filter protocol ip pref 1 u32 chain 0 fh 800: ht divisor -30591 Note that the last line reports a table instead of a match entry (you can tell this because it says "ht divisor..."). As a result of reporting the wrong data type (misinterpretting of struct tc_u_knode as being struct tc_u_hnode) the divisor is reported with value of -30591. Ming identified this as part of the heap address (physmap_base is 0xffff8880 (-30591 - 1)). The fix is to ensure that when table entry matches are added and no nodeid is specified (i.e nodeid == 0) then we get the next available nodeid from the table's pool. After the fix, this is what the dump shows: $ tc filter ls dev dummy0 parent 10: filter protocol ip pref 1 u32 chain 0 filter protocol ip pref 1 u32 chain 0 fh 800: ht divisor 1 filter protocol ip pref 1 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 10:1 not_in_hw match 0a000001/ffffffff at 12 action order 1: gact action pass random type none pass val 0 index 1 ref 1 bind 1 Reported-by: Mingi Cho Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jamal Hadi Salim Link: https://lore.kernel.org/r/20230726135151.416917-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski commit dea499781a1150d285c62b26659f62fb00824fce Author: Zheng Yejian Date: Wed Jul 26 17:58:04 2023 +0800 tracing: Fix warning in trace_buffered_event_disable() Warning happened in trace_buffered_event_disable() at WARN_ON_ONCE(!trace_buffered_event_ref) Call Trace: ? __warn+0xa5/0x1b0 ? trace_buffered_event_disable+0x189/0x1b0 __ftrace_event_enable_disable+0x19e/0x3e0 free_probe_data+0x3b/0xa0 unregister_ftrace_function_probe_func+0x6b8/0x800 event_enable_func+0x2f0/0x3d0 ftrace_process_regex.isra.0+0x12d/0x1b0 ftrace_filter_write+0xe6/0x140 vfs_write+0x1c9/0x6f0 [...] The cause of the warning is in __ftrace_event_enable_disable(), trace_buffered_event_enable() was called once while trace_buffered_event_disable() was called twice. Reproduction script show as below, for analysis, see the comments: ``` #!/bin/bash cd /sys/kernel/tracing/ # 1. Register a 'disable_event' command, then: # 1) SOFT_DISABLED_BIT was set; # 2) trace_buffered_event_enable() was called first time; echo 'cmdline_proc_show:disable_event:initcall:initcall_finish' > \ set_ftrace_filter # 2. Enable the event registered, then: # 1) SOFT_DISABLED_BIT was cleared; # 2) trace_buffered_event_disable() was called first time; echo 1 > events/initcall/initcall_finish/enable # 3. Try to call into cmdline_proc_show(), then SOFT_DISABLED_BIT was # set again!!! cat /proc/cmdline # 4. Unregister the 'disable_event' command, then: # 1) SOFT_DISABLED_BIT was cleared again; # 2) trace_buffered_event_disable() was called second time!!! echo '!cmdline_proc_show:disable_event:initcall:initcall_finish' > \ set_ftrace_filter ``` To fix it, IIUC, we can change to call trace_buffered_event_enable() at fist time soft-mode enabled, and call trace_buffered_event_disable() at last time soft-mode disabled. Link: https://lore.kernel.org/linux-trace-kernel/20230726095804.920457-1-zhengyejian1@huawei.com Cc: Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events") Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit 122e7943b252fcf48b4d085dec084e24fc8bec45 Merge: 20d3f2417b41a 6c54312f9689f Author: Linus Torvalds Date: Fri Jul 28 17:19:52 2023 -0700 Merge tag 'mm-hotfixes-stable-2023-07-28-15-52' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull hotfixes from Andrew Morton: "11 hotfixes. Five are cc:stable and the remainder address post-6.4 issues or aren't considered serious enough to justify backporting" * tag 'mm-hotfixes-stable-2023-07-28-15-52' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/memory-failure: fix hardware poison check in unpoison_memory() proc/vmcore: fix signedness bug in read_from_oldmem() mailmap: update remaining active codeaurora.org email addresses mm: lock VMA in dup_anon_vma() before setting ->anon_vma mm: fix memory ordering for mm_lock_seq and vm_lock_seq scripts/spelling.txt: remove 'thead' as a typo mm/pagewalk: fix EFI_PGT_DUMP of espfix area shmem: minor fixes to splice-read implementation tmpfs: fix Documentation of noswap and huge mount options Revert "um: Use swap() to make code cleaner" mm/damon/core-test: initialise context before test in damon_test_set_attrs() commit 20d3f2417b41a04510722144eb9a2d7ab53bd75b Merge: 3632f42176a9b ac4436a5b20e0 Author: Linus Torvalds Date: Fri Jul 28 17:14:05 2023 -0700 Merge tag 'thermal-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control fixes from Rafael Wysocki: "Constify thermal_zone_device_register() parameters, which was omitted by mistake, and fix a double free on thermal zone unregistration in the generic DT thermal driver (Ahmad Fatoum)" * tag 'thermal-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: thermal: of: fix double-free on unregistration thermal: core: constify params in thermal_zone_device_register commit 3632f42176a9baaa6959c59364c85d71e574c0c0 Merge: 2f4effd85fe92 4dd8752a14ca0 Author: Linus Torvalds Date: Fri Jul 28 17:08:59 2023 -0700 Merge tag 'pm-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "Fix the arming of wakeup IRQs in the generic wakeup IRQ code (wakeirq), drop unused functions from it and fix up a driver using it and trying to work around the IRQ arming issue in a questionable way (Johan Hovold)" * tag 'pm-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: serial: qcom-geni: drop bogus runtime pm state update PM: sleep: wakeirq: drop unused enable helpers PM: sleep: wakeirq: fix wake irq arming commit 2f4effd85fe9228a21bdfd037be006aa9bd7a617 Merge: c06f9091a2913 e146503ac6841 Author: Linus Torvalds Date: Fri Jul 28 17:02:11 2023 -0700 Merge tag 'hwmon-for-v6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - k10temp: Display negative temperatures for industrial processors - pmbus core: Fix deadlock, NULL pointer dereference, and chip enable detection - nct7802: Do not display PECI1 temperature if disabled - nct6775: Fix IN scaling factors and feature detection for NCT6798/6799 - oxp-sensors: Fix race condition during device attribute creation - aquacomputer_d5next: Fix incorrect PWM value readout * tag 'hwmon-for-v6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (k10temp) Enable AMD3255 Proc to show negative temperature hwmon: (pmbus_core) Fix Deadlock in pmbus_regulator_get_status hwmon: (pmbus_core) Fix NULL pointer dereference hwmon: (pmbus_core) Fix pmbus_is_enabled() hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled hwmon: (nct6775) Fix IN scaling factors for 6798/6799 hwmon: (oxp-sensors) Move tt_toggle attribute to dev_groups hwmon: (aquacomputer_d5next) Fix incorrect PWM value readout hwmon: (nct6775) Fix register for nct6799 commit 800959e697de0c55613a2ce40bca52520a421c9f Author: YueHaibing Date: Tue Jul 25 21:48:08 2023 +0800 ftrace: Remove unused extern declarations commit 6a9c981b1e96 ("ftrace: Remove unused function ftrace_arch_read_dyn_info()") left ftrace_arch_read_dyn_info() extern declaration. And commit 1d74f2a0f64b ("ftrace: remove ftrace_ip_converted()") leave ftrace_ip_converted() declaration. Link: https://lore.kernel.org/linux-trace-kernel/20230725134808.9716-1-yuehaibing@huawei.com Cc: Cc: Signed-off-by: YueHaibing Signed-off-by: Steven Rostedt (Google) commit 6c95d71bad61410e3717afcf7fd1837a8e03edf2 Author: Gaosheng Cui Date: Mon Jul 24 22:08:27 2023 +0800 tracing: Fix kernel-doc warnings in trace_seq.c Fix kernel-doc warning: kernel/trace/trace_seq.c:142: warning: Function parameter or member 'args' not described in 'trace_seq_vprintf' Link: https://lkml.kernel.org/r/20230724140827.1023266-5-cuigaosheng1@huawei.com Cc: Signed-off-by: Gaosheng Cui Signed-off-by: Steven Rostedt (Google) commit bd7217f30c7f08fc20f745aa1e2174eb3ff6d82a Author: Gaosheng Cui Date: Mon Jul 24 22:08:26 2023 +0800 tracing: Fix kernel-doc warnings in trace_events_trigger.c Fix kernel-doc warnings: kernel/trace/trace_events_trigger.c:59: warning: Function parameter or member 'buffer' not described in 'event_triggers_call' kernel/trace/trace_events_trigger.c:59: warning: Function parameter or member 'event' not described in 'event_triggers_call' Link: https://lkml.kernel.org/r/20230724140827.1023266-4-cuigaosheng1@huawei.com Cc: Signed-off-by: Gaosheng Cui Signed-off-by: Steven Rostedt (Google) commit b32c789f7dbbba3e55f6295ad64923cb69e6f563 Author: Gaosheng Cui Date: Mon Jul 24 22:08:25 2023 +0800 tracing/synthetic: Fix kernel-doc warnings in trace_events_synth.c Fix kernel-doc warning: kernel/trace/trace_events_synth.c:1257: warning: Function parameter or member 'mod' not described in 'synth_event_gen_cmd_array_start' Link: https://lkml.kernel.org/r/20230724140827.1023266-3-cuigaosheng1@huawei.com Cc: Signed-off-by: Gaosheng Cui Signed-off-by: Steven Rostedt (Google) commit 151e34d1c6eb2f9b4b0b9d085d1fa9f02cc74f48 Author: Gaosheng Cui Date: Mon Jul 24 22:08:24 2023 +0800 ring-buffer: Fix kernel-doc warnings in ring_buffer.c Fix kernel-doc warnings: kernel/trace/ring_buffer.c:954: warning: Function parameter or member 'cpu' not described in 'ring_buffer_wake_waiters' kernel/trace/ring_buffer.c:3383: warning: Excess function parameter 'event' description in 'ring_buffer_unlock_commit' kernel/trace/ring_buffer.c:5359: warning: Excess function parameter 'cpu' description in 'ring_buffer_reset_online_cpus' Link: https://lkml.kernel.org/r/20230724140827.1023266-2-cuigaosheng1@huawei.com Cc: Signed-off-by: Gaosheng Cui Signed-off-by: Steven Rostedt (Google) commit c06f9091a2913f9f76e68ce3e0a7f781546034b6 Merge: 2b17e90d3f92f ae463563b7a1b Author: Linus Torvalds Date: Fri Jul 28 16:55:56 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Several smaller driver fixes and a core RDMA CM regression fix: - Fix improperly accepting flags from userspace in mlx4 - Add missing DMA barriers for irdma - Fix two kcsan warnings in irdma - Report the correct CQ op code to userspace in irdma - Report the correct MW bind error code for irdma - Load the destination address in RDMA CM to resolve a recent regression - Fix a QP regression in mthca - Remove a race processing completions in bnxt_re resulting in a crash - Fix driver unloading races with interrupts and tasklets in bnxt_re - Fix missing error unwind in rxe" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/irdma: Report correct WC error RDMA/irdma: Fix op_type reporting in CQEs RDMA/rxe: Fix an error handling path in rxe_bind_mw() RDMA/bnxt_re: Fix hang during driver unload RDMA/bnxt_re: Prevent handling any completions after qp destroy RDMA/mthca: Fix crash when polling CQ for shared QPs RDMA/core: Update CMA destination address on rdma_resolve_addr RDMA/irdma: Fix data race on CQP request done RDMA/irdma: Fix data race on CQP completion stats RDMA/irdma: Add missing read barriers RDMA/mlx4: Make check for invalid flags stricter commit 2b17e90d3f92f394a6dea9243aac70a5aa0d0c57 Merge: f837f0a3c9488 513253f8c293c Author: Linus Torvalds Date: Fri Jul 28 16:44:32 2023 -0700 Merge tag 'tpmdd-v6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm fixes from Jarkko Sakkinen: "I picked up three small scale updates that I think would improve the quality of the release" * tag 'tpmdd-v6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm_tis: Explicitly check for error code tpm: Switch i2c drivers back to use .probe() security: keys: perform capable check only on privileged operations commit 2d093282b0d4357373497f65db6a05eb0c28b7c8 Author: Zheng Yejian Date: Mon Jul 24 13:40:40 2023 +0800 ring-buffer: Fix wrong stat of cpu_buffer->read When pages are removed in rb_remove_pages(), 'cpu_buffer->read' is set to 0 in order to make sure any read iterators reset themselves. However, this will mess 'entries' stating, see following steps: # cd /sys/kernel/tracing/ # 1. Enlarge ring buffer prepare for later reducing: # echo 20 > per_cpu/cpu0/buffer_size_kb # 2. Write a log into ring buffer of cpu0: # taskset -c 0 echo "hello1" > trace_marker # 3. Read the log: # cat per_cpu/cpu0/trace_pipe <...>-332 [000] ..... 62.406844: tracing_mark_write: hello1 # 4. Stop reading and see the stats, now 0 entries, and 1 event readed: # cat per_cpu/cpu0/stats entries: 0 [...] read events: 1 # 5. Reduce the ring buffer # echo 7 > per_cpu/cpu0/buffer_size_kb # 6. Now entries became unexpected 1 because actually no entries!!! # cat per_cpu/cpu0/stats entries: 1 [...] read events: 0 To fix it, introduce 'page_removed' field to count total removed pages since last reset, then use it to let read iterators reset themselves instead of changing the 'read' pointer. Link: https://lore.kernel.org/linux-trace-kernel/20230724054040.3489499-1-zhengyejian1@huawei.com Cc: Cc: Fixes: 83f40318dab0 ("ring-buffer: Make removal of ring buffer pages atomic") Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit ad64f5952ce3ea565c7f76ec37ab41df0dde773a Author: Davidlohr Bueso Date: Tue Jul 25 22:19:40 2023 -0700 cxl/memdev: Only show sanitize sysfs files when supported If the device does not support Sanitize or Secure Erase commands, hide the respective sysfs interfaces such that the operation can never be attempted. In order to be generic, keep track of the enabled security commands found in the CEL - the driver does not support Security Passthrough. Signed-off-by: Davidlohr Bueso Link: https://lore.kernel.org/r/20230726051940.3570-4-dave@stgolabs.net Reviewed-by: Dave Jiang Signed-off-by: Vishal Verma commit 3de8cd2242419fb0adaee629d488acfd6cd93c92 Author: Davidlohr Bueso Date: Tue Jul 25 22:19:39 2023 -0700 cxl/memdev: Document security state in kern-doc ... as is the case with all members of struct cxl_memdev_state. Signed-off-by: Davidlohr Bueso Link: https://lore.kernel.org/r/20230726051940.3570-3-dave@stgolabs.net Reviewed-by: Dave Jiang Signed-off-by: Vishal Verma commit 0fcde5989e8a54b2a155d8bcea21a7f99abb50f9 Author: Davidlohr Bueso Date: Tue Jul 25 22:19:38 2023 -0700 cxl/memdev: Improve sanitize ABI descriptions Be more detailed about the CPU cache management situation. The same goes for both sanitize and secure erase. Signed-off-by: Davidlohr Bueso Link: https://lore.kernel.org/r/20230726051940.3570-2-dave@stgolabs.net Reviewed-by: Dave Jiang Signed-off-by: Vishal Verma commit 98ce8e4a9dcfb448b30a2d7a16190f4a00382377 Author: Georg Müller Date: Fri Jul 28 17:18:12 2023 +0200 perf test uprobe_from_different_cu: Skip if there is no gcc Without gcc, the test will fail. On cleanup, ignore probe removal errors. Otherwise, in case of an error adding the probe, the temporary directory is not removed. Fixes: 56cbeacf14353057 ("perf probe: Add test for regression introduced by switch to die_get_decl_file()") Signed-off-by: Georg Müller Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Georg Müller Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20230728151812.454806-2-georgmueller@gmx.net Link: https://lore.kernel.org/r/CAP-5=fUP6UuLgRty3t2=fQsQi3k4hDMz415vWdp1x88QMvZ8ug@mail.gmail.com/ Signed-off-by: Arnaldo Carvalho de Melo commit f837f0a3c94882a29e38ff211a36c1c8a0f07804 Merge: 81eef8909d171 003e6b56d7800 Author: Linus Torvalds Date: Fri Jul 28 11:21:57 2023 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - A couple of SME updates for recent fixes (one of which went to stable): reverting the flushing of the SME hardware state along with the thread flushing and making sure we have the correct vector length before reallocating. - An ACPI/IORT fix to avoid skipping ID mappings whose "number of IDs" is 0 (the spec reports the number of IDs in the mapping range minus 1). * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: ACPI/IORT: Remove erroneous id_count check in iort_node_get_rmr_info() arm64/sme: Set new vector length before reallocating arm64/fpsimd: Don't flush SME register hardware state along with thread commit 81eef8909d171bdca6af37028a11a24e011ed312 Merge: e62e26d3e9ab8 c04e9894846c6 Author: Linus Torvalds Date: Fri Jul 28 11:17:30 2023 -0700 Merge tag 'for-linus-6.5a-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - A fix for a performance problem in QubesOS, adding a way to drain the queue of grants experiencing delayed unmaps faster - A patch enabling the use of static event channels from user mode, which was omitted when introducing supporting static event channels - A fix for a problem where Xen related code didn't check properly for running in a Xen environment, resulting in a WARN splat * tag 'for-linus-6.5a-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: speed up grant-table reclaim xen/evtchn: Introduce new IOCTL to bind static evtchn xenbus: check xen_domain in xenbus_probe_initcall commit 513253f8c293c0c8bd46d09d337fc892bf8f9f48 Author: Alexander Steffen Date: Tue Jun 13 20:02:56 2023 +0200 tpm_tis: Explicitly check for error code recv_data either returns the number of received bytes, or a negative value representing an error code. Adding the return value directly to the total number of received bytes therefore looks a little weird, since it might add a negative error code to a sum of bytes. The following check for size < expected usually makes the function return ETIME in that case, so it does not cause too many problems in practice. But to make the code look cleaner and because the caller might still be interested in the original error code, explicitly check for the presence of an error code and pass that through. Cc: stable@vger.kernel.org Fixes: cb5354253af2 ("[PATCH] tpm: spacing cleanups 2") Signed-off-by: Alexander Steffen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit be6f48a7c8e44a15ffc95f6f323dec548a4b990e Author: Uwe Kleine-König Date: Thu May 25 22:24:24 2023 +0200 tpm: Switch i2c drivers back to use .probe() After commit b8a1a4cd5a98 ("i2c: Provide a temporary .probe_new() call-back type"), all drivers being converted to .probe_new() and then 03c835f498b5 ("i2c: Switch .probe() to not take an id parameter") convert back to (the new) .probe() to be able to eventually drop .probe_new() from struct i2c_driver. Signed-off-by: Uwe Kleine-König Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 2d7f105edbb3b2be5ffa4d833abbf9b6965e9ce7 Author: Christian Göttsche Date: Thu May 11 14:32:52 2023 +0200 security: keys: perform capable check only on privileged operations If the current task fails the check for the queried capability via `capable(CAP_SYS_ADMIN)` LSMs like SELinux generate a denial message. Issuing such denial messages unnecessarily can lead to a policy author granting more privileges to a subject than needed to silence them. Reorder CAP_SYS_ADMIN checks after the check whether the operation is actually privileged. Signed-off-by: Christian Göttsche Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit e62e26d3e9ab89a0d40f94b237676b7e540d6d5c Merge: 28d79b746cf46 588159009d5b7 Author: Linus Torvalds Date: Fri Jul 28 10:47:24 2023 -0700 Merge tag 'ceph-for-6.5-rc4' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "A patch to reduce the potential for erroneous RBD exclusive lock blocklisting (fencing) with a couple of prerequisites and a fixup to prevent metrics from being sent to the MDS even just once after that has been disabled by the user. All marked for stable" * tag 'ceph-for-6.5-rc4' of https://github.com/ceph/ceph-client: rbd: retrieve and check lock owner twice before blocklisting rbd: harden get_lock_owner_info() a bit rbd: make get_lock_owner_info() return a single locker or NULL ceph: never send metrics if disable_send_metrics is set commit 28d79b746cf46e48e5c38c6904ea5faac217da21 Merge: 818680d154170 e6ab0b914c12a Author: Linus Torvalds Date: Fri Jul 28 10:43:16 2023 -0700 Merge tag '9p-fixes-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs Pull 9p fixes from Eric Van Hensbergen: "Misc set of fixes for 9p. Most of these clean up warnings we've gotten out of compilation tools, but several of them were from inspection while hunting down a couple of regressions. The most important one is 75b396821cb7 ("fs/9p: remove unnecessary and overrestrictive check") which caused a regression for some folks by restricting mmap in any case where writeback caches weren't enabled. Most of the other bugs caught via inspection were type mismatches" * tag '9p-fixes-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs: fs/9p: Remove unused extern declaration 9p: remove dead stores (variable set again without being read) 9p: virtio: skip incrementing unused variable 9p: virtio: make sure 'offs' is initialized in zc_request 9p: virtio: fix unlikely null pointer deref in handle_rerror 9p: fix ignored return value in v9fs_dir_release fs/9p: remove unnecessary invalidate_inode_pages2 fs/9p: fix type mismatch in file cache mode helper fs/9p: fix typo in comparison logic for cache mode fs/9p: remove unnecessary and overrestrictive check fs/9p: Fix a datatype used with V9FS_DIRECT_IO commit 818680d154170b4e41dc0c1a10e20bc03ca14a00 Merge: 9c65505826395 3e9dce80dbf91 Author: Linus Torvalds Date: Fri Jul 28 10:23:41 2023 -0700 Merge tag 'block-6.5-2023-07-28' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "A few fixes that should go into the current kernel release, mainly: - Set of fixes for dasd (Stefan) - Handle interruptible waits returning because of a signal for ublk (Ming)" * tag 'block-6.5-2023-07-28' of git://git.kernel.dk/linux: ublk: return -EINTR if breaking from waiting for existed users in DEL_DEV ublk: fail to recover device if queue setup is interrupted ublk: fail to start device if queue setup is interrupted block: Fix a source code comment in include/uapi/linux/blkzoned.h s390/dasd: print copy pair message only for the correct error s390/dasd: fix hanging device after request requeue s390/dasd: use correct number of retries for ERP requests s390/dasd: fix hanging device after quiesce/resume commit 9c65505826395e1193495ad73087bcdaa4347813 Merge: 0299a13af0be4 7b72d661f1f2f Author: Linus Torvalds Date: Fri Jul 28 10:19:44 2023 -0700 Merge tag 'io_uring-6.5-2023-07-28' of git://git.kernel.dk/linux Pull io_uring fix from Jens Axboe: "Just a single tweak to a patch from last week, to avoid having idle cqring waits be attributed as iowait" * tag 'io_uring-6.5-2023-07-28' of git://git.kernel.dk/linux: io_uring: gate iowait schedule on having pending requests commit 0299a13af0be43f2679047c7236e3a58e587f3f8 Merge: c75981a1be350 b7c822fa6b770 Author: Linus Torvalds Date: Fri Jul 28 10:15:44 2023 -0700 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd fixes from Jason Gunthorpe: "Two user triggerable problems: - Syzkaller found a way to trigger a WARN_ON and leak memory by racing destroy with other actions - There is still a bug in the "batch carry" stuff that gets invoked for complex cases with accesses and unmapping of huge pages. The test suite found this (triggers rarely)" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Set end correctly when doing batch carry iommufd: IOMMUFD_DESTROY should not increase the refcount commit 74158a8cad79d2f5dcf71508993664c5cfcbfa3c Author: Oliver Upton Date: Fri Jul 28 00:08:24 2023 +0000 KVM: arm64: Skip instruction after emulating write to TCR_EL1 Whelp, this is embarrassing. Since commit 082fdfd13841 ("KVM: arm64: Prevent guests from enabling HA/HD on Ampere1") KVM traps writes to TCR_EL1 on AmpereOne to work around an erratum in the unadvertised HAFDBS implementation, preventing the guest from enabling the feature. Unfortunately, I failed virtualization 101 when working on that change, and forgot to advance PC after instruction emulation. Do the right thing and skip the MSR instruction after emulating the write. Fixes: 082fdfd13841 ("KVM: arm64: Prevent guests from enabling HA/HD on Ampere1") Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20230728000824.3848025-1-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit c75981a1be350f14dbfca56e62bea077dafdad96 Merge: 6fb9f7f839e09 1e4ab7b4c881c Author: Linus Torvalds Date: Fri Jul 28 10:08:49 2023 -0700 Merge tag 'for-6.5/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix double free on memory allocation failure in DM integrity target's integrity_recalc() - Fix locking in DM raid target's raid_ctr() and around call to md_stop() - Fix DM cache target's cleaner policy to always allow work to be queued for writeback; even if cache isn't idle. * tag 'for-6.5/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm cache policy smq: ensure IO doesn't prevent cleaner policy progress dm raid: protect md_stop() with 'reconfig_mutex' dm raid: clean up four equivalent goto tags in raid_ctr() dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths dm integrity: fix double free on memory allocation failure commit 6fb9f7f839e0928dd15e68d4006729d1a9782c75 Merge: 17bf3df9af08c 3b9adfbba5af9 Author: Linus Torvalds Date: Fri Jul 28 10:04:40 2023 -0700 Merge tag 'sound-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of device-specific small fixes such as ASoC Realtek codec fixes for PM issues, ASoC nau8821 quirk additions, and usual HD- and USB-audio quirks" * tag 'sound-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: Support ASUS G713PV laptop ALSA: usb-audio: Update for native DSD support quirks ALSA: usb-audio: Add quirk for Microsoft Modern Wireless Headset ALSA: hda/relatek: Enable Mute LED on HP 250 G8 ASoC: atmel: Fix the 8K sample parameter in I2SC master ASoC: rt711-sdca: fix for JD event handling in ClockStop Mode0 ASoC: rt711: fix for JD event handling in ClockStop Mode0 ASoC: rt722-sdca: fix for JD event handling in ClockStop Mode0 ASoC: rt712-sdca: fix for JD event handling in ClockStop Mode0 ASoc: codecs: ES8316: Fix DMIC config ASoC: rt5682-sdw: fix for JD event handling in ClockStop Mode0 ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect ASoC: da7219: Check for failure reading AAD IRQ events ASoC: da7219: Flush pending AAD IRQ when suspending ALSA: seq: remove redundant unsigned comparison to zero ASoC: fsl_spdif: Silence output on stop commit 17bf3df9af08c5e87c07a92b811b7f9f8034a32c Merge: f24767ca4f004 9a767faa9477e Author: Linus Torvalds Date: Fri Jul 28 09:59:39 2023 -0700 Merge tag 'drm-fixes-2023-07-28' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Regular scheduled fixes, msm and amdgpu leading the way, with some i915 and a single misc fbdev, all seems fine. fbdev: - remove unused function amdgpu: - gfxhub partition fix - Fix error handling in psp_sw_init() - SMU13 fix - DCN 3.1 fix - DCN 3.2 fix - Fix for display PHY programming sequence - DP MST error handling fix - GFX 9.4.3 fix amdkfd: - GFX11 trap handling fix i915: - Use shmem for dpt objects - Fix an error handling path in igt_write_huge() msm: - display: - Fix to correct the UBWC programming for decoder version 4.3 seen on SM8550 - Add the missing flush and fetch bits for DMA4 and DMA5 SSPPs. - Fix to drop the unused dpu_core_perf_data_bus_id enum from the code - Drop the unused dsi_phy_14nm_17mA_regulators from QCM 2290 DSI cfg. - gpu: - Fix warn splat for newer devices without revn - Remove name/revn for a690.. we shouldn't be populating these for newer devices, for consistency, but it slipped through review - Fix a6xx gpu snapshot BINDLESS_DATA size (was listed in bytes instead of dwords, causing AHB faults on a6xx gen4/a660-family) - Disallow submit with fence id 0" * tag 'drm-fixes-2023-07-28' of git://anongit.freedesktop.org/drm/drm: (22 commits) drm/msm: Disallow submit with fence id 0 drm/amdgpu: Restore HQD persistent state register drm/amd/display: Unlock on error path in dm_handle_mst_sideband_msg_ready_event() drm/amd/display: Exit idle optimizations before attempt to access PHY drm/amd/display: Don't apply FIFO resync W/A if rdivider = 0 drm/amd/display: Guard DCN31 PHYD32CLK logic against chip family drm/amd/smu: use AverageGfxclkFrequency* to replace previous GFX Curr Clock drm/amd: Fix an error handling mistake in psp_sw_init() drm/amdgpu: Fix infinite loop in gfxhub_v1_2_xcc_gart_enable (v2) drm/amdkfd: fix trap handling work around for debugging drm/fb-helper: Remove unused inline function drm_fb_helper_defio_init() drm/i915: Fix an error handling path in igt_write_huge() drm/i915/dpt: Use shmem for dpt objects drm/msm: Fix hw_fence error path cleanup drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb() drm/msm/adreno: Fix snapshot BINDLESS_DATA size drm/msm/a690: Remove revn and name drm/msm/adreno: Fix warn splat for devices without revn drm/msm/dsi: Drop unused regulators from QCM2290 14nm DSI PHY config drm/msm/dpu: drop enum dpu_core_perf_data_bus_id ... commit f24767ca4f004f6a34411229a84394e1b94deae7 Merge: c442a957b2f4e 70d49bbf962ce Author: Linus Torvalds Date: Fri Jul 28 09:50:04 2023 -0700 Merge tag 'cxl-fixes-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull cxl fixes from Vishal Verma: - Update MAINTAINERS for cxl - A few static analysis fixes - Fix a Kconfig dependency for CONFIG_FW_LOADER * tag 'cxl-fixes-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: tools/testing/cxl: Remove unused SZ_512G macro cxl/acpi: Return 'rc' instead of '0' in cxl_parse_cfmws() cxl/acpi: Fix a use-after-free in cxl_parse_cfmws() cxl: Update MAINTAINERS cxl/mem: Fix a double shift bug cxl: fix CONFIG_FW_LOADER dependency commit c442a957b2f4e116f28aeb55bf2719cb7bb2ad60 Author: Mike Rapoport (IBM) Date: Fri Jul 28 13:55:12 2023 +0300 Revert "mm,memblock: reset memblock.reserved to system init state to prevent UAF" This reverts commit 9e46e4dcd9d6cd88342b028dbfa5f4fb7483d39c. kbuild reports a warning in memblock_remove_region() because of a false positive caused by partial reset of the memblock state. Doing the full reset will remove the false positives, but will allow late use of memblock_free() to go unnoticed, so it is better to revert the offending commit. WARNING: CPU: 0 PID: 1 at mm/memblock.c:352 memblock_remove_region (kbuild/src/x86_64/mm/memblock.c:352 (discriminator 1)) Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.5.0-rc3-00001-g9e46e4dcd9d6 #2 RIP: 0010:memblock_remove_region (kbuild/src/x86_64/mm/memblock.c:352 (discriminator 1)) Call Trace: memblock_discard (kbuild/src/x86_64/mm/memblock.c:383) page_alloc_init_late (kbuild/src/x86_64/include/linux/find.h:208 kbuild/src/x86_64/include/linux/nodemask.h:266 kbuild/src/x86_64/mm/mm_init.c:2405) kernel_init_freeable (kbuild/src/x86_64/init/main.c:1325 kbuild/src/x86_64/init/main.c:1546) kernel_init (kbuild/src/x86_64/init/main.c:1439) ret_from_fork (kbuild/src/x86_64/arch/x86/kernel/process.c:145) ret_from_fork_asm (kbuild/src/x86_64/arch/x86/entry/entry_64.S:298) Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202307271656.447aa17e-oliver.sang@intel.com Signed-off-by: "Mike Rapoport (IBM)" Signed-off-by: Linus Torvalds commit 6c21e066f9256ea1df6f88768f6ae1080b7cf509 Author: Jann Horn Date: Fri Jul 28 06:13:21 2023 +0200 mm/mempolicy: Take VMA lock before replacing policy mbind() calls down into vma_replace_policy() without taking the per-VMA locks, replaces the VMA's vma->vm_policy pointer, and frees the old policy. That's bad; a concurrent page fault might still be using the old policy (in vma_alloc_folio()), resulting in use-after-free. Normally this will manifest as a use-after-free read first, but it can result in memory corruption, including because vma_alloc_folio() can call mpol_cond_put() on the freed policy, which conditionally changes the policy's refcount member. This bug is specific to CONFIG_NUMA, but it does also affect non-NUMA systems as long as the kernel was built with CONFIG_NUMA. Signed-off-by: Jann Horn Reviewed-by: Suren Baghdasaryan Fixes: 5e31275cc997 ("mm: add per-VMA lock and helper functions to control it") Cc: stable@kernel.org Signed-off-by: Linus Torvalds commit ee31742bf17636da1304af77b2cb1c29b5dda642 Author: Alexander Stein Date: Mon May 15 09:21:37 2023 +0200 drm/imx/ipuv3: Fix front porch adjustment upon hactive aligning When hactive is not aligned to 8 pixels, it is aligned accordingly and hfront porch needs to be reduced the same amount. Unfortunately the front porch is set to the difference rather than reducing it. There are some Samsung TVs which can't cope with a front porch of instead of 70. Fixes: 94dfec48fca7 ("drm/imx: Add 8 pixel alignment fix") Signed-off-by: Alexander Stein Reviewed-by: Philipp Zabel Link: https://lore.kernel.org/r/20230515072137.116211-1-alexander.stein@ew.tq-group.com [p.zabel@pengutronix.de: Fixed subject] Signed-off-by: Philipp Zabel Link: https://patchwork.freedesktop.org/patch/msgid/20230515072137.116211-1-alexander.stein@ew.tq-group.com commit 003e6b56d780095a9adc23efc9cb4b4b4717169b Author: Guanghui Feng Date: Mon Jul 17 19:33:45 2023 +0800 ACPI/IORT: Remove erroneous id_count check in iort_node_get_rmr_info() According to the ARM IORT specifications DEN 0049 issue E, the "Number of IDs" field in the ID mapping format reports the number of IDs in the mapping range minus one. In iort_node_get_rmr_info(), we erroneously skip ID mappings whose "Number of IDs" equal to 0, resulting in valid mapping nodes with a single ID to map being skipped, which is wrong. Fix iort_node_get_rmr_info() by removing the bogus id_count check. Fixes: 491cf4a6735a ("ACPI/IORT: Add support to retrieve IORT RMR reserved regions") Signed-off-by: Guanghui Feng Cc: # 6.0.x Acked-by: Lorenzo Pieralisi Tested-by: Hanjun Guo Link: https://lore.kernel.org/r/1689593625-45213-1-git-send-email-guanghuifeng@linux.alibaba.com Signed-off-by: Catalin Marinas commit eac27a41ab641de074655d2932fc7f8cdb446881 Author: Remi Pommarel Date: Fri Jul 28 15:38:50 2023 +0200 batman-adv: Do not get eth header before batadv_check_management_packet If received skb in batadv_v_elp_packet_recv or batadv_v_ogm_packet_recv is either cloned or non linearized then its data buffer will be reallocated by batadv_check_management_packet when skb_cow or skb_linearize get called. Thus geting ethernet header address inside skb data buffer before batadv_check_management_packet had any chance to reallocate it could lead to the following kernel panic: Unable to handle kernel paging request at virtual address ffffff8020ab069a Mem abort info: ESR = 0x96000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007 CM = 0, WnR = 0 swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000040f45000 [ffffff8020ab069a] pgd=180000007fffa003, p4d=180000007fffa003, pud=180000007fffa003, pmd=180000007fefe003, pte=0068000020ab0706 Internal error: Oops: 96000007 [#1] SMP Modules linked in: ahci_mvebu libahci_platform libahci dvb_usb_af9035 dvb_usb_dib0700 dib0070 dib7000m dibx000_common ath11k_pci ath10k_pci ath10k_core mwl8k_new nf_nat_sip nf_conntrack_sip xhci_plat_hcd xhci_hcd nf_nat_pptp nf_conntrack_pptp at24 sbsa_gwdt CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.15.42-00066-g3242268d425c-dirty #550 Hardware name: A8k (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : batadv_is_my_mac+0x60/0xc0 lr : batadv_v_ogm_packet_recv+0x98/0x5d0 sp : ffffff8000183820 x29: ffffff8000183820 x28: 0000000000000001 x27: ffffff8014f9af00 x26: 0000000000000000 x25: 0000000000000543 x24: 0000000000000003 x23: ffffff8020ab0580 x22: 0000000000000110 x21: ffffff80168ae880 x20: 0000000000000000 x19: ffffff800b561000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00dc098924ae0032 x14: 0f0405433e0054b0 x13: ffffffff00000080 x12: 0000004000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000000 x7 : ffffffc076dae000 x6 : ffffff8000183700 x5 : ffffffc00955e698 x4 : ffffff80168ae000 x3 : ffffff80059cf000 x2 : ffffff800b561000 x1 : ffffff8020ab0696 x0 : ffffff80168ae880 Call trace: batadv_is_my_mac+0x60/0xc0 batadv_v_ogm_packet_recv+0x98/0x5d0 batadv_batman_skb_recv+0x1b8/0x244 __netif_receive_skb_core.isra.0+0x440/0xc74 __netif_receive_skb_one_core+0x14/0x20 netif_receive_skb+0x68/0x140 br_pass_frame_up+0x70/0x80 br_handle_frame_finish+0x108/0x284 br_handle_frame+0x190/0x250 __netif_receive_skb_core.isra.0+0x240/0xc74 __netif_receive_skb_list_core+0x6c/0x90 netif_receive_skb_list_internal+0x1f4/0x310 napi_complete_done+0x64/0x1d0 gro_cell_poll+0x7c/0xa0 __napi_poll+0x34/0x174 net_rx_action+0xf8/0x2a0 _stext+0x12c/0x2ac run_ksoftirqd+0x4c/0x7c smpboot_thread_fn+0x120/0x210 kthread+0x140/0x150 ret_from_fork+0x10/0x20 Code: f9403844 eb03009f 54fffee1 f94 Thus ethernet header address should only be fetched after batadv_check_management_packet has been called. Fixes: 0da0035942d4 ("batman-adv: OGMv2 - add basic infrastructure") Cc: stable@vger.kernel.org Signed-off-by: Remi Pommarel Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit 41a506ef71eb38d94fe133f565c87c3e06ccc072 Author: Naveen N Rao Date: Wed Jun 21 10:43:49 2023 +0530 powerpc/ftrace: Create a dummy stackframe to fix stack unwind With ppc64 -mprofile-kernel and ppc32 -pg, profiling instructions to call into ftrace are emitted right at function entry. The instruction sequence used is minimal to reduce overhead. Crucially, a stackframe is not created for the function being traced. This breaks stack unwinding since the function being traced does not have a stackframe for itself. As such, it never shows up in the backtrace: /sys/kernel/debug/tracing # echo 1 > /proc/sys/kernel/stack_tracer_enabled /sys/kernel/debug/tracing # cat stack_trace Depth Size Location (17 entries) ----- ---- -------- 0) 4144 32 ftrace_call+0x4/0x44 1) 4112 432 get_page_from_freelist+0x26c/0x1ad0 2) 3680 496 __alloc_pages+0x290/0x1280 3) 3184 336 __folio_alloc+0x34/0x90 4) 2848 176 vma_alloc_folio+0xd8/0x540 5) 2672 272 __handle_mm_fault+0x700/0x1cc0 6) 2400 208 handle_mm_fault+0xf0/0x3f0 7) 2192 80 ___do_page_fault+0x3e4/0xbe0 8) 2112 160 do_page_fault+0x30/0xc0 9) 1952 256 data_access_common_virt+0x210/0x220 10) 1696 400 0xc00000000f16b100 11) 1296 384 load_elf_binary+0x804/0x1b80 12) 912 208 bprm_execve+0x2d8/0x7e0 13) 704 64 do_execveat_common+0x1d0/0x2f0 14) 640 160 sys_execve+0x54/0x70 15) 480 64 system_call_exception+0x138/0x350 16) 416 416 system_call_common+0x160/0x2c4 Fix this by having ftrace create a dummy stackframe for the function being traced. With this, backtraces now capture the function being traced: /sys/kernel/debug/tracing # cat stack_trace Depth Size Location (17 entries) ----- ---- -------- 0) 3888 32 _raw_spin_trylock+0x8/0x70 1) 3856 576 get_page_from_freelist+0x26c/0x1ad0 2) 3280 64 __alloc_pages+0x290/0x1280 3) 3216 336 __folio_alloc+0x34/0x90 4) 2880 176 vma_alloc_folio+0xd8/0x540 5) 2704 416 __handle_mm_fault+0x700/0x1cc0 6) 2288 96 handle_mm_fault+0xf0/0x3f0 7) 2192 48 ___do_page_fault+0x3e4/0xbe0 8) 2144 192 do_page_fault+0x30/0xc0 9) 1952 608 data_access_common_virt+0x210/0x220 10) 1344 16 0xc0000000334bbb50 11) 1328 416 load_elf_binary+0x804/0x1b80 12) 912 64 bprm_execve+0x2d8/0x7e0 13) 848 176 do_execveat_common+0x1d0/0x2f0 14) 672 192 sys_execve+0x54/0x70 15) 480 64 system_call_exception+0x138/0x350 16) 416 416 system_call_common+0x160/0x2c4 This results in two additional stores in the ftrace entry code, but produces reliable backtraces. Fixes: 153086644fd1 ("powerpc/ftrace: Add support for -mprofile-kernel ftrace ABI") Cc: stable@vger.kernel.org Signed-off-by: Naveen N Rao Signed-off-by: Michael Ellerman Link: https://msgid.link/20230621051349.759567-1-naveen@kernel.org commit 5416d7925e6ee72bf1d35cad1957c9a194554da4 Author: Eugen Hristev Date: Wed Jul 26 10:06:15 2023 +0300 dt-bindings: net: rockchip-dwmac: fix {tx|rx}-delay defaults/range in schema The range and the defaults are specified in the description instead of being specified in the schema. Fix it by adding the default value in the `default` field and specifying the range as `minimum` and `maximum`. Fixes: b331b8ef86f0 ("dt-bindings: net: convert rockchip-dwmac to json-schema") Signed-off-by: Eugen Hristev Signed-off-by: David S. Miller commit 6d00f4ec1205a01a6aac1fe3ce04d53a6b2ede59 Author: Laurent Pinchart Date: Tue Jun 6 18:55:30 2023 +0200 media: uvcvideo: Fix menu count handling for userspace XU mappings When commit 716c330433e3 ("media: uvcvideo: Use standard names for menus") reworked the handling of menu controls, it inadvertently replaced a GENMASK(n - 1, 0) with a BIT_MASK(n). The latter isn't equivalent to the former, which broke adding XU mappings from userspace. Fix it. Link: https://lore.kernel.org/linux-media/468a36ec-c3ac-cb47-e12f-5906239ae3cd@spahan.ch/ Cc: stable@vger.kernel.org Reported-by: Poncho Fixes: 716c330433e3 ("media: uvcvideo: Use standard names for menus") Signed-off-by: Laurent Pinchart Reviewed-by: Ricardo Ribalda Signed-off-by: Mauro Carvalho Chehab commit 8329d0c7355bfb7237baf09ec979c3e8144d2781 Author: Chen-Yu Tsai Date: Mon Jul 10 08:51:36 2023 +0200 media: mtk-jpeg: Set platform driver data earlier In the multi-core JPEG encoder/decoder setup, the driver for the individual cores references the parent device's platform driver data. However, in the parent driver, this is only set at the end of the probe function, way later than devm_of_platform_populate(), which triggers the probe of the cores. This causes a kernel splat in the sub-device probe function. Move platform_set_drvdata() to before devm_of_platform_populate() to fix this. Fixes: 934e8bccac95 ("mtk-jpegenc: support jpegenc multi-hardware") Signed-off-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 6722b25712054c0f903b839b8f5088438dd04df3 Author: Aneesh Kumar K.V Date: Mon Jul 24 23:43:20 2023 +0530 powerpc/mm/altmap: Fix altmap boundary check altmap->free includes the entire free space from which altmap blocks can be allocated. So when checking whether the kernel is doing altmap block free, compute the boundary correctly, otherwise memory hotunplug can fail. Fixes: 9ef34630a461 ("powerpc/mm: Fallback to RAM if the altmap is unusable") Signed-off-by: "Aneesh Kumar K.V" Reviewed-by: David Hildenbrand Signed-off-by: Michael Ellerman Link: https://msgid.link/20230724181320.471386-1-aneesh.kumar@linux.ibm.com commit 4a0822608e6aafdcb67ea0aaaa516b67826d1119 Merge: dadc5b86cc945 53d737dfd3d7b Author: Jakub Kicinski Date: Thu Jul 27 20:03:40 2023 -0700 Merge tag 'mlx5-fixes-2023-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2023-07-26 This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2023-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5: Unregister devlink params in case interface is down net/mlx5: DR, Fix peer domain namespace setting net/mlx5: fs_chains: Fix ft prio if ignore_flow_level is not supported net/mlx5e: kTLS, Fix protection domain in use syndrome when devlink reload net/mlx5: Bridge, set debugfs access right to root-only net/mlx5e: xsk: Fix crash on regular rq reactivation net/mlx5e: xsk: Fix invalid buffer access for legacy rq net/mlx5e: Move representor neigh cleanup to profile cleanup_tx net/mlx5e: Fix crash moving to switchdev mode when ntuple offload is set net/mlx5e: Don't hold encap tbl lock if there is no encap action net/mlx5: Honor user input for migratable port fn attr net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer() net/mlx5: fix potential memory leak in mlx5e_init_rep_rx net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx net/mlx5e: fix double free in macsec_fs_tx_create_crypto_table_groups ==================== Link: https://lore.kernel.org/r/20230726213206.47022-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit dadc5b86cc9459581f37fe755b431adc399ea393 Author: Yuanjun Gong Date: Thu Jul 27 01:05:06 2023 +0800 net: dsa: fix value check in bcm_sf2_sw_probe() in bcm_sf2_sw_probe(), check the return value of clk_prepare_enable() and return the error code if clk_prepare_enable() returns an unexpected value. Fixes: e9ec5c3bd238 ("net: dsa: bcm_sf2: request and handle clocks") Signed-off-by: Yuanjun Gong Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20230726170506.16547-1-ruc_gongyuanjun@163.com Signed-off-by: Jakub Kicinski commit 4d50e50045aa46d9f3e578ed2edea9bd0a123d24 Author: Eric Dumazet Date: Wed Jul 26 14:58:15 2023 +0000 net: flower: fix stack-out-of-bounds in fl_set_key_cfm() Typical misuse of nla_parse_nested(array, XXX_MAX, ...); array must be declared as struct nlattr *array[XXX_MAX + 1]; v2: Based on feedbacks from Ido Schimmel and Zahari Doychev, I also changed TCA_FLOWER_KEY_CFM_OPT_MAX and cfm_opt_policy definitions. syzbot reported: BUG: KASAN: stack-out-of-bounds in __nla_validate_parse+0x136/0x2bd0 lib/nlattr.c:588 Write of size 32 at addr ffffc90003a0ee20 by task syz-executor296/5014 CPU: 0 PID: 5014 Comm: syz-executor296 Not tainted 6.5.0-rc2-syzkaller-00307-gd192f5382581 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0x163/0x540 mm/kasan/report.c:475 kasan_report+0x175/0x1b0 mm/kasan/report.c:588 kasan_check_range+0x27e/0x290 mm/kasan/generic.c:187 __asan_memset+0x23/0x40 mm/kasan/shadow.c:84 __nla_validate_parse+0x136/0x2bd0 lib/nlattr.c:588 __nla_parse+0x40/0x50 lib/nlattr.c:700 nla_parse_nested include/net/netlink.h:1262 [inline] fl_set_key_cfm+0x1e3/0x440 net/sched/cls_flower.c:1718 fl_set_key+0x2168/0x6620 net/sched/cls_flower.c:1884 fl_tmplt_create+0x1fe/0x510 net/sched/cls_flower.c:2666 tc_chain_tmplt_add net/sched/cls_api.c:2959 [inline] tc_ctl_chain+0x131d/0x1ac0 net/sched/cls_api.c:3068 rtnetlink_rcv_msg+0x82b/0xf50 net/core/rtnetlink.c:6424 netlink_rcv_skb+0x1df/0x430 net/netlink/af_netlink.c:2549 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x7c3/0x990 net/netlink/af_netlink.c:1365 netlink_sendmsg+0xa2a/0xd60 net/netlink/af_netlink.c:1914 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg net/socket.c:748 [inline] ____sys_sendmsg+0x592/0x890 net/socket.c:2494 ___sys_sendmsg net/socket.c:2548 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2577 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f54c6150759 Code: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe06c30578 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f54c619902d RCX: 00007f54c6150759 RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 RBP: 00007ffe06c30590 R08: 0000000000000000 R09: 00007ffe06c305f0 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f54c61c35f0 R13: 00007ffe06c30778 R14: 0000000000000001 R15: 0000000000000001 The buggy address belongs to stack of task syz-executor296/5014 and is located at offset 32 in frame: fl_set_key_cfm+0x0/0x440 net/sched/cls_flower.c:374 This frame has 1 object: [32, 56) 'nla_cfm_opt' The buggy address belongs to the virtual mapping at [ffffc90003a08000, ffffc90003a11000) created by: copy_process+0x5c8/0x4290 kernel/fork.c:2330 Fixes: 7cfffd5fed3e ("net: flower: add support for matching cfm fields") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Simon Horman Reviewed-by: Ido Schimmel Reviewed-by: Zahari Doychev Link: https://lore.kernel.org/r/20230726145815.943910-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1e74ae32805b6630c78bd7fb746fbfe936fb8f86 Author: Huacai Chen Date: Fri Jul 28 10:30:42 2023 +0800 LoongArch: Cleanup __builtin_constant_p() checking for cpu_has_* In the current configuration, cpu_has_lsx and cpu_has_lasx cannot be constants. So cleanup the __builtin_constant_p() checking to reduce the complexity. Reviewed-by: WANG Xuerui Signed-off-by: Huacai Chen commit 4eece7e6de94d833c8aeed2f438faf487cbf94ff Author: Tiezhu Yang Date: Fri Jul 28 10:30:42 2023 +0800 LoongArch: BPF: Fix check condition to call lu32id in move_imm() As the code comment says, the initial aim is to reduce one instruction in some corner cases, if bit[51:31] is all 0 or all 1, no need to call lu32id. That is to say, it should call lu32id only if bit[51:31] is not all 0 and not all 1. The current code always call lu32id, the result is right but the logic is unexpected and wrong, fix it. Cc: stable@vger.kernel.org # 6.1 Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") Reported-by: Colin King (gmail) Closes: https://lore.kernel.org/all/bcf97046-e336-712a-ac68-7fd194f2953e@gmail.com/ Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit de0e30bee86d0f99c696a1fea34474e556a946ec Author: Chenguang Zhao Date: Fri Jul 28 10:30:42 2023 +0800 LoongArch: BPF: Enable bpf_probe_read{, str}() on LoongArch Currently nettrace does not work on LoongArch due to missing bpf_probe_read{,str}() support, with the error message: ERROR: failed to load kprobe-based eBPF ERROR: failed to load kprobe-based bpf According to commit 0ebeea8ca8a4d1d ("bpf: Restrict bpf_probe_read{, str}() only to archs where they work"), we only need to select CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE to add said support, because LoongArch does have non-overlapping address ranges for kernel and userspace. Cc: stable@vger.kernel.org # 6.1 Signed-off-by: Chenguang Zhao Signed-off-by: Huacai Chen commit e66d511fc92201ba481392e54896f1aeadfcf0e9 Author: WANG Rui Date: Fri Jul 28 10:30:42 2023 +0800 LoongArch: Fix return value underflow in exception path This patch fixes an underflow issue in the return value within the exception path, specifically at .Llt8 when the remaining length is less than 8 bytes. Cc: stable@vger.kernel.org Fixes: 8941e93ca590 ("LoongArch: Optimize memory ops (memset/memcpy/memmove)") Reported-by: Weihao Li Signed-off-by: WANG Rui Signed-off-by: Huacai Chen commit 83da30d73b86ab5898fb84f8b49c11557c3fcc67 Author: Zhihong Dong Date: Fri Jul 28 10:30:42 2023 +0800 LoongArch: Fix CMDLINE_EXTEND and CMDLINE_BOOTLOADER handling On FDT systems these command line processing are already taken care of by early_init_dt_scan_chosen(). Add similar handling to the ACPI (non- FDT) code path to allow these config options to work for ACPI (non-FDT) systems too. Signed-off-by: Zhihong Dong Signed-off-by: Huacai Chen commit 03c53eb90c0c61885b2175adf8675fb56df7f8db Author: Huacai Chen Date: Fri Jul 28 10:30:42 2023 +0800 LoongArch: Fix module relocation error with binutils 2.41 Binutils 2.41 enables linker relaxation by default, but the kernel module loader doesn't support that, so just disable it. Otherwise we get such an error when loading modules: "Unknown relocation type 102" As an alternative, we could add linker relaxation support in the kernel module loader. But it is relatively large complexity that may or may not bring a similar gain, and we don't really want to include this linker pass in the kernel. Reviewed-by: WANG Xuerui Signed-off-by: Huacai Chen commit 54c2c9df083fe1d4a9df54d9876f32582ce6d77a Author: Huacai Chen Date: Fri Jul 28 10:30:42 2023 +0800 LoongArch: Only fiddle with CHECKFLAGS if `need-compiler' This is a port of commit 4fe4a6374c4db9ae2b ("MIPS: Only fiddle with CHECKFLAGS if `need-compiler'") to LoongArch. We have originally guarded fiddling with CHECKFLAGS in our arch Makefile by checking for the CONFIG_LOONGARCH variable, not set for targets such as `distclean', etc. that neither include `.config' nor use the compiler. Starting from commit 805b2e1d427aab4 ("kbuild: include Makefile.compiler only when compiler is needed") we have had a generic `need-compiler' variable explicitly telling us if the compiler will be used and thus its capabilities need to be checked and expressed in the form of compilation flags. If this variable is not set, then `make' functions such as `cc-option' are undefined, causing all kinds of weirdness to happen if we expect specific results to be returned. It doesn't cause problems on LoongArch now. But as a guard we replace the check for CONFIG_LOONGARCH with one for `need-compiler' instead, so as to prevent the compiler from being ever called for CHECKFLAGS when not needed. Signed-off-by: Huacai Chen commit 3ac873c76d79f055e1712754d9f2e90e41582f04 Author: Niklas Cassel Date: Sun Jul 23 15:03:14 2023 +0200 ata: libata-core: fix when to fetch sense data for successful commands The condition to fetch sense data was supposed to be: ATA_SENSE set AND either 1) Command was NCQ and ATA_DFLAG_CDL_ENABLED flag set (flag ATA_DFLAG_CDL_ENABLED will only be set if the Successful NCQ command sense data supported bit is set); or 2) Command was non-NCQ and regular sense data reporting is enabled. However the check in 2) accidentally had the negation at the wrong place, causing it to try to fetch sense data if it was a non-NCQ command _or_ if regular sense data reporting was _not_ enabled. Fix this by removing the extra parentheses that should not be there, such that only the correct return (ata_is_ncq()) is negated. Fixes: 18bd7718b5c4 ("scsi: ata: libata: Handle completion of CDL commands using policy 0xD") Reported-by: Borislav Petkov Closes: https://lore.kernel.org/linux-ide/20230722155621.GIZLv8JbURKzHtKvQE@fat_crate.local/ Signed-off-by: Niklas Cassel Tested-by: Borislav Petkov (AMD) Reviewed-by: Jason Yan Signed-off-by: Damien Le Moal commit 9a767faa9477ef2a5fee6a0c9d69587b95a885df Merge: 0dd9c514d2ce1 1b5d0ddcb34a6 Author: Dave Airlie Date: Fri Jul 28 11:59:14 2023 +1000 Merge tag 'drm-msm-fixes-2023-07-27' of https://gitlab.freedesktop.org/drm/msm into drm-fixes Fixes for v6.5-rc4 Display: + Fix to correct the UBWC programming for decoder version 4.3 seen on SM8550 + Add the missing flush and fetch bits for DMA4 and DMA5 SSPPs. + Fix to drop the unused dpu_core_perf_data_bus_id enum from the code + Drop the unused dsi_phy_14nm_17mA_regulators from QCM 2290 DSI cfg. GPU: + Fix warn splat for newer devices without revn + Remove name/revn for a690.. we shouldn't be populating these for newer devices, for consistency, but it slipped through review + Fix a6xx gpu snapshot BINDLESS_DATA size (was listed in bytes instead of dwords, causing AHB faults on a6xx gen4/a660-family) + Disallow submit with fence id 0 Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGs9MwCSfiyv8i7yWAsJKYEzCDyzaTx=ujX80Y23rZd9RA@mail.gmail.com commit 0dd9c514d2ce19c896daffd76de008a68982de23 Merge: 75da46c1fad5f bc1688fce2ec7 Author: Dave Airlie Date: Fri Jul 28 11:55:13 2023 +1000 Merge tag 'amd-drm-fixes-6.5-2023-07-26' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.5-2023-07-26: amdgpu: - gfxhub partition fix - Fix error handling in psp_sw_init() - SMU13 fix - DCN 3.1 fix - DCN 3.2 fix - Fix for display PHY programming sequence - DP MST error handling fix - GFX 9.4.3 fix amdkfd: - GFX11 trap handling fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230726184936.7812-1-alexander.deucher@amd.com commit 75da46c1fad5f88e24c08995f6e303e9b9fe8f12 Merge: 8e4bc0284cd8d e354f67733115 Author: Dave Airlie Date: Fri Jul 28 11:53:26 2023 +1000 Merge tag 'drm-intel-fixes-2023-07-27' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Use shmem for dpt objects [dpt] (Radhakrishna Sripada) - Fix an error handling path in igt_write_huge() (Christophe JAILLET) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/ZMI4Mtom7pDhLB7M@tursulin-desk commit 8e4bc0284cd8df25556671796acea5442f246dfb Merge: 6eaae19807608 39b1320e5dc2b Author: Dave Airlie Date: Fri Jul 28 11:46:27 2023 +1000 Merge tag 'drm-misc-fixes-2023-07-27' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes A single patch to remove an unused function. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/dqvxednqyab5t7gvwvcq72x6yu7ug5gusmhpgs3kq6z7pf3co6@ofr6s7547gbe commit fa467226669c09520bfb3e67fca5aeff947cdf17 Author: Jakub Kicinski Date: Wed Jul 26 08:11:20 2023 -0700 MAINTAINERS: stmmac: retire Giuseppe Cavallaro I tried to get stmmac maintainers to be more active by agreeing with them off-list on a review rotation. I pinged Peppe 3 times over 2 weeks during his "shift month", no reviews are flowing. All the contributions are much appreciated! But stmmac is quite active, we need participating maintainers :( Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230726151120.1649474-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 9945c1fb03a3c9f7e0dcf9aa17041a70e551387a Author: Russell King (Oracle) Date: Wed Jul 26 15:45:16 2023 +0100 net: dsa: fix older DSA drivers using phylink Older DSA drivers that do not provide an dsa_ops adjust_link method end up using phylink. Unfortunately, a recent phylink change that requires its supported_interfaces bitmap to be filled breaks these drivers because the bitmap remains empty. Rather than fixing each driver individually, fix it in the core code so we have a sensible set of defaults. Reported-by: Sergei Antonov Fixes: de5c9bf40c45 ("net: phylink: require supported_interfaces to be filled") Signed-off-by: Russell King (Oracle) Reviewed-by: Vladimir Oltean Tested-by: Vladimir Oltean # dsa_loop Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/E1qOflM-001AEz-D3@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d73ef2d69c0dba5f5a1cb9600045c873bab1fb7f Author: Lin Ma Date: Wed Jul 26 15:53:14 2023 +0800 rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length There are totally 9 ndo_bridge_setlink handlers in the current kernel, which are 1) bnxt_bridge_setlink, 2) be_ndo_bridge_setlink 3) i40e_ndo_bridge_setlink 4) ice_bridge_setlink 5) ixgbe_ndo_bridge_setlink 6) mlx5e_bridge_setlink 7) nfp_net_bridge_setlink 8) qeth_l2_bridge_setlink 9) br_setlink. By investigating the code, we find that 1-7 parse and use nlattr IFLA_BRIDGE_MODE but 3 and 4 forget to do the nla_len check. This can lead to an out-of-attribute read and allow a malformed nlattr (e.g., length 0) to be viewed as a 2 byte integer. To avoid such issues, also for other ndo_bridge_setlink handlers in the future. This patch adds the nla_len check in rtnl_bridge_setlink and does an early error return if length mismatches. To make it works, the break is removed from the parsing for IFLA_BRIDGE_FLAGS to make sure this nla_for_each_nested iterates every attribute. Fixes: b1edc14a3fbf ("ice: Implement ice_bridge_getlink and ice_bridge_setlink") Fixes: 51616018dd1b ("i40e: Add support for getlink, setlink ndo ops") Suggested-by: Jakub Kicinski Signed-off-by: Lin Ma Acked-by: Nikolay Aleksandrov Reviewed-by: Hangbin Liu Link: https://lore.kernel.org/r/20230726075314.1059224-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski commit 3fc2febb0f8ffae354820c1772ec008733237cfa Author: Arnd Bergmann Date: Wed Jul 26 22:33:22 2023 +0200 ata: pata_ns87415: mark ns87560_tf_read static The global function triggers a warning because of the missing prototype drivers/ata/pata_ns87415.c:263:6: warning: no previous prototype for 'ns87560_tf_read' [-Wmissing-prototypes] 263 | void ns87560_tf_read(struct ata_port *ap, struct ata_taskfile *tf) There are no other references to this, so just make it static. Fixes: c4b5b7b6c4423 ("pata_ns87415: Initial cut at 87415/87560 IDE support") Reviewed-by: Sergey Shtylyov Reviewed-by: Serge Semin Signed-off-by: Arnd Bergmann Signed-off-by: Damien Le Moal commit 6c54312f9689fbe27c70db5d42eebd29d04b672e Author: Sidhartha Kumar Date: Mon Jul 17 11:18:12 2023 -0700 mm/memory-failure: fix hardware poison check in unpoison_memory() It was pointed out[1] that using folio_test_hwpoison() is wrong as we need to check the indiviual page that has poison. folio_test_hwpoison() only checks the head page so go back to using PageHWPoison(). User-visible effects include existing hwpoison-inject tests possibly failing as unpoisoning a single subpage could lead to unpoisoning an entire folio. Memory unpoisoning could also not work as expected as the function will break early due to only checking the head page and not the actually poisoned subpage. [1]: https://lore.kernel.org/lkml/ZLIbZygG7LqSI9xe@casper.infradead.org/ Link: https://lkml.kernel.org/r/20230717181812.167757-1-sidhartha.kumar@oracle.com Fixes: a6fddef49eef ("mm/memory-failure: convert unpoison_memory() to folios") Signed-off-by: Sidhartha Kumar Reported-by: Matthew Wilcox (Oracle) Acked-by: Naoya Horiguchi Reviewed-by: Miaohe Lin Cc: Signed-off-by: Andrew Morton commit 641db40f3afe7998011bfabc726dba3e698f8196 Author: Dan Carpenter Date: Tue Jul 25 20:03:16 2023 +0300 proc/vmcore: fix signedness bug in read_from_oldmem() The bug is the error handling: if (tmp < nr_bytes) { "tmp" can hold negative error codes but because "nr_bytes" is type size_t the negative error codes are treated as very high positive values (success). Fix this by changing "nr_bytes" to type ssize_t. The "nr_bytes" variable is used to store values between 1 and PAGE_SIZE and they can fit in ssize_t without any issue. Link: https://lkml.kernel.org/r/b55f7eed-1c65-4adc-95d1-6c7c65a54a6e@moroto.mountain Fixes: 5d8de293c224 ("vmcore: convert copy_oldmem_page() to take an iov_iter") Signed-off-by: Dan Carpenter Reviewed-by: Matthew Wilcox (Oracle) Acked-by: Baoquan He Cc: Dave Young Cc: Vivek Goyal Cc: Alexey Dobriyan Cc: Signed-off-by: Andrew Morton commit 286812b041ccc74b114cada5c10ada70a6277a20 Author: Bjorn Andersson Date: Thu Jul 20 14:02:56 2023 -0700 mailmap: update remaining active codeaurora.org email addresses The lack of mailmap updates for @codeaurora.org addresses reduces the usefulness of tools such as get_maintainer.pl. Some recent (and welcome!) additions has been made to improve the situation, this concludes the effort. Link: https://lkml.kernel.org/r/20230720210256.1296567-1-quic_bjorande@quicinc.com Signed-off-by: Bjorn Andersson Cc: Arnd Bergmann Cc: Konrad Dybcio Signed-off-by: Andrew Morton commit d8ab9f7b644a2c9b64de405c1953c905ff219dc9 Author: Jann Horn Date: Fri Jul 21 05:46:43 2023 +0200 mm: lock VMA in dup_anon_vma() before setting ->anon_vma When VMAs are merged, dup_anon_vma() is called with `dst` pointing to the VMA that is being expanded to cover the area previously occupied by another VMA. This currently happens while `dst` is not write-locked. This means that, in the `src->anon_vma && !dst->anon_vma` case, as soon as the assignment `dst->anon_vma = src->anon_vma` has happened, concurrent page faults can happen on `dst` under the per-VMA lock. This is already icky in itself, since such page faults can now install pages into `dst` that are attached to an `anon_vma` that is not yet tied back to the `anon_vma` with an `anon_vma_chain`. But if `anon_vma_clone()` fails due to an out-of-memory error, things get much worse: `anon_vma_clone()` then reverts `dst->anon_vma` back to NULL, and `dst` remains completely unconnected to the `anon_vma`, even though we can have pages in the area covered by `dst` that point to the `anon_vma`. This means the `anon_vma` of such pages can be freed while the pages are still mapped into userspace, which leads to UAF when a helper like folio_lock_anon_vma_read() tries to look up the anon_vma of such a page. This theoretically is a security bug, but I believe it is really hard to actually trigger as an unprivileged user because it requires that you can make an order-0 GFP_KERNEL allocation fail, and the page allocator tries pretty hard to prevent that. I think doing the vma_start_write() call inside dup_anon_vma() is the most straightforward fix for now. For a kernel-assisted reproducer, see the notes section of the patch mail. Link: https://lkml.kernel.org/r/20230721034643.616851-1-jannh@google.com Fixes: 5e31275cc997 ("mm: add per-VMA lock and helper functions to control it") Signed-off-by: Jann Horn Reviewed-by: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton commit b1f02b95758d05b799731d939e76a0bd6da312db Author: Jann Horn Date: Sat Jul 22 00:51:07 2023 +0200 mm: fix memory ordering for mm_lock_seq and vm_lock_seq mm->mm_lock_seq effectively functions as a read/write lock; therefore it must be used with acquire/release semantics. A specific example is the interaction between userfaultfd_register() and lock_vma_under_rcu(). userfaultfd_register() does the following from the point where it changes a VMA's flags to the point where concurrent readers are permitted again (in a simple scenario where only a single private VMA is accessed and no merging/splitting is involved): userfaultfd_register userfaultfd_set_vm_flags vm_flags_reset vma_start_write down_write(&vma->vm_lock->lock) vma->vm_lock_seq = mm_lock_seq [marks VMA as busy] up_write(&vma->vm_lock->lock) vm_flags_init [sets VM_UFFD_* in __vm_flags] vma->vm_userfaultfd_ctx.ctx = ctx mmap_write_unlock vma_end_write_all WRITE_ONCE(mm->mm_lock_seq, mm->mm_lock_seq + 1) [unlocks VMA] There are no memory barriers in between the __vm_flags update and the mm->mm_lock_seq update that unlocks the VMA, so the unlock can be reordered to above the `vm_flags_init()` call, which means from the perspective of a concurrent reader, a VMA can be marked as a userfaultfd VMA while it is not VMA-locked. That's bad, we definitely need a store-release for the unlock operation. The non-atomic write to vma->vm_lock_seq in vma_start_write() is mostly fine because all accesses to vma->vm_lock_seq that matter are always protected by the VMA lock. There is a racy read in vma_start_read() though that can tolerate false-positives, so we should be using WRITE_ONCE() to keep things tidy and data-race-free (including for KCSAN). On the other side, lock_vma_under_rcu() works as follows in the relevant region for locking and userfaultfd check: lock_vma_under_rcu vma_start_read vma->vm_lock_seq == READ_ONCE(vma->vm_mm->mm_lock_seq) [early bailout] down_read_trylock(&vma->vm_lock->lock) vma->vm_lock_seq == READ_ONCE(vma->vm_mm->mm_lock_seq) [main check] userfaultfd_armed checks vma->vm_flags & __VM_UFFD_FLAGS Here, the interesting aspect is how far down the mm->mm_lock_seq read can be reordered - if this read is reordered down below the vma->vm_flags access, this could cause lock_vma_under_rcu() to partly operate on information that was read while the VMA was supposed to be locked. To prevent this kind of downwards bleeding of the mm->mm_lock_seq read, we need to read it with a load-acquire. Some of the comment wording is based on suggestions by Suren. BACKPORT WARNING: One of the functions changed by this patch (which I've written against Linus' tree) is vma_try_start_write(), but this function no longer exists in mm/mm-everything. I don't know whether the merged version of this patch will be ordered before or after the patch that removes vma_try_start_write(). If you're backporting this patch to a tree with vma_try_start_write(), make sure this patch changes that function. Link: https://lkml.kernel.org/r/20230721225107.942336-1-jannh@google.com Fixes: 5e31275cc997 ("mm: add per-VMA lock and helper functions to control it") Signed-off-by: Jann Horn Reviewed-by: Suren Baghdasaryan Cc: Signed-off-by: Andrew Morton commit 15571273db93ac2e4415e74280e04566c31d5eb0 Author: Drew Fustini Date: Sat Jul 22 18:03:30 2023 -0700 scripts/spelling.txt: remove 'thead' as a typo T-Head is a vendor of processor core IP, and they have recently introduced the RISC-V TH1520 SoC. Remove 'thead' as a typo of 'thread' to avoid checkpatch incorrectly warning that 'thead' is typo in patches that add support for T-Head designs in the kernel. Link: https://lkml.kernel.org/r/20230723010329.674186-1-dfustini@baylibre.com Link: https://www.t-head.cn/ Signed-off-by: Drew Fustini Acked-by: Guo Ren Cc: Conor Dooley Cc: Jisheng Zhang Cc: Colin Ian King Cc: Diederik de Haas Cc: Ian Rogers Cc: Luca Ceresoli # versaclock5 Cc: Randy Dunlap Cc: SeongJae Park Signed-off-by: Andrew Morton commit 8b1cb4a2e819a2e4851ceeba53563f4edf03a8cf Author: Hugh Dickins Date: Sun Jul 23 14:17:55 2023 -0700 mm/pagewalk: fix EFI_PGT_DUMP of espfix area Booting x86_64 with CONFIG_EFI_PGT_DUMP=y shows messages of the form "mm/pgtable-generic.c:53: bad pmd (____ptrval____)(8000000100077061)". EFI_PGT_DUMP dumps all of efi_mm, including the espfix area, which is set up with pmd entries which fit the pmd_bad() check: so 0d940a9b270b warns and clears those entries, which would ruin running Win16 binaries. The failing pte_offset_map() stopped such a kernel from even booting, until a few commits later be872f83bf57 changed the pagewalk to tolerate that: but it needs to be even more careful, to not spoil those entries. I might have preferred to change init_espfix_ap() not to use "bad" pmd entries; or to leave them out of the efi_mm dump. But there is great value in staying away from there, and a pagewalk check of address against TASK_SIZE may protect from other such aberrations too. Link: https://lkml.kernel.org/r/22bca736-4cab-9ee5-6a52-73a3b2bbe865@google.com Closes: https://lore.kernel.org/linux-mm/CABXGCsN3JqXckWO=V7p=FhPU1tK03RE1w9UE6xL5Y86SMk209w@mail.gmail.com/ Fixes: 0d940a9b270b ("mm/pgtable: allow pte_offset_map[_lock]() to fail") Fixes: be872f83bf57 ("mm/pagewalk: walk_pte_range() allow for pte_offset_map()") Signed-off-by: Hugh Dickins Reported-by: Mikhail Gavrilov Tested-by: Mikhail Gavrilov Cc: Bagas Sanjaya Cc: Laura Abbott Signed-off-by: Andrew Morton commit fa598952fac059054316dccb2213478ccb81a0d1 Author: Hugh Dickins Date: Sun Jul 23 14:05:54 2023 -0700 shmem: minor fixes to splice-read implementation HWPoison: my reading of folio_test_hwpoison() is that it only tests the head page of a large folio, whereas splice_folio_into_pipe() will splice as much of the folio as it can: so for safety we should also check the has_hwpoisoned flag, set if any of the folio's pages are hwpoisoned. (Perhaps that ugliness can be improved at the mm end later.) The call to splice_zeropage_into_pipe() risked overrunning past EOF: ask it for "part" not "len". Link: https://lkml.kernel.org/r/32c72c9c-72a8-115f-407d-f0148f368@google.com Fixes: bd194b187115 ("shmem: Implement splice-read") Signed-off-by: Hugh Dickins Reviewed-by: David Howells Cc: David Hildenbrand Cc: Jens Axboe Signed-off-by: Andrew Morton commit 253e5df8b8f0145adb090f57c6f4e6efa52d738e Author: Hugh Dickins Date: Sun Jul 23 13:55:00 2023 -0700 tmpfs: fix Documentation of noswap and huge mount options The noswap mount option is surely not one of the three options for sizing: move its description down. The huge= mount option does not accept numeric values: those are just in an internal enum. Delete those numbers, and follow the manpage text more closely (but there's not yet any fadvise() or fcntl() which applies here). /sys/kernel/mm/transparent_hugepage/shmem_enabled is hard to describe, and barely relevant to mounting a tmpfs: just refer to transhuge.rst (while still using the words deny and force, to help as informal reminders). [rdunlap@infradead.org: fixup Docs table for huge mount options] Link: https://lkml.kernel.org/r/20230725052333.26857-1-rdunlap@infradead.org Link: https://lkml.kernel.org/r/986cb0bf-9780-354-9bb-4bf57aadbab@google.com Signed-off-by: Hugh Dickins Signed-off-by: Randy Dunlap Fixes: d0f5a85442d1 ("shmem: update documentation") Fixes: 2c6efe9cf2d7 ("shmem: add support to ignore swap") Reviewed-by: Luis Chamberlain Cc: Christian Brauner Signed-off-by: Andrew Morton commit dddfa05eb58076ad60f9a66e7155a5b3502b2dd5 Author: Andy Shevchenko Date: Mon Jul 24 17:31:31 2023 +0300 Revert "um: Use swap() to make code cleaner" This reverts commit 9b0da3f22307af693be80f5d3a89dc4c7f360a85. The sigio.c is clearly user space code which is handled by arch/um/scripts/Makefile.rules (see USER_OBJS rule). The above mentioned commit simply broke this agreement, we may not use Linux kernel internal headers in them without thorough thinking. Hence, revert the wrong commit. Link: https://lkml.kernel.org/r/20230724143131.30090-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202307212304.cH79zJp1-lkp@intel.com/ Cc: Anton Ivanov Cc: Herve Codina Cc: Jason A. Donenfeld Cc: Johannes Berg Cc: Rasmus Villemoes Cc: Richard Weinberger Cc: Yang Guang Cc: Signed-off-by: Andrew Morton commit d1836a3b2a9a50134ac449359b2fec56e3685e1d Author: Feng Tang Date: Tue Jul 18 13:28:11 2023 +0800 mm/damon/core-test: initialise context before test in damon_test_set_attrs() Running kunit test for 6.5-rc1 hits one bug: ok 10 damon_test_update_monitoring_result general protection fault, probably for non-canonical address 0x1bffa5c419cfb81: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 110 Comm: kunit_try_catch Tainted: G N 6.5.0-rc2 #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:damon_set_attrs+0xb9/0x120 Code: f8 00 00 00 4c 8d 58 e0 48 39 c3 74 ba 41 ba 59 17 b7 d1 49 8b 43 10 4d 8d 4b 10 48 8d 70 e0 49 39 c1 74 50 49 8b 40 08 31 d2 <69> 4e 18 10 27 00 00 49 f7 30 31 d2 48 89 c5 89 c8 f7 f5 31 d2 89 RSP: 0000:ffffc900005bfd40 EFLAGS: 00010246 RAX: ffffffff81159fc0 RBX: ffffc900005bfeb8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 01bffa5c419cfb69 RDI: ffffc900005bfd70 RBP: ffffc90000013c10 R08: ffffc900005bfdc0 R09: ffffffff81ff10ed R10: 00000000d1b71759 R11: ffffffff81ff10dd R12: ffffc90000013a78 R13: ffff88810eb78180 R14: ffffffff818297c0 R15: ffffc90000013c28 FS: 0000000000000000(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000002a1c001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: damon_test_set_attrs+0x63/0x1f0 kunit_generic_run_threadfn_adapter+0x17/0x30 kthread+0xfd/0x130 The problem seems to be related with the damon_ctx was used without being initialized. Fix it by adding the initialization. Link: https://lkml.kernel.org/r/20230718052811.1065173-1-feng.tang@intel.com Fixes: aa13779be6b7 ("mm/damon/core-test: add a test for damon_set_attrs()") Signed-off-by: Feng Tang Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 57012c57536f8814dec92e74197ee96c3498d24e Merge: bc168790de87b de52e17326c3e Author: Linus Torvalds Date: Thu Jul 27 12:27:37 2023 -0700 Merge tag 'net-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from can, netfilter. Current release - regressions: - core: fix splice_to_socket() for O_NONBLOCK socket - af_unix: fix fortify_panic() in unix_bind_bsd(). - can: raw: fix lockdep issue in raw_release() Previous releases - regressions: - tcp: reduce chance of collisions in inet6_hashfn(). - netfilter: skip immediate deactivate in _PREPARE_ERROR - tipc: stop tipc crypto on failure in tipc_node_create - eth: igc: fix kernel panic during ndo_tx_timeout callback - eth: iavf: fix potential deadlock on allocation failure Previous releases - always broken: - ipv6: fix bug where deleting a mngtmpaddr can create a new temporary address - eth: ice: fix memory management in ice_ethtool_fdir.c - eth: hns3: fix the imp capability bit cannot exceed 32 bits issue - eth: vxlan: calculate correct header length for GPE - eth: stmmac: apply redundant write work around on 4.xx too" * tag 'net-6.5-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (49 commits) tipc: stop tipc crypto on failure in tipc_node_create af_unix: Terminate sun_path when bind()ing pathname socket. tipc: check return value of pskb_trim() benet: fix return value check in be_lancer_xmit_workarounds() virtio-net: fix race between set queues and probe net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64 splice, net: Fix splice_to_socket() for O_NONBLOCK socket net: fec: tx processing does not call XDP APIs if budget is 0 mptcp: more accurate NL event generation selftests: mptcp: join: only check for ip6tables if needed tools: ynl-gen: fix parse multi-attr enum attribute tools: ynl-gen: fix enum index in _decode_enum(..) netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR netfilter: nft_set_rbtree: fix overlap expiration walk igc: Fix Kernel Panic during ndo_tx_timeout callback net: dsa: qca8k: fix mdb add/del case with 0 VID net: dsa: qca8k: fix broken search_and_del net: dsa: qca8k: fix search_and_insert wrong handling of new rule net: dsa: qca8k: enable use_single_write for qca8xxx ... commit bc168790de87bd70371793cfecb0fab26f85b857 Merge: 53c8621b9e6c3 7891d0a5ce6f6 Author: Linus Torvalds Date: Thu Jul 27 12:07:41 2023 -0700 Merge tag 'soundwire-6.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire fixes from Vinod Koul: - Core fix for enumeration completion - Qualcomm driver fix to update status - AMD driver fix for probe error check * tag 'soundwire-6.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: amd: Fix a check for errors in probe() soundwire: qcom: update status correctly with mask soundwire: fix enumeration completion commit 53c8621b9e6c3fa2607cb36db76780f6e327f57d Merge: 64de76ce8e26f 13c088cf3657d Author: Linus Torvalds Date: Thu Jul 27 11:52:41 2023 -0700 Merge tag 'phy-fixes-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy fixes from Vinod Koul: - Out of bound fix for hisilicon phy - Qualcomm synopsis femto phy for keeping clock enabled during suspend and enabling ref clocks - Mediatek driver fixes for upper limit test and error code * tag 'phy-fixes-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe() phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code phy: qcom-snps-femto-v2: properly enable ref clock phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend phy: mediatek: hdmi: mt8195: fix prediv bad upper limit test phy: phy-mtk-dp: Fix an error code in probe() commit 64de76ce8e26fb0a5ca32ac2210ef99238c28525 Merge: 379e66711b33f b28ff3a7d7e97 Author: Linus Torvalds Date: Thu Jul 27 11:44:08 2023 -0700 Merge tag 'for-6.5-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix accounting of global block reserve size when block group tree is enabled - the async discard has been enabled in 6.2 unconditionally, but for zoned mode it does not make that much sense to do it asynchronously as the zones are reset as needed - error handling and proper error value propagation fixes * tag 'for-6.5-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: check for commit error at btrfs_attach_transaction_barrier() btrfs: check if the transaction was aborted at btrfs_wait_for_commit() btrfs: remove BUG_ON()'s in add_new_free_space() btrfs: account block group tree when calculating global reserve size btrfs: zoned: do not enable async discard commit 379e66711b33f9fdc0513daee6cf3dd8d2f6f435 Merge: 657b5146955eb 9e46e4dcd9d6c Author: Linus Torvalds Date: Thu Jul 27 11:37:34 2023 -0700 Merge tag 'fixes-2023-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock fix from Mike Rapoport: "A call to memblock_free() or memblock_phys_free() issued after memblock data is discarded will result in use after free in memblock_isolate_range(). Avoid those issues by making sure that memblock_discard points memblock.reserved.regions back at the static buffer" * tag 'fixes-2023-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: mm,memblock: reset memblock.reserved to system init state to prevent UAF commit 657b5146955eba331e01b9a6ae89ce2e716ba306 Author: Jann Horn Date: Wed Jul 26 23:41:03 2023 +0200 mm: lock_vma_under_rcu() must check vma->anon_vma under vma lock lock_vma_under_rcu() tries to guarantee that __anon_vma_prepare() can't be called in the VMA-locked page fault path by ensuring that vma->anon_vma is set. However, this check happens before the VMA is locked, which means a concurrent move_vma() can concurrently call unlink_anon_vmas(), which disassociates the VMA's anon_vma. This means we can get UAF in the following scenario: THREAD 1 THREAD 2 ======== ======== lock_vma_under_rcu() rcu_read_lock() mas_walk() check vma->anon_vma mremap() syscall move_vma() vma_start_write() unlink_anon_vmas() handle_mm_fault() __handle_mm_fault() handle_pte_fault() do_pte_missing() do_anonymous_page() anon_vma_prepare() __anon_vma_prepare() find_mergeable_anon_vma() mas_walk() [looks up VMA X] munmap() syscall (deletes VMA X) reusable_anon_vma() [called on freed VMA X] This is a security bug if you can hit it, although an attacker would have to win two races at once where the first race window is only a few instructions wide. This patch is based on some previous discussion with Linus Torvalds on the security list. Cc: stable@vger.kernel.org Fixes: 5e31275cc997 ("mm: add per-VMA lock and helper functions to control it") Signed-off-by: Jann Horn Signed-off-by: Linus Torvalds commit cdddb626dc053a2bbe8be4150e9b67395130a683 Author: Gustavo A. R. Silva Date: Sat Jul 1 11:17:22 2023 -0600 media: venus: Use struct_size_t() helper in pkt_session_unset_buffers() Prefer struct_size_t() over struct_size() when no pointer instance of the structure type is present. Signed-off-by: "Gustavo A. R. Silva" Reviewed-by: Vikash Garodia Link: https://lore.kernel.org/r/ZKBfoqSl61jfpO2r@work Signed-off-by: Kees Cook commit bcc29b7f5af6797702c2306a7aacb831fc5ce9cb Author: Lin Ma Date: Tue Jul 25 10:33:30 2023 +0800 bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing The nla_for_each_nested parsing in function bpf_sk_storage_diag_alloc does not check the length of the nested attribute. This can lead to an out-of-attribute read and allow a malformed nlattr (e.g., length 0) to be viewed as a 4 byte integer. This patch adds an additional check when the nlattr is getting counted. This makes sure the latter nla_get_u32 can access the attributes with the correct length. Fixes: 1ed4d92458a9 ("bpf: INET_DIAG support in bpf_sk_storage") Suggested-by: Jakub Kicinski Signed-off-by: Lin Ma Reviewed-by: Jakub Kicinski Link: https://lore.kernel.org/r/20230725023330.422856-1-linma@zju.edu.cn Signed-off-by: Martin KaFai Lau commit e146503ac68418859fb063a3a0cd9ec93bc52238 Author: Baskaran Kannan Date: Thu Jul 27 11:21:59 2023 -0500 hwmon: (k10temp) Enable AMD3255 Proc to show negative temperature Industrial processor i3255 supports temperatures -40 deg celcius to 105 deg Celcius. The current implementation of k10temp_read_temp rounds off any negative temperatures to '0'. To fix this, the following changes have been made. A flag 'disp_negative' is added to struct k10temp_data to support AMD i3255 processors. Flag 'disp_negative' is set if 3255 processor is found during k10temp_probe. Flag 'disp_negative' is used to determine whether to round off negative temperatures to '0' in k10temp_read_temp. Signed-off-by: Baskaran Kannan Link: https://lore.kernel.org/r/20230727162159.1056136-1-Baski.Kannan@amd.com Fixes: aef17ca12719 ("hwmon: (k10temp) Only apply temperature offset if result is positive") Cc: stable@vger.kernel.org [groeck: Fixed multi-line comment] Signed-off-by: Guenter Roeck commit c6abce60338aa2080973cd95be0aedad528bb41f Author: Christophe JAILLET Date: Wed Jul 19 23:55:01 2023 +0200 mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op() 'op-cs' is copied in 'fun->mchip_number' which is used to access the 'mchip_offsets' and the 'rnb_gpio' arrays. These arrays have NAND_MAX_CHIPS elements, so the index must be below this limit. Fix the sanity check in order to avoid the NAND_MAX_CHIPS value. This would lead to out-of-bound accesses. Fixes: 54309d657767 ("mtd: rawnand: fsl_upm: Implement exec_op()") Signed-off-by: Christophe JAILLET Reviewed-by: Dan Carpenter Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/cd01cba1c7eda58bdabaae174c78c067325803d2.1689803636.git.christophe.jaillet@wanadoo.fr commit 71c8f9cf2623d0db79665f876b95afcdd8214aec Author: Arnd Bergmann Date: Wed Jul 19 21:00:25 2023 +0200 mtd: spi-nor: avoid holes in struct spi_mem_op gcc gets confused when -ftrivial-auto-var-init=pattern is used on sparse bit fields such as 'struct spi_mem_op', which caused the previous false positive warning about an uninitialized variable: drivers/mtd/spi-nor/spansion.c: error: 'op' is used uninitialized [-Werror=uninitialized] In fact, the variable is fully initialized and gcc does not see it being used, so the warning is entirely bogus. The problem appears to be a misoptimization in the initialization of single bit fields when the rest of the bytes are not initialized. A previous workaround added another initialization, which ended up shutting up the warning in spansion.c, though it apparently still happens in other files as reported by Peter Foley in the gcc bugzilla. The workaround of adding a fake initialization seems particularly bad because it would set values that can never be correct but prevent the compiler from warning about actually missing initializations. Revert the broken workaround and instead pad the structure to only have bitfields that add up to full bytes, which should avoid this behavior in all drivers. I also filed a new bug against gcc with what I found, so this can hopefully be addressed in future gcc releases. At the moment, only gcc-12 and gcc-13 are affected. Cc: Peter Foley Cc: Pedro Falcato Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110743 Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108402 Link: https://godbolt.org/z/efMMsG1Kx Fixes: 420c4495b5e56 ("mtd: spi-nor: spansion: make sure local struct does not contain garbage") Signed-off-by: Arnd Bergmann Acked-by: Mark Brown Acked-by: Tudor Ambarus Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230719190045.4007391-1-arnd@kernel.org commit d3053b4a6b76f29fd1bf0b438b19a2d6ece9657d Author: Tudor Ambarus Date: Tue Jun 20 05:53:59 2023 +0300 MAINTAINERS: Add myself as reviewer for HYPERBUS Add myself as Designated Reviewer for Hyperbus support. I'm assessing the framework and I'd like to get involved in reviewing further patches. Signed-off-by: Tudor Ambarus Acked-by: Vignesh Raghavendra Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230620025359.33839-1-tudor.ambarus@linaro.org commit b7c822fa6b7701b17e139f1c562fc24135880ed4 Author: Jason Gunthorpe Date: Tue Jul 25 16:05:50 2023 -0300 iommufd: Set end correctly when doing batch carry Even though the test suite covers this it somehow became obscured that this wasn't working. The test iommufd_ioas.mock_domain.access_domain_destory would blow up rarely. end should be set to 1 because this just pushed an item, the carry, to the pfns list. Sometimes the test would blow up with: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 5 PID: 584 Comm: iommufd Not tainted 6.5.0-rc1-dirty #1236 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:batch_unpin+0xa2/0x100 [iommufd] Code: 17 48 81 fe ff ff 07 00 77 70 48 8b 15 b7 be 97 e2 48 85 d2 74 14 48 8b 14 fa 48 85 d2 74 0b 40 0f b6 f6 48 c1 e6 04 48 01 f2 <48> 8b 3a 48 c1 e0 06 89 ca 48 89 de 48 83 e7 f0 48 01 c7 e8 96 dc RSP: 0018:ffffc90001677a58 EFLAGS: 00010246 RAX: 00007f7e2646f000 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 00000000fefc4c8d RDI: 0000000000fefc4c RBP: ffffc90001677a80 R08: 0000000000000048 R09: 0000000000000200 R10: 0000000000030b98 R11: ffffffff81f3bb40 R12: 0000000000000001 R13: ffff888101f75800 R14: ffffc90001677ad0 R15: 00000000000001fe FS: 00007f9323679740(0000) GS:ffff8881ba540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000105ede003 CR4: 00000000003706a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? show_regs+0x5c/0x70 ? __die+0x1f/0x60 ? page_fault_oops+0x15d/0x440 ? lock_release+0xbc/0x240 ? exc_page_fault+0x4a4/0x970 ? asm_exc_page_fault+0x27/0x30 ? batch_unpin+0xa2/0x100 [iommufd] ? batch_unpin+0xba/0x100 [iommufd] __iopt_area_unfill_domain+0x198/0x430 [iommufd] ? __mutex_lock+0x8c/0xb80 ? __mutex_lock+0x6aa/0xb80 ? xa_erase+0x28/0x30 ? iopt_table_remove_domain+0x162/0x320 [iommufd] ? lock_release+0xbc/0x240 iopt_area_unfill_domain+0xd/0x10 [iommufd] iopt_table_remove_domain+0x195/0x320 [iommufd] iommufd_hw_pagetable_destroy+0xb3/0x110 [iommufd] iommufd_object_destroy_user+0x8e/0xf0 [iommufd] iommufd_device_detach+0xc5/0x140 [iommufd] iommufd_selftest_destroy+0x1f/0x70 [iommufd] iommufd_object_destroy_user+0x8e/0xf0 [iommufd] iommufd_destroy+0x3a/0x50 [iommufd] iommufd_fops_ioctl+0xfb/0x170 [iommufd] __x64_sys_ioctl+0x40d/0x9a0 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Link: https://lore.kernel.org/r/3-v1-85aacb2af554+bc-iommufd_syz3_jgg@nvidia.com Cc: Fixes: f394576eb11d ("iommufd: PFN handling for iopt_pages") Reviewed-by: Kevin Tian Tested-by: Nicolin Chen Reported-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 99f98a7c0d6985d5507c8130a981972e4b7b3bdc Author: Jason Gunthorpe Date: Tue Jul 25 16:05:49 2023 -0300 iommufd: IOMMUFD_DESTROY should not increase the refcount syzkaller found a race where IOMMUFD_DESTROY increments the refcount: obj = iommufd_get_object(ucmd->ictx, cmd->id, IOMMUFD_OBJ_ANY); if (IS_ERR(obj)) return PTR_ERR(obj); iommufd_ref_to_users(obj); /* See iommufd_ref_to_users() */ if (!iommufd_object_destroy_user(ucmd->ictx, obj)) As part of the sequence to join the two existing primitives together. Allowing the refcount the be elevated without holding the destroy_rwsem violates the assumption that all temporary refcount elevations are protected by destroy_rwsem. Racing IOMMUFD_DESTROY with iommufd_object_destroy_user() will cause spurious failures: WARNING: CPU: 0 PID: 3076 at drivers/iommu/iommufd/device.c:477 iommufd_access_destroy+0x18/0x20 drivers/iommu/iommufd/device.c:478 Modules linked in: CPU: 0 PID: 3076 Comm: syz-executor.0 Not tainted 6.3.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 RIP: 0010:iommufd_access_destroy+0x18/0x20 drivers/iommu/iommufd/device.c:477 Code: e8 3d 4e 00 00 84 c0 74 01 c3 0f 0b c3 0f 1f 44 00 00 f3 0f 1e fa 48 89 fe 48 8b bf a8 00 00 00 e8 1d 4e 00 00 84 c0 74 01 c3 <0f> 0b c3 0f 1f 44 00 00 41 57 41 56 41 55 4c 8d ae d0 00 00 00 41 RSP: 0018:ffffc90003067e08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888109ea0300 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 00000000ffffffff RBP: 0000000000000004 R08: 0000000000000000 R09: ffff88810bbb3500 R10: ffff88810bbb3e48 R11: 0000000000000000 R12: ffffc90003067e88 R13: ffffc90003067ea8 R14: ffff888101249800 R15: 00000000fffffffe FS: 00007ff7254fe6c0(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555557262da8 CR3: 000000010a6fd000 CR4: 0000000000350ef0 Call Trace: iommufd_test_create_access drivers/iommu/iommufd/selftest.c:596 [inline] iommufd_test+0x71c/0xcf0 drivers/iommu/iommufd/selftest.c:813 iommufd_fops_ioctl+0x10f/0x1b0 drivers/iommu/iommufd/main.c:337 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x84/0xc0 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The solution is to not increment the refcount on the IOMMUFD_DESTROY path at all. Instead use the xa_lock to serialize everything. The refcount check == 1 and xa_erase can be done under a single critical region. This avoids the need for any refcount incrementing. It has the downside that if userspace races destroy with other operations it will get an EBUSY instead of waiting, but this is kind of racing is already dangerous. Fixes: 2ff4bed7fee7 ("iommufd: File descriptor, context, kconfig and makefiles") Link: https://lore.kernel.org/r/2-v1-85aacb2af554+bc-iommufd_syz3_jgg@nvidia.com Reviewed-by: Kevin Tian Reported-by: syzbot+7574ebfe589049630608@syzkaller.appspotmail.com Signed-off-by: Jason Gunthorpe commit d21afb098c510739a2f5dd27aed5d3198816d8dc Merge: 77489a4eb76c3 db66795f61354 Author: Arnd Bergmann Date: Thu Jul 27 15:44:02 2023 +0200 Merge tag 'socfpga_dts_fix_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into arm/fixes SoCFPGA dts fix for v6.5 - Fix incorrect I2C property for SCL signal * tag 'socfpga_dts_fix_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: arm64: dts: stratix10: fix incorrect I2C property for SCL signal Link: https://lore.kernel.org/r/20230724145617.887443-1-dinguyen@kernel.org Signed-off-by: Arnd Bergmann commit 77489a4eb76c3bf597bd92dee750cf8669cad1ce Merge: b1e052903cb56 4c188fa183ebb Author: Arnd Bergmann Date: Thu Jul 27 15:41:10 2023 +0200 Merge tag 'renesas-fixes-for-v6.5-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into arm/fixes Renesas fixes for v6.5 - Fix interrupt names for MTU3 channels on RZ/G2L and RZ/V2L. * tag 'renesas-fixes-for-v6.5-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: arm64: dts: renesas: rzg2l: Update overfow/underflow IRQ names for MTU3 channels Link: https://lore.kernel.org/r/cover.1690463347.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit b1e052903cb5605e77476166a3296759835fdb69 Merge: c05cfd71df7c0 faafd6ca7e6e7 Author: Arnd Bergmann Date: Thu Jul 27 15:40:53 2023 +0200 Merge tag 'memory-controller-drv-fixes-6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into arm/fixes Memory controller drivers - fixes for v6.5 Two fixes are needed for Tegra194 memory controllers caused by the same Tegra PCI commit merged in v6.5-rc1. The Tegra PCI requires now interconnect from the memory controller, which was set only for Tegra234, but not for Tegra194, causing probe deferrals. Expose some dummy interconnect provider for Tegra194, to satisfy PCI driver needs. * tag 'memory-controller-drv-fixes-6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl: memory: tegra: make icc_set_bw return zero if BWMGR not supported memory: tegra: Add dummy implementation on Tegra194 Link: https://lore.kernel.org/r/20230726084811.124038-1-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit c05cfd71df7c0adfaa60c153a75b23e6efbd3978 Merge: 09eadda27ca4a 53cab4d871690 Author: Arnd Bergmann Date: Thu Jul 27 15:40:33 2023 +0200 Merge tag 'imx-fixes-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.5: - A couple of ARM DTS fixes for i.MX6SLL usbphy and supported CPU frequency of sk-imx53 board - Add missing pull-up for imx8mn-var-som onboard PHY reset pinmux - A couple of imx8mm-venice fixes from Tim Harvey to diable disp_blk_ctrl - A couple of phycore-imx8mm fixes from Yashwanth Varakala to correct VPU label and gpio-line-names - Fix imx8mp-blk-ctrl driver to register HSIO PLL clock as bus_power_dev child, so that runtime PM can translate into the necessary GPC power domain action * tag 'imx-fixes-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: soc: imx: imx8mp-blk-ctrl: register HSIO PLL clock as bus_power_dev child ARM: dts: nxp/imx: limit sk-imx53 supported frequencies arm64: dts: freescale: Fix VPU G2 clock arm64: dts: imx8mn-var-som: add missing pull-up for onboard PHY reset pinmux arm64: dts: phycore-imx8mm: Correction in gpio-line-names arm64: dts: phycore-imx8mm: Label typo-fix of VPU ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node arm64: dts: imx8mm-venice-gw7904: disable disp_blk_ctrl arm64: dts: imx8mm-venice-gw7903: disable disp_blk_ctrl Link: https://lore.kernel.org/r/20230725075837.GR151430@dragon Signed-off-by: Arnd Bergmann commit 09eadda27ca4afc3f560efea265bbe7a93ef786d Author: Arnd Bergmann Date: Sun Mar 19 22:29:28 2023 +0100 backlight: corgi_lcd: fix missing prototype The corgi_lcd_limit_intensity() function is called from platform and defined in a driver, but the driver does not see the declaration: drivers/video/backlight/corgi_lcd.c:434:6: error: no previous prototype for 'corgi_lcd_limit_intensity' [-Werror=missing-prototypes] 434 | void corgi_lcd_limit_intensity(int limit) Move the prototype into a header that can be included from both sides to shut up the warning. Reviewed-by: Daniel Thompson Signed-off-by: Arnd Bergmann commit b161f25fa30644598007d752a1b802cda0140788 Author: Ian Rogers Date: Tue Jul 18 17:18:36 2023 -0700 perf parse-events: Only move force grouped evsels when sorting Prior to this change, events without a group would be sorted as if they were from the location of the first event without a group. For example instructions and cycles are without a group: instructions,{imc_free_running/data_read/,imc_free_running/data_write/},cycles parse events would create an eventual evlist like: instructions,cycles,{uncore_imc_free_running_0/data_read/,uncore_imc_free_running_1/data_read/,uncore_imc_free_running_0/data_write/,uncore_imc_free_running_1/data_write/} This is done so that perf metric events, that must always be in a group, will be adjacent and so can be forced into a group. This change modifies the sorting so that only force grouped events, like perf metrics, are sorted and all other events keep their position with respect to groups in the evlist. The location of the force grouped event is chosen to match the first force grouped event. For architectures without force grouped events, ie anything not Intel Icelake or newer, this should mean sorting and fixing doesn't modify the event positions except when fixing the grouping for PMUs of things like uncore events. Fixes: 347c2f0a0988c59c ("perf parse-events: Sort and group parsed events") Reported-by: Andi Kleen Signed-off-by: Ian Rogers Tested-by: Andi Kleen Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20230719001836.198363-4-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit e8d38345da249be17046b74d7bb64b77cdd07a08 Author: Ian Rogers Date: Tue Jul 18 17:18:35 2023 -0700 perf parse-events: When fixing group leaders always set the leader The evsel grouping fix iterates over evsels tracking the leader group and the current position's group, updating the current position's leader if an evsel is being forced into a group or groups changed. However, groups changing isn't a sufficient condition as sorting may have reordered events and the leader may no longer come first. For this reason update all leaders whenever they disagree. This change breaks certain Icelake+ metrics due to bugs in the kernel. For example, tma_l3_bound with threshold enabled tries to program the events: {topdown-retiring,slots,CYCLE_ACTIVITY.STALLS_L2_MISS,topdown-fe-bound,EXE_ACTIVITY.BOUND_ON_STORES,EXE_ACTIVITY.1_PORTS_UTIL,topdown-be-bound,cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/,CYCLE_ACTIVITY.STALLS_L3_MISS,CPU_CLK_UNHALTED.THREAD,CYCLE_ACTIVITY.STALLS_MEM_ANY,EXE_ACTIVITY.2_PORTS_UTIL,CYCLE_ACTIVITY.STALLS_TOTAL,topdown-bad-spec}:W fixing the perf metric event order gives: {slots,topdown-retiring,topdown-fe-bound,topdown-be-bound,topdown-bad-spec,CYCLE_ACTIVITY.STALLS_L2_MISS,EXE_ACTIVITY.BOUND_ON_STORES,EXE_ACTIVITY.1_PORTS_UTIL,cpu/INT_MISC.RECOVERY_CYCLES,cmask=1,edge/,CYCLE_ACTIVITY.STALLS_L3_MISS,CPU_CLK_UNHALTED.THREAD,CYCLE_ACTIVITY.STALLS_MEM_ANY,EXE_ACTIVITY.2_PORTS_UTIL,CYCLE_ACTIVITY.STALLS_TOTAL}:W Both of these return "" for all events, whilst they work with the group removed respecting that the perf metric events must still be grouped. A vendor events update will need to add METRIC_NO_GROUP to these metrics to workaround the kernel PMU driver issue. Fixes: a90cc5a9eeab45ea ("perf evsel: Don't let evsel__group_pmu_name() traverse unsorted group") Signed-off-by: Ian Rogers Tested-by: Andi Kleen Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20230719001836.198363-3-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 5c49b6c3f2cc6d44f691c4aa3d22ca49bedf637b Author: Ian Rogers Date: Tue Jul 18 17:18:34 2023 -0700 perf parse-events: Extra care around force grouped events Perf metric (topdown) events on Intel Icelake+ machines require a group, however, they may be next to events that don't require a group. Consider: cycles,slots,topdown-fe-bound The cycles event needn't be grouped but slots and topdown-fe-bound need grouping. Prior to this change, as slots and topdown-fe-bound need a group forcing and all events share the same PMU, slots and topdown-fe-bound would be forced into a group with cycles. This is a bug on two fronts, cycles wasn't supposed to be grouped and cycles can't be a group leader with a perf metric event. This change adds recognition that cycles isn't force grouped and so it shouldn't be force grouped with slots and topdown-fe-bound. Fixes: a90cc5a9eeab45ea ("perf evsel: Don't let evsel__group_pmu_name() traverse unsorted group") Signed-off-by: Ian Rogers Tested-by: Andi Kleen Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20230719001836.198363-2-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 3e9dce80dbf91972aed972c743f539c396a34312 Author: Ming Lei Date: Wed Jul 26 22:45:02 2023 +0800 ublk: return -EINTR if breaking from waiting for existed users in DEL_DEV If user interrupts wait_event_interruptible() in ublk_ctrl_del_dev(), return -EINTR and let user know what happens. Fixes: 0abe39dec065 ("block: ublk: improve handling device deletion") Reported-by: Stefano Garzarella Signed-off-by: Ming Lei Reviewed-by: Stefano Garzarella Link: https://lore.kernel.org/r/20230726144502.566785-4-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 0c0cbd4ebc375ceebc75c89df04b74f215fab23a Author: Ming Lei Date: Wed Jul 26 22:45:01 2023 +0800 ublk: fail to recover device if queue setup is interrupted In ublk_ctrl_end_recovery(), if wait_for_completion_interruptible() is interrupted by signal, queues aren't setup successfully yet, so we have to fail UBLK_CMD_END_USER_RECOVERY, otherwise kernel oops can be triggered. Fixes: c732a852b419 ("ublk_drv: add START_USER_RECOVERY and END_USER_RECOVERY support") Reported-by: Stefano Garzarella Signed-off-by: Ming Lei Reviewed-by: Stefano Garzarella Link: https://lore.kernel.org/r/20230726144502.566785-3-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 53e7d08f6d6e214c40db1f51291bb2975c789dc2 Author: Ming Lei Date: Wed Jul 26 22:45:00 2023 +0800 ublk: fail to start device if queue setup is interrupted In ublk_ctrl_start_dev(), if wait_for_completion_interruptible() is interrupted by signal, queues aren't setup successfully yet, so we have to fail UBLK_CMD_START_DEV, otherwise kernel oops can be triggered. Reported by German when working on qemu-storage-deamon which requires single thread ublk daemon. Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Reported-by: German Maglione Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20230726144502.566785-2-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 3b9adfbba5af9e1e83897e832fbe6f5778bfc5d3 Merge: 8019a4ab3d80c f85739c0b2b0d Author: Takashi Iwai Date: Thu Jul 27 14:54:23 2023 +0200 Merge tag 'asoc-fix-v6.5-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.5 A collection of device specific fixes, none particularly remarkable. There's a set of repetitive fixes for the RealTek drivers fixing an issue with suspend that was replicated in multiple drivers. commit 2608766756578629b42b54c8307c56269ca07a33 Author: Heiko Carstens Date: Wed Jul 26 15:25:33 2023 +0200 s390: update defconfigs Changes from before and new defaults: - enable USER_EVENTS - enable FAULT_INJECTION_CONFIGFS (debug only) - disable FW_LOADER Signed-off-by: Heiko Carstens commit edc1e4b6e26536868ef819a735e04a5b32c10589 Author: Sven Schnelle Date: Wed Jul 26 11:10:19 2023 +0200 s390/vmem: split pages when debug pagealloc is enabled Since commit bb1520d581a3 ("s390/mm: start kernel with DAT enabled") the kernel crashes early during boot when debug pagealloc is enabled: mem auto-init: stack:off, heap alloc:off, heap free:off addressing exception: 0005 ilc:2 [#1] SMP DEBUG_PAGEALLOC Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 6.5.0-rc3-09759-gc5666c912155 #630 [..] Krnl Code: 00000000001325f6: ec5600248064 cgrj %r5,%r6,8,000000000013263e 00000000001325fc: eb880002000c srlg %r8,%r8,2 #0000000000132602: b2210051 ipte %r5,%r1,%r0,0 >0000000000132606: b90400d1 lgr %r13,%r1 000000000013260a: 41605008 la %r6,8(%r5) 000000000013260e: a7db1000 aghi %r13,4096 0000000000132612: b221006d ipte %r6,%r13,%r0,0 0000000000132616: e3d0d0000171 lay %r13,4096(%r13) Call Trace: __kernel_map_pages+0x14e/0x320 __free_pages_ok+0x23a/0x5a8) free_low_memory_core_early+0x214/0x2c8 memblock_free_all+0x28/0x58 mem_init+0xb6/0x228 mm_core_init+0xb6/0x3b0 start_kernel+0x1d2/0x5a8 startup_continue+0x36/0x40 Kernel panic - not syncing: Fatal exception: panic_on_oops This is caused by using large mappings on machines with EDAT1/EDAT2. Add the code to split the mappings into 4k pages if debug pagealloc is enabled by CONFIG_DEBUG_PAGEALLOC_ENABLE_DEFAULT or the debug_pagealloc kernel command line option. Fixes: bb1520d581a3 ("s390/mm: start kernel with DAT enabled") Signed-off-by: Sven Schnelle Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens commit de52e17326c3e9a719c9ead4adb03467b8fae0ef Author: Fedor Pchelkin Date: Wed Jul 26 00:46:25 2023 +0300 tipc: stop tipc crypto on failure in tipc_node_create If tipc_link_bc_create() fails inside tipc_node_create() for a newly allocated tipc node then we should stop its tipc crypto and free the resources allocated with a call to tipc_crypto_start(). As the node ref is initialized to one to that point, just put the ref on tipc_link_bc_create() error case that would lead to tipc_node_free() be eventually executed and properly clean the node and its crypto resources. Found by Linux Verification Center (linuxtesting.org). Fixes: cb8092d70a6f ("tipc: move bc link creation back to tipc_node_create") Suggested-by: Xin Long Signed-off-by: Fedor Pchelkin Reviewed-by: Xin Long Link: https://lore.kernel.org/r/20230725214628.25246-1-pchelkin@ispras.ru Signed-off-by: Paolo Abeni commit ecb4534b6a1c8a9c01d4d1d532d58fc18f23c8da Author: Kuniyuki Iwashima Date: Wed Jul 26 12:08:28 2023 -0700 af_unix: Terminate sun_path when bind()ing pathname socket. kernel test robot reported slab-out-of-bounds access in strlen(). [0] Commit 06d4c8a80836 ("af_unix: Fix fortify_panic() in unix_bind_bsd().") removed unix_mkname_bsd() call in unix_bind_bsd(). If sunaddr->sun_path is not terminated by user and we don't enable CONFIG_INIT_STACK_ALL_ZERO=y, strlen() will do the out-of-bounds access during file creation. Let's go back to strlen()-with-sockaddr_storage way and pack all 108 trickiness into unix_mkname_bsd() with bold comments. [0]: BUG: KASAN: slab-out-of-bounds in strlen (lib/string.c:?) Read of size 1 at addr ffff000015492777 by task fortify_strlen_/168 CPU: 0 PID: 168 Comm: fortify_strlen_ Not tainted 6.5.0-rc1-00333-g3329b603ebba #16 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace (arch/arm64/kernel/stacktrace.c:235) show_stack (arch/arm64/kernel/stacktrace.c:242) dump_stack_lvl (lib/dump_stack.c:107) print_report (mm/kasan/report.c:365 mm/kasan/report.c:475) kasan_report (mm/kasan/report.c:590) __asan_report_load1_noabort (mm/kasan/report_generic.c:378) strlen (lib/string.c:?) getname_kernel (./include/linux/fortify-string.h:? fs/namei.c:226) kern_path_create (fs/namei.c:3926) unix_bind (net/unix/af_unix.c:1221 net/unix/af_unix.c:1324) __sys_bind (net/socket.c:1792) __arm64_sys_bind (net/socket.c:1801) invoke_syscall (arch/arm64/kernel/syscall.c:? arch/arm64/kernel/syscall.c:52) el0_svc_common (./include/linux/thread_info.h:127 arch/arm64/kernel/syscall.c:147) do_el0_svc (arch/arm64/kernel/syscall.c:189) el0_svc (./arch/arm64/include/asm/daifflags.h:28 arch/arm64/kernel/entry-common.c:133 arch/arm64/kernel/entry-common.c:144 arch/arm64/kernel/entry-common.c:648) el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:?) el0t_64_sync (arch/arm64/kernel/entry.S:591) Allocated by task 168: kasan_set_track (mm/kasan/common.c:45 mm/kasan/common.c:52) kasan_save_alloc_info (mm/kasan/generic.c:512) __kasan_kmalloc (mm/kasan/common.c:383) __kmalloc (mm/slab_common.c:? mm/slab_common.c:998) unix_bind (net/unix/af_unix.c:257 net/unix/af_unix.c:1213 net/unix/af_unix.c:1324) __sys_bind (net/socket.c:1792) __arm64_sys_bind (net/socket.c:1801) invoke_syscall (arch/arm64/kernel/syscall.c:? arch/arm64/kernel/syscall.c:52) el0_svc_common (./include/linux/thread_info.h:127 arch/arm64/kernel/syscall.c:147) do_el0_svc (arch/arm64/kernel/syscall.c:189) el0_svc (./arch/arm64/include/asm/daifflags.h:28 arch/arm64/kernel/entry-common.c:133 arch/arm64/kernel/entry-common.c:144 arch/arm64/kernel/entry-common.c:648) el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:?) el0t_64_sync (arch/arm64/kernel/entry.S:591) The buggy address belongs to the object at ffff000015492700 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 0 bytes to the right of allocated 119-byte region [ffff000015492700, ffff000015492777) The buggy address belongs to the physical page: page:00000000aeab52ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x55492 anon flags: 0x3fffc0000000200(slab|node=0|zone=0|lastcpupid=0xffff) page_type: 0xffffffff() raw: 03fffc0000000200 ffff0000084018c0 fffffc00003d0e00 0000000000000005 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff000015492600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff000015492680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff000015492700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 fc ^ ffff000015492780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff000015492800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: 06d4c8a80836 ("af_unix: Fix fortify_panic() in unix_bind_bsd().") Reported-by: kernel test robot Closes: https://lore.kernel.org/netdev/202307262110.659e5e8-oliver.sang@intel.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20230726190828.47874-1-kuniyu@amazon.com Signed-off-by: Paolo Abeni commit d893832d0e1ef41c72cdae444268c1d64a2be8ad Author: Borislav Petkov (AMD) Date: Fri Jul 7 13:53:41 2023 +0200 x86/srso: Add IBPB on VMEXIT Add the option to flush IBPB only on VMEXIT in order to protect from malicious guests but one otherwise trusts the software that runs on the hypervisor. Signed-off-by: Borislav Petkov (AMD) commit 233d6f68b98d480a7c42ebe78c38f79d44741ca9 Author: Borislav Petkov (AMD) Date: Thu Jul 6 15:04:35 2023 +0200 x86/srso: Add IBPB Add the option to mitigate using IBPB on a kernel entry. Pull in the Retbleed alternative so that the IBPB call from there can be used. Also, if Retbleed mitigation is done using IBPB, the same mitigation can and must be used here. Signed-off-by: Borislav Petkov (AMD) commit 1b5277c0ea0b247393a9c426769fde18cff5e2f6 Author: Borislav Petkov (AMD) Date: Thu Jun 29 17:43:40 2023 +0200 x86/srso: Add SRSO_NO support Add support for the CPUID flag which denotes that the CPU is not affected by SRSO. Signed-off-by: Borislav Petkov (AMD) commit 79113e4060aba744787a81edb9014f2865193854 Author: Borislav Petkov (AMD) Date: Tue Jul 18 11:13:40 2023 +0200 x86/srso: Add IBPB_BRTYPE support Add support for the synthetic CPUID flag which "if this bit is 1, it indicates that MSR 49h (PRED_CMD) bit 0 (IBPB) flushes all branch type predictions from the CPU branch predictor." This flag is there so that this capability in guests can be detected easily (otherwise one would have to track microcode revisions which is impossible for guests). It is also needed only for Zen3 and -4. The other two (Zen1 and -2) always flush branch type predictions by default. Signed-off-by: Borislav Petkov (AMD) commit fb3bd914b3ec28f5fb697ac55c4846ac2d542855 Author: Borislav Petkov (AMD) Date: Wed Jun 28 11:02:39 2023 +0200 x86/srso: Add a Speculative RAS Overflow mitigation Add a mitigation for the speculative return address stack overflow vulnerability found on AMD processors. The mitigation works by ensuring all RET instructions speculate to a controlled location, similar to how speculation is controlled in the retpoline sequence. To accomplish this, the __x86_return_thunk forces the CPU to mispredict every function return using a 'safe return' sequence. To ensure the safety of this mitigation, the kernel must ensure that the safe return sequence is itself free from attacker interference. In Zen3 and Zen4, this is accomplished by creating a BTB alias between the untraining function srso_untrain_ret_alias() and the safe return function srso_safe_ret_alias() which results in evicting a potentially poisoned BTB entry and using that safe one for all function returns. In older Zen1 and Zen2, this is accomplished using a reinterpretation technique similar to Retbleed one: srso_untrain_ret() and srso_safe_ret(). Signed-off-by: Borislav Petkov (AMD) commit e46e06ffc6d667a89b979701288e2264f45e6a7b Author: Yuanjun Gong Date: Tue Jul 25 14:48:10 2023 +0800 tipc: check return value of pskb_trim() goto free_skb if an unexpected result is returned by pskb_tirm() in tipc_crypto_rcv_complete(). Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication") Signed-off-by: Yuanjun Gong Reviewed-by: Tung Nguyen Link: https://lore.kernel.org/r/20230725064810.5820-1-ruc_gongyuanjun@163.com Signed-off-by: Paolo Abeni commit 7f2327666a9080e428166964e37548b0168cd5e9 Author: Xu Yang Date: Wed Jul 5 17:52:31 2023 +0800 usb: misc: ehset: fix wrong if condition A negative number from ret means the host controller had failed to send usb message and 0 means succeed. Therefore, the if logic is wrong here and this patch will fix it. Fixes: f2b42379c576 ("usb: misc: ehset: Rework test mode entry") Cc: stable Signed-off-by: Xu Yang Link: https://lore.kernel.org/r/20230705095231.457860-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit b32b8f2b9542d8039f5468303a6ca78c1b5611a5 Author: Gratian Crisan Date: Wed Jul 26 13:45:56 2023 -0500 usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy Hardware based on the Bay Trail / BYT SoCs require an external ULPI phy for USB device-mode. The phy chip usually has its 'reset' and 'chip select' lines connected to GPIOs described by ACPI fwnodes in the DSDT table. Because of hardware with missing ACPI resources for the 'reset' and 'chip select' GPIOs commit 5741022cbdf3 ("usb: dwc3: pci: Add GPIO lookup table on platforms without ACPI GPIO resources") introduced a fallback gpiod_lookup_table with hard-coded mappings for Bay Trail devices. However there are existing Bay Trail based devices, like the National Instruments cRIO-903x series, where the phy chip has its 'reset' and 'chip-select' lines always asserted in hardware via resistor pull-ups. On this hardware the phy chip is always enabled and the ACPI dsdt table is missing information not only for the 'chip-select' and 'reset' lines but also for the BYT GPIO controller itself "INT33FC". With the introduction of the gpiod_lookup_table initializing the USB device-mode on these hardware now errors out. The error comes from the gpiod_get_optional() calls in dwc3_pci_quirks() which will now return an -ENOENT error due to the missing ACPI entry for the INT33FC gpio controller used in the aforementioned table. This hardware used to work before because gpiod_get_optional() will return NULL instead of -ENOENT if no GPIO has been assigned to the requested function. The dwc3_pci_quirks() code for setting the 'cs' and 'reset' GPIOs was then skipped (due to the NULL return). This is the correct behavior in cases where the phy chip is hardwired and there are no GPIOs to control. Since the gpiod_lookup_table relies on the presence of INT33FC fwnode in ACPI tables only add the table if we know the entry for the INT33FC gpio controller is present. This allows Bay Trail based devices with hardwired dwc3 ULPI phys to continue working. Fixes: 5741022cbdf3 ("usb: dwc3: pci: Add GPIO lookup table on platforms without ACPI GPIO resources") Cc: stable Signed-off-by: Gratian Crisan Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20230726184555.218091-2-gratian.crisan@ni.com Signed-off-by: Greg Kroah-Hartman commit 5c85f7065718a949902b238a6abd8fc907c5d3e0 Author: Yuanjun Gong Date: Tue Jul 25 11:27:26 2023 +0800 benet: fix return value check in be_lancer_xmit_workarounds() in be_lancer_xmit_workarounds(), it should go to label 'tx_drop' if an unexpected value is returned by pskb_trim(). Fixes: 93040ae5cc8d ("be2net: Fix to trim skb for padded vlan packets to workaround an ASIC Bug") Signed-off-by: Yuanjun Gong Link: https://lore.kernel.org/r/20230725032726.15002-1-ruc_gongyuanjun@163.com Signed-off-by: Paolo Abeni commit 5f1c7031e044cb2fba82836d55cc235e2ad619dc Author: Zhang Shurong Date: Sun Jul 9 13:50:07 2023 +0800 staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() The "exc->key_len" is a u16 that comes from the user. If it's over IW_ENCODING_TOKEN_MAX (64) that could lead to memory corruption. Fixes: b121d84882b9 ("staging: ks7010: simplify calls to memcpy()") Cc: stable Signed-off-by: Zhang Shurong Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/tencent_5153B668C0283CAA15AA518325346E026A09@qq.com Signed-off-by: Greg Kroah-Hartman commit 4912649e1cf0317bf563f91655e04a303cacaf8d Author: Raphael Gallais-Pou Date: Tue Jul 18 19:20:24 2023 +0200 staging: fbtft: ili9341: use macro FBTFT_REGISTER_SPI_DRIVER Using FBTFT_REGISTER_DRIVER resolves to a NULL struct spi_device_id. This ultimately causes a warning when the module probes. Fixes it. Signed-off-by: Raphael Gallais-Pou Link: https://lore.kernel.org/r/20230718172024.67488-1-rgallaispou@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2dedcf414bb01b8d966eb445db1d181d92304fb2 Author: Guchun Chen Date: Mon Jul 24 10:42:29 2023 +0800 drm/ttm: check null pointer before accessing when swapping Add a check to avoid null pointer dereference as below: [ 90.002283] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 90.002292] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 90.002346] ? exc_general_protection+0x159/0x240 [ 90.002352] ? asm_exc_general_protection+0x26/0x30 [ 90.002357] ? ttm_bo_evict_swapout_allowable+0x322/0x5e0 [ttm] [ 90.002365] ? ttm_bo_evict_swapout_allowable+0x42e/0x5e0 [ttm] [ 90.002373] ttm_bo_swapout+0x134/0x7f0 [ttm] [ 90.002383] ? __pfx_ttm_bo_swapout+0x10/0x10 [ttm] [ 90.002391] ? lock_acquire+0x44d/0x4f0 [ 90.002398] ? ttm_device_swapout+0xa5/0x260 [ttm] [ 90.002412] ? lock_acquired+0x355/0xa00 [ 90.002416] ? do_raw_spin_trylock+0xb6/0x190 [ 90.002421] ? __pfx_lock_acquired+0x10/0x10 [ 90.002426] ? ttm_global_swapout+0x25/0x210 [ttm] [ 90.002442] ttm_device_swapout+0x198/0x260 [ttm] [ 90.002456] ? __pfx_ttm_device_swapout+0x10/0x10 [ttm] [ 90.002472] ttm_global_swapout+0x75/0x210 [ttm] [ 90.002486] ttm_tt_populate+0x187/0x3f0 [ttm] [ 90.002501] ttm_bo_handle_move_mem+0x437/0x590 [ttm] [ 90.002517] ttm_bo_validate+0x275/0x430 [ttm] [ 90.002530] ? __pfx_ttm_bo_validate+0x10/0x10 [ttm] [ 90.002544] ? kasan_save_stack+0x33/0x60 [ 90.002550] ? kasan_set_track+0x25/0x30 [ 90.002554] ? __kasan_kmalloc+0x8f/0xa0 [ 90.002558] ? amdgpu_gtt_mgr_new+0x81/0x420 [amdgpu] [ 90.003023] ? ttm_resource_alloc+0xf6/0x220 [ttm] [ 90.003038] amdgpu_bo_pin_restricted+0x2dd/0x8b0 [amdgpu] [ 90.003210] ? __x64_sys_ioctl+0x131/0x1a0 [ 90.003210] ? do_syscall_64+0x60/0x90 Fixes: a2848d08742c ("drm/ttm: never consider pinned BOs for eviction&swap") Tested-by: Mikhail Gavrilov Signed-off-by: Guchun Chen Reviewed-by: Alex Deucher Reviewed-by: Christian König Cc: stable@vger.kernel.org Link: https://patchwork.freedesktop.org/patch/msgid/20230724024229.1118444-1-guchun.chen@amd.com Signed-off-by: Christian König commit ac83631230f77dda94154ed0ebfd368fc81c70a3 Author: Larry Finger Date: Fri Jul 14 12:54:17 2023 -0500 staging: r8712: Fix memory leak in _r8712_init_xmit_priv() In the above mentioned routine, memory is allocated in several places. If the first succeeds and a later one fails, the routine will leak memory. This patch fixes commit 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel"). A potential memory leak in r8712_xmit_resource_alloc() is also addressed. Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel") Reported-by: syzbot+cf71097ffb6755df8251@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/x/log.txt?x=11ac3fa0a80000 Cc: stable@vger.kernel.org Cc: Nam Cao Signed-off-by: Larry Finger Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20230714175417.18578-1-Larry.Finger@lwfinger.net Signed-off-by: Greg Kroah-Hartman commit 8019a4ab3d80c7af391a646cccff953753fc025f Author: Pavel Asyutchenko Date: Thu Jul 27 01:37:32 2023 +0300 ALSA: hda/realtek: Support ASUS G713PV laptop This laptop has CS35L41 amp connected via I2C. With this patch speakers begin to work if the missing _DSD properties are added to ACPI tables. Signed-off-by: Pavel Asyutchenko Cc: Link: https://lore.kernel.org/r/20230726223732.20775-1-svenpavel@gmail.com Signed-off-by: Takashi Iwai commit c04e9894846c663f3278a414f34416e6e45bbe68 Author: Demi Marie Obenour Date: Wed Jul 26 12:52:41 2023 -0400 xen: speed up grant-table reclaim When a grant entry is still in use by the remote domain, Linux must put it on a deferred list. Normally, this list is very short, because the PV network and block protocols expect the backend to unmap the grant first. However, Qubes OS's GUI protocol is subject to the constraints of the X Window System, and as such winds up with the frontend unmapping the window first. As a result, the list can grow very large, resulting in a massive memory leak and eventual VM freeze. To partially solve this problem, make the number of entries that the VM will attempt to free at each iteration tunable. The default is still 10, but it can be overridden via a module parameter. This is Cc: stable because (when combined with appropriate userspace changes) it fixes a severe performance and stability problem for Qubes OS users. Cc: stable@vger.kernel.org Signed-off-by: Demi Marie Obenour Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20230726165354.1252-1-demi@invisiblethingslab.com Signed-off-by: Juergen Gross commit ff0df20827f6ac32822f9855998c4db3e99af47c Merge: 25266128fe16d 0ebc1064e4874 Author: Jakub Kicinski Date: Wed Jul 26 22:18:00 2023 -0700 Merge tag 'nf-23-07-26' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter fixes for net 1. On-demand overlap detection in 'rbtree' set can cause memory leaks. This is broken since 6.2. 2. An earlier fix in 6.4 to address an imbalance in refcounts during transaction error unwinding was incomplete, from Pablo Neira. 3. Disallow adding a rule to a deleted chain, also from Pablo. Broken since 5.9. * tag 'nf-23-07-26' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR netfilter: nft_set_rbtree: fix overlap expiration walk ==================== Link: https://lore.kernel.org/r/20230726152524.26268-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 25266128fe16d5632d43ada34c847d7b8daba539 Author: Jason Wang Date: Tue Jul 25 03:20:49 2023 -0400 virtio-net: fix race between set queues and probe A race were found where set_channels could be called after registering but before virtnet_set_queues() in virtnet_probe(). Fixing this by moving the virtnet_set_queues() before netdevice registering. While at it, use _virtnet_set_queues() to avoid holding rtnl as the device is not even registered at that time. Cc: stable@vger.kernel.org Fixes: a220871be66f ("virtio-net: correctly enable multiqueue") Signed-off-by: Jason Wang Acked-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo Link: https://lore.kernel.org/r/20230725072049.617289-1-jasowang@redhat.com Signed-off-by: Jakub Kicinski commit 6c58c8816abb7b93b21fa3b1d0c1726402e5e568 Author: Lin Ma Date: Tue Jul 25 10:42:27 2023 +0800 net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64 The nla_for_each_nested parsing in function mqprio_parse_nlattr() does not check the length of the nested attribute. This can lead to an out-of-attribute read and allow a malformed nlattr (e.g., length 0) to be viewed as 8 byte integer and passed to priv->max_rate/min_rate. This patch adds the check based on nla_len() when check the nla_type(), which ensures that the length of these two attribute must equals sizeof(u64). Fixes: 4e8b86c06269 ("mqprio: Introduce new hardware offload mode and shaper in mqprio") Reviewed-by: Victor Nogueira Signed-off-by: Lin Ma Link: https://lore.kernel.org/r/20230725024227.426561-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski commit 0f0fa27b871b53a62c3cd2b054ebcce199277310 Author: Jan Stancek Date: Mon Jul 24 19:39:04 2023 +0200 splice, net: Fix splice_to_socket() for O_NONBLOCK socket LTP sendfile07 [1], which expects sendfile() to return EAGAIN when transferring data from regular file to a "full" O_NONBLOCK socket, started failing after commit 2dc334f1a63a ("splice, net: Use sendmsg(MSG_SPLICE_PAGES) rather than ->sendpage()"). sendfile() no longer immediately returns, but now blocks. Removed sock_sendpage() handled this case by setting a MSG_DONTWAIT flag, fix new splice_to_socket() to do the same for O_NONBLOCK sockets. [1] https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/syscalls/sendfile/sendfile07.c Fixes: 2dc334f1a63a ("splice, net: Use sendmsg(MSG_SPLICE_PAGES) rather than ->sendpage()") Acked-by: David Howells Signed-off-by: Jan Stancek Tested-by: Xi Ruoyao Link: https://lore.kernel.org/r/023c0e21e595e00b93903a813bc0bfb9a5d7e368.1690219914.git.jstancek@redhat.com Signed-off-by: Jakub Kicinski commit 15cec633fc7bfe4cd69aa012c3b35b31acfc86f2 Author: Wei Fang Date: Tue Jul 25 15:41:48 2023 +0800 net: fec: tx processing does not call XDP APIs if budget is 0 According to the clarification [1] in the latest napi.rst, the tx processing cannot call any XDP (or page pool) APIs if the "budget" is 0. Because NAPI is called with the budget of 0 (such as netpoll) indicates we may be in an IRQ context, however, we cannot use the page pool from IRQ context. [1] https://lore.kernel.org/all/20230720161323.2025379-1-kuba@kernel.org/ Fixes: 20f797399035 ("net: fec: recycle pages for transmitted XDP frames") Signed-off-by: Wei Fang Suggested-by: Jakub Kicinski Link: https://lore.kernel.org/r/20230725074148.2936402-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit b84000f2274520f73ac9dc59fd9403260b61c4e7 Author: Guenter Roeck Date: Wed Jul 26 20:18:13 2023 -0700 hwmon: (pmbus_core) Fix Deadlock in pmbus_regulator_get_status pmbus_regulator_get_status() acquires update_lock. pmbus_regulator_get_error_flags() acquires it again, resulting in an immediate deadlock. Call _pmbus_get_flags() from pmbus_regulator_get_status() directly to avoid the problem. Reported-by: Patrick Rudolph Closes: https://lore.kernel.org/linux-hwmon/b7a3ad85-aab4-4718-a001-1d8b1c0eef36@roeck-us.net/T/#u Cc: Naresh Solanki Cc: stable@vger.kernel.org # v6.2+ Fixes: c05f477c4ba3 ("hwmon: (pmbus/core) Implement regulator get_status") Signed-off-by: Guenter Roeck commit 2e3c5df2ee89d01c4dc6c30b4366375d3cf942bd Merge: fa29d467977d5 21d9b73a7d524 Author: Jakub Kicinski Date: Wed Jul 26 16:48:55 2023 -0700 Merge branch 'mptcp-more-fixes-for-6-5' Mat Martineau says: ==================== mptcp: More fixes for 6.5 Patch 1: Better detection of ip6tables vs ip6tables-legacy tools for self tests. Fix for 6.4 and newer. Patch 2: Only generate "new listener" event if listen operation succeeds. Fix for 6.2 and newer. ==================== Link: https://lore.kernel.org/r/20230725-send-net-20230725-v1-0-6f60fe7137a9@kernel.org Signed-off-by: Jakub Kicinski commit 21d9b73a7d5241905367098d260a3c68b811da32 Author: Paolo Abeni Date: Tue Jul 25 11:34:56 2023 -0700 mptcp: more accurate NL event generation Currently the mptcp code generate a "new listener" event even if the actual listen() syscall fails. Address the issue moving the event generation call under the successful branch. Cc: stable@vger.kernel.org Fixes: f8c9dfbd875b ("mptcp: add pm listener events") Reviewed-by: Mat Martineau Signed-off-by: Paolo Abeni Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20230725-send-net-20230725-v1-2-6f60fe7137a9@kernel.org Signed-off-by: Jakub Kicinski commit 016e7ba47f33064fbef8c4307a2485d2669dfd03 Author: Matthieu Baerts Date: Tue Jul 25 11:34:55 2023 -0700 selftests: mptcp: join: only check for ip6tables if needed If 'iptables-legacy' is available, 'ip6tables-legacy' command will be used instead of 'ip6tables'. So no need to look if 'ip6tables' is available in this case. Cc: stable@vger.kernel.org Fixes: 0c4cd3f86a40 ("selftests: mptcp: join: use 'iptables-legacy' if available") Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20230725-send-net-20230725-v1-1-6f60fe7137a9@kernel.org Signed-off-by: Jakub Kicinski commit a8f014ec6a214c94ed6a9ff5ba8904a5cadd42a6 Author: Kees Cook Date: Thu Jul 20 08:15:06 2023 -0700 vboxsf: Use flexible arrays for trailing string member The declaration of struct shfl_string used trailing fake flexible arrays for the string member. This was tripping FORTIFY_SOURCE since commit df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3"). Replace the utf8 and utf16 members with actual flexible arrays, drop the unused ucs2 member, and retriain a 2 byte padding to keep the structure size the same. Reported-by: Larry Finger Closes: https://lore.kernel.org/lkml/ab3a70e9-60ed-0f13-e3d4-8866eaccc8c1@lwfinger.net/ Tested-by: Larry Finger Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20230720151458.never.673-kees@kernel.org Signed-off-by: Kees Cook commit 53d737dfd3d7b023fa9fa445ea3f3db0ac9da402 Author: Shay Drory Date: Sun Jun 25 11:07:38 2023 +0300 net/mlx5: Unregister devlink params in case interface is down Currently, in case an interface is down, mlx5 driver doesn't unregister its devlink params, which leads to this WARN[1]. Fix it by unregistering devlink params in that case as well. [1] [ 295.244769 ] WARNING: CPU: 15 PID: 1 at net/core/devlink.c:9042 devlink_free+0x174/0x1fc [ 295.488379 ] CPU: 15 PID: 1 Comm: shutdown Tainted: G S OE 5.15.0-1017.19.3.g0677e61-bluefield #g0677e61 [ 295.509330 ] Hardware name: https://www.mellanox.com BlueField SoC/BlueField SoC, BIOS 4.2.0.12761 Jun 6 2023 [ 295.543096 ] pc : devlink_free+0x174/0x1fc [ 295.551104 ] lr : mlx5_devlink_free+0x18/0x2c [mlx5_core] [ 295.561816 ] sp : ffff80000809b850 [ 295.711155 ] Call trace: [ 295.716030 ] devlink_free+0x174/0x1fc [ 295.723346 ] mlx5_devlink_free+0x18/0x2c [mlx5_core] [ 295.733351 ] mlx5_sf_dev_remove+0x98/0xb0 [mlx5_core] [ 295.743534 ] auxiliary_bus_remove+0x2c/0x50 [ 295.751893 ] __device_release_driver+0x19c/0x280 [ 295.761120 ] device_release_driver+0x34/0x50 [ 295.769649 ] bus_remove_device+0xdc/0x170 [ 295.777656 ] device_del+0x17c/0x3a4 [ 295.784620 ] mlx5_sf_dev_remove+0x28/0xf0 [mlx5_core] [ 295.794800 ] mlx5_sf_dev_table_destroy+0x98/0x110 [mlx5_core] [ 295.806375 ] mlx5_unload+0x34/0xd0 [mlx5_core] [ 295.815339 ] mlx5_unload_one+0x70/0xe4 [mlx5_core] [ 295.824998 ] shutdown+0xb0/0xd8 [mlx5_core] [ 295.833439 ] pci_device_shutdown+0x3c/0xa0 [ 295.841651 ] device_shutdown+0x170/0x340 [ 295.849486 ] __do_sys_reboot+0x1f4/0x2a0 [ 295.857322 ] __arm64_sys_reboot+0x2c/0x40 [ 295.865329 ] invoke_syscall+0x78/0x100 [ 295.872817 ] el0_svc_common.constprop.0+0x54/0x184 [ 295.882392 ] do_el0_svc+0x30/0xac [ 295.889008 ] el0_svc+0x48/0x160 [ 295.895278 ] el0t_64_sync_handler+0xa4/0x130 [ 295.903807 ] el0t_64_sync+0x1a4/0x1a8 [ 295.911120 ] ---[ end trace 4f1d2381d00d9dce ]--- Fixes: fe578cbb2f05 ("net/mlx5: Move devlink registration before mlx5_load") Signed-off-by: Shay Drory Reviewed-by: Maher Sanalla Signed-off-by: Saeed Mahameed commit 62752c0bc67f79f064cbe2605054f99d52809e7b Author: Shay Drory Date: Wed Jun 14 09:03:32 2023 +0300 net/mlx5: DR, Fix peer domain namespace setting The offending patch is based on the assumption that for PFs, mlx5_get_dev_index() is the same as vhca_id. However, this assumption is wrong in case of DPU (ECPF). Fix it by using vhca_id directly, and switch the array of peers to xarray. Fixes: 6d5b7321d8af ("net/mlx5: DR, handle more than one peer domain") Signed-off-by: Shay Drory Reviewed-by: Yevgeny Kliteynik Signed-off-by: Saeed Mahameed commit 61eab651f6e96791cfad6db45f1107c398699b2d Author: Chris Mi Date: Mon Jul 17 08:32:51 2023 +0300 net/mlx5: fs_chains: Fix ft prio if ignore_flow_level is not supported The cited commit sets ft prio to fs_base_prio. But if ignore_flow_level it not supported, ft prio must be set based on tc filter prio. Otherwise, all the ft prio are the same on the same chain. It is invalid if ignore_flow_level is not supported. Fix it by setting ft prio based on tc filter prio and setting fs_base_prio to 0 for fdb. Fixes: 8e80e5648092 ("net/mlx5: fs_chains: Refactor to detach chains from tc usage") Signed-off-by: Chris Mi Reviewed-by: Paul Blakey Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 3e4cf1dd2ce413f4be3e2c9062fb470e2ad2be88 Author: Jianbo Liu Date: Mon May 8 03:36:10 2023 +0000 net/mlx5e: kTLS, Fix protection domain in use syndrome when devlink reload There are DEK objects cached in DEK pool after kTLS is used, and they are freed only in mlx5e_ktls_cleanup(). mlx5e_destroy_mdev_resources() is called in mlx5e_suspend() to free mdev resources, including protection domain (PD). However, PD is still referenced by the cached DEK objects in this case, because profile->cleanup() (and therefore mlx5e_ktls_cleanup()) is called after mlx5e_suspend() during devlink reload. So the following FW syndrome is generated: mlx5_cmd_out_err:803:(pid 12948): DEALLOC_PD(0x801) op_mod(0x0) failed, status bad resource state(0x9), syndrome (0xef0c8a), err(-22) To avoid this syndrome, move DEK pool destruction to mlx5e_ktls_cleanup_tx(), which is called by profile->cleanup_tx(). And move pool creation to mlx5e_ktls_init_tx() for symmetry. Fixes: f741db1a5171 ("net/mlx5e: kTLS, Improve connection rate by using fast update encryption key") Signed-off-by: Jianbo Liu Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit eb02b93aad952008f1692cee5c5b13001e908407 Author: Vlad Buslov Date: Tue Jun 27 09:26:56 2023 +0200 net/mlx5: Bridge, set debugfs access right to root-only As suggested during code review set the access rights for bridge 'fdb' debugfs file to root-only. Fixes: 791eb78285e8 ("net/mlx5: Bridge, expose FDB state via debugfs") Reported-by: Jakub Kicinski Link: https://lore.kernel.org/netdev/20230619120515.5045132a@kernel.org/ Signed-off-by: Vlad Buslov Reviewed-by: Gal Pressman Signed-off-by: Saeed Mahameed commit 39646d9bcd1a65d2396328026626859a1dab59d7 Author: Dragos Tatulea Date: Mon Apr 24 18:19:00 2023 +0300 net/mlx5e: xsk: Fix crash on regular rq reactivation When the regular rq is reactivated after the XSK socket is closed it could be reading stale cqes which eventually corrupts the rq. This leads to no more traffic being received on the regular rq and a crash on the next close or deactivation of the rq. Kal Cuttler Conely reported this issue as a crash on the release path when the xdpsock sample program is stopped (killed) and restarted in sequence while traffic is running. This patch flushes all cqes when during the rq flush. The cqe flushing is done in the reset state of the rq. mlx5e_rq_to_ready code is moved into the flush function to allow for this. Fixes: 082a9edf12fe ("net/mlx5e: xsk: Flush RQ on XSK activation to save memory") Reported-by: Kal Cutter Conley Closes: https://lore.kernel.org/xdp-newbies/CAHApi-nUAs4TeFWUDV915CZJo07XVg2Vp63-no7UDfj6wur9nQ@mail.gmail.com Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit e0f52298fee449fec37e3e3c32df60008b509b16 Author: Dragos Tatulea Date: Tue Jul 18 11:13:33 2023 +0300 net/mlx5e: xsk: Fix invalid buffer access for legacy rq The below crash can be encountered when using xdpsock in rx mode for legacy rq: the buffer gets released in the XDP_REDIRECT path, and then once again in the driver. This fix sets the flag to avoid releasing on the driver side. XSK handling of buffers for legacy rq was relying on the caller to set the skip release flag. But the referenced fix started using fragment counts for pages instead of the skip flag. Crash log: general protection fault, probably for non-canonical address 0xffff8881217e3a: 0000 [#1] SMP CPU: 0 PID: 14 Comm: ksoftirqd/0 Not tainted 6.5.0-rc1+ #31 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:bpf_prog_03b13f331978c78c+0xf/0x28 Code: ... RSP: 0018:ffff88810082fc98 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888138404901 RCX: c0ffffc900027cbc RDX: ffffffffa000b514 RSI: 00ffff8881217e32 RDI: ffff888138404901 RBP: ffff88810082fc98 R08: 0000000000091100 R09: 0000000000000006 R10: 0000000000000800 R11: 0000000000000800 R12: ffffc9000027a000 R13: ffff8881217e2dc0 R14: ffff8881217e2910 R15: ffff8881217e2f00 FS: 0000000000000000(0000) GS:ffff88852c800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564cb2e2cde0 CR3: 000000010e603004 CR4: 0000000000370eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? die_addr+0x32/0x80 ? exc_general_protection+0x192/0x390 ? asm_exc_general_protection+0x22/0x30 ? 0xffffffffa000b514 ? bpf_prog_03b13f331978c78c+0xf/0x28 mlx5e_xdp_handle+0x48/0x670 [mlx5_core] ? dev_gro_receive+0x3b5/0x6e0 mlx5e_xsk_skb_from_cqe_linear+0x6e/0x90 [mlx5_core] mlx5e_handle_rx_cqe+0x55/0x100 [mlx5_core] mlx5e_poll_rx_cq+0x87/0x6e0 [mlx5_core] mlx5e_napi_poll+0x45e/0x6b0 [mlx5_core] __napi_poll+0x25/0x1a0 net_rx_action+0x28a/0x300 __do_softirq+0xcd/0x279 ? sort_range+0x20/0x20 run_ksoftirqd+0x1a/0x20 smpboot_thread_fn+0xa2/0x130 kthread+0xc9/0xf0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 Modules linked in: mlx5_ib mlx5_core rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter overlay zram zsmalloc fuse [last unloaded: mlx5_core] ---[ end trace 0000000000000000 ]--- Fixes: 7abd955a58fb ("net/mlx5e: RX, Fix page_pool page fragment tracking for XDP") Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit d03b6e6f31820b84f7449cca022047f36c42bc3f Author: Jianbo Liu Date: Mon Jul 3 08:28:16 2023 +0000 net/mlx5e: Move representor neigh cleanup to profile cleanup_tx For IP tunnel encapsulation in ECMP (Equal-Cost Multipath) mode, as the flow is duplicated to the peer eswitch, the related neighbour information on the peer uplink representor is created as well. In the cited commit, eswitch devcom unpair is moved to uplink unload API, specifically the profile->cleanup_tx. If there is a encap rule offloaded in ECMP mode, when one eswitch does unpair (because of unloading the driver, for instance), and the peer rule from the peer eswitch is going to be deleted, the use-after-free error is triggered while accessing neigh info, as it is already cleaned up in uplink's profile->disable, which is before its profile->cleanup_tx. To fix this issue, move the neigh cleanup to profile's cleanup_tx callback, and after mlx5e_cleanup_uplink_rep_tx is called. The neigh init is moved to init_tx for symmeter. [ 2453.376299] BUG: KASAN: slab-use-after-free in mlx5e_rep_neigh_entry_release+0x109/0x3a0 [mlx5_core] [ 2453.379125] Read of size 4 at addr ffff888127af9008 by task modprobe/2496 [ 2453.381542] CPU: 7 PID: 2496 Comm: modprobe Tainted: G B 6.4.0-rc7+ #15 [ 2453.383386] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 2453.384335] Call Trace: [ 2453.384625] [ 2453.384891] dump_stack_lvl+0x33/0x50 [ 2453.385285] print_report+0xc2/0x610 [ 2453.385667] ? __virt_addr_valid+0xb1/0x130 [ 2453.386091] ? mlx5e_rep_neigh_entry_release+0x109/0x3a0 [mlx5_core] [ 2453.386757] kasan_report+0xae/0xe0 [ 2453.387123] ? mlx5e_rep_neigh_entry_release+0x109/0x3a0 [mlx5_core] [ 2453.387798] mlx5e_rep_neigh_entry_release+0x109/0x3a0 [mlx5_core] [ 2453.388465] mlx5e_rep_encap_entry_detach+0xa6/0xe0 [mlx5_core] [ 2453.389111] mlx5e_encap_dealloc+0xa7/0x100 [mlx5_core] [ 2453.389706] mlx5e_tc_tun_encap_dests_unset+0x61/0xb0 [mlx5_core] [ 2453.390361] mlx5_free_flow_attr_actions+0x11e/0x340 [mlx5_core] [ 2453.391015] ? complete_all+0x43/0xd0 [ 2453.391398] ? free_flow_post_acts+0x38/0x120 [mlx5_core] [ 2453.392004] mlx5e_tc_del_fdb_flow+0x4ae/0x690 [mlx5_core] [ 2453.392618] mlx5e_tc_del_fdb_peers_flow+0x308/0x370 [mlx5_core] [ 2453.393276] mlx5e_tc_clean_fdb_peer_flows+0xf5/0x140 [mlx5_core] [ 2453.393925] mlx5_esw_offloads_unpair+0x86/0x540 [mlx5_core] [ 2453.394546] ? mlx5_esw_offloads_set_ns_peer.isra.0+0x180/0x180 [mlx5_core] [ 2453.395268] ? down_write+0xaa/0x100 [ 2453.395652] mlx5_esw_offloads_devcom_event+0x203/0x530 [mlx5_core] [ 2453.396317] mlx5_devcom_send_event+0xbb/0x190 [mlx5_core] [ 2453.396917] mlx5_esw_offloads_devcom_cleanup+0xb0/0xd0 [mlx5_core] [ 2453.397582] mlx5e_tc_esw_cleanup+0x42/0x120 [mlx5_core] [ 2453.398182] mlx5e_rep_tc_cleanup+0x15/0x30 [mlx5_core] [ 2453.398768] mlx5e_cleanup_rep_tx+0x6c/0x80 [mlx5_core] [ 2453.399367] mlx5e_detach_netdev+0xee/0x120 [mlx5_core] [ 2453.399957] mlx5e_netdev_change_profile+0x84/0x170 [mlx5_core] [ 2453.400598] mlx5e_vport_rep_unload+0xe0/0xf0 [mlx5_core] [ 2453.403781] mlx5_eswitch_unregister_vport_reps+0x15e/0x190 [mlx5_core] [ 2453.404479] ? mlx5_eswitch_register_vport_reps+0x200/0x200 [mlx5_core] [ 2453.405170] ? up_write+0x39/0x60 [ 2453.405529] ? kernfs_remove_by_name_ns+0xb7/0xe0 [ 2453.405985] auxiliary_bus_remove+0x2e/0x40 [ 2453.406405] device_release_driver_internal+0x243/0x2d0 [ 2453.406900] ? kobject_put+0x42/0x2d0 [ 2453.407284] bus_remove_device+0x128/0x1d0 [ 2453.407687] device_del+0x240/0x550 [ 2453.408053] ? waiting_for_supplier_show+0xe0/0xe0 [ 2453.408511] ? kobject_put+0xfa/0x2d0 [ 2453.408889] ? __kmem_cache_free+0x14d/0x280 [ 2453.409310] mlx5_rescan_drivers_locked.part.0+0xcd/0x2b0 [mlx5_core] [ 2453.409973] mlx5_unregister_device+0x40/0x50 [mlx5_core] [ 2453.410561] mlx5_uninit_one+0x3d/0x110 [mlx5_core] [ 2453.411111] remove_one+0x89/0x130 [mlx5_core] [ 2453.411628] pci_device_remove+0x59/0xf0 [ 2453.412026] device_release_driver_internal+0x243/0x2d0 [ 2453.412511] ? parse_option_str+0x14/0x90 [ 2453.412915] driver_detach+0x7b/0xf0 [ 2453.413289] bus_remove_driver+0xb5/0x160 [ 2453.413685] pci_unregister_driver+0x3f/0xf0 [ 2453.414104] mlx5_cleanup+0xc/0x20 [mlx5_core] Fixes: 2be5bd42a5bb ("net/mlx5: Handle pairing of E-switch via uplink un/load APIs") Signed-off-by: Jianbo Liu Reviewed-by: Vlad Buslov Signed-off-by: Saeed Mahameed commit 3ec43c1b082a8804472430e1253544d75f4b540e Author: Amir Tzin Date: Tue May 30 20:11:14 2023 +0300 net/mlx5e: Fix crash moving to switchdev mode when ntuple offload is set Moving to switchdev mode with ntuple offload on causes the kernel to crash since fs->arfs is freed during nic profile cleanup flow. Ntuple offload is not supported in switchdev mode and it is already unset by mlx5 fix feature ndo in switchdev mode. Verify fs->arfs is valid before disabling it. trace: [] RIP: 0010:_raw_spin_lock_bh+0x17/0x30 [] arfs_del_rules+0x44/0x1a0 [mlx5_core] [] mlx5e_arfs_disable+0xe/0x20 [mlx5_core] [] mlx5e_handle_feature+0x3d/0xb0 [mlx5_core] [] ? __rtnl_unlock+0x25/0x50 [] mlx5e_set_features+0xfe/0x160 [mlx5_core] [] __netdev_update_features+0x278/0xa50 [] ? netdev_run_todo+0x5e/0x2a0 [] netdev_update_features+0x22/0x70 [] ? _cond_resched+0x15/0x30 [] mlx5e_attach_netdev+0x12a/0x1e0 [mlx5_core] [] mlx5e_netdev_attach_profile+0xa1/0xc0 [mlx5_core] [] mlx5e_netdev_change_profile+0x77/0xe0 [mlx5_core] [] mlx5e_vport_rep_load+0x1ed/0x290 [mlx5_core] [] mlx5_esw_offloads_rep_load+0x88/0xd0 [mlx5_core] [] esw_offloads_load_rep.part.38+0x31/0x50 [mlx5_core] [] esw_offloads_enable+0x6c5/0x710 [mlx5_core] [] mlx5_eswitch_enable_locked+0x1bb/0x290 [mlx5_core] [] mlx5_devlink_eswitch_mode_set+0x14f/0x320 [mlx5_core] [] devlink_nl_cmd_eswitch_set_doit+0x94/0x120 [] genl_family_rcv_msg_doit.isra.17+0x113/0x150 [] genl_family_rcv_msg+0xb7/0x170 [] ? devlink_nl_cmd_port_split_doit+0x100/0x100 [] genl_rcv_msg+0x47/0xa0 [] ? genl_family_rcv_msg+0x170/0x170 [] netlink_rcv_skb+0x4c/0x130 [] genl_rcv+0x24/0x40 [] netlink_unicast+0x19a/0x230 [] netlink_sendmsg+0x204/0x3d0 [] sock_sendmsg+0x50/0x60 Fixes: 90b22b9bcd24 ("net/mlx5e: Disable Rx ntuple offload for uplink representor") Signed-off-by: Amir Tzin Reviewed-by: Aya Levin Signed-off-by: Saeed Mahameed commit 93a331939d1d1c6c3422bc09ec43cac658594b34 Author: Chris Mi Date: Thu Jun 29 11:32:03 2023 +0300 net/mlx5e: Don't hold encap tbl lock if there is no encap action The cited commit holds encap tbl lock unconditionally when setting up dests. But it may cause the following deadlock: PID: 1063722 TASK: ffffa062ca5d0000 CPU: 13 COMMAND: "handler8" #0 [ffffb14de05b7368] __schedule at ffffffffa1d5aa91 #1 [ffffb14de05b7410] schedule at ffffffffa1d5afdb #2 [ffffb14de05b7430] schedule_preempt_disabled at ffffffffa1d5b528 #3 [ffffb14de05b7440] __mutex_lock at ffffffffa1d5d6cb #4 [ffffb14de05b74e8] mutex_lock_nested at ffffffffa1d5ddeb #5 [ffffb14de05b74f8] mlx5e_tc_tun_encap_dests_set at ffffffffc12f2096 [mlx5_core] #6 [ffffb14de05b7568] post_process_attr at ffffffffc12d9fc5 [mlx5_core] #7 [ffffb14de05b75a0] mlx5e_tc_add_fdb_flow at ffffffffc12de877 [mlx5_core] #8 [ffffb14de05b75f0] __mlx5e_add_fdb_flow at ffffffffc12e0eef [mlx5_core] #9 [ffffb14de05b7660] mlx5e_tc_add_flow at ffffffffc12e12f7 [mlx5_core] #10 [ffffb14de05b76b8] mlx5e_configure_flower at ffffffffc12e1686 [mlx5_core] #11 [ffffb14de05b7720] mlx5e_rep_indr_offload at ffffffffc12e3817 [mlx5_core] #12 [ffffb14de05b7730] mlx5e_rep_indr_setup_tc_cb at ffffffffc12e388a [mlx5_core] #13 [ffffb14de05b7740] tc_setup_cb_add at ffffffffa1ab2ba8 #14 [ffffb14de05b77a0] fl_hw_replace_filter at ffffffffc0bdec2f [cls_flower] #15 [ffffb14de05b7868] fl_change at ffffffffc0be6caa [cls_flower] #16 [ffffb14de05b7908] tc_new_tfilter at ffffffffa1ab71f0 [1031218.028143] wait_for_completion+0x24/0x30 [1031218.028589] mlx5e_update_route_decap_flows+0x9a/0x1e0 [mlx5_core] [1031218.029256] mlx5e_tc_fib_event_work+0x1ad/0x300 [mlx5_core] [1031218.029885] process_one_work+0x24e/0x510 Actually no need to hold encap tbl lock if there is no encap action. Fix it by checking if encap action exists or not before holding encap tbl lock. Fixes: 37c3b9fa7ccf ("net/mlx5e: Prevent encap offload when neigh update is running") Signed-off-by: Chris Mi Reviewed-by: Vlad Buslov Signed-off-by: Saeed Mahameed commit 0507f2c8be0d345fe7014147c027cea6dc1c00a4 Author: Shay Drory Date: Mon Jul 3 17:34:44 2023 +0300 net/mlx5: Honor user input for migratable port fn attr Currently, whenever a user is setting migratable port fn attr, the driver is always turn migratable capability on. Fix it by honor the user input Fixes: e5b9642a33be ("net/mlx5: E-Switch, Implement devlink port function cmds to control migratable") Signed-off-by: Shay Drory Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit e5bcb7564d3bd0c88613c76963c5349be9c511c5 Author: Yuanjun Gong Date: Tue Jul 25 14:56:55 2023 +0800 net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer() mlx5e_ipsec_remove_trailer() should return an error code if function pskb_trim() returns an unexpected value. Fixes: 2ac9cfe78223 ("net/mlx5e: IPSec, Add Innova IPSec offload TX data path") Signed-off-by: Yuanjun Gong Reviewed-by: Leon Romanovsky Signed-off-by: Saeed Mahameed commit c6cf0b6097bf1bf1b2a89b521e9ecd26b581a93a Author: Zhengchao Shao Date: Sat Jul 8 15:13:07 2023 +0800 net/mlx5: fix potential memory leak in mlx5e_init_rep_rx The memory pointed to by the priv->rx_res pointer is not freed in the error path of mlx5e_init_rep_rx, which can lead to a memory leak. Fix by freeing the memory in the error path, thereby making the error path identical to mlx5e_cleanup_rep_rx(). Fixes: af8bbf730068 ("net/mlx5e: Convert mlx5e_flow_steering member of mlx5e_priv to pointer") Signed-off-by: Zhengchao Shao Reviewed-by: Simon Horman Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 5dd77585dd9d0e03dd1bceb95f0269a7eaf6b936 Author: Zhengchao Shao Date: Wed Jul 5 20:15:27 2023 +0800 net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx when mlx5_cmd_exec failed in mlx5dr_cmd_create_reformat_ctx, the memory pointed by 'in' is not released, which will cause memory leak. Move memory release after mlx5_cmd_exec. Fixes: 1d9186476e12 ("net/mlx5: DR, Add direct rule command utilities") Signed-off-by: Zhengchao Shao Reviewed-by: Leon Romanovsky Signed-off-by: Saeed Mahameed commit aeb660171b0663847fa04806a96302ac6112ad26 Author: Zhengchao Shao Date: Tue Jul 4 15:06:40 2023 +0800 net/mlx5e: fix double free in macsec_fs_tx_create_crypto_table_groups In function macsec_fs_tx_create_crypto_table_groups(), when the ft->g memory is successfully allocated but the 'in' memory fails to be allocated, the memory pointed to by ft->g is released once. And in function macsec_fs_tx_create(), macsec_fs_tx_destroy() is called to release the memory pointed to by ft->g again. This will cause double free problem. Fixes: e467b283ffd5 ("net/mlx5e: Add MACsec TX steering rules") Signed-off-by: Zhengchao Shao Reviewed-by: Simon Horman Reviewed-by: Leon Romanovsky Signed-off-by: Saeed Mahameed commit a171eb5cac427fa8d084eaf5e47fbe4c0f1e279f Author: Shyam Prasad N Date: Wed Jul 26 17:02:11 2023 +0000 cifs: add missing return value check for cifs_sb_tlink Whenever a tlink is obtained by cifs_sb_tlink, we need to check that the tlink returned is not an error. It was missing with the last change here. Fixes: b3edef6b9cd0 ("cifs: allow dumping keys for directories too") Reported-by: Dan Carpenter Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit fa29d467977d50400f6bb1374e942e7474fdf53c Merge: d4a7ce6421007 df15c15e6c987 Author: Jakub Kicinski Date: Wed Jul 26 13:38:29 2023 -0700 Merge branch 'tools-ynl-gen-fix-parse-multi-attr-enum-attribute' Arkadiusz Kubalewski says: ==================== tools: ynl-gen: fix parse multi-attr enum attribute Fix the issues with parsing enums in ynl.py script. ==================== Link: https://lore.kernel.org/r/20230725101642.267248-1-arkadiusz.kubalewski@intel.com Signed-off-by: Jakub Kicinski commit df15c15e6c987a32ecbafe011ffae8a53c84cb4f Author: Arkadiusz Kubalewski Date: Tue Jul 25 12:16:42 2023 +0200 tools: ynl-gen: fix parse multi-attr enum attribute When attribute is enum type and marked as multi-attr, the netlink respond is not parsed, fails with stack trace: Traceback (most recent call last): File "/net-next/tools/net/ynl/./test.py", line 520, in main() File "/net-next/tools/net/ynl/./test.py", line 488, in main dplls=dplls_get(282574471561216) File "/net-next/tools/net/ynl/./test.py", line 48, in dplls_get reply=act(args) File "/net-next/tools/net/ynl/./test.py", line 41, in act reply = ynl.dump(args.dump, attrs) File "/net-next/tools/net/ynl/lib/ynl.py", line 598, in dump return self._op(method, vals, dump=True) File "/net-next/tools/net/ynl/lib/ynl.py", line 584, in _op rsp_msg = self._decode(gm.raw_attrs, op.attr_set.name) File "/net-next/tools/net/ynl/lib/ynl.py", line 451, in _decode self._decode_enum(rsp, attr_spec) File "/net-next/tools/net/ynl/lib/ynl.py", line 408, in _decode_enum value = enum.entries_by_val[raw].name TypeError: unhashable type: 'list' error: 1 Redesign _decode_enum(..) to take a enum int value and translate it to either a bitmask or enum name as expected. Signed-off-by: Arkadiusz Kubalewski Reviewed-by: Donald Hunter Link: https://lore.kernel.org/r/20230725101642.267248-3-arkadiusz.kubalewski@intel.com Reviewed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski commit d7ddf5f4269fcaf19aafe971e635d91897423a3a Author: Arkadiusz Kubalewski Date: Tue Jul 25 12:16:41 2023 +0200 tools: ynl-gen: fix enum index in _decode_enum(..) Remove wrong index adjustment, which is leftover from adding support for sparse enums. enum.entries_by_val() function shall not subtract the start-value, as it is indexed with real enum value. Fixes: c311aaa74ca1 ("tools: ynl: fix enum-as-flags in the generic CLI") Signed-off-by: Arkadiusz Kubalewski Reviewed-by: Donald Hunter Link: https://lore.kernel.org/r/20230725101642.267248-2-arkadiusz.kubalewski@intel.com Reviewed-by: Jakub Kicinski Signed-off-by: Jakub Kicinski commit ae9b14582ad03abb3db66ba3f8dc5ca443ff54a1 Merge: e7dd44f4f3166 6e2acbfe59b83 Author: Stephen Boyd Date: Wed Jul 26 11:47:57 2023 -0700 Merge tag 'clk-meson-fixes-v6.5-1' of https://github.com/BayLibre/clk-meson into clk-fixes Pull an Amlogic clk driver fix from Jerome Brunet: - Fix PLL scheduling while atomic following a1 locking sequence update * tag 'clk-meson-fixes-v6.5-1' of https://github.com/BayLibre/clk-meson: clk: meson: change usleep_range() to udelay() for atomic context commit 0a8db05b571ad5b8d5c8774a004c0424260a90bd Merge: f40125c0a1609 c21733754cd6e Author: Linus Torvalds Date: Wed Jul 26 11:37:34 2023 -0700 Merge tag 'platform-drivers-x86-v6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: "Misc small fixes and hw-id additions" * tag 'platform-drivers-x86-v6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: huawei-wmi: Silence ambient light sensor platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100 platform/x86: asus-wmi: Fix setting RGB mode on some TUF laptops platform/x86: think-lmi: Use kfree_sensitive instead of kfree platform/x86/intel/hid: Add HP Dragonfly G2 to VGBS DMI quirks platform/x86: intel: hid: Always call BTNL ACPI method platform/x86/amd/pmf: Notify OS power slider update platform/x86/amd/pmf: reduce verbosity of apmf_get_system_params platform/x86: serial-multi-instantiate: Auto detect IRQ resource for CSC3551 platform/x86/amd: pmc: Use release_mem_region() to undo request_mem_region_muxed() platform/x86: touchscreen_dmi.c: small changes for Archos 101 Cesium Educ tablet commit f40125c0a160912ee3ac8def2f7de5bacb80df50 Merge: 5f0bc0b042fc7 536bb492d39bb Author: Linus Torvalds Date: Wed Jul 26 11:20:36 2023 -0700 Merge tag '6.5-rc3-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull ksmbd server fixes from Steve French: - fixes for two possible out of bounds access (in negotiate, and in decrypt msg) - fix unsigned compared to zero warning - fix path lookup crossing a mountpoint - fix case when first compound request is a tree connect - fix memory leak if reads are compounded * tag '6.5-rc3-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix out of bounds in init_smb2_rsp_hdr() ksmbd: no response from compound read ksmbd: validate session id and tree id in compound request ksmbd: fix out of bounds in smb3_decrypt_req() ksmbd: check if a mount point is crossed during path lookup ksmbd: Fix unsigned expression compared with zero commit f7fea075edfa085c25eb34c44ceacf3602537f98 Author: Jussi Laako Date: Wed Jul 26 19:56:45 2023 +0300 ALSA: usb-audio: Update for native DSD support quirks Maintenance patch for native DSD support. Remove incorrect T+A device quirks. Move set of device quirks to vendor quirks. Add set of missing device and vendor quirks. Signed-off-by: Jussi Laako Link: https://lore.kernel.org/r/20230726165645.404311-1-jussi@sonarnerd.net Signed-off-by: Takashi Iwai commit 5f0bc0b042fc77ff70e14c790abdec960cde4ec1 Author: Linus Torvalds Date: Tue Jul 25 09:38:32 2023 -0700 mm: suppress mm fault logging if fatal signal already pending Commit eda0047296a1 ("mm: make the page fault mmap locking killable") intentionally made it much easier to trigger the "page fault fails because a fatal signal is pending" situation, by having the mmap locking fail early in that case. We have long aborted page faults in other fatal cases when the actual IO for a page is interrupted by SIGKILL - which is particularly useful for the traditional case of NFS hanging due to network issues, but local filesystems could cause it too if you happened to get the SIGKILL while waiting for a page to be faulted in (eg lock_folio_maybe_drop_mmap()). So aborting the page fault wasn't a new condition - but it now triggers earlier, before we even get to 'handle_mm_fault()'. And as a result the error doesn't go through our 'fault_signal_pending()' logic, and doesn't get filtered away there. Normally you'd never even notice, because if a fatal signal is pending, the new SIGSEGV we send ends up being ignored anyway. But it turns out that there is one very noticeable exception: if you enable 'show_unhandled_signals', the aborted page fault will be logged in the kernel messages, and you'll get a scary line looking something like this in your logs: pverados[2183248]: segfault at 55e5a00f9ae0 ip 000055e5a00f9ae0 sp 00007ffc0720bea8 error 14 in perl[55e5a00d4000+195000] likely on CPU 10 (core 4, socket 0) which is rather misleading. It's not really a segfault at all, it's just "the thread was killed before the page fault completed, so we aborted the page fault". Fix this by just making it clear that a pending fatal signal means that any new signal coming in after that is implicitly handled. This will avoid the misleading logging, since now the signal isn't 'unhandled' any more. Reported-and-tested-by: Fiona Ebner Tested-by: Thomas Lamprecht Link: https://lore.kernel.org/lkml/8d063a26-43f5-0bb7-3203-c6a04dc159f8@proxmox.com/ Acked-by: Oleg Nesterov Fixes: eda0047296a1 ("mm: make the page fault mmap locking killable") Signed-off-by: Linus Torvalds commit 1b5d0ddcb34a605835051ae2950d5cfed0373dd8 Author: Rob Clark Date: Mon Jul 24 13:30:21 2023 -0700 drm/msm: Disallow submit with fence id 0 A fence id of zero is expected to be invalid, and is not removed from the fence_idr table. If userspace is requesting to specify the fence id with the FENCE_SN_IN flag, we need to reject a zero fence id value. Fixes: 17154addc5c1 ("drm/msm: Add MSM_SUBMIT_FENCE_SN_IN") Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/549180/ commit 05d881b85b48c7ac6a7c92ce00aa916c4a84d052 Author: Mark Brown Date: Wed Jul 26 13:12:26 2023 +0100 arm64/sme: Set new vector length before reallocating As part of fixing the allocation of the buffer for SVE state when changing SME vector length we introduced an immediate reallocation of the SVE state, this is also done when changing the SVE vector length for consistency. Unfortunately this reallocation is done prior to writing the new vector length to the task struct, meaning the allocation is done with the old vector length and can lead to memory corruption due to an undersized buffer being used. Move the update of the vector length before the allocation to ensure that the new vector length is taken into account. For some reason this isn't triggering any problems when running tests on the arm64 fixes branch (even after repeated tries) but is triggering issues very often after merge into mainline. Fixes: d4d5be94a878 ("arm64/fpsimd: Ensure SME storage is allocated after SVE VL changes") Signed-off-by: Mark Brown Cc: Link: https://lore.kernel.org/r/20230726-arm64-fix-sme-fix-v1-1-7752ec58af27@kernel.org Signed-off-by: Catalin Marinas commit 3421ddbe6d64e55b76a67d57cef9e950b3d873ba Author: Mark Brown Date: Mon Jul 24 14:09:19 2023 +0100 arm64/fpsimd: Don't flush SME register hardware state along with thread We recently changed the fpsimd thread flush to flush the physical SME state as well as the thread state for the current thread. Unfortunately this leads to intermittent corruption in interaction with the lazy FPSIMD register switching. When under heavy load such as can be triggered by the startup phase of fp-stress it is possible that the current thread may not be scheduled prior to returning to userspace, and indeed we may end up returning to the last thread that was scheduled on the PE without ever exiting the kernel to any other task. If that happens then we will not reload the register state from memory, leading to loss of any SME register state. Since this was purely an attempt to defensively close off potential problems revert the change. Fixes: af3215fd0230 ("arm64/fpsimd: Exit streaming mode when flushing tasks") Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230724-arm64-dont-flush-smstate-v1-1-9a8b637ace6c@kernel.org Signed-off-by: Catalin Marinas commit 01b94b0f3922039f7d3e0d1eeb33b8891746b65f Author: Arnd Bergmann Date: Mon Jul 24 14:18:42 2023 +0200 KVM: arm64: fix __kvm_host_psci_cpu_entry() prototype The kvm_host_psci_cpu_entry() function was renamed in order to add a wrapper around it, but the prototype did not change, so now the missing-prototype warning came back in W=1 builds: arch/arm64/kvm/hyp/nvhe/psci-relay.c:203:28: error: no previous prototype for function '__kvm_host_psci_cpu_entry' [-Werror,-Wmissing-prototypes] asmlinkage void __noreturn __kvm_host_psci_cpu_entry(bool is_cpu_on) Fixes: dcf89d1111995 ("KVM: arm64: Add missing BTI instructions") Signed-off-by: Arnd Bergmann Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20230724121850.1386668-1-arnd@kernel.org Signed-off-by: Oliver Upton commit 375110ab51dec5dcd077b8fa95075b2c67499119 Author: Fuad Tabba Date: Mon Jul 24 13:38:29 2023 +0100 KVM: arm64: Fix resetting SME trap values on reset for (h)VHE Ensure that SME traps are disabled for (h)VHE when getting the reset value for the architectural feature control register. Fixes: 75c76ab5a641 ("KVM: arm64: Rework CPTR_EL2 programming for HVHE configuration") Signed-off-by: Fuad Tabba Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20230724123829.2929609-9-tabba@google.com Signed-off-by: Oliver Upton commit 7af0d5e50006614cbf313373df708df79d9f4657 Author: Fuad Tabba Date: Mon Jul 24 13:38:28 2023 +0100 KVM: arm64: Fix resetting SVE trap values on reset for hVHE Ensure that SVE traps are disabled for hVHE, if the FPSIMD state isn't owned by the guest, when getting the reset value for the architectural feature control register. Fixes: 75c76ab5a641 ("KVM: arm64: Rework CPTR_EL2 programming for HVHE configuration") Signed-off-by: Fuad Tabba Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20230724123829.2929609-8-tabba@google.com Signed-off-by: Oliver Upton commit a9626099a51f697939d35983b92a9384a4c4a676 Author: Fuad Tabba Date: Mon Jul 24 13:38:27 2023 +0100 KVM: arm64: Use the appropriate feature trap register when activating traps Instead of writing directly to cptr_el2, use the helper that selects which feature trap register to write to based on the KVM mode. Fixes: 75c76ab5a641 ("KVM: arm64: Rework CPTR_EL2 programming for HVHE configuration") Signed-off-by: Fuad Tabba Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20230724123829.2929609-7-tabba@google.com Signed-off-by: Oliver Upton commit 90ae31c65d5afdd0864017c9354247ddb601917f Author: Fuad Tabba Date: Mon Jul 24 13:38:26 2023 +0100 KVM: arm64: Helper to write to appropriate feature trap register based on mode Factor out the code that decides whether to write to the feature trap registers, CPTR_EL2 or CPACR_EL1, based on the KVM mode, i.e., (h)VHE or nVHE. This function will be used in the subsequent patch. No functional change intended. Signed-off-by: Fuad Tabba Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20230724123829.2929609-6-tabba@google.com Signed-off-by: Oliver Upton commit 380624d4358b0150804d279c20632555e453bc1f Author: Fuad Tabba Date: Mon Jul 24 13:38:25 2023 +0100 KVM: arm64: Disable SME traps for (h)VHE at setup Ensure that SME traps are disabled for (h)VHE when setting up EL2, as they are for nVHE. Signed-off-by: Fuad Tabba Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20230724123829.2929609-5-tabba@google.com Signed-off-by: Oliver Upton commit 45a3681a10ff1732fcd7a177fbf1f9ceeaffd7c9 Author: Fuad Tabba Date: Mon Jul 24 13:38:24 2023 +0100 KVM: arm64: Use the appropriate feature trap register for SVE at EL2 setup Use the architectural feature trap/control register that corresponds to the current KVM mode, i.e., CPTR_EL2 or CPACR_EL1, when setting up SVE feature traps. Signed-off-by: Fuad Tabba Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20230724123829.2929609-4-tabba@google.com Signed-off-by: Oliver Upton commit ce92232614a5fb16992de8eb85bba7cb90772a1f Author: Fuad Tabba Date: Mon Jul 24 13:38:23 2023 +0100 KVM: arm64: Factor out code for checking (h)VHE mode into a macro The code for checking whether the kernel is in (h)VHE mode is repeated, and will be needed again in future patches. Factor it out in a macro. No functional change intended. No change in emitted assembly code intended. Signed-off-by: Fuad Tabba Link: https://lore.kernel.org/kvmarm/20230724123829.2929609-3-tabba@google.com/ Reviewed-by: Marc Zyngier Signed-off-by: Oliver Upton commit c5097b9869a136349d8404715dc8aabb7570a762 Author: Johan Hovold Date: Thu Jul 6 10:26:10 2023 +0200 Revert "PCI: dwc: Wait for link up only if link is started" This reverts commit da56a1bfbab55189595e588f1d984bdfb5cf5924. Bjorn Andersson, Fabio Estevam, Xiaolei Wang, and Jon Hunter reported that da56a1bfbab5 ("PCI: dwc: Wait for link up only if link is started") broke controller probing by returning an error in case the link does not come up during host initialisation, for example when the slot is empty. As explained in commit 886a9c134755 ("PCI: dwc: Move link handling into common code") and as indicated by the comment "Ignore errors, the link may come up later" in the code, waiting for link up and ignoring errors is the intended behaviour: Let's standardize this to succeed as there are usecases where devices (and the link) appear later even without hotplug. For example, a reconfigured FPGA device. Reverting the offending commit specifically fixes a regression on Qualcomm platforms like the Lenovo ThinkPad X13s which no longer reach the interconnect sync state if a slot does not have a device populated (e.g. an optional modem). Note that enabling asynchronous probing by default as was done for Qualcomm platforms by commit c0e1eb441b1d ("PCI: qcom: Enable async probe by default"), should take care of any related boot time concerns. Finally, note that the intel-gw driver is the only driver currently not providing a .start_link() callback and instead starts the link in its .host_init() callback, which may avoid an additional one-second timeout during probe by making the link-up wait conditional. If anyone cares, that can be done in a follow-up patch with a proper motivation. [bhelgaas: add Fabio Estevam, Xiaolei Wang, Jon Hunter reports] Fixes: da56a1bfbab5 ("PCI: dwc: Wait for link up only if link is started") Link: https://lore.kernel.org/r/20230706082610.26584-1-johan+linaro@kernel.org Reported-by: Bjorn Andersson Signed-off-by: Johan Hovold Reported-by: Fabio Estevam Link: https://lore.kernel.org/r/20230704122635.1362156-1-festevam@gmail.com/ Reported-by: Xiaolei Wang Link: https://lore.kernel.org/r/20230705010624.3912934-1-xiaolei.wang@windriver.com/ Reported-by: Jon Hunter Link: https://lore.kernel.org/r/6ca287a1-6c7c-7b90-9022-9e73fb82b564@nvidia.com Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Cc: Sajid Dalvi Cc: Ajay Agarwal commit 0ebc1064e4874d5987722a2ddbc18f94aa53b211 Author: Pablo Neira Ayuso Date: Sun Jul 23 16:41:48 2023 +0200 netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID Bail out with EOPNOTSUPP when adding rule to bound chain via NFTA_RULE_CHAIN_ID. The following warning splat is shown when adding a rule to a deleted bound chain: WARNING: CPU: 2 PID: 13692 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] CPU: 2 PID: 13692 Comm: chain-bound-rul Not tainted 6.1.39 #1 RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") Reported-by: Kevin Rich Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 0a771f7b266b02d262900c75f1e175c7fe76fec2 Author: Pablo Neira Ayuso Date: Sun Jul 23 16:24:46 2023 +0200 netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR On error when building the rule, the immediate expression unbinds the chain, hence objects can be deactivated by the transaction records. Otherwise, it is possible to trigger the following warning: WARNING: CPU: 3 PID: 915 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] CPU: 3 PID: 915 Comm: chain-bind-err- Not tainted 6.1.39 #1 RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] Fixes: 4bedf9eee016 ("netfilter: nf_tables: fix chain binding transaction logic") Reported-by: Kevin Rich Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit f718863aca469a109895cb855e6b81fff4827d71 Author: Florian Westphal Date: Thu Jul 20 21:30:05 2023 +0200 netfilter: nft_set_rbtree: fix overlap expiration walk The lazy gc on insert that should remove timed-out entries fails to release the other half of the interval, if any. Can be reproduced with tests/shell/testcases/sets/0044interval_overlap_0 in nftables.git and kmemleak enabled kernel. Second bug is the use of rbe_prev vs. prev pointer. If rbe_prev() returns NULL after at least one iteration, rbe_prev points to element that is not an end interval, hence it should not be removed. Lastly, check the genmask of the end interval if this is active in the current generation. Fixes: c9e6978e2725 ("netfilter: nft_set_rbtree: Switch to node list walk for overlap detection") Signed-off-by: Florian Westphal commit 588159009d5b7a09c3e5904cffddbe4a4e170301 Author: Ilya Dryomov Date: Sat Jul 22 20:28:08 2023 +0200 rbd: retrieve and check lock owner twice before blocklisting An attempt to acquire exclusive lock can race with the current lock owner closing the image: 1. lock is held by client123, rbd_lock() returns -EBUSY 2. get_lock_owner_info() returns client123 instance details 3. client123 closes the image, lock is released 4. find_watcher() returns 0 as there is no matching watcher anymore 5. client123 instance gets erroneously blocklisted Particularly impacted is mirror snapshot scheduler in snapshot-based mirroring since it happens to open and close images a lot (images are opened only for as long as it takes to take the next mirror snapshot, the same client instance is used for all images). To reduce the potential for erroneous blocklisting, retrieve the lock owner again after find_watcher() returns 0. If it's still there, make sure it matches the previously detected lock owner. Cc: stable@vger.kernel.org # f38cb9d9c204: rbd: make get_lock_owner_info() return a single locker or NULL Cc: stable@vger.kernel.org # 8ff2c64c9765: rbd: harden get_lock_owner_info() a bit Cc: stable@vger.kernel.org Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit 8ff2c64c9765446c3cef804fb99da04916603e27 Author: Ilya Dryomov Date: Sat Jul 8 16:16:59 2023 +0200 rbd: harden get_lock_owner_info() a bit - we want the exclusive lock type, so test for it directly - use sscanf() to actually parse the lock cookie and avoid admitting invalid handles - bail if locker has a blank address Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit f38cb9d9c2045dad16eead4a2e1aedfddd94603b Author: Ilya Dryomov Date: Fri Jun 30 13:52:13 2023 +0200 rbd: make get_lock_owner_info() return a single locker or NULL Make the "num_lockers can be only 0 or 1" assumption explicit and simplify the API by getting rid of output parameters in preparation for calling get_lock_owner_info() twice before blocklisting. Signed-off-by: Ilya Dryomov Reviewed-by: Dongsheng Yang commit ae463563b7a1b7d4a3d0b065b09d37a76b693937 Author: Sindhu Devale Date: Tue Jul 25 10:54:38 2023 -0500 RDMA/irdma: Report correct WC error Report the correct WC error if a MW bind is performed on an already valid/bound window. Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions") Signed-off-by: Sindhu Devale Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20230725155439.1057-2-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky commit 3bfb25fa2b5bb9c29681e6ac861808f4be1331a9 Author: Sindhu Devale Date: Tue Jul 25 10:54:37 2023 -0500 RDMA/irdma: Fix op_type reporting in CQEs The op_type field CQ poll info structure is incorrectly filled in with the queue type as opposed to the op_type received in the CQEs. The wrong opcode could be decoded and returned to the ULP. Copy the op_type field received in the CQE in the CQ poll info structure. Fixes: 24419777e943 ("RDMA/irdma: Fix RQ completion opcode") Signed-off-by: Sindhu Devale Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20230725155439.1057-1-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky commit b28ff3a7d7e97456fd86b68d24caa32e1cfa7064 Author: Filipe Manana Date: Fri Jul 21 10:49:21 2023 +0100 btrfs: check for commit error at btrfs_attach_transaction_barrier() btrfs_attach_transaction_barrier() is used to get a handle pointing to the current running transaction if the transaction has not started its commit yet (its state is < TRANS_STATE_COMMIT_START). If the transaction commit has started, then we wait for the transaction to commit and finish before returning - however we completely ignore if the transaction was aborted due to some error during its commit, we simply return ERR_PT(-ENOENT), which makes the caller assume everything is fine and no errors happened. This could make an fsync return success (0) to user space when in fact we had a transaction abort and the target inode changes were therefore not persisted. Fix this by checking for the return value from btrfs_wait_for_commit(), and if it returned an error, return it back to the caller. Fixes: d4edf39bd5db ("Btrfs: fix uncompleted transaction") CC: stable@vger.kernel.org # 4.19+ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit cc71c42b3dc1085d3e72dfa5603e827b9eb59da1 Author: Douglas Anderson Date: Tue Jul 25 11:02:27 2023 -0700 spi: spi-qcom-qspi: Add mem_ops to avoid PIO for badly sized reads In the patch ("spi: spi-qcom-qspi: Fallback to PIO for xfers that aren't multiples of 4 bytes") we detect reads that we can't handle properly and fallback to PIO mode. While that's correct behavior, we can do better by adding "spi_controller_mem_ops" for our controller. Once we do this then the caller will give us a transfer that's a multiple of 4-bytes so we can DMA. Fixes: b5762d95607e ("spi: spi-qcom-qspi: Add DMA mode support") Signed-off-by: Douglas Anderson Reviewed-by: Vijaya Krishna Nivarthi Link: https://lore.kernel.org/r/20230725110226.2.Id4a39804e01e4a06dae9b73fd2a5194c4c7ea453@changeid Signed-off-by: Mark Brown commit 138d73b627c71bf2b2f61502dc6c1137b9656434 Author: Douglas Anderson Date: Tue Jul 25 11:02:26 2023 -0700 spi: spi-qcom-qspi: Fallback to PIO for xfers that aren't multiples of 4 bytes The Qualcomm QSPI driver appears to require that any reads using DMA are a mutliple of 4 bytes. If this isn't true then the controller will clobber any extra bytes in memory following the last word. Let's detect this and falback to PIO. This fixes problems reported by slub_debug=FZPUA, which would complain about "kmalloc Redzone overwritten". One such instance said: 0xffffff80c29d541a-0xffffff80c29d541b @offset=21530. First byte 0x0 instead of 0xcc Allocated in mtd_kmalloc_up_to+0x98/0xac age=36 cpu=3 pid=6658 Tracing through what was happening I saw that, while we often did DMA tranfers of 0x1000 bytes, sometimes we'd end up doing ones of 0x41a bytes. Those 0x41a byte transfers were the problem. NOTE: a future change will enable the SPI "mem ops" to help avoid this case, but it still seems good to add the extra check in the transfer. Fixes: b5762d95607e ("spi: spi-qcom-qspi: Add DMA mode support") Signed-off-by: Douglas Anderson Reviewed-by: Vijaya Krishna Nivarthi Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/r/20230725110226.1.Ia2f980fc7cd0b831e633391f0bb1272914d8f381@changeid Signed-off-by: Mark Brown commit d4a7ce642100765119a872d4aba1bf63e3a22c8a Author: Muhammad Husaini Zulkifli Date: Mon Jul 24 09:12:50 2023 -0700 igc: Fix Kernel Panic during ndo_tx_timeout callback The Xeon validation group has been carrying out some loaded tests with various HW configurations, and they have seen some transmit queue time out happening during the test. This will cause the reset adapter function to be called by igc_tx_timeout(). Similar race conditions may arise when the interface is being brought down and up in igc_reinit_locked(), an interrupt being generated, and igc_clean_tx_irq() being called to complete the TX. When the igc_tx_timeout() function is invoked, this patch will turn off all TX ring HW queues during igc_down() process. TX ring HW queues will be activated again during the igc_configure_tx_ring() process when performing the igc_up() procedure later. This patch also moved existing igc_disable_tx_ring_hw() to avoid using forward declaration. Kernel trace: [ 7678.747813] ------------[ cut here ]------------ [ 7678.757914] NETDEV WATCHDOG: enp1s0 (igc): transmit queue 2 timed out [ 7678.770117] WARNING: CPU: 0 PID: 13 at net/sched/sch_generic.c:525 dev_watchdog+0x1ae/0x1f0 [ 7678.784459] Modules linked in: xt_conntrack nft_chain_nat xt_MASQUERADE xt_addrtype nft_compat nf_tables nfnetlink br_netfilter bridge stp llc overlay dm_mod emrcha(PO) emriio(PO) rktpm(PO) cegbuf_mod(PO) patch_update(PO) se(PO) sgx_tgts(PO) mktme(PO) keylocker(PO) svtdx(PO) svfs_pci_hotplug(PO) vtd_mod(PO) davemem(PO) svmabort(PO) svindexio(PO) usbx2(PO) ehci_sched(PO) svheartbeat(PO) ioapic(PO) sv8259(PO) svintr(PO) lt(PO) pcierootport(PO) enginefw_mod(PO) ata(PO) smbus(PO) spiflash_cdf(PO) arden(PO) dsa_iax(PO) oobmsm_punit(PO) cpm(PO) svkdb(PO) ebg_pch(PO) pch(PO) sviotargets(PO) svbdf(PO) svmem(PO) svbios(PO) dram(PO) svtsc(PO) targets(PO) superio(PO) svkernel(PO) cswitch(PO) mcf(PO) pentiumIII_mod(PO) fs_svfs(PO) mdevdefdb(PO) svfs_os_services(O) ixgbe mdio mdio_devres libphy emeraldrapids_svdefs(PO) regsupport(O) libnvdimm nls_cp437 snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hwdep x86_pkg_temp_thermal snd_hda_core snd_pcm snd_timer isst_if_mbox_pci [ 7678.784496] input_leds isst_if_mmio sg snd isst_if_common soundcore wmi button sad9(O) drm fuse backlight configfs efivarfs ip_tables x_tables vmd sdhci led_class rtl8150 r8152 hid_generic pegasus mmc_block usbhid mmc_core hid megaraid_sas ixgb igb i2c_algo_bit ice i40e hpsa scsi_transport_sas e1000e e1000 e100 ax88179_178a usbnet xhci_pci sd_mod xhci_hcd t10_pi crc32c_intel crc64_rocksoft igc crc64 crc_t10dif usbcore crct10dif_generic ptp crct10dif_common usb_common pps_core [ 7679.200403] RIP: 0010:dev_watchdog+0x1ae/0x1f0 [ 7679.210201] Code: 28 e9 53 ff ff ff 4c 89 e7 c6 05 06 42 b9 00 01 e8 17 d1 fb ff 44 89 e9 4c 89 e6 48 c7 c7 40 ad fb 81 48 89 c2 e8 52 62 82 ff <0f> 0b e9 72 ff ff ff 65 8b 05 80 7d 7c 7e 89 c0 48 0f a3 05 0a c1 [ 7679.245438] RSP: 0018:ffa00000001f7d90 EFLAGS: 00010282 [ 7679.256021] RAX: 0000000000000000 RBX: ff11000109938440 RCX: 0000000000000000 [ 7679.268710] RDX: ff11000361e26cd8 RSI: ff11000361e1b880 RDI: ff11000361e1b880 [ 7679.281314] RBP: ffa00000001f7da8 R08: ff1100035f8fffe8 R09: 0000000000027ffb [ 7679.293840] R10: 0000000000001f0a R11: ff1100035f840000 R12: ff11000109938000 [ 7679.306276] R13: 0000000000000002 R14: dead000000000122 R15: ffa00000001f7e18 [ 7679.318648] FS: 0000000000000000(0000) GS:ff11000361e00000(0000) knlGS:0000000000000000 [ 7679.332064] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7679.342757] CR2: 00007ffff7fca168 CR3: 000000013b08a006 CR4: 0000000000471ef8 [ 7679.354984] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 7679.367207] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 7679.379370] PKRU: 55555554 [ 7679.386446] Call Trace: [ 7679.393152] [ 7679.399363] ? __pfx_dev_watchdog+0x10/0x10 [ 7679.407870] call_timer_fn+0x31/0x110 [ 7679.415698] expire_timers+0xb2/0x120 [ 7679.423403] run_timer_softirq+0x179/0x1e0 [ 7679.431532] ? __schedule+0x2b1/0x820 [ 7679.439078] __do_softirq+0xd1/0x295 [ 7679.446426] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 7679.454867] run_ksoftirqd+0x22/0x30 [ 7679.462058] smpboot_thread_fn+0xb7/0x160 [ 7679.469670] kthread+0xcd/0xf0 [ 7679.476097] ? __pfx_kthread+0x10/0x10 [ 7679.483211] ret_from_fork+0x29/0x50 [ 7679.490047] [ 7679.495204] ---[ end trace 0000000000000000 ]--- [ 7679.503179] igc 0000:01:00.0 enp1s0: Register Dump [ 7679.511230] igc 0000:01:00.0 enp1s0: Register Name Value [ 7679.519892] igc 0000:01:00.0 enp1s0: CTRL 181c0641 [ 7679.528782] igc 0000:01:00.0 enp1s0: STATUS 40280683 [ 7679.537551] igc 0000:01:00.0 enp1s0: CTRL_EXT 10000040 [ 7679.546284] igc 0000:01:00.0 enp1s0: MDIC 180a3800 [ 7679.554942] igc 0000:01:00.0 enp1s0: ICR 00000081 [ 7679.563503] igc 0000:01:00.0 enp1s0: RCTL 04408022 [ 7679.571963] igc 0000:01:00.0 enp1s0: RDLEN[0-3] 00001000 00001000 00001000 00001000 [ 7679.583075] igc 0000:01:00.0 enp1s0: RDH[0-3] 00000068 000000b6 0000000f 00000031 [ 7679.594162] igc 0000:01:00.0 enp1s0: RDT[0-3] 00000066 000000b2 0000000e 00000030 [ 7679.605174] igc 0000:01:00.0 enp1s0: RXDCTL[0-3] 02040808 02040808 02040808 02040808 [ 7679.616196] igc 0000:01:00.0 enp1s0: RDBAL[0-3] 1bb7c000 1bb7f000 1bb82000 0ef33000 [ 7679.627242] igc 0000:01:00.0 enp1s0: RDBAH[0-3] 00000001 00000001 00000001 00000001 [ 7679.638256] igc 0000:01:00.0 enp1s0: TCTL a503f0fa [ 7679.646607] igc 0000:01:00.0 enp1s0: TDBAL[0-3] 2ba4a000 1bb6f000 1bb74000 1bb79000 [ 7679.657609] igc 0000:01:00.0 enp1s0: TDBAH[0-3] 00000001 00000001 00000001 00000001 [ 7679.668551] igc 0000:01:00.0 enp1s0: TDLEN[0-3] 00001000 00001000 00001000 00001000 [ 7679.679470] igc 0000:01:00.0 enp1s0: TDH[0-3] 000000a7 0000002d 000000bf 000000d9 [ 7679.690406] igc 0000:01:00.0 enp1s0: TDT[0-3] 000000a7 0000002d 000000bf 000000d9 [ 7679.701264] igc 0000:01:00.0 enp1s0: TXDCTL[0-3] 02100108 02100108 02100108 02100108 [ 7679.712123] igc 0000:01:00.0 enp1s0: Reset adapter [ 7683.085967] igc 0000:01:00.0 enp1s0: NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX/TX [ 8086.945561] ------------[ cut here ]------------ Entering kdb (current=0xffffffff8220b200, pid 0) on processor 0 Oops: (null) due to oops @ 0xffffffff81573888 RIP: 0010:dql_completed+0x148/0x160 Code: c9 00 48 89 57 58 e9 46 ff ff ff 45 85 e4 41 0f 95 c4 41 39 db 0f 95 c1 41 84 cc 74 05 45 85 ed 78 0a 44 89 c1 e9 27 ff ff ff <0f> 0b 01 f6 44 89 c1 29 f1 0f 48 ca eb 8c cc cc cc cc cc cc cc cc RSP: 0018:ffa0000000003e00 EFLAGS: 00010287 RAX: 000000000000006c RBX: ffa0000003eb0f78 RCX: ff11000109938000 RDX: 0000000000000003 RSI: 0000000000000160 RDI: ff110001002e9480 RBP: ffa0000000003ed8 R08: ff110001002e93c0 R09: ffa0000000003d28 R10: 0000000000007cc0 R11: 0000000000007c54 R12: 00000000ffffffd9 R13: ff1100037039cb00 R14: 00000000ffffffd9 R15: ff1100037039c048 FS: 0000000000000000(0000) GS:ff11000361e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffff7fca168 CR3: 000000013b08a003 CR4: 0000000000471ef8 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ? igc_poll+0x1a9/0x14d0 [igc] __napi_poll+0x2e/0x1b0 net_rx_action+0x126/0x250 __do_softirq+0xd1/0x295 irq_exit_rcu+0xc5/0xf0 common_interrupt+0x86/0xa0 asm_common_interrupt+0x27/0x40 RIP: 0010:cpuidle_enter_state+0xd3/0x3e0 Code: 73 f1 ff ff 49 89 c6 8b 05 e2 ca a7 00 85 c0 0f 8f b3 02 00 00 31 ff e8 1b de 75 ff 80 7d d7 00 0f 85 cd 01 00 00 fb 45 85 ff <0f> 88 fd 00 00 00 49 63 cf 4c 2b 75 c8 48 8d 04 49 48 89 ca 48 8d RSP: 0018:ffffffff82203df0 EFLAGS: 00000202 RAX: ff11000361e2a200 RBX: 0000000000000002 RCX: 000000000000001f RDX: 0000000000000000 RSI: 000000003cf3cf3d RDI: 0000000000000000 RBP: ffffffff82203e28 R08: 0000075ae38471c8 R09: 0000000000000018 R10: 000000000000031a R11: ffffffff8238dca0 R12: ffd1ffffff200000 R13: ffffffff8238dca0 R14: 0000075ae38471c8 R15: 0000000000000002 cpuidle_enter+0x2e/0x50 call_cpuidle+0x23/0x40 do_idle+0x1be/0x220 cpu_startup_entry+0x20/0x30 rest_init+0xb5/0xc0 arch_call_rest_init+0xe/0x30 start_kernel+0x448/0x760 x86_64_start_kernel+0x109/0x150 secondary_startup_64_no_verify+0xe0/0xeb more> [0]kdb> [0]kdb> [0]kdb> go Catastrophic error detected kdb_continue_catastrophic=0, type go a second time if you really want to continue [0]kdb> go Catastrophic error detected kdb_continue_catastrophic=0, attempting to continue [ 8086.955689] refcount_t: underflow; use-after-free. [ 8086.955697] WARNING: CPU: 0 PID: 0 at lib/refcount.c:28 refcount_warn_saturate+0xc2/0x110 [ 8086.955706] Modules linked in: xt_conntrack nft_chain_nat xt_MASQUERADE xt_addrtype nft_compat nf_tables nfnetlink br_netfilter bridge stp llc overlay dm_mod emrcha(PO) emriio(PO) rktpm(PO) cegbuf_mod(PO) patch_update(PO) se(PO) sgx_tgts(PO) mktme(PO) keylocker(PO) svtdx(PO) svfs_pci_hotplug(PO) vtd_mod(PO) davemem(PO) svmabort(PO) svindexio(PO) usbx2(PO) ehci_sched(PO) svheartbeat(PO) ioapic(PO) sv8259(PO) svintr(PO) lt(PO) pcierootport(PO) enginefw_mod(PO) ata(PO) smbus(PO) spiflash_cdf(PO) arden(PO) dsa_iax(PO) oobmsm_punit(PO) cpm(PO) svkdb(PO) ebg_pch(PO) pch(PO) sviotargets(PO) svbdf(PO) svmem(PO) svbios(PO) dram(PO) svtsc(PO) targets(PO) superio(PO) svkernel(PO) cswitch(PO) mcf(PO) pentiumIII_mod(PO) fs_svfs(PO) mdevdefdb(PO) svfs_os_services(O) ixgbe mdio mdio_devres libphy emeraldrapids_svdefs(PO) regsupport(O) libnvdimm nls_cp437 snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hwdep x86_pkg_temp_thermal snd_hda_core snd_pcm snd_timer isst_if_mbox_pci [ 8086.955751] input_leds isst_if_mmio sg snd isst_if_common soundcore wmi button sad9(O) drm fuse backlight configfs efivarfs ip_tables x_tables vmd sdhci led_class rtl8150 r8152 hid_generic pegasus mmc_block usbhid mmc_core hid megaraid_sas ixgb igb i2c_algo_bit ice i40e hpsa scsi_transport_sas e1000e e1000 e100 ax88179_178a usbnet xhci_pci sd_mod xhci_hcd t10_pi crc32c_intel crc64_rocksoft igc crc64 crc_t10dif usbcore crct10dif_generic ptp crct10dif_common usb_common pps_core [ 8086.955784] RIP: 0010:refcount_warn_saturate+0xc2/0x110 [ 8086.955788] Code: 01 e8 82 e7 b4 ff 0f 0b 5d c3 cc cc cc cc 80 3d 68 c6 eb 00 00 75 81 48 c7 c7 a0 87 f6 81 c6 05 58 c6 eb 00 01 e8 5e e7 b4 ff <0f> 0b 5d c3 cc cc cc cc 80 3d 42 c6 eb 00 00 0f 85 59 ff ff ff 48 [ 8086.955790] RSP: 0018:ffa0000000003da0 EFLAGS: 00010286 [ 8086.955793] RAX: 0000000000000000 RBX: ff1100011da40ee0 RCX: ff11000361e1b888 [ 8086.955794] RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ff11000361e1b880 [ 8086.955795] RBP: ffa0000000003da0 R08: 80000000ffff9f45 R09: ffa0000000003d28 [ 8086.955796] R10: ff1100035f840000 R11: 0000000000000028 R12: ff11000319ff8000 [ 8086.955797] R13: ff1100011bb79d60 R14: 00000000ffffffd6 R15: ff1100037039cb00 [ 8086.955798] FS: 0000000000000000(0000) GS:ff11000361e00000(0000) knlGS:0000000000000000 [ 8086.955800] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8086.955801] CR2: 00007ffff7fca168 CR3: 000000013b08a003 CR4: 0000000000471ef8 [ 8086.955803] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 8086.955803] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 8086.955804] PKRU: 55555554 [ 8086.955805] Call Trace: [ 8086.955806] [ 8086.955808] tcp_wfree+0x112/0x130 [ 8086.955814] skb_release_head_state+0x24/0xa0 [ 8086.955818] napi_consume_skb+0x9c/0x160 [ 8086.955821] igc_poll+0x5d8/0x14d0 [igc] [ 8086.955835] __napi_poll+0x2e/0x1b0 [ 8086.955839] net_rx_action+0x126/0x250 [ 8086.955843] __do_softirq+0xd1/0x295 [ 8086.955846] irq_exit_rcu+0xc5/0xf0 [ 8086.955851] common_interrupt+0x86/0xa0 [ 8086.955857] [ 8086.955857] [ 8086.955858] asm_common_interrupt+0x27/0x40 [ 8086.955862] RIP: 0010:cpuidle_enter_state+0xd3/0x3e0 [ 8086.955866] Code: 73 f1 ff ff 49 89 c6 8b 05 e2 ca a7 00 85 c0 0f 8f b3 02 00 00 31 ff e8 1b de 75 ff 80 7d d7 00 0f 85 cd 01 00 00 fb 45 85 ff <0f> 88 fd 00 00 00 49 63 cf 4c 2b 75 c8 48 8d 04 49 48 89 ca 48 8d [ 8086.955867] RSP: 0018:ffffffff82203df0 EFLAGS: 00000202 [ 8086.955869] RAX: ff11000361e2a200 RBX: 0000000000000002 RCX: 000000000000001f [ 8086.955870] RDX: 0000000000000000 RSI: 000000003cf3cf3d RDI: 0000000000000000 [ 8086.955871] RBP: ffffffff82203e28 R08: 0000075ae38471c8 R09: 0000000000000018 [ 8086.955872] R10: 000000000000031a R11: ffffffff8238dca0 R12: ffd1ffffff200000 [ 8086.955873] R13: ffffffff8238dca0 R14: 0000075ae38471c8 R15: 0000000000000002 [ 8086.955875] cpuidle_enter+0x2e/0x50 [ 8086.955880] call_cpuidle+0x23/0x40 [ 8086.955884] do_idle+0x1be/0x220 [ 8086.955887] cpu_startup_entry+0x20/0x30 [ 8086.955889] rest_init+0xb5/0xc0 [ 8086.955892] arch_call_rest_init+0xe/0x30 [ 8086.955895] start_kernel+0x448/0x760 [ 8086.955898] x86_64_start_kernel+0x109/0x150 [ 8086.955900] secondary_startup_64_no_verify+0xe0/0xeb [ 8086.955904] [ 8086.955904] ---[ end trace 0000000000000000 ]--- [ 8086.955912] ------------[ cut here ]------------ [ 8086.955913] kernel BUG at lib/dynamic_queue_limits.c:27! [ 8086.955918] invalid opcode: 0000 [#1] SMP [ 8086.955922] RIP: 0010:dql_completed+0x148/0x160 [ 8086.955925] Code: c9 00 48 89 57 58 e9 46 ff ff ff 45 85 e4 41 0f 95 c4 41 39 db 0f 95 c1 41 84 cc 74 05 45 85 ed 78 0a 44 89 c1 e9 27 ff ff ff <0f> 0b 01 f6 44 89 c1 29 f1 0f 48 ca eb 8c cc cc cc cc cc cc cc cc [ 8086.955927] RSP: 0018:ffa0000000003e00 EFLAGS: 00010287 [ 8086.955928] RAX: 000000000000006c RBX: ffa0000003eb0f78 RCX: ff11000109938000 [ 8086.955929] RDX: 0000000000000003 RSI: 0000000000000160 RDI: ff110001002e9480 [ 8086.955930] RBP: ffa0000000003ed8 R08: ff110001002e93c0 R09: ffa0000000003d28 [ 8086.955931] R10: 0000000000007cc0 R11: 0000000000007c54 R12: 00000000ffffffd9 [ 8086.955932] R13: ff1100037039cb00 R14: 00000000ffffffd9 R15: ff1100037039c048 [ 8086.955933] FS: 0000000000000000(0000) GS:ff11000361e00000(0000) knlGS:0000000000000000 [ 8086.955934] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8086.955935] CR2: 00007ffff7fca168 CR3: 000000013b08a003 CR4: 0000000000471ef8 [ 8086.955936] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 8086.955937] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 8086.955938] PKRU: 55555554 [ 8086.955939] Call Trace: [ 8086.955939] [ 8086.955940] ? igc_poll+0x1a9/0x14d0 [igc] [ 8086.955949] __napi_poll+0x2e/0x1b0 [ 8086.955952] net_rx_action+0x126/0x250 [ 8086.955956] __do_softirq+0xd1/0x295 [ 8086.955958] irq_exit_rcu+0xc5/0xf0 [ 8086.955961] common_interrupt+0x86/0xa0 [ 8086.955964] [ 8086.955965] [ 8086.955965] asm_common_interrupt+0x27/0x40 [ 8086.955968] RIP: 0010:cpuidle_enter_state+0xd3/0x3e0 [ 8086.955971] Code: 73 f1 ff ff 49 89 c6 8b 05 e2 ca a7 00 85 c0 0f 8f b3 02 00 00 31 ff e8 1b de 75 ff 80 7d d7 00 0f 85 cd 01 00 00 fb 45 85 ff <0f> 88 fd 00 00 00 49 63 cf 4c 2b 75 c8 48 8d 04 49 48 89 ca 48 8d [ 8086.955972] RSP: 0018:ffffffff82203df0 EFLAGS: 00000202 [ 8086.955973] RAX: ff11000361e2a200 RBX: 0000000000000002 RCX: 000000000000001f [ 8086.955974] RDX: 0000000000000000 RSI: 000000003cf3cf3d RDI: 0000000000000000 [ 8086.955974] RBP: ffffffff82203e28 R08: 0000075ae38471c8 R09: 0000000000000018 [ 8086.955975] R10: 000000000000031a R11: ffffffff8238dca0 R12: ffd1ffffff200000 [ 8086.955976] R13: ffffffff8238dca0 R14: 0000075ae38471c8 R15: 0000000000000002 [ 8086.955978] cpuidle_enter+0x2e/0x50 [ 8086.955981] call_cpuidle+0x23/0x40 [ 8086.955984] do_idle+0x1be/0x220 [ 8086.955985] cpu_startup_entry+0x20/0x30 [ 8086.955987] rest_init+0xb5/0xc0 [ 8086.955990] arch_call_rest_init+0xe/0x30 [ 8086.955992] start_kernel+0x448/0x760 [ 8086.955994] x86_64_start_kernel+0x109/0x150 [ 8086.955996] secondary_startup_64_no_verify+0xe0/0xeb [ 8086.955998] [ 8086.955999] Modules linked in: xt_conntrack nft_chain_nat xt_MASQUERADE xt_addrtype nft_compat nf_tables nfnetlink br_netfilter bridge stp llc overlay dm_mod emrcha(PO) emriio(PO) rktpm(PO) cegbuf_mod(PO) patch_update(PO) se(PO) sgx_tgts(PO) mktme(PO) keylocker(PO) svtdx(PO) svfs_pci_hotplug(PO) vtd_mod(PO) davemem(PO) svmabort(PO) svindexio(PO) usbx2(PO) ehci_sched(PO) svheartbeat(PO) ioapic(PO) sv8259(PO) svintr(PO) lt(PO) pcierootport(PO) enginefw_mod(PO) ata(PO) smbus(PO) spiflash_cdf(PO) arden(PO) dsa_iax(PO) oobmsm_punit(PO) cpm(PO) svkdb(PO) ebg_pch(PO) pch(PO) sviotargets(PO) svbdf(PO) svmem(PO) svbios(PO) dram(PO) svtsc(PO) targets(PO) superio(PO) svkernel(PO) cswitch(PO) mcf(PO) pentiumIII_mod(PO) fs_svfs(PO) mdevdefdb(PO) svfs_os_services(O) ixgbe mdio mdio_devres libphy emeraldrapids_svdefs(PO) regsupport(O) libnvdimm nls_cp437 snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hwdep x86_pkg_temp_thermal snd_hda_core snd_pcm snd_timer isst_if_mbox_pci [ 8086.956029] input_leds isst_if_mmio sg snd isst_if_common soundcore wmi button sad9(O) drm fuse backlight configfs efivarfs ip_tables x_tables vmd sdhci led_class rtl8150 r8152 hid_generic pegasus mmc_block usbhid mmc_core hid megaraid_sas ixgb igb i2c_algo_bit ice i40e hpsa scsi_transport_sas e1000e e1000 e100 ax88179_178a usbnet xhci_pci sd_mod xhci_hcd t10_pi crc32c_intel crc64_rocksoft igc crc64 crc_t10dif usbcore crct10dif_generic ptp crct10dif_common usb_common pps_core [16762.543675] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.593 msecs [16762.543678] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.595 msecs [16762.543673] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.495 msecs [16762.543679] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.599 msecs [16762.543678] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.598 msecs [16762.543690] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.605 msecs [16762.543684] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.599 msecs [16762.543693] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 8675587.613 msecs [16762.543784] ---[ end trace 0000000000000000 ]--- [16762.849099] RIP: 0010:dql_completed+0x148/0x160 PANIC: Fatal exception in interrupt Fixes: 9b275176270e ("igc: Add ndo_tx_timeout support") Tested-by: Alejandra Victoria Alcaraz Signed-off-by: Muhammad Husaini Zulkifli Acked-by: Sasha Neftin Tested-by: Naama Meir Signed-off-by: Tony Nguyen Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit dfd739f182b00b02bd7470ed94d112684cc04fa2 Author: Christian Marangi Date: Mon Jul 24 05:25:31 2023 +0200 net: dsa: qca8k: fix mdb add/del case with 0 VID The qca8k switch doesn't support using 0 as VID and require a default VID to be always set. MDB add/del function doesn't currently handle this and are currently setting the default VID. Fix this by correctly handling this corner case and internally use the default VID for VID 0 case. Fixes: ba8f870dfa63 ("net: dsa: qca8k: add support for mdb_add/del") Signed-off-by: Christian Marangi Cc: stable@vger.kernel.org Signed-off-by: David S. Miller commit ae70dcb9d9ecaf7d9836d3e1b5bef654d7ef5680 Author: Christian Marangi Date: Mon Jul 24 05:25:30 2023 +0200 net: dsa: qca8k: fix broken search_and_del On deleting an MDB entry for a port, fdb_search_and_del is used. An FDB entry can't be modified so it needs to be deleted and readded again with the new portmap (and the port deleted as requested) We use the SEARCH operator to search the entry to edit by vid and mac address and then we check the aging if we actually found an entry. Currently the code suffer from a bug where the searched fdb entry is never read again with the found values (if found) resulting in the code always returning -EINVAL as aging was always 0. Fix this by correctly read the fdb entry after it was searched. Fixes: ba8f870dfa63 ("net: dsa: qca8k: add support for mdb_add/del") Signed-off-by: Christian Marangi Cc: stable@vger.kernel.org Signed-off-by: David S. Miller commit 80248d4160894d7e40b04111bdbaa4ff93fc4bd7 Author: Christian Marangi Date: Mon Jul 24 05:25:29 2023 +0200 net: dsa: qca8k: fix search_and_insert wrong handling of new rule On inserting a mdb entry, fdb_search_and_insert is used to add a port to the qca8k target entry in the FDB db. A FDB entry can't be modified so it needs to be removed and insert again with the new values. To detect if an entry already exist, the SEARCH operation is used and we check the aging of the entry. If the entry is not 0, the entry exist and we proceed to delete it. Current code have 2 main problem: - The condition to check if the FDB entry exist is wrong and should be the opposite. - When a FDB entry doesn't exist, aging was never actually set to the STATIC value resulting in allocating an invalid entry. Fix both problem by adding aging support to the function, calling the function with STATIC as aging by default and finally by correct the condition to check if the entry actually exist. Fixes: ba8f870dfa63 ("net: dsa: qca8k: add support for mdb_add/del") Signed-off-by: Christian Marangi Cc: stable@vger.kernel.org Signed-off-by: David S. Miller commit 2c39dd025da489cf87d26469d9f5ff19715324a0 Author: Christian Marangi Date: Mon Jul 24 05:25:28 2023 +0200 net: dsa: qca8k: enable use_single_write for qca8xxx The qca8xxx switch supports 2 way to write reg values, a slow way using mdio and a fast way by sending specially crafted mgmt packet to read/write reg. The fast way can support up to 32 bytes of data as eth packet are used to send/receive. This correctly works for almost the entire regmap of the switch but with the use of some kernel selftests for dsa drivers it was found a funny and interesting hw defect/limitation. For some specific reg, bulk write won't work and will result in writing only part of the requested regs resulting in half data written. This was especially hard to track and discover due to the total strangeness of the problem and also by the specific regs where this occurs. This occurs in the specific regs of the ATU table, where multiple entry needs to be written to compose the entire entry. It was discovered that with a bulk write of 12 bytes on QCA8K_REG_ATU_DATA0 only QCA8K_REG_ATU_DATA0 and QCA8K_REG_ATU_DATA2 were written, but QCA8K_REG_ATU_DATA1 was always zero. Tcpdump was used to make sure the specially crafted packet was correct and this was confirmed. The problem was hard to track as the lack of QCA8K_REG_ATU_DATA1 resulted in an entry somehow possible as the first bytes of the mac address are set in QCA8K_REG_ATU_DATA0 and the entry type is set in QCA8K_REG_ATU_DATA2. Funlly enough writing QCA8K_REG_ATU_DATA1 results in the same problem with QCA8K_REG_ATU_DATA2 empty and QCA8K_REG_ATU_DATA1 and QCA8K_REG_ATU_FUNC correctly written. A speculation on the problem might be that there are some kind of indirection internally when accessing these regs and they can't be accessed all together, due to the fact that it's really a table mapped somewhere in the switch SRAM. Even more funny is the fact that every other reg was tested with all kind of combination and they are not affected by this problem. Read operation was also tested and always worked so it's not affected by this problem. The problem is not present if we limit writing a single reg at times. To handle this hardware defect, enable use_single_write so that bulk api can correctly split the write in multiple different operation effectively reverting to a non-bulk write. Cc: Mark Brown Fixes: c766e077d927 ("net: dsa: qca8k: convert to regmap read/write API") Signed-off-by: Christian Marangi Cc: stable@vger.kernel.org Signed-off-by: David S. Miller commit f8ea95021022826a010f56cf19451c21f4c9c155 Author: Linus Walleij Date: Thu Jun 22 09:45:20 2023 +0200 misc/genalloc: Name subpools by of_node_full_name() A previous commit tried to come up with more generic subpool names, but this isn't quite working: the node name was used elsewhere to match pools to consumers which regressed the nVidia Tegra 2/3 video decoder. Revert back to an earlier approach using of_node_full_name() instead of just the name to make sure the pool name is more unique, and change both sites using this in the kernel. It is not perfect since two SRAM nodes could have the same subpool name but it makes the situation better than before. Reported-by: Dmitry Osipenko Fixes: 21e5a2d10c8f ("misc: sram: Generate unique names for subpools") Signed-off-by: Linus Walleij Tested-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20230622074520.3058027-1-linus.walleij@linaro.org Signed-off-by: Greg Kroah-Hartman commit 645bb6b1fe0b15f2f134055e7ad470036aca9202 Author: Greg Kroah-Hartman Date: Tue Jul 25 08:38:15 2023 +0200 Documentation: embargoed-hardware-issues.rst: add AMD to the list Add AMD back to the embargoed-hardware-issues.rst list. There was confusion about a recent issue that ended up being due to third-party's misrepresentation, not AMD, so add AMD back to the list to get notified properly as they understand the proper procedures to follow. Cc: Tom Lendacky Cc: Thomas Gleixner Link: https://lore.kernel.org/r/2023072514-submersed-yanking-652e@gregkh Signed-off-by: Greg Kroah-Hartman commit 456b5e85d8a56e5563573b10e0840c7ae59373da Author: Kalle Valo Date: Tue Jul 25 12:42:48 2023 +0300 MAINTAINERS: add Jeff as ath10k, ath11k and ath12k maintainer Jeff will now start maintaining these drivers together with me. Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230725094248.3205486-1-kvalo@kernel.org commit cc326aae03c37d393e8dfba950caa33493dcdfad Author: Kalle Valo Date: Mon Jul 24 13:45:47 2023 +0300 MAINTAINERS: wifi: mark mlw8k as orphan Last activity from Lennert is from 2012 so mark the driver as orphan. Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230724104547.3061709-10-kvalo@kernel.org commit 3ccbc99c152fded21ff3661d7685095e14065e96 Author: Kalle Valo Date: Mon Jul 24 13:45:46 2023 +0300 MAINTAINERS: wifi: mark b43 as orphan There's no maintainer for b43 so mark it as orphan. Signed-off-by: Kalle Valo Acked-by: Larry Finger Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230724104547.3061709-9-kvalo@kernel.org commit c1e0a70de12dea642c696a81fd1104f5377fb203 Author: Kalle Valo Date: Mon Jul 24 13:45:45 2023 +0300 MAINTAINERS: wifi: mark zd1211rw as orphan Last activity from Ulrich is from 2007 so mark the driver orphan. Remove the zd1211-devs list, I doubt anyone uses it anymore. The webpage seems to be down so remove that as well. Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230724104547.3061709-8-kvalo@kernel.org commit 0566ec90515c50352442db467d2a8c8950d35dc9 Author: Kalle Valo Date: Mon Jul 24 13:45:44 2023 +0300 MAINTAINERS: wifi: mark wl3501 as orphan There's no maintainer for this driver so mark it as orphan. Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230724104547.3061709-7-kvalo@kernel.org commit bc5dee3ce7c06d2c3d7a3b135a24f85de45a8362 Author: Kalle Valo Date: Mon Jul 24 13:45:43 2023 +0300 MAINTAINERS: wifi: mark rndis_wlan as orphan Last activity from Jussi for this driver is from 2013 so mark the driver orphan. Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230724104547.3061709-6-kvalo@kernel.org commit e76983151dc66717e43c2a77abcfdb36318d2255 Author: Kalle Valo Date: Mon Jul 24 13:45:42 2023 +0300 MAINTAINERS: wifi: mark ar5523 as orphan Last activity from Pontus for this driver is from 2013 so mark the driver orphan. Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230724104547.3061709-5-kvalo@kernel.org commit 74b81eac2dda55584aa6102feb920142ab08721a Author: Kalle Valo Date: Mon Jul 24 13:45:41 2023 +0300 MAINTAINERS: wifi: mark cw1200 as orphan Last activity from Solomon is from 2013 so mark the driver orphan. Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230724104547.3061709-4-kvalo@kernel.org commit 25700d4916fefd27f83b933149c4da3d32db8585 Author: Kalle Valo Date: Mon Jul 24 13:45:40 2023 +0300 MAINTAINERS: wifi: atmel: mark as orphan Last activity from Simon is from 2005 so mark the driver is orphan. Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230724104547.3061709-3-kvalo@kernel.org commit 96839282edc28996809b2101afef8ae971b9dad7 Author: Kalle Valo Date: Mon Jul 24 13:45:39 2023 +0300 MAINTAINERS: wifi: rtw88: change Ping as the maintainer Yan-Hsuan has been away since 2021 and Ping has been the de facto maintainer the past year, actively reviewing patches and doing all other maintainer duties. So fix the MAINTAINERS file to show the current situation. Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230724104547.3061709-2-kvalo@kernel.org commit a1ce186db7f0e449f35d12fb55ae0da2a1b400e2 Author: Kalle Valo Date: Mon Jul 24 13:08:23 2023 +0300 Revert "wifi: ath6k: silence false positive -Wno-dangling-pointer warning on GCC 12" This reverts commit bd1d129daa3ede265a880e2c6a7f91eab0f4dc62. The dangling-pointer warnings were disabled kernel-wide by commit 49beadbd47c2 ("gcc-12: disable '-Wdangling-pointer' warning for now") for v5.19. So this hack in ath6kl is not needed anymore. Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230724100823.2948804-1-kvalo@kernel.org commit fd7f08d92fcd7cc3eca0dd6c853f722a4c6176df Author: Ilan Peer Date: Sun Jul 23 23:10:43 2023 +0300 wifi: cfg80211: Fix return value in scan logic The reporter noticed a warning when running iwlwifi: WARNING: CPU: 8 PID: 659 at mm/page_alloc.c:4453 __alloc_pages+0x329/0x340 As cfg80211_parse_colocated_ap() is not expected to return a negative value return 0 and not a negative value if cfg80211_calc_short_ssid() fails. Fixes: c8cb5b854b40f ("nl80211/cfg80211: support 6 GHz scanning") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217675 Signed-off-by: Ilan Peer Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230723201043.3007430-1-ilan.peer@intel.com commit d265ebe41c911314bd273c218a37088835959fa1 Author: Kalle Valo Date: Thu Jul 20 18:14:44 2023 +0300 Revert "wifi: ath11k: Enable threaded NAPI" This reverts commit 13aa2fb692d3717767303817f35b3e650109add3. This commit broke QCN9074 initialisation: [ 358.960477] ath11k_pci 0000:04:00.0: ce desc not available for wmi command 36866 [ 358.960481] ath11k_pci 0000:04:00.0: failed to send WMI_STA_POWERSAVE_PARAM_CMDID [ 358.960484] ath11k_pci 0000:04:00.0: could not set uapsd params -105 As there's no fix available let's just revert it to get QCN9074 working again. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217536 Signed-off-by: Kalle Valo Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230720151444.2016637-1-kvalo@kernel.org commit 58f6259b7a08f8d47d4629609703d358b042f0fd Author: Rahul Singh Date: Tue Jul 18 12:31:07 2023 +0100 xen/evtchn: Introduce new IOCTL to bind static evtchn Xen 4.17 supports the creation of static evtchns. To allow user space application to bind static evtchns introduce new ioctl "IOCTL_EVTCHN_BIND_STATIC". Existing IOCTL doing more than binding that’s why we need to introduce the new IOCTL to only bind the static event channels. Static evtchns to be available for use during the lifetime of the guest. When the application exits, __unbind_from_irq() ends up being called from release() file operations because of that static evtchns are getting closed. To avoid closing the static event channel, add the new bool variable "is_static" in "struct irq_info" to mark the event channel static when creating the event channel to avoid closing the static evtchn. Also, take this opportunity to remove the open-coded version of the evtchn close in drivers/xen/evtchn.c file and use xen_evtchn_close(). Signed-off-by: Rahul Singh Reviewed-by: Oleksandr Tyshchenko Acked-by: Stefano Stabellini Link: https://lore.kernel.org/r/ae7329bf1713f83e4aad4f3fa0f316258c40a3e9.1689677042.git.rahul.singh@arm.com Signed-off-by: Juergen Gross commit 02ab7234fc69695736d60b34044fe591689ffadd Author: Masami Hiramatsu (Google) Date: Tue Jul 25 10:37:29 2023 +0900 selftests/ftrace: Fix to check fprobe event eneblement Fix to check the availability of fprobe and kprobes for add_remove_btfarg.tc. Only if both kprobe and fprobe are not supported, it should return "unsupported". Link: https://lore.kernel.org/all/169024904889.395371.17998733386857387118.stgit@devnote2/ Fixes: 4231f30fcc34 ("selftests/ftrace: Add BTF arguments test cases") Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit 1f9f4f4777e7958e5c1fbdfd9ddf4207dc00a40f Author: Masami Hiramatsu (Google) Date: Tue Jul 25 10:37:19 2023 +0900 tracing/probes: Fix to add NULL check for BTF APIs Since find_btf_func_param() abd btf_type_by_id() can return NULL, the caller must check the return value correctly. Link: https://lore.kernel.org/all/169024903951.395371.11361556840733470934.stgit@devnote2/ Fixes: b576e09701c7 ("tracing/probes: Support function parameters if BTF is available") Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit e11ec2b868af2b351c6c1e2e50eb711cc5423a10 Author: Alex Elder Date: Mon Jul 24 17:40:55 2023 -0500 net: ipa: only reset hashed tables when supported Last year, the code that manages GSI channel transactions switched from using spinlock-protected linked lists to using indexes into the ring buffer used for a channel. Recently, Google reported seeing transaction reference count underflows occasionally during shutdown. Doug Anderson found a way to reproduce the issue reliably, and bisected the issue to the commit that eliminated the linked lists and the lock. The root cause was ultimately determined to be related to unused transactions being committed as part of the modem shutdown cleanup activity. Unused transactions are not normally expected (except in error cases). The modem uses some ranges of IPA-resident memory, and whenever it shuts down we zero those ranges. In ipa_filter_reset_table() a transaction is allocated to zero modem filter table entries. If hashing is not supported, hashed table memory should not be zeroed. But currently nothing prevents that, and the result is an unused transaction. Something similar occurs when we zero routing table entries for the modem. By preventing any attempt to clear hashed tables when hashing is not supported, the reference count underflow is avoided in this case. Note that there likely remains an issue with properly freeing unused transactions (if they occur due to errors). This patch addresses only the underflows that Google originally reported. Cc: # 6.1.x Fixes: d338ae28d8a8 ("net: ipa: kill all other transaction lists") Tested-by: Douglas Anderson Signed-off-by: Alex Elder Link: https://lore.kernel.org/r/20230724224055.1688854-1-elder@linaro.org Signed-off-by: Jakub Kicinski commit a49441c9ab059ce47f97dc15fb82d4e7b7b2ef65 Merge: 55cef78c244d0 a0ade8404c3bc Author: Jakub Kicinski Date: Tue Jul 25 20:10:08 2023 -0700 Merge branch 'net-fix-error-warning-by-fstrict-flex-arrays-3' Kuniyuki Iwashima says: ==================== net: Fix error/warning by -fstrict-flex-arrays=3. df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3") started applying strict rules for standard string functions (strlen(), memcpy(), etc.) if CONFIG_FORTIFY_SOURCE=y. This series fixes two false positives caught by syzkaller. v2: https://lore.kernel.org/netdev/20230720004410.87588-1-kuniyu@amazon.com/ v1: https://lore.kernel.org/netdev/20230719185322.44255-1-kuniyu@amazon.com/ ==================== Link: https://lore.kernel.org/r/20230724213425.22920-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit a0ade8404c3bc2bf2631cb0f20d372eed22d9d96 Author: Kuniyuki Iwashima Date: Mon Jul 24 14:34:25 2023 -0700 af_packet: Fix warning of fortified memcpy() in packet_getname(). syzkaller found a warning in packet_getname() [0], where we try to copy 16 bytes to sockaddr_ll.sll_addr[8]. Some devices (ip6gre, vti6, ip6tnl) have 16 bytes address expressed by struct in6_addr. Also, Infiniband has 32 bytes as MAX_ADDR_LEN. The write seems to overflow, but actually not since we use struct sockaddr_storage defined in __sys_getsockname() and its size is 128 (_K_SS_MAXSIZE) bytes. Thus, we have sufficient room after sll_addr[] as __data[]. To avoid the warning, let's add a flex array member union-ed with sll_addr. Another option would be to use strncpy() and limit the copied length to sizeof(sll_addr), but it will return the partial address and break an application that passes sockaddr_storage to getsockname(). [0]: memcpy: detected field-spanning write (size 16) of single field "sll->sll_addr" at net/packet/af_packet.c:3604 (size 8) WARNING: CPU: 0 PID: 255 at net/packet/af_packet.c:3604 packet_getname+0x25c/0x3a0 net/packet/af_packet.c:3604 Modules linked in: CPU: 0 PID: 255 Comm: syz-executor750 Not tainted 6.5.0-rc1-00330-g60cc1f7d0605 #4 Hardware name: linux,dummy-virt (DT) pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : packet_getname+0x25c/0x3a0 net/packet/af_packet.c:3604 lr : packet_getname+0x25c/0x3a0 net/packet/af_packet.c:3604 sp : ffff800089887bc0 x29: ffff800089887bc0 x28: ffff000010f80f80 x27: 0000000000000003 x26: dfff800000000000 x25: ffff700011310f80 x24: ffff800087d55000 x23: dfff800000000000 x22: ffff800089887c2c x21: 0000000000000010 x20: ffff00000de08310 x19: ffff800089887c20 x18: ffff800086ab1630 x17: 20646c6569662065 x16: 6c676e697320666f x15: 0000000000000001 x14: 1fffe0000d56d7ca x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 3e60944c3da92b00 x8 : 3e60944c3da92b00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000898874f8 x4 : ffff800086ac99e0 x3 : ffff8000803f8808 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 0000000000000000 Call trace: packet_getname+0x25c/0x3a0 net/packet/af_packet.c:3604 __sys_getsockname+0x168/0x24c net/socket.c:2042 __do_sys_getsockname net/socket.c:2057 [inline] __se_sys_getsockname net/socket.c:2054 [inline] __arm64_sys_getsockname+0x7c/0x94 net/socket.c:2054 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x134/0x240 arch/arm64/kernel/syscall.c:139 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188 el0_svc+0x2c/0x7c arch/arm64/kernel/entry-common.c:647 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 Fixes: df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3") Reported-by: syzkaller Suggested-by: Kees Cook Signed-off-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230724213425.22920-3-kuniyu@amazon.com Reviewed-by: Simon Horman Reviewed-by: Kees Cook Signed-off-by: Jakub Kicinski commit 06d4c8a80836d76ffec4f71ddb3de94ee93ab40d Author: Kuniyuki Iwashima Date: Mon Jul 24 14:34:24 2023 -0700 af_unix: Fix fortify_panic() in unix_bind_bsd(). syzkaller found a bug in unix_bind_bsd() [0]. We can reproduce it by bind()ing a socket on a path with length 108. 108 is the size of sun_addr of struct sockaddr_un and is the maximum valid length for the pathname socket. When calling bind(), we use struct sockaddr_storage as the actual buffer size, so terminating sun_addr[108] with null is legitimate as done in unix_mkname_bsd(). However, strlen(sunaddr) for such a case causes fortify_panic() if CONFIG_FORTIFY_SOURCE=y. __fortify_strlen() has no idea about the actual buffer size and see the string as unterminated. Let's use strnlen() to allow sun_addr to be unterminated at 107. [0]: detected buffer overflow in __fortify_strlen kernel BUG at lib/string_helpers.c:1031! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 255 Comm: syz-executor296 Not tainted 6.5.0-rc1-00330-g60cc1f7d0605 #4 Hardware name: linux,dummy-virt (DT) pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : fortify_panic+0x1c/0x20 lib/string_helpers.c:1030 lr : fortify_panic+0x1c/0x20 lib/string_helpers.c:1030 sp : ffff800089817af0 x29: ffff800089817af0 x28: ffff800089817b40 x27: 1ffff00011302f68 x26: 000000000000006e x25: 0000000000000012 x24: ffff800087e60140 x23: dfff800000000000 x22: ffff800089817c20 x21: ffff800089817c8e x20: 000000000000006c x19: ffff00000c323900 x18: ffff800086ab1630 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001 x14: 1ffff00011302eb8 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 64a26b65474d2a00 x8 : 64a26b65474d2a00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800089817438 x4 : ffff800086ac99e0 x3 : ffff800080f19e8c x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000002c Call trace: fortify_panic+0x1c/0x20 lib/string_helpers.c:1030 _Z16__fortify_strlenPKcU25pass_dynamic_object_size1 include/linux/fortify-string.h:217 [inline] unix_bind_bsd net/unix/af_unix.c:1212 [inline] unix_bind+0xba8/0xc58 net/unix/af_unix.c:1326 __sys_bind+0x1ac/0x248 net/socket.c:1792 __do_sys_bind net/socket.c:1803 [inline] __se_sys_bind net/socket.c:1801 [inline] __arm64_sys_bind+0x7c/0x94 net/socket.c:1801 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x134/0x240 arch/arm64/kernel/syscall.c:139 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:188 el0_svc+0x2c/0x7c arch/arm64/kernel/entry-common.c:647 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 Code: aa0003e1 d0000e80 91030000 97ffc91a (d4210000) Fixes: df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3") Reported-by: syzkaller Suggested-by: Kees Cook Signed-off-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230724213425.22920-2-kuniyu@amazon.com Reviewed-by: Simon Horman Reviewed-by: Kees Cook Signed-off-by: Jakub Kicinski commit 55cef78c244d0d076f5a75a35530ca63c92f4426 Author: Lin Ma Date: Sun Jul 23 16:02:05 2023 +0800 macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF The previous commit 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff") added one additional attribute named IFLA_MACVLAN_BC_CUTOFF to allow broadcast cutfoff. However, it forgot to describe the nla_policy at macvlan_policy (drivers/net/macvlan.c). Hence, this suppose NLA_S32 (4 bytes) integer can be faked as empty (0 bytes) by a malicious user, which could leads to OOB in heap just like CVE-2023-3773. To fix it, this commit just completes the nla_policy description for IFLA_MACVLAN_BC_CUTOFF. This enforces the length check and avoids the potential OOB read. Fixes: 954d1fa1ac93 ("macvlan: Add netlink attribute for broadcast cutoff") Signed-off-by: Lin Ma Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230723080205.3715164-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski commit d4e0265345778c623d1fe619075b677731847c34 Author: Yang Yingliang Date: Tue Jul 25 20:57:06 2023 +0800 scsi: pm80xx: Fix error return code in pm8001_pci_probe() If pm8001_init_sas_add() fails, return error code in pm8001_pci_probe(). Fixes: 14a8f116cdc0 ("scsi: pm80xx: Add GET_NVMD timeout during probe") Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20230725125706.566990-1-yangyingliang@huawei.com Reviewed-by: Igor Pylypiv Signed-off-by: Martin K. Petersen commit e65851989001c0c9ba9177564b13b38201c0854c Author: Steffen Maier Date: Mon Jul 24 16:51:56 2023 +0200 scsi: zfcp: Defer fc_rport blocking until after ADISC response Storage devices are free to send RSCNs, e.g. for internal state changes. If this happens on all connected paths, zfcp risks temporarily losing all paths at the same time. This has strong requirements on multipath configuration such as "no_path_retry queue". Avoid such situations by deferring fc_rport blocking until after the ADISC response, when any actual state change of the remote port became clear. The already existing port recovery triggers explicitly block the fc_rport. The triggers are: on ADISC reject or timeout (typical cable pull case), and on ADISC indicating that the remote port has changed its WWPN or the port is meanwhile no longer open. As a side effect, this also removes a confusing direct function call to another work item function zfcp_scsi_rport_work() instead of scheduling that other work item. It was probably done that way to have the rport block side effect immediate and synchronous to the caller. Fixes: a2fa0aede07c ("[SCSI] zfcp: Block FC transport rports early on errors") Cc: stable@vger.kernel.org #v2.6.30+ Reviewed-by: Benjamin Block Reviewed-by: Fedor Loshakov Signed-off-by: Steffen Maier Link: https://lore.kernel.org/r/20230724145156.3920244-1-maier@linux.ibm.com Signed-off-by: Martin K. Petersen commit aa89592fcb3af8372bd39ff468fdd65477f57201 Merge: 284779dbf4e98 d62cc390c2e99 Author: Alexei Starovoitov Date: Tue Jul 25 17:04:27 2023 -0700 Merge branch 'bpf-disable-preemption-in-perf_event_output-helpers-code' Jiri Olsa says: ==================== bpf: Disable preemption in perf_event_output helpers code hi, we got report of kernel crash [1][3] within bpf_event_output helper. The reason is the nesting protection code in bpf_event_output that expects disabled preemption, which is not guaranteed for programs executed by bpf_prog_run_array_cg. I managed to reproduce on tracing side where we have the same problem in bpf_perf_event_output. The reproducer [2] just creates busy uprobe and call bpf_perf_event_output helper a lot. v3 changes: - added acks and fixed 'Fixes' tag style [Hou Tao] - added Closes tag to patch 2 v2 changes: - I changed 'Fixes' commits to where I saw we switched from preempt_disable to migrate_disable, but I'm not completely sure about the patch 2, because it was tricky to find, would be nice if somebody could check on that thanks, jirka [1] https://github.com/cilium/cilium/issues/26756 [2] https://git.kernel.org/pub/scm/linux/kernel/git/jolsa/perf.git/commit/?h=bpf_output_fix_reproducer&id=8054dcc634121b884c7c331329d61d93351d03b5 [3] slack: [66194.378161] BUG: kernel NULL pointer dereference, address: 0000000000000001 [66194.378324] #PF: supervisor instruction fetch in kernel mode [66194.378447] #PF: error_code(0x0010) - not-present page ... [66194.378692] Oops: 0010 [#1] PREEMPT SMP NOPTI ... [66194.380666] [66194.380775] ? perf_output_sample+0x12a/0x9a0 [66194.380902] ? finish_task_switch.isra.0+0x81/0x280 [66194.381024] ? perf_event_output+0x66/0xa0 [66194.381148] ? bpf_event_output+0x13a/0x190 [66194.381270] ? bpf_event_output_data+0x22/0x40 [66194.381391] ? bpf_prog_dfc84bbde731b257_cil_sock4_connect+0x40a/0xacb [66194.381519] ? xa_load+0x87/0xe0 [66194.381635] ? __cgroup_bpf_run_filter_sock_addr+0xc1/0x1a0 [66194.381759] ? release_sock+0x3e/0x90 [66194.381876] ? sk_setsockopt+0x1a1/0x12f0 [66194.381996] ? udp_pre_connect+0x36/0x50 [66194.382114] ? inet_dgram_connect+0x93/0xa0 [66194.382233] ? __sys_connect+0xb4/0xe0 [66194.382353] ? udp_setsockopt+0x27/0x40 [66194.382470] ? __pfx_udp_push_pending_frames+0x10/0x10 [66194.382593] ? __sys_setsockopt+0xdf/0x1a0 [66194.382713] ? __x64_sys_connect+0xf/0x20 [66194.382832] ? do_syscall_64+0x3a/0x90 [66194.382949] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [66194.383077] --- ==================== Link: https://lore.kernel.org/r/20230725084206.580930-1-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit d62cc390c2e99ae267ffe4b8d7e2e08b6c758c32 Author: Jiri Olsa Date: Tue Jul 25 10:42:06 2023 +0200 bpf: Disable preemption in bpf_event_output We received report [1] of kernel crash, which is caused by using nesting protection without disabled preemption. The bpf_event_output can be called by programs executed by bpf_prog_run_array_cg function that disabled migration but keeps preemption enabled. This can cause task to be preempted by another one inside the nesting protection and lead eventually to two tasks using same perf_sample_data buffer and cause crashes like: BUG: kernel NULL pointer dereference, address: 0000000000000001 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page ... ? perf_output_sample+0x12a/0x9a0 ? finish_task_switch.isra.0+0x81/0x280 ? perf_event_output+0x66/0xa0 ? bpf_event_output+0x13a/0x190 ? bpf_event_output_data+0x22/0x40 ? bpf_prog_dfc84bbde731b257_cil_sock4_connect+0x40a/0xacb ? xa_load+0x87/0xe0 ? __cgroup_bpf_run_filter_sock_addr+0xc1/0x1a0 ? release_sock+0x3e/0x90 ? sk_setsockopt+0x1a1/0x12f0 ? udp_pre_connect+0x36/0x50 ? inet_dgram_connect+0x93/0xa0 ? __sys_connect+0xb4/0xe0 ? udp_setsockopt+0x27/0x40 ? __pfx_udp_push_pending_frames+0x10/0x10 ? __sys_setsockopt+0xdf/0x1a0 ? __x64_sys_connect+0xf/0x20 ? do_syscall_64+0x3a/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc Fixing this by disabling preemption in bpf_event_output. [1] https://github.com/cilium/cilium/issues/26756 Cc: stable@vger.kernel.org Reported-by: Oleg "livelace" Popov Closes: https://github.com/cilium/cilium/issues/26756 Fixes: 2a916f2f546c ("bpf: Use migrate_disable/enable in array macros and cgroup/lirc code.") Acked-by: Hou Tao Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20230725084206.580930-3-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit f2c67a3e60d1071b65848efaa8c3b66c363dd025 Author: Jiri Olsa Date: Tue Jul 25 10:42:05 2023 +0200 bpf: Disable preemption in bpf_perf_event_output The nesting protection in bpf_perf_event_output relies on disabled preemption, which is guaranteed for kprobes and tracepoints. However bpf_perf_event_output can be also called from uprobes context through bpf_prog_run_array_sleepable function which disables migration, but keeps preemption enabled. This can cause task to be preempted by another one inside the nesting protection and lead eventually to two tasks using same perf_sample_data buffer and cause crashes like: kernel tried to execute NX-protected page - exploit attempt? (uid: 0) BUG: unable to handle page fault for address: ffffffff82be3eea ... Call Trace: ? __die+0x1f/0x70 ? page_fault_oops+0x176/0x4d0 ? exc_page_fault+0x132/0x230 ? asm_exc_page_fault+0x22/0x30 ? perf_output_sample+0x12b/0x910 ? perf_event_output+0xd0/0x1d0 ? bpf_perf_event_output+0x162/0x1d0 ? bpf_prog_c6271286d9a4c938_krava1+0x76/0x87 ? __uprobe_perf_func+0x12b/0x540 ? uprobe_dispatcher+0x2c4/0x430 ? uprobe_notify_resume+0x2da/0xce0 ? atomic_notifier_call_chain+0x7b/0x110 ? exit_to_user_mode_prepare+0x13e/0x290 ? irqentry_exit_to_user_mode+0x5/0x30 ? asm_exc_int3+0x35/0x40 Fixing this by disabling preemption in bpf_perf_event_output. Cc: stable@vger.kernel.org Fixes: 8c7dcb84e3b7 ("bpf: implement sleepable uprobes by chaining gps") Acked-by: Hou Tao Signed-off-by: Jiri Olsa Link: https://lore.kernel.org/r/20230725084206.580930-2-jolsa@kernel.org Signed-off-by: Alexei Starovoitov commit 1cfe2d28e4d50a4e3e49344ade3b28f8dc26f891 Author: Yang Yingliang Date: Tue Jul 25 20:28:09 2023 +0800 ata: pata_octeon_cf: fix error return code in octeon_cf_probe() The variable 'rv' is set to 0 after calling of_property_read_reg(), so it cannot be used as an error code. Change to using correct error codes in the error path. Fixes: d0b2461678b1 ("ata: Use of_property_read_reg() to parse "reg"") Signed-off-by: Yang Yingliang Reviewed-by: Sergey Shtylyov Reviewed-by: Rob Herring Signed-off-by: Damien Le Moal commit 4139f992c49356391fb086c0c8ce51f66c26d623 Author: Minjie Du Date: Tue Jul 25 11:06:25 2023 +0800 ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer() It is possible for dma_request_chan() to return EPROBE_DEFER, which means acdev->host->dev is not ready yet. At this point dev_err() will have no output. Use dev_err_probe() instead. Signed-off-by: Minjie Du Acked-by: Viresh Kumar Reviewed-by: Sergey Shtylyov Signed-off-by: Damien Le Moal commit 18b44bc5a67275641fb26f2c54ba7eef80ac5950 Author: Eric Snowberg Date: Tue Jul 25 17:56:46 2023 -0400 ovl: Always reevaluate the file signature for IMA Commit db1d1e8b9867 ("IMA: use vfs_getattr_nosec to get the i_version") partially closed an IMA integrity issue when directly modifying a file on the lower filesystem. If the overlay file is first opened by a user and later the lower backing file is modified by root, but the extended attribute is NOT updated, the signature validation succeeds with the old original signature. Update the super_block s_iflags to SB_I_IMA_UNVERIFIABLE_SIGNATURE to force signature reevaluation on every file access until a fine grained solution can be found. Signed-off-by: Eric Snowberg Signed-off-by: Mimi Zohar Signed-off-by: Linus Torvalds commit 9f9116406120638b4d8db3831ffbc430dd2e1e95 Author: Kirill A. Shutemov Date: Tue Jul 25 02:03:29 2023 +0300 x86/traps: Fix load_unaligned_zeropad() handling for shared TDX memory Commit c4e34dd99f2e ("x86: simplify load_unaligned_zeropad() implementation") changes how exceptions around load_unaligned_zeropad() handled. The kernel now uses the fault_address in fixup_exception() to verify the address calculations for the load_unaligned_zeropad(). It works fine for #PF, but breaks on #VE since no fault address is passed down to fixup_exception(). Propagating ve_info.gla down to fixup_exception() resolves the issue. See commit 1e7769653b06 ("x86/tdx: Handle load_unaligned_zeropad() page-cross to a shared page") for more context. Signed-off-by: Kirill A. Shutemov Reported-by: Michael Kelley Fixes: c4e34dd99f2e ("x86: simplify load_unaligned_zeropad() implementation") Acked-by: Dave Hansen Signed-off-by: Linus Torvalds commit aa6fde93f3a49e42c0fe0490d7f3711bac0d162e Author: Tejun Heo Date: Mon Jul 17 12:50:02 2023 -1000 workqueue: Scale up wq_cpu_intensive_thresh_us if BogoMIPS is below 4000 wq_cpu_intensive_thresh_us is used to detect CPU-hogging per-cpu work items. Once detected, they're excluded from concurrency management to prevent them from blocking other per-cpu work items. If CONFIG_WQ_CPU_INTENSIVE_REPORT is enabled, repeat offenders are also reported so that the code can be updated. The default threshold is 10ms which is long enough to do fair bit of work on modern CPUs while short enough to be usually not noticeable. This unfortunately leads to a lot of, arguable spurious, detections on very slow CPUs. Using the same threshold across CPUs whose performance levels may be apart by multiple levels of magnitude doesn't make whole lot of sense. This patch scales up wq_cpu_intensive_thresh_us upto 1 second when BogoMIPS is below 4000. This is obviously very inaccurate but it doesn't have to be accurate to be useful. The mechanism is still useful when the threshold is fully scaled up and the benefits of reports are usually shared with everyone regardless of who's reporting, so as long as there are sufficient number of fast machines reporting, we don't lose much. Some (or is it all?) ARM CPUs systemtically report significantly lower BogoMIPS. While this doesn't break anything, given how widespread ARM CPUs are, it's at least a missed opportunity and it probably would be a good idea to teach workqueue about it. Signed-off-by: Tejun Heo Reported-and-Tested-by: Geert Uytterhoeven commit 0b4a9fdc9317440a71d4d4c264a5650bf4a90f3c Merge: af2e19389c2c1 f75546f58a70d Author: Linus Torvalds Date: Tue Jul 25 13:54:04 2023 -0700 Merge tag 'nfsd-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fix from Chuck Lever: - Fix TEST_STATEID response * tag 'nfsd-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: Remove incorrect check in nfsd4_validate_stateid commit bc1688fce2ec7726112276650762275392d1bab1 Author: Lijo Lazar Date: Tue Jul 25 11:00:08 2023 +0530 drm/amdgpu: Restore HQD persistent state register On GFX v9.4.3, compute queue MQD is populated using the values in HQD persistent state register. Hence don't clear the values on module unload, instead restore it to the default reset value so that MQD is initialized correctly during next module load. In particular, preload flag needs to be set on compute queue MQD, otherwise it could cause uninitialized values being used at device reset state resulting in EDC. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 38ac4e8385ffb275b1837986ca6c16f26ea028c5 Author: Dan Carpenter Date: Fri Jul 21 17:55:49 2023 +0300 drm/amd/display: Unlock on error path in dm_handle_mst_sideband_msg_ready_event() This error path needs to unlock the "aconnector->handle_mst_msg_ready" mutex before returning. Fixes: 4f6d9e38c4d2 ("drm/amd/display: Add polling method to handle MST reply packet") Signed-off-by: Dan Carpenter Signed-off-by: Alex Deucher commit de612738e9771bd66aeb20044486c457c512f684 Author: Leo Chen Date: Wed Jul 12 16:50:15 2023 -0400 drm/amd/display: Exit idle optimizations before attempt to access PHY [Why & How] DMUB may hang when powering down pixel clocks due to no dprefclk. It is fixed by exiting idle optimization before the attempt to access PHY. Reviewed-by: Nicholas Kazlauskas Acked-by: Alex Hung Signed-off-by: Leo Chen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 4509e69a07761d08df7c46d4a08c8222522b1933 Author: Alvin Lee Date: Wed Jul 12 17:22:25 2023 -0400 drm/amd/display: Don't apply FIFO resync W/A if rdivider = 0 [Description] It is not valid to set the WDIVIDER value to 0, so do not re-write to DISPCLK_WDIVIDER if the current value is 0 (i.e., it is at it's initial value and we have not made any requests to change DISPCLK yet). Reviewed-by: Saaem Rizvi Acked-by: Alex Hung Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 25b054c3c89cb6a7106a7982f0f70e83d0797dab Author: George Shen Date: Tue Jul 11 13:22:36 2023 -0400 drm/amd/display: Guard DCN31 PHYD32CLK logic against chip family [Why] Current yellow carp B0 PHYD32CLK logic is incorrectly applied to other ASICs. [How] Add guard to check chip family is yellow carp before applying logic. Reviewed-by: Hansen Dsouza Acked-by: Alex Hung Signed-off-by: George Shen Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 4a37c55b859a69f429bfa7fab4fc43ee470b60ed Author: Jane Jian Date: Thu Jul 20 18:08:07 2023 +0800 drm/amd/smu: use AverageGfxclkFrequency* to replace previous GFX Curr Clock Report current GFX clock also from average clock value as the original CurrClock data is not valid/accurate any more as per FW team Signed-off-by: Jane Jian Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit c01aebeef3ce45f696ffa0a1303cea9b34babb45 Author: Mario Limonciello Date: Thu Jul 13 00:14:59 2023 -0500 drm/amd: Fix an error handling mistake in psp_sw_init() If the second call to amdgpu_bo_create_kernel() fails, the memory allocated from the first call should be cleared. If the third call fails, the memory from the second call should be cleared. Fixes: b95b5391684b ("drm/amdgpu/psp: move PSP memory alloc from hw_init to sw_init") Signed-off-by: Mario Limonciello Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 9beb223f2a3d1bb2cc4dff71b9750d2b82f01ae5 Author: Victor Lu Date: Tue Jul 18 14:31:58 2023 -0400 drm/amdgpu: Fix infinite loop in gfxhub_v1_2_xcc_gart_enable (v2) An instance of for_each_inst() was not changed to match its new behaviour and is causing a loop. v2: remove tmp_mask variable Fixes: b579ea632fca ("drm/amdgpu: Modify for_each_inst macro") Signed-off-by: Victor Lu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 602816c3ee3fdbf4a72cb4d2e5b8b756a5104b0f Author: Jonathan Kim Date: Wed Jul 12 16:32:29 2023 -0400 drm/amdkfd: fix trap handling work around for debugging Update the list of devices that require the cwsr trap handling workaround for debugging use cases. Signed-off-by: Jonathan Kim Acked-by: Ruili Ji Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit faafd6ca7e6e7100d21d3f43ec17674f36c9f843 Author: Sumit Gupta Date: Wed Jun 21 19:14:00 2023 +0530 memory: tegra: make icc_set_bw return zero if BWMGR not supported Return zero from icc_set_bw() to MC client driver if MRQ_BWMGR_INT is not supported by the BPMP-FW. Currently, 'EINVAL' is returned which causes error message in client drivers even when the platform doesn't support scaling. Fixes: 9365bf006f53 ("PCI: tegra194: Add interconnect support in Tegra234") Signed-off-by: Sumit Gupta Acked-by: Thierry Reding Link: https://lore.kernel.org/r/20230621134400.23070-5-sumitg@nvidia.com Signed-off-by: Krzysztof Kozlowski commit 39b1320e5dc2b707dfb5c25b0298ce9d4fc05aea Author: YueHaibing Date: Tue Jul 25 10:13:17 2023 +0800 drm/fb-helper: Remove unused inline function drm_fb_helper_defio_init() Since commit 8e86dee02253 ("drm/fb-helper: Remove drm_fb_helper_defio_init() and update docs") this inline helper not used anymore. Fixes: 8e86dee02253 ("drm/fb-helper: Remove drm_fb_helper_defio_init() and update docs") Signed-off-by: YueHaibing Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230725021317.8080-1-yuehaibing@huawei.com commit 748c5ea8b8796ae8ee80b8d3a3d940570b588d59 Author: Ruihong Luo Date: Thu Jul 13 08:42:36 2023 +0800 serial: 8250_dw: Preserve original value of DLF register Preserve the original value of the Divisor Latch Fraction (DLF) register. When the DLF register is modified without preservation, it can disrupt the baudrate settings established by firmware or bootloader, leading to data corruption and the generation of unreadable or distorted characters. Fixes: 701c5e73b296 ("serial: 8250_dw: add fractional divisor support") Cc: stable Signed-off-by: Ruihong Luo Link: https://lore.kernel.org/stable/20230713004235.35904-1-colorsu1922%40gmail.com Reviewed-by: Ilpo Järvinen Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230713004235.35904-1-colorsu1922@gmail.com Signed-off-by: Greg Kroah-Hartman commit 57c984f6fe20ebb9306d6e8c09b4f67fe63298c6 Author: Biju Das Date: Tue Jul 4 16:48:18 2023 +0100 tty: serial: sh-sci: Fix sleeping in atomic context Fix sleeping in atomic context warning as reported by the Smatch static checker tool by replacing disable_irq->disable_irq_nosync. Reported by: Dan Carpenter Fixes: 8749061be196 ("tty: serial: sh-sci: Add RZ/G2L SCIFA DMA tx support") Cc: stable@kernel.org Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230704154818.406913-1-biju.das.jz@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 9b8fef6345d5487137d4193bb0a0eae2203c284e Author: Samuel Holland Date: Fri Jun 23 23:01:59 2023 -0700 serial: sifive: Fix sifive_serial_console_setup() section This function is called indirectly from the platform driver probe function. Even if the driver is built in, it may be probed after free_initmem() due to deferral or unbinding/binding via sysfs. Thus the function cannot be marked as __init. Fixes: 45c054d0815b ("tty: serial: add driver for the SiFive UART") Cc: stable Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20230624060159.3401369-1-samuel.holland@sifive.com Signed-off-by: Greg Kroah-Hartman commit 916a4edf3daed845b1e5d6cf0578a7e43c6f520e Author: Vijaya Krishna Nivarthi Date: Tue Jul 25 17:18:09 2023 +0530 spi: spi-qcom-qspi: Add DMA_CHAIN_DONE to ALL_IRQS Add latest added DMA_CHAIN_DONE irq to QSPI_ALL_IRQS that encompasses all of the qspi IRQs. Signed-off-by: Vijaya Krishna Nivarthi Reviewed-by: Douglas Anderson Link: https://lore.kernel.org/r/1690285689-30233-5-git-send-email-quic_vnivarth@quicinc.com Signed-off-by: Mark Brown commit cfb81f2243b25a0d79accc6510ad66c5c5ad99ba Author: Vijaya Krishna Nivarthi Date: Tue Jul 25 17:18:08 2023 +0530 spi: spi-qcom-qspi: Call dma_wmb() after setting up descriptors After setting up dma descriptors and before initiaiting dma transfer, call dma_wmb() to ensure all writes go through. This doesn't fix any reported problem but is added for safety. Signed-off-by: Vijaya Krishna Nivarthi Fixes: b5762d95607e ("spi: spi-qcom-qspi: Add DMA mode support") Reviewed-by: Douglas Anderson Link: https://lore.kernel.org/r/1690285689-30233-4-git-send-email-quic_vnivarth@quicinc.com Signed-off-by: Mark Brown commit f7ba36d399c4558f36886adff9400be591b245f6 Author: Vijaya Krishna Nivarthi Date: Tue Jul 25 17:18:07 2023 +0530 spi: spi-qcom-qspi: Use GFP_ATOMIC flag while allocating for descriptor While allocating for DMA descriptor, GFP_KERNEL flag is being used and this allocation happens within critical section with spinlock acquired. This generates a static checker warning. Use GFP_ATOMIC to prevent sleeping; and since this increases chances of allocation failure, add handling accordingly. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/abc223e8-44af-40bb-a0bd-9865b393f435@moroto.mountain/ Signed-off-by: Vijaya Krishna Nivarthi Fixes: b5762d95607e ("spi: spi-qcom-qspi: Add DMA mode support") Reviewed-by: Douglas Anderson Link: https://lore.kernel.org/r/1690285689-30233-3-git-send-email-quic_vnivarth@quicinc.com Signed-off-by: Mark Brown commit 17aaf9ea07b656016316dc37716e987742b3e296 Author: Vijaya Krishna Nivarthi Date: Tue Jul 25 17:18:06 2023 +0530 spi: spi-qcom-qspi: Ignore disabled interrupts' status in isr During FIFO/DMA modes dynamic switching, only corresponding interrupts are enabled. However its possible that FIFO related interrupt status registers get set during DMA mode. For example WR_FIFO_EMPTY bit is set during DMA TX. Ignore such status bits so that they don't trip unwanted operations. Suggested-by: Douglas Anderson Signed-off-by: Vijaya Krishna Nivarthi Fixes: b5762d95607e ("spi: spi-qcom-qspi: Add DMA mode support") Reviewed-by: Douglas Anderson Tested-by: Douglas Anderson Link: https://lore.kernel.org/r/1690285689-30233-2-git-send-email-quic_vnivarth@quicinc.com Signed-off-by: Mark Brown commit af2e19389c2c1d8a299e04c5105b180ef0c5b5b5 Merge: 0b5547c51827e 922a9bd138101 Author: Linus Torvalds Date: Tue Jul 25 11:03:53 2023 -0700 Merge tag 'm68k-for-v6.5-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k fix from Geert Uytterhoeven: - Fix the build when using the toolchain in Debian unstable. * tag 'm68k-for-v6.5-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: Fix invalid .section syntax commit e29c3f81eb8904edb762ea450aa78f52e5044b31 Author: Randy Dunlap Date: Sun Jul 23 23:33:41 2023 -0700 Documentation: devices.txt: reconcile serial/ucc_uart minor numers Reconcile devices.txt with serial/ucc_uart.c regarding device number assignments. ucc_uart.c supports 4 ports and uses minor devnums 46-49, so update devices.txt with that info. Then update ucc_uart.c's reference to the location of the devices.txt list in the kernel source tree. Fixes: d7584ed2b994 ("[POWERPC] qe-uart: add support for Freescale QUICCEngine UART") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Randy Dunlap Cc: Timur Tabi Cc: Kumar Gala Cc: linuxppc-dev@lists.ozlabs.org Cc: Greg Kroah-Hartman Cc: Jiri Slaby Cc: linux-serial@vger.kernel.org Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Link: https://lore.kernel.org/r/20230724063341.28198-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman commit 767bb2aacf64752946f0a72fcec521a4968b2942 Author: Tony Lindgren Date: Fri Jul 21 10:23:32 2023 +0300 MAINTAINERS: Update TTY layer for lists and recently added files Add mailing lists for linux-serial and lkml for the TTY layer. And let's list the recently added files. This makes it easier for get_maintainer.pl to include linux-serial for patches. Signed-off-by: Tony Lindgren Link: https://lore.kernel.org/r/20230721072334.59272-1-tony@atomide.com Signed-off-by: Greg Kroah-Hartman commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239 Author: Chaoyuan Peng Date: Tue Jul 18 04:39:43 2023 +0000 tty: n_gsm: fix UAF in gsm_cleanup_mux In gsm_cleanup_mux() the 'gsm->dlci' pointer was not cleaned properly, leaving it a dangling pointer after gsm_dlci_release. This leads to use-after-free where 'gsm->dlci[0]' are freed and accessed by the subsequent gsm_cleanup_mux(). Such is the case in the following call trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 print_address_description+0x63/0x3b0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0x16b/0x1c0 mm/kasan/report.c:451 gsm_cleanup_mux+0x76a/0x850 drivers/tty/n_gsm.c:2397 gsm_config drivers/tty/n_gsm.c:2653 [inline] gsmld_ioctl+0xaae/0x15b0 drivers/tty/n_gsm.c:2986 tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb Allocated by task 3501: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc+0xba/0xf0 mm/kasan/common.c:513 kasan_kmalloc include/linux/kasan.h:264 [inline] kmem_cache_alloc_trace+0x143/0x290 mm/slub.c:3247 kmalloc include/linux/slab.h:591 [inline] kzalloc include/linux/slab.h:721 [inline] gsm_dlci_alloc+0x53/0x3a0 drivers/tty/n_gsm.c:1932 gsm_activate_mux+0x1c/0x330 drivers/tty/n_gsm.c:2438 gsm_config drivers/tty/n_gsm.c:2677 [inline] gsmld_ioctl+0xd46/0x15b0 drivers/tty/n_gsm.c:2986 tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 3501: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x80 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 ____kasan_slab_free+0xd8/0x120 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1705 [inline] slab_free_freelist_hook+0xdd/0x160 mm/slub.c:1731 slab_free mm/slub.c:3499 [inline] kfree+0xf1/0x270 mm/slub.c:4559 dlci_put drivers/tty/n_gsm.c:1988 [inline] gsm_dlci_release drivers/tty/n_gsm.c:2021 [inline] gsm_cleanup_mux+0x574/0x850 drivers/tty/n_gsm.c:2415 gsm_config drivers/tty/n_gsm.c:2653 [inline] gsmld_ioctl+0xaae/0x15b0 drivers/tty/n_gsm.c:2986 tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb Fixes: aa371e96f05d ("tty: n_gsm: fix restart handling via CLD command") Signed-off-by: Chaoyuan Peng Cc: stable Signed-off-by: Greg Kroah-Hartman commit 1e4ab7b4c881cf26c1c72b3f56519e03475486fb Author: Joe Thornber Date: Tue Jul 25 11:44:41 2023 -0400 dm cache policy smq: ensure IO doesn't prevent cleaner policy progress When using the cleaner policy to decommission the cache, there is never any writeback started from the cache as it is constantly delayed due to normal I/O keeping the device busy. Meaning @idle=false was always being passed to clean_target_met() Fix this by adding a specific 'cleaner' flag that is set when the cleaner policy is configured. This flag serves to always allow the cleaner's writeback work to be queued until the cache is decommissioned (even if the cache isn't idle). Reported-by: David Jeffery Fixes: b29d4986d0da ("dm cache: significant rework to leverage dm-bio-prison-v2") Cc: stable@vger.kernel.org Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer commit 7d5fff8982a2199d49ec067818af7d84d4f95ca0 Author: Yu Kuai Date: Sat Jul 8 17:21:53 2023 +0800 dm raid: protect md_stop() with 'reconfig_mutex' __md_stop_writes() and __md_stop() will modify many fields that are protected by 'reconfig_mutex', and all the callers will grab 'reconfig_mutex' except for md_stop(). Also, update md_stop() to make certain 'reconfig_mutex' is held using lockdep_assert_held(). Fixes: 9d09e663d550 ("dm: raid456 basic support") Signed-off-by: Yu Kuai Signed-off-by: Mike Snitzer commit e74c874eabe2e9173a8fbdad616cd89c70eb8ffd Author: Yu Kuai Date: Sat Jul 8 17:21:52 2023 +0800 dm raid: clean up four equivalent goto tags in raid_ctr() There are four equivalent goto tags in raid_ctr(), clean them up to use just one. There is no functional change and this is preparation to fix raid_ctr()'s unprotected md_stop(). Signed-off-by: Yu Kuai Signed-off-by: Mike Snitzer commit bae3028799dc4f1109acc4df37c8ff06f2d8f1a0 Author: Yu Kuai Date: Sat Jul 8 17:21:51 2023 +0800 dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths In the error paths 'bad_stripe_cache' and 'bad_check_reshape', 'reconfig_mutex' is still held after raid_ctr() returns. Fixes: 9dbd1aa3a81c ("dm raid: add reshaping support to the target") Signed-off-by: Yu Kuai Signed-off-by: Mike Snitzer commit d4a3806bea61c8ef6e0103d0f39786e00586522e Author: Mikulas Patocka Date: Mon Jul 3 17:12:39 2023 +0200 dm integrity: fix double free on memory allocation failure If the statement "recalc_tags = kvmalloc(recalc_tags_size, GFP_NOIO);" fails, we call "vfree(recalc_buffer)" and we jump to the label "oom". If the condition "recalc_sectors >= 1U << ic->sb->log2_sectors_per_block" is false, we jump to the label "free_ret" and call "vfree(recalc_buffer)" again, on an already released memory block. Fix the bug by setting "recalc_buffer = NULL" after freeing it. Fixes: da8b4fc1f63a ("dm integrity: only allocate recalculate buffer when needed") Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 2627335a1329a0d39d8d277994678571c4f21800 Author: Frank Li Date: Fri Jul 7 19:00:15 2023 -0400 usb: cdns3: fix incorrect calculation of ep_buf_size when more than one config Previously, the cdns3_gadget_check_config() function in the cdns3 driver mistakenly calculated the ep_buf_size by considering only one configuration's endpoint information because "claimed" will be clear after call usb_gadget_check_config(). The fix involves checking the private flags EP_CLAIMED instead of relying on the "claimed" flag. Fixes: dce49449e04f ("usb: cdns3: allocate TX FIFO size according to composite EP number") Cc: stable Reported-by: Ravi Gunasekaran Signed-off-by: Frank Li Acked-by: Peter Chen Tested-by: Ravi Gunasekaran Link: https://lore.kernel.org/r/20230707230015.494999-2-Frank.Li@nxp.com Signed-off-by: Greg Kroah-Hartman commit f4fc01af5b640bc39bd9403b5fd855345a2ad5f8 Author: Frank Li Date: Fri Jul 7 19:00:14 2023 -0400 usb: gadget: call usb_gadget_check_config() to verify UDC capability The legacy gadget driver omitted calling usb_gadget_check_config() to ensure that the USB device controller (UDC) has adequate resources, including sufficient endpoint numbers and types, to support the given configuration. Previously, usb_add_config() was solely invoked by the legacy gadget driver. Adds the necessary usb_gadget_check_config() after the bind() operation to fix the issue. Fixes: dce49449e04f ("usb: cdns3: allocate TX FIFO size according to composite EP number") Cc: stable Reported-by: Ravi Gunasekaran Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20230707230015.494999-1-Frank.Li@nxp.com Signed-off-by: Greg Kroah-Hartman commit 609fded3f91972ada551c141c5d04a71704f8967 Author: Kyle Tso Date: Fri Jun 23 23:10:36 2023 +0800 usb: typec: Use sysfs_emit_at when concatenating the string The buffer address used in sysfs_emit should be aligned to PAGE_SIZE. Use sysfs_emit_at instead to offset the buffer. Fixes: a7cff92f0635 ("usb: typec: USB Power Delivery helpers for ports and partners") Cc: stable@vger.kernel.org Signed-off-by: Kyle Tso Acked-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230623151036.3955013-4-kyletso@google.com Signed-off-by: Greg Kroah-Hartman commit 4b642dc9829507e4afabc03d32a18abbdb192c5e Author: Kyle Tso Date: Fri Jun 23 23:10:35 2023 +0800 usb: typec: Iterate pds array when showing the pd list The pointers of each usb_power_delivery handles are stored in "pds" array returned from the pd_get ops but not in the adjacent memory calculated from "pd". Get the handles from "pds" array directly instead of deriving them from "pd". Fixes: a7cff92f0635 ("usb: typec: USB Power Delivery helpers for ports and partners") Cc: stable@vger.kernel.org Signed-off-by: Kyle Tso Acked-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230623151036.3955013-3-kyletso@google.com Signed-off-by: Greg Kroah-Hartman commit b33ebb2415e7e0a55ee3d049c2890d3a3e3805b6 Author: Kyle Tso Date: Fri Jun 23 23:10:34 2023 +0800 usb: typec: Set port->pd before adding device for typec_port When calling device_add in the registration of typec_port, it will do the NULL check on usb_power_delivery handle in typec_port for the visibility of the device attributes. It is always NULL because port->pd is set in typec_port_set_usb_power_delivery which is later than the device_add call. Set port->pd before device_add and only link the device after that. Fixes: a7cff92f0635 ("usb: typec: USB Power Delivery helpers for ports and partners") Cc: stable@vger.kernel.org Signed-off-by: Kyle Tso Acked-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230623151036.3955013-2-kyletso@google.com Signed-off-by: Greg Kroah-Hartman commit da6d91ed77062960107e2eddacd932abecfd0592 Author: Yang Yingliang Date: Tue Jul 25 20:53:19 2023 +0800 usb: typec: qcom: fix return value check in qcom_pmic_typec_probe() device_get_named_child_node() returns NULL, if it fails, replace IS_ERR() with NULL pointer check. Fixes: a4422ff22142 ("usb: typec: qcom: Add Qualcomm PMIC Type-C driver") Signed-off-by: Yang Yingliang Acked-by: Konrad Dybcio Acked-by: Bryan O'Donoghue Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20230725125319.565733-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman commit a8291be6b5dd465c22af229483dbac543a91e24e Author: Dan Carpenter Date: Tue Jul 4 17:09:09 2023 +0300 Revert "usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()" This reverts commit f08aa7c80dac27ee00fa6827f447597d2fba5465. The reverted commit was based on static analysis and a misunderstanding of how PTR_ERR() and NULLs are supposed to work. When a function returns both pointer errors and NULL then normally the NULL means "continue operating without a feature because it was deliberately turned off". The NULL should not be treated as a failure. If a driver cannot work when that feature is disabled then the KConfig should enforce that the function cannot return NULL. We should not need to test for it. In this driver, the bug means that probe cannot succeed when CONFIG_PM is disabled. Signed-off-by: Dan Carpenter Fixes: f08aa7c80dac ("usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()") Cc: stable Link: https://lore.kernel.org/r/ZKQoBa84U/ykEh3C@moroto Signed-off-by: Greg Kroah-Hartman commit 288b4fa1798e3637a9304c6e90a93d900e02369c Author: Dan Carpenter Date: Tue Jul 4 17:08:27 2023 +0300 Revert "usb: xhci: tegra: Fix error check" This reverts commit 18fc7c435be3f17ea26a21b2e2312fcb9088e01f. The reverted commit was based on static analysis and a misunderstanding of how PTR_ERR() and NULLs are supposed to work. When a function returns both pointer errors and NULL then normally the NULL means "continue operating without a feature because it was deliberately turned off". The NULL should not be treated as a failure. If a driver cannot work when that feature is disabled then the KConfig should enforce that the function cannot return NULL. We should not need to test for it. In this code, the patch means that certain tegra_xusb_probe() will fail if the firmware supports power-domains but CONFIG_PM is disabled. Signed-off-by: Dan Carpenter Fixes: 18fc7c435be3 ("usb: xhci: tegra: Fix error check") Cc: stable Link: https://lore.kernel.org/r/8baace8d-fb4b-41a4-ad5f-848ae643a23b@moroto.mountain Signed-off-by: Greg Kroah-Hartman commit 83e30f2bf86ef7c38fbd476ed81a88522b620628 Author: Zqiang Date: Fri Jul 14 15:40:11 2023 +0800 USB: gadget: Fix the memory leak in raw_gadget driver Currently, increasing raw_dev->count happens before invoke the raw_queue_event(), if the raw_queue_event() return error, invoke raw_release() will not trigger the dev_free() to be called. [ 268.905865][ T5067] raw-gadget.0 gadget.0: failed to queue event [ 268.912053][ T5067] udc dummy_udc.0: failed to start USB Raw Gadget: -12 [ 268.918885][ T5067] raw-gadget.0: probe of gadget.0 failed with error -12 [ 268.925956][ T5067] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 268.934657][ T5067] misc raw-gadget: fail, usb_gadget_register_driver returned -16 BUG: memory leak [] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076 [] kmalloc include/linux/slab.h:582 [inline] [] kzalloc include/linux/slab.h:703 [inline] [] dev_new drivers/usb/gadget/legacy/raw_gadget.c:191 [inline] [] raw_open+0x45/0x110 drivers/usb/gadget/legacy/raw_gadget.c:385 [] misc_open+0x1a9/0x1f0 drivers/char/misc.c:165 [] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076 [] kmalloc include/linux/slab.h:582 [inline] [] raw_ioctl_init+0xdf/0x410 drivers/usb/gadget/legacy/raw_gadget.c:460 [] raw_ioctl+0x5f9/0x1120 drivers/usb/gadget/legacy/raw_gadget.c:1250 [] vfs_ioctl fs/ioctl.c:51 [inline] [] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076 [] kmalloc include/linux/slab.h:582 [inline] [] kzalloc include/linux/slab.h:703 [inline] [] dummy_alloc_request+0x5a/0xe0 drivers/usb/gadget/udc/dummy_hcd.c:665 [] usb_ep_alloc_request+0x22/0xd0 drivers/usb/gadget/udc/core.c:196 [] gadget_bind+0x6d/0x370 drivers/usb/gadget/legacy/raw_gadget.c:292 This commit therefore invoke kref_get() under the condition that raw_queue_event() return success. Reported-by: syzbot+feb045d335c1fdde5bf7@syzkaller.appspotmail.com Cc: stable Closes: https://syzkaller.appspot.com/bug?extid=feb045d335c1fdde5bf7 Signed-off-by: Zqiang Reviewed-by: Andrey Konovalov Tested-by: Andrey Konovalov Link: https://lore.kernel.org/r/20230714074011.20989-1-qiang.zhang1211@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6237390644fb92b81f5262877fe545d0d2c7b5d7 Author: Michael Grzeschik Date: Sat Jul 22 00:22:56 2023 +0200 usb: gadget: core: remove unbalanced mutex_unlock in usb_gadget_activate Commit 286d9975a838 ("usb: gadget: udc: core: Prevent soft_connect_store() race") introduced one extra mutex_unlock of connect_lock in the usb_gadget_active function. Fixes: 286d9975a838 ("usb: gadget: udc: core: Prevent soft_connect_store() race") Cc: stable Signed-off-by: Michael Grzeschik Reviewed-by: Alan Stern Link: https://lore.kernel.org/r/20230721222256.1743645-1-m.grzeschik@pengutronix.de Signed-off-by: Greg Kroah-Hartman commit 734ae15ab95a18d3d425fc9cb38b7a627d786f08 Author: Jakub Vanek Date: Fri Jul 14 14:24:19 2023 +0200 Revert "usb: dwc3: core: Enable AutoRetry feature in the controller" This reverts commit b138e23d3dff90c0494925b4c1874227b81bddf7. AutoRetry has been found to sometimes cause controller freezes when communicating with buggy USB devices. This controller feature allows the controller in host mode to send non-terminating/burst retry ACKs instead of terminating retry ACKs to devices when a transaction error (CRC error or overflow) occurs. Unfortunately, if the USB device continues to respond with a CRC error, the controller will not complete endpoint-related commands while it keeps trying to auto-retry. [3] The xHCI driver will notice this once it tries to abort the transfer using a Stop Endpoint command and does not receive a completion in time. [1] This situation is reported to dmesg: [sda] tag#29 uas_eh_abort_handler 0 uas-tag 1 inflight: CMD IN [sda] tag#29 CDB: opcode=0x28 28 00 00 69 42 80 00 00 48 00 xhci-hcd: xHCI host not responding to stop endpoint command xhci-hcd: xHCI host controller not responding, assume dead xhci-hcd: HC died; cleaning up Some users observed this problem on an Odroid HC2 with the JMS578 USB3-to-SATA bridge. The issue can be triggered by starting a read-heavy workload on an attached SSD. After a while, the host controller would die and the SSD would disappear from the system. [1] Further analysis by Synopsys determined that controller revisions other than the one in Odroid HC2 are also affected by this. The recommended solution was to disable AutoRetry altogether. This change does not have a noticeable performance impact. [2] Revert the enablement commit. This will keep the AutoRetry bit in the default state configured during SoC design [2]. Fixes: b138e23d3dff ("usb: dwc3: core: Enable AutoRetry feature in the controller") Link: https://lore.kernel.org/r/a21f34c04632d250cd0a78c7c6f4a1c9c7a43142.camel@gmail.com/ [1] Link: https://lore.kernel.org/r/20230711214834.kyr6ulync32d4ktk@synopsys.com/ [2] Link: https://lore.kernel.org/r/20230712225518.2smu7wse6djc7l5o@synopsys.com/ [3] Cc: stable@vger.kernel.org Cc: Mauro Ribeiro Cc: Krzysztof Kozlowski Suggested-by: Thinh Nguyen Signed-off-by: Jakub Vanek Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20230714122419.27741-1-linuxtardis@gmail.com Signed-off-by: Greg Kroah-Hartman commit 5bef4b3cb95a5b883dfec8b3ffc0d671323d55bb Author: Oliver Neukum Date: Thu Jul 13 13:28:10 2023 +0200 Revert "xhci: add quirk for host controllers that don't update endpoint DCS" This reverts commit 5255660b208aebfdb71d574f3952cf48392f4306. This quirk breaks at least the following hardware: 0b:00.0 0c03: 1106:3483 (rev 01) (prog-if 30 [XHCI]) Subsystem: 1106:3483 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+ Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- SERR- Fixes: 5255660b208a ("xhci: add quirk for host controllers that don't update endpoint DCS") Cc: stable Link: https://lore.kernel.org/r/20230713112830.21773-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 9dc162e22387080e2d06de708b89920c0e158c9a Author: Łukasz Bartosik Date: Mon Jul 24 13:29:11 2023 +0200 USB: quirks: add quirk for Focusrite Scarlett The Focusrite Scarlett audio device does not behave correctly during resumes. Below is what happens during every resume (captured with Beagle 5000): // The Scarlett disconnects and is enumerated again. However from time to time it drops completely off the USB bus during resume. Below is captured occurrence of such an event: // // To fix the condition a user has to unplug and plug the device again. With USB_QUIRK_RESET_RESUME applied ("usbcore.quirks=1235:8211:b") for the Scarlett audio device the issue still reproduces. Applying USB_QUIRK_DISCONNECT_SUSPEND ("usbcore.quirks=1235:8211:m") fixed the issue and the Scarlett audio device didn't drop off the USB bus for ~5000 suspend/resume cycles where originally issue reproduced in ~100 or less suspend/resume cycles. Signed-off-by: Łukasz Bartosik Cc: stable Link: https://lore.kernel.org/r/20230724112911.1802577-1-lb@semihalf.com Signed-off-by: Greg Kroah-Hartman commit 9fd10829a9eb482e192a845675ecc5480e0bfa10 Author: Ricardo Ribalda Date: Wed Jul 19 13:01:04 2023 +0000 usb: xhci-mtk: set the dma max_seg_size Allow devices to have dma operations beyond 64K, and avoid warnings such as: DMA-API: xhci-mtk 11200000.usb: mapping sg segment longer than device claims to support [len=98304] [max=65536] Fixes: 0cbd4b34cda9 ("xhci: mediatek: support MTK xHCI host controller") Cc: stable Tested-by: Zubin Mithra Reported-by: Zubin Mithra Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20230628-mtk-usb-v2-1-c8c34eb9f229@chromium.org Signed-off-by: Greg Kroah-Hartman commit 57111552a5284533282199ba20d0e264f4ed28bc Author: Roger Quadros Date: Wed Jul 12 15:28:28 2023 +0300 MAINTAINERS: drop invalid usb/cdns3 Reviewer e-mail Alternate working e-mail of this Reviewer not available so drop it do prevent unnecessary bounce backs. Signed-off-by: Roger Quadros Link: https://lore.kernel.org/r/20230712122828.17793-1-rogerq@kernel.org Signed-off-by: Greg Kroah-Hartman commit e835c0a4e23c38531dcee5ef77e8d1cf462658c7 Author: Jisheng Zhang Date: Wed Jun 28 00:20:18 2023 +0800 usb: dwc3: don't reset device side if dwc3 was configured as host-only Commit c4a5153e87fd ("usb: dwc3: core: Power-off core/PHYs on system_suspend in host mode") replaces check for HOST only dr_mode with current_dr_role. But during booting, the current_dr_role isn't initialized, thus the device side reset is always issued even if dwc3 was configured as host-only. What's more, on some platforms with host only dwc3, aways issuing device side reset by accessing device register block can cause kernel panic. Fixes: c4a5153e87fd ("usb: dwc3: core: Power-off core/PHYs on system_suspend in host mode") Cc: stable Signed-off-by: Jisheng Zhang Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20230627162018.739-1-jszhang@kernel.org Signed-off-by: Greg Kroah-Hartman commit 71c47ad8920ef19d6545202191252a50c03aca30 Author: Neil Armstrong Date: Mon Jun 26 18:52:00 2023 +0200 usb: typec: ucsi: move typec_set_mode(TYPEC_STATE_SAFE) to ucsi_unregister_partner() It's better to set TYPEC_STATE_SAFE mode from ucsi_unregister_partner() instead of ucsi_partner_change(), ucsi_unregister_partner() is always when the partner disconnects. Fixes: 25a2bc21c863 ("usb: typec: ucsi: call typec_set_mode on non-altmode partner change") Suggested-by: Heikki Krogerus Signed-off-by: Neil Armstrong Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20230626-topic-sm8550-usb-c-audio-fixup-v1-1-bc72fddf3f42@linaro.org Signed-off-by: Greg Kroah-Hartman commit c55afcbeaa7a6f4fffdbc999a9bf3f0b29a5186f Author: Guiting Shen Date: Mon Jun 26 23:27:13 2023 +0800 usb: ohci-at91: Fix the unhandle interrupt when resume The ohci_hcd_at91_drv_suspend() sets ohci->rh_state to OHCI_RH_HALTED when suspend which will let the ohci_irq() skip the interrupt after resume. And nobody to handle this interrupt. According to the comment in ohci_hcd_at91_drv_suspend(), it need to reset when resume from suspend(MEM) to fix by setting "hibernated" argument of ohci_resume(). Signed-off-by: Guiting Shen Cc: stable Reviewed-by: Alan Stern Link: https://lore.kernel.org/r/20230626152713.18950-1-aarongt.shen@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0d8f7cc8057890db08c54fe610d8a94af59da082 Author: Stefano Stabellini Date: Fri Jul 21 16:13:03 2023 -0700 xenbus: check xen_domain in xenbus_probe_initcall The same way we already do in xenbus_init. Fixes the following warning: [ 352.175563] Trying to free already-free IRQ 0 [ 352.177355] WARNING: CPU: 1 PID: 88 at kernel/irq/manage.c:1893 free_irq+0xbf/0x350 [...] [ 352.213951] Call Trace: [ 352.214390] [ 352.214717] ? __warn+0x81/0x170 [ 352.215436] ? free_irq+0xbf/0x350 [ 352.215906] ? report_bug+0x10b/0x200 [ 352.216408] ? prb_read_valid+0x17/0x20 [ 352.216926] ? handle_bug+0x44/0x80 [ 352.217409] ? exc_invalid_op+0x13/0x60 [ 352.217932] ? asm_exc_invalid_op+0x16/0x20 [ 352.218497] ? free_irq+0xbf/0x350 [ 352.218979] ? __pfx_xenbus_probe_thread+0x10/0x10 [ 352.219600] xenbus_probe+0x7a/0x80 [ 352.221030] xenbus_probe_thread+0x76/0xc0 Fixes: 5b3353949e89 ("xen: add support for initializing xenstore later as HVM domain") Signed-off-by: Stefano Stabellini Tested-by: Petr Mladek Reviewed-by: Oleksandr Tyshchenko Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2307211609140.3118466@ubuntu-linux-20-04-desktop Signed-off-by: Juergen Gross commit 13e098b58b8ff6d17f98f459dcc23ff064818e80 Merge: 6eaae19807608 d245aedc00775 Author: Greg Kroah-Hartman Date: Tue Jul 25 17:07:44 2023 +0200 Merge tag 'usb-serial-6.5-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial device ids for 6.5-rc4 Here are some new modem device ids and a new "simple" driver for a CAN bus device. Included is also a patch sorting the "simple" driver entries in order to make it more obvious where new ones should be added. All have been in linux-next with no reported issues. * tag 'usb-serial-6.5-rc4' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: simple: sort driver entries USB: serial: simple: add Kaufmann RKS+CAN VCP USB: serial: option: add Quectel EC200A module support USB: serial: option: support Quectel EM060K_128 commit 0bd66784274a287beada2933c2c0fa3a0ddae0d7 Author: Patrick Rudolph Date: Tue Jul 25 14:54:26 2023 +0200 hwmon: (pmbus_core) Fix NULL pointer dereference Pass i2c_client to _pmbus_is_enabled to drop the assumption that a regulator device is passed in. This will fix the issue of a NULL pointer dereference when called from _pmbus_get_flags. Fixes: df5f6b6af01c ("hwmon: (pmbus/core) Generalise pmbus get status") Cc: stable@vger.kernel.org # v6.4 Signed-off-by: Patrick Rudolph Signed-off-by: Naresh Solanki Link: https://lore.kernel.org/r/20230725125428.3966803-2-Naresh.Solanki@9elements.com Signed-off-by: Guenter Roeck commit 55aab08f1856894d7d47d0ee23abbb4bc4854345 Author: Patrick Rudolph Date: Tue Jul 25 14:54:25 2023 +0200 hwmon: (pmbus_core) Fix pmbus_is_enabled() Refactor pmbus_is_enabled() to return the status without any additional processing as it is already done in _pmbus_is_enabled(). Fixes: df5f6b6af01c ("hwmon: (pmbus/core) Generalise pmbus get status") Cc: stable@vger.kernel.org # v6.4 Signed-off-by: Patrick Rudolph Signed-off-by: Naresh Solanki Link: https://lore.kernel.org/r/20230725125428.3966803-1-Naresh.Solanki@9elements.com [groeck: Rephrased commit message] Signed-off-by: Guenter Roeck commit c21733754cd6ecbca346f2adf9b17d4cfa50504f Author: Konstantin Shelekhin Date: Sat Jul 22 18:59:20 2023 +0300 platform/x86: huawei-wmi: Silence ambient light sensor Currently huawei-wmi causes a lot of spam in dmesg on my Huawei MateBook X Pro 2022: ... [36409.328463] input input9: Unknown key pressed, code: 0x02c1 [36411.335104] input input9: Unknown key pressed, code: 0x02c1 [36412.338674] input input9: Unknown key pressed, code: 0x02c1 [36414.848564] input input9: Unknown key pressed, code: 0x02c1 [36416.858706] input input9: Unknown key pressed, code: 0x02c1 ... Fix that by ignoring events generated by ambient light sensor. This issue was reported on GitHub and resolved with the following merge request: https://github.com/aymanbagabas/Huawei-WMI/pull/70 I've contacted the mainter of this repo and he gave me the "go ahead" to send this patch to the maling list. Signed-off-by: Konstantin Shelekhin Link: https://lore.kernel.org/r/20230722155922.173856-1-k.shelekhin@ftml.net Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit ad084a6d99bc182bf109c190c808e2ea073ec57b Author: Maxim Mikityanskiy Date: Fri Jul 21 17:54:23 2023 +0300 platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100 Only the HW rfkill state is toggled on laptops with quirks->ec_read_only (so far only MSI Wind U90/U100). There are, however, a few issues with the implementation: 1. The initial HW state is always unblocked, regardless of the actual state on boot, because msi_init_rfkill only sets the SW state, regardless of ec_read_only. 2. The initial SW state corresponds to the actual state on boot, but it can't be changed afterwards, because set_device_state returns -EOPNOTSUPP. It confuses the userspace, making Wi-Fi and/or Bluetooth unusable if it was blocked on boot, and breaking the airplane mode if the rfkill was unblocked on boot. Address the above issues by properly initializing the HW state on ec_read_only laptops and by allowing the userspace to toggle the SW state. Don't set the SW state ourselves and let the userspace fully control it. Toggling the SW state is a no-op, however, it allows the userspace to properly toggle the airplane mode. The actual SW radio disablement is handled by the corresponding rtl818x_pci and btusb drivers that have their own rfkills. Tested on MSI Wind U100 Plus, BIOS ver 1.0G, EC ver 130. Fixes: 0816392b97d4 ("msi-laptop: merge quirk tables to one") Fixes: 0de6575ad0a8 ("msi-laptop: Add MSI Wind U90/U100 support") Signed-off-by: Maxim Mikityanskiy Link: https://lore.kernel.org/r/20230721145423.161057-1-maxtram95@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 6a758a3e831ce1a84c9c209ac6dc755f4c8ce77a Author: Kristian Angelov Date: Thu Jul 20 18:29:50 2023 +0300 platform/x86: asus-wmi: Fix setting RGB mode on some TUF laptops This patch fixes setting the cmd values to 0xb3 and 0xb4. This is necessary on some TUF laptops in order to set the RGB mode. Closes: https://lore.kernel.org/platform-driver-x86/443078148.491022.1677576298133@nm83.abv.bg Signed-off-by: Kristian Angelov Reviewed-by: Luke D. Jones Link: https://lore.kernel.org/r/ZLlS7o6UdTUBkyqa@wyvern.localdomain Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 1da0893aed2e48e2bdf37c29b029f2e060d25927 Author: Wang Ming Date: Mon Jul 17 18:11:02 2023 +0800 platform/x86: think-lmi: Use kfree_sensitive instead of kfree key might contain private part of the key, so better use kfree_sensitive to free it. Signed-off-by: Wang Ming Link: https://lore.kernel.org/r/20230717101114.18966-1-machel@vivo.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 7783e97f8558ad7a4d1748922461bc88483fbcdf Author: Maxim Mikityanskiy Date: Sun Jul 16 21:32:13 2023 +0300 platform/x86/intel/hid: Add HP Dragonfly G2 to VGBS DMI quirks HP Elite Dragonfly G2 (a convertible laptop/tablet) has a reliable VGBS method. If VGBS is not called on boot, the firmware sends an initial 0xcd event shortly after calling the BTNL method, but only if the device is booted in the laptop mode. However, if the device is booted in the tablet mode and VGBS is not called, there is no initial 0xcc event, and the input device for SW_TABLET_MODE is not registered up until the user turns the device into the laptop mode. Call VGBS on boot on this device to get the initial state of SW_TABLET_MODE in a reliable way. Tested with BIOS 1.13.1. Signed-off-by: Maxim Mikityanskiy Link: https://lore.kernel.org/r/20230716183213.64173-1-maxtram95@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit e3ab18de2b09361d6f0e4aafb9cfd6d002ce43a1 Author: Hans de Goede Date: Sat Jul 15 20:15:16 2023 +0200 platform/x86: intel: hid: Always call BTNL ACPI method On a HP Elite Dragonfly G2 the 0xcc and 0xcd events for SW_TABLET_MODE are only send after the BTNL ACPI method has been called. Likely more devices need this, so make the BTNL ACPI method unconditional instead of only doing it on devices with a 5 button array. Note this also makes the intel_button_array_enable() call in probe() unconditional, that function does its own priv->array check. This makes the intel_button_array_enable() call in probe() consistent with the calls done on suspend/resume which also rely on the priv->array check inside the function. Reported-by: Maxim Mikityanskiy Closes: https://lore.kernel.org/platform-driver-x86/20230712175023.31651-1-maxtram95@gmail.com/ Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20230715181516.5173-1-hdegoede@redhat.com commit 33c9ab5b493a0e922b06c12fed4fdcb862212cda Author: Shyam Sundar S K Date: Fri Jul 14 20:14:35 2023 +0530 platform/x86/amd/pmf: Notify OS power slider update APMF fn8 can notify EC about the OS slider position change. Add this capability to the PMF driver so that it can call the APMF fn8 based on the changes in the Platform profile events. Co-developed-by: Mario Limonciello Signed-off-by: Mario Limonciello Signed-off-by: Patil Rajesh Reddy Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20230714144435.1239776-2-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 839e90e75e695b3d9ee17f5a2811e7ee5aea8d4a Author: Shyam Sundar S K Date: Fri Jul 14 20:14:34 2023 +0530 platform/x86/amd/pmf: reduce verbosity of apmf_get_system_params apmf_get_system_params() failure is not a critical event, reduce its verbosity from dev_err to dev_dbg. Signed-off-by: Mario Limonciello Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20230714144435.1239776-1-Shyam-sundar.S-k@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 3da435063777f8d861ba5a165344e3f75f839357 Author: Takashi Iwai Date: Tue Jul 25 11:20:57 2023 +0200 ALSA: usb-audio: Add quirk for Microsoft Modern Wireless Headset Microsoft Modern Wireless Headset (appearing on the host as "Microsoft USB Link") has a playback and a capture mixer volume/switch, but they are fairly broken. The descriptor reports wrong dB ranges for playback, and the capture volume/switch don't influence on the actual recording at all. Moreover, there seem instabilities in the connection, and at best, we should disable the runtime PM. So this ended up with a quirk entry for: - Correct the playback dB range; I picked up some reasonable values but it's a guess work - Disable the capture mixer; it's completely useless and confuses PA/PW - Suppress get-sample-rate, apply the delay for message handling, and suppress the auto-suspend The behavior of the wheel control on the headset is somehow flaky, too, but it's an issue of HID. Link: https://bugzilla.suse.com/show_bug.cgi?id=1207129 Link: https://lore.kernel.org/r/20230725092057.15115-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit d510acb610e6aa07a04b688236868b2a5fd60deb Author: Luka Guzenko Date: Tue Jul 25 13:15:09 2023 +0200 ALSA: hda/relatek: Enable Mute LED on HP 250 G8 This HP Notebook used ALC236 codec with COEF 0x07 idx 1 controlling the mute LED. Enable already existing quirk for this device. Signed-off-by: Luka Guzenko Cc: Link: https://lore.kernel.org/r/20230725111509.623773-1-l.guzenko@web.de Signed-off-by: Takashi Iwai commit f85739c0b2b0d98a32f5ca4fcc5501d2b76df4f6 Author: Guiting Shen Date: Sat Jul 15 11:06:20 2023 +0800 ASoC: atmel: Fix the 8K sample parameter in I2SC master The 8K sample parameter of 12.288Mhz main system bus clock doesn't work because the I2SC_MR.IMCKDIV must not be 0 according to the sama5d2 series datasheet(I2SC Mode Register of Register Summary). So use the 6.144Mhz instead of 12.288Mhz to support 8K sample. Signed-off-by: Guiting Shen Link: https://lore.kernel.org/r/20230715030620.62328-1-aarongt.shen@gmail.com Signed-off-by: Mark Brown commit 23adeb7056acd4fd866969f4afb91441776cc4f5 Author: Shuming Fan Date: Fri Jul 21 17:07:11 2023 +0800 ASoC: rt711-sdca: fix for JD event handling in ClockStop Mode0 When the system suspends, peripheral SDCA interrupts are disabled. When system level resume is invoked, the peripheral SDCA interrupts should be enabled to handle JD events. Enable SDCA interrupts in resume sequence when ClockStop Mode0 is applied. Signed-off-by: Shuming Fan Reported-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230721090711.128247-1-shumingf@realtek.com Signed-off-by: Mark Brown commit b69de265bd0e877015a00fbba453ef72af162e0f Author: Shuming Fan Date: Fri Jul 21 17:06:54 2023 +0800 ASoC: rt711: fix for JD event handling in ClockStop Mode0 When the system suspends, peripheral Imp-defined interrupt is disabled. When system level resume is invoked, the peripheral Imp-defined interrupts should be enabled to handle JD events. Signed-off-by: Shuming Fan Reported-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230721090654.128230-1-shumingf@realtek.com Signed-off-by: Mark Brown commit a0b7c59ac1a9bae015a9b90dfda28158586006c8 Author: Shuming Fan Date: Fri Jul 21 17:07:32 2023 +0800 ASoC: rt722-sdca: fix for JD event handling in ClockStop Mode0 When the system suspends, peripheral SDCA interrupts are disabled. When system level resume is invoked, the peripheral SDCA interrupts should be enabled to handle JD events. Enable SDCA interrupts in resume sequence when ClockStop Mode0 is applied. Signed-off-by: Shuming Fan Reported-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230721090732.128282-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 7a8735c1551e489351172d0da96128f6f8b52b2d Author: Shuming Fan Date: Fri Jul 21 17:07:21 2023 +0800 ASoC: rt712-sdca: fix for JD event handling in ClockStop Mode0 When the system suspends, peripheral SDCA interrupts are disabled. When system level resume is invoked, the peripheral SDCA interrupts should be enabled to handle JD events. Enable SDCA interrupts in resume sequence when ClockStop Mode0 is applied. Signed-off-by: Shuming Fan Reported-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230721090721.128264-1-shumingf@realtek.com Signed-off-by: Mark Brown commit d20d35d1ad62c6cca36368c1e8f29335a068659e Author: Edgar Date: Wed Jul 19 13:47:22 2023 +0800 ASoc: codecs: ES8316: Fix DMIC config According to the datasheet, the DMIC config should be changed to { 0, 2 ,3 } Signed-off-by: Edgar Link: https://lore.kernel.org/r/20230719054722.401954-1-ljijcj@163.com Signed-off-by: Mark Brown commit 02fb23d72720df2b6be3f29fc5787ca018eb92c3 Author: Shuming Fan Date: Fri Jul 21 17:06:43 2023 +0800 ASoC: rt5682-sdw: fix for JD event handling in ClockStop Mode0 When the system suspends, peripheral Imp-defined interrupt is disabled. When system level resume is invoked, the peripheral Imp-defined interrupts should be enabled to handle JD events. Signed-off-by: Shuming Fan Reported-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230721090643.128213-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 4c188fa183ebb45238ef16504c4c7606955cf9d4 Author: Biju Das Date: Mon Jul 24 10:19:25 2023 +0100 arm64: dts: renesas: rzg2l: Update overfow/underflow IRQ names for MTU3 channels As per R01UH0914EJ0130 Rev.1.30 HW manual the MTU3 overflow/underflow interrupt names start with 'tci' instead of 'tgi'. Replace the below overflow/underflow interrupt names: - tgiv0->tciv0 - tgiv1->tciv1 - tgiu1->tciu1 - tgiv2->tciv2 - tgiu2->tciu2 - tgiv3->tciv3 - tgiv4->tciv4 - tgiv6->tciv6 - tgiv7->tciv7 - tgiv8->tciv8 - tgiu8->tciu8 Fixes: 26336d66d021 ("arm64: dts: renesas: r9a07g044: Add MTU3a node") Fixes: dd123dd01def ("arm64: dts: renesas: r9a07g054: Add MTU3a node") Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230724091927.123847-5-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 284779dbf4e98753458708783af8c35630674a21 Author: Vincent Whitchurch Date: Fri Jul 21 15:39:20 2023 +0200 net: stmmac: Apply redundant write work around on 4.xx too commit a3a57bf07de23fe1ff779e0fdf710aa581c3ff73 ("net: stmmac: work around sporadic tx issue on link-up") worked around a problem with TX sometimes not working after a link-up by avoiding a redundant write to MAC_CTRL_REG (aka GMAC_CONFIG), since the IP appeared to have problems with handling multiple writes to that register in some cases. That commit however only added the work around to dwmac_lib.c (apart from the common code in stmmac_main.c), but my systems with version 4.21a of the IP exhibit the same problem, so add the work around to dwmac4_lib.c too. Fixes: a3a57bf07de2 ("net: stmmac: work around sporadic tx issue on link-up") Signed-off-by: Vincent Whitchurch Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230721-stmmac-tx-workaround-v1-1-9411cbd5ee07@axis.com Signed-off-by: Paolo Abeni commit 4e62c99d71e56817c934caa2a709a775c8cee078 Author: Suman Ghosh Date: Fri Jul 21 11:42:22 2023 +0530 octeontx2-af: Fix hash extraction enable configuration As of today, hash extraction support is enabled for all the silicons. Because of which we are facing initialization issues when the silicon does not support hash extraction. During creation of the hardware parsing table for IPv6 address, we need to consider if hash extraction is enabled then extract only 32 bit, otherwise 128 bit needs to be extracted. This patch fixes the issue and configures the hardware parser based on the availability of the feature. Fixes: a95ab93550d3 ("octeontx2-af: Use hashed field in MCAM key") Signed-off-by: Suman Ghosh Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230721061222.2632521-1-sumang@marvell.com Signed-off-by: Paolo Abeni commit e354f67733115b4453268f61e6e072e9b1ea7a2f Author: Christophe JAILLET Date: Mon Jul 17 20:49:31 2023 +0200 drm/i915: Fix an error handling path in igt_write_huge() All error handling paths go to 'out', except this one. Be consistent and also branch to 'out' here. Fixes: c10a652e239e ("drm/i915/selftests: Rework context handling in hugepages selftests") Signed-off-by: Christophe JAILLET Reviewed-by: Andrzej Hajda Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://patchwork.freedesktop.org/patch/msgid/7a036b88671312ee9adc01c74ef5b3376f690b76.1689619758.git.christophe.jaillet@wanadoo.fr (cherry picked from commit 361ecaadb1ce3c5312c7c4c419271326d43899eb) Signed-off-by: Tvrtko Ursulin commit 3844ed5e78823eebb5f0f1edefc403310693d402 Author: Radhakrishna Sripada Date: Tue Jul 18 15:51:18 2023 -0700 drm/i915/dpt: Use shmem for dpt objects Dpt objects that are created from internal get evicted when there is memory pressure and do not get restored when pinned during scanout. The pinned page table entries look corrupted and programming the display engine with the incorrect pte's result in DE throwing pipe faults. Create DPT objects from shmem and mark the object as dirty when pinning so that the object is restored when shrinker evicts an unpinned buffer object. v2: Unconditionally mark the dpt objects dirty during pinning(Chris). Fixes: 0dc987b699ce ("drm/i915/display: Add smem fallback allocation for dpt") Cc: # v6.0+ Cc: Ville Syrjälä Cc: Tvrtko Ursulin Suggested-by: Chris Wilson Signed-off-by: Fei Yang Signed-off-by: Radhakrishna Sripada Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20230718225118.2562132-1-radhakrishna.sripada@intel.com (cherry picked from commit e91a777a6e602ba0e3366e053e4e094a334a1244) Signed-off-by: Tvrtko Ursulin commit 34192a2f46b99324877ef24a6f8f56b1a6b533de Merge: f0291103d2327 fa532bee17d15 Author: Paolo Abeni Date: Tue Jul 25 09:32:29 2023 +0200 Merge branch 'fix-up-dev-flags-when-add-p2p-down-link' Hangbin Liu says: ==================== Fix up dev flags when add P2P down link When adding p2p interfaces to bond/team. The POINTOPOINT, NOARP flags are not inherit to up devices. Which will trigger IPv6 DAD. Since there is no ethernet MAC address for P2P devices. This will cause unexpected DAD failures. ==================== Link: https://lore.kernel.org/r/20230721040356.3591174-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit fa532bee17d15acf8bba4bc8e2062b7a093ba801 Author: Hangbin Liu Date: Fri Jul 21 12:03:56 2023 +0800 team: reset team's flags when down link is P2P device When adding a point to point downlink to team device, we neglected to reset the team's flags, which were still using flags like BROADCAST and MULTICAST. Consequently, this would initiate ARP/DAD for P2P downlink interfaces, such as when adding a GRE device to team device. Fix this by remove multicast/broadcast flags and add p2p and noarp flags. After removing the none ethernet interface and adding an ethernet interface to team, we need to reset team interface flags. Unlike bonding interface, team do not need restore IFF_MASTER, IFF_SLAVE flags. Reported-by: Liang Li Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2221438 Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") Signed-off-by: Hangbin Liu Signed-off-by: Paolo Abeni commit da19a2b967cf1e2c426f50d28550d1915214a81d Author: Hangbin Liu Date: Fri Jul 21 12:03:55 2023 +0800 bonding: reset bond's flags when down link is P2P device When adding a point to point downlink to the bond, we neglected to reset the bond's flags, which were still using flags like BROADCAST and MULTICAST. Consequently, this would initiate ARP/DAD for P2P downlink interfaces, such as when adding a GRE device to the bonding. To address this issue, let's reset the bond's flags for P2P interfaces. Before fix: 7: gre0@NONE: mtu 1500 qdisc noqueue master bond0 state UNKNOWN group default qlen 1000 link/gre6 2006:70:10::1 peer 2006:70:10::2 permaddr 167f:18:f188:: 8: bond0: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/gre6 2006:70:10::1 brd 2006:70:10::2 inet6 fe80::200:ff:fe00:0/64 scope link valid_lft forever preferred_lft forever After fix: 7: gre0@NONE: mtu 1500 qdisc noqueue master bond2 state UNKNOWN group default qlen 1000 link/gre6 2006:70:10::1 peer 2006:70:10::2 permaddr c29e:557a:e9d9:: 8: bond0: mtu 1500 qdisc noqueue state UP group default qlen 1000 link/gre6 2006:70:10::1 peer 2006:70:10::2 inet6 fe80::1/64 scope link valid_lft forever preferred_lft forever Reported-by: Liang Li Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2221438 Fixes: 872254dd6b1f ("net/bonding: Enable bonding to enslave non ARPHRD_ETHER") Signed-off-by: Hangbin Liu Signed-off-by: Paolo Abeni commit 19826558210b9102a7d4681c91784d137d60d71b Author: Steve French Date: Tue Jul 25 01:05:23 2023 -0500 smb3: do not set NTLMSSP_VERSION flag for negotiate not auth request The NTLMSSP_NEGOTIATE_VERSION flag only needs to be sent during the NTLMSSP NEGOTIATE (not the AUTH) request, so filter it out for NTLMSSP AUTH requests. See MS-NLMP 2.2.1.3 This fixes a problem found by the gssntlmssp server. Link: https://github.com/gssapi/gss-ntlmssp/issues/95 Fixes: 52d005337b2c ("smb3: send NTLMSSP version information") Acked-by: Roy Shterman Signed-off-by: Steve French commit a43f95fdd39490f7b156fd126f1e90ec2d5553f1 Author: Winston Wen Date: Mon Jul 24 10:10:57 2023 +0800 cifs: fix charset issue in reconnection We need to specify charset, like "iocharset=utf-8", in mount options for Chinese path if the nls_default don't support it, such as iso8859-1, the default value for CONFIG_NLS_DEFAULT. But now in reconnection the nls_default is used, instead of the one we specified and used in mount, and this can lead to mount failure. Signed-off-by: Winston Wen Reviewed-by: Paulo Alcantara Signed-off-by: Steve French commit c1ed39ec116272935528ca9b348b8ee79b0791da Author: Winston Wen Date: Mon Jul 24 10:10:56 2023 +0800 fs/nls: make load_nls() take a const parameter load_nls() take a char * parameter, use it to find nls module in list or construct the module name to load it. This change make load_nls() take a const parameter, so we don't need do some cast like this: ses->local_nls = load_nls((char *)ctx->local_nls->charset); Suggested-by: Stephen Rothwell Signed-off-by: Winston Wen Reviewed-by: Paulo Alcantara Reviewed-by: Christian Brauner Signed-off-by: Steve French commit e0933b526fbfd937c4a8f4e35fcdd49f0e22d411 Author: Bart Van Assche Date: Thu Jul 6 13:14:12 2023 -0700 block: Fix a source code comment in include/uapi/linux/blkzoned.h Fix the symbolic names for zone conditions in the blkzoned.h header file. Cc: Hannes Reinecke Cc: Damien Le Moal Fixes: 6a0cb1bc106f ("block: Implement support for zoned block devices") Signed-off-by: Bart Van Assche Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/20230706201422.3987341-1-bvanassche@acm.org Signed-off-by: Jens Axboe commit f0291103d23276bc38d9b91f327e8dc3cecfdb0e Merge: ac2a7b1317615 91896c8acce23 Author: Jakub Kicinski Date: Mon Jul 24 17:12:06 2023 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-07-21 (i40e, iavf) This series contains updates to i40e and iavf drivers. Wang Ming corrects an error check on i40e. Jake unlocks crit_lock on allocation failure to prevent deadlock and stops re-enabling of interrupts when it's not intended for iavf. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: iavf: check for removal state before IAVF_FLAG_PF_COMMS_FAILED iavf: fix potential deadlock on allocation failure i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir() ==================== Link: https://lore.kernel.org/r/20230721155812.1292752-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit ac2a7b13176157833baf5db0db20cfb370bd7779 Merge: a3336056504d7 11c9027c983e9 Author: Jakub Kicinski Date: Mon Jul 24 17:10:10 2023 -0700 Merge tag 'linux-can-fixes-for-6.5-20230724' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2023-07-24 The first patch is by me and adds a missing set of CAN state to CAN_STATE_STOPPED on close in the gs_usb driver. The last patch is by Eric Dumazet and fixes a lockdep issue in the CAN raw protocol. * tag 'linux-can-fixes-for-6.5-20230724' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: raw: fix lockdep issue in raw_release() can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED ==================== Link: https://lore.kernel.org/r/20230724150141.766047-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit a3336056504d780590ac6d6ac94fbba829994594 Author: Jedrzej Jagielski Date: Fri Jul 21 08:58:54 2023 -0700 ice: Fix memory management in ice_ethtool_fdir.c Fix ethtool FDIR logic to not use memory after its release. In the ice_ethtool_fdir.c file there are 2 spots where code can refer to pointers which may be missing. In the ice_cfg_fdir_xtrct_seq() function seg may be freed but even then may be still used by memcpy(&tun_seg[1], seg, sizeof(*seg)). In the ice_add_fdir_ethtool() function struct ice_fdir_fltr *input may first fail to be added via ice_fdir_update_list_entry() but then may be deleted by ice_fdir_update_list_entry. Terminate in both cases when the returned value of the previous operation is other than 0, free memory and don't use it anymore. Reported-by: Michal Schmidt Link: https://bugzilla.redhat.com/show_bug.cgi?id=2208423 Fixes: cac2a27cd9ab ("ice: Support IPv4 Flow Director filters") Reviewed-by: Przemek Kitszel Signed-off-by: Jedrzej Jagielski Reviewed-by: Leon Romanovsky Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20230721155854.1292805-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit d11b0df7ddf1831f3e170972f43186dad520bfcc Author: Stewart Smith Date: Fri Jul 21 15:24:10 2023 -0700 tcp: Reduce chance of collisions in inet6_hashfn(). For both IPv4 and IPv6 incoming TCP connections are tracked in a hash table with a hash over the source & destination addresses and ports. However, the IPv6 hash is insufficient and can lead to a high rate of collisions. The IPv6 hash used an XOR to fit everything into the 96 bits for the fast jenkins hash, meaning it is possible for an external entity to ensure the hash collides, thus falling back to a linear search in the bucket, which is slow. We take the approach of hash the full length of IPv6 address in __ipv6_addr_jhash() so that all users can benefit from a more secure version. While this may look like it adds overhead, the reality of modern CPUs means that this is unmeasurable in real world scenarios. In simulating with llvm-mca, the increase in cycles for the hashing code was ~16 cycles on Skylake (from a base of ~155), and an extra ~9 on Nehalem (base of ~173). In commit dd6d2910c5e0 ("netfilter: conntrack: switch to siphash") netfilter switched from a jenkins hash to a siphash, but even the faster hsiphash is a more significant overhead (~20-30%) in some preliminary testing. So, in this patch, we keep to the more conservative approach to ensure we don't add much overhead per SYN. In testing, this results in a consistently even spread across the connection buckets. In both testing and real-world scenarios, we have not found any measurable performance impact. Fixes: 08dcdbf6a7b9 ("ipv6: use a stronger hash for tcp") Signed-off-by: Stewart Smith Signed-off-by: Samuel Mendoza-Jonas Suggested-by: Eric Dumazet Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20230721222410.17914-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit bb7a0156365dffe2fcd63e2051145fbe4f8908b4 Author: Wei Fang Date: Fri Jul 21 16:35:59 2023 +0800 net: fec: avoid tx queue timeout when XDP is enabled According to the implementation of XDP of FEC driver, the XDP path shares the transmit queues with the kernel network stack, so it is possible to lead to a tx timeout event when XDP uses the tx queue pretty much exclusively. And this event will cause the reset of the FEC hardware. To avoid timeout in this case, we use the txq_trans_cond_update() interface to update txq->trans_start to jiffies so that watchdog won't generate a transmit timeout warning. Fixes: 6d6b39f180b8 ("net: fec: add initial XDP support") Signed-off-by: Wei Fang Link: https://lore.kernel.org/r/20230721083559.2857312-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 69172f0bcb6a09110c5d2a6d792627f5095a9018 Author: Maciej Żenczykowski Date: Thu Jul 20 09:00:22 2023 -0700 ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address currently on 6.4 net/main: # ip link add dummy1 type dummy # echo 1 > /proc/sys/net/ipv6/conf/dummy1/use_tempaddr # ip link set dummy1 up # ip -6 addr add 2000::1/64 mngtmpaddr dev dummy1 # ip -6 addr show dev dummy1 11: dummy1: mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000 inet6 2000::44f3:581c:8ca:3983/64 scope global temporary dynamic valid_lft 604800sec preferred_lft 86172sec inet6 2000::1/64 scope global mngtmpaddr valid_lft forever preferred_lft forever inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link valid_lft forever preferred_lft forever # ip -6 addr del 2000::44f3:581c:8ca:3983/64 dev dummy1 (can wait a few seconds if you want to, the above delete isn't [directly] the problem) # ip -6 addr show dev dummy1 11: dummy1: mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000 inet6 2000::1/64 scope global mngtmpaddr valid_lft forever preferred_lft forever inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link valid_lft forever preferred_lft forever # ip -6 addr del 2000::1/64 mngtmpaddr dev dummy1 # ip -6 addr show dev dummy1 11: dummy1: mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000 inet6 2000::81c9:56b7:f51a:b98f/64 scope global temporary dynamic valid_lft 604797sec preferred_lft 86169sec inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link valid_lft forever preferred_lft forever This patch prevents this new 'global temporary dynamic' address from being created by the deletion of the related (same subnet prefix) 'mngtmpaddr' (which is triggered by there already being no temporary addresses). Cc: Jiri Pirko Fixes: 53bd67491537 ("ipv6 addrconf: introduce IFA_F_MANAGETEMPADDR to tell kernel to manage temporary addresses") Reported-by: Xiao Ma Signed-off-by: Maciej Żenczykowski Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20230720160022.1887942-1-maze@google.com Signed-off-by: Jakub Kicinski commit 69a184f7a372aac588babfb0bd681aaed9779f5b Author: Yuanjun Gong Date: Thu Jul 20 22:42:19 2023 +0800 ethernet: atheros: fix return value check in atl1e_tso_csum() in atl1e_tso_csum, it should check the return value of pskb_trim(), and return an error code if an unexpected value is returned by pskb_trim(). Fixes: a6a5325239c2 ("atl1e: Atheros L1E Gigabit Ethernet driver") Signed-off-by: Yuanjun Gong Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230720144219.39285-1-ruc_gongyuanjun@163.com Signed-off-by: Jakub Kicinski commit ed96824b71ed67664390890441b229423a25317f Author: Yuanjun Gong Date: Sat Jul 22 22:25:11 2023 +0800 atheros: fix return value check in atl1_tso() in atl1_tso(), it should check the return value of pskb_trim(), and return an error code if an unexpected value is returned by pskb_trim(). Fixes: 401c0aabec4b ("atl1: simplify tx packet descriptor") Signed-off-by: Yuanjun Gong Link: https://lore.kernel.org/r/20230722142511.12448-1-ruc_gongyuanjun@163.com Signed-off-by: Jakub Kicinski commit 0b5547c51827e053cc754db47d3ec3e6c2c451d2 Merge: 20ea1e7d13c1b 80b6051085c5f Author: Linus Torvalds Date: Mon Jul 24 14:38:41 2023 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fix from James Bottomley: "A single fix for a potential regression over a misunderstanding of the blk_get_queue() api" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: sg: Fix checking return value of blk_get_queue() commit 341e0e9f59e26676c88d0aa9a5a9b2d3c44bf21c Author: Athira Rajeev Date: Mon Jul 24 22:28:15 2023 +0530 perf callchain powerpc: Fix addr location init during arch_skip_callchain_idx function 'perf record; with callchain recording fails as below in powerpc: ./perf record -a -gR sleep 10 ./perf report perf: Segmentation fault gdb trace points to thread__find_map 0 0x00000000101df314 in atomic_cmpxchg (newval=1818846826, oldval=1818846827, v=0x1001a8f3) at /home/athira/linux/tools/include/asm-generic/atomic-gcc.h:70 1 refcount_sub_and_test (i=1, r=0x1001a8f3) at /home/athira/linux/tools/include/linux/refcount.h:135 2 refcount_dec_and_test (r=0x1001a8f3) at /home/athira/linux/tools/include/linux/refcount.h:148 3 map__put (map=0x1001a8b3) at util/map.c:311 4 0x000000001016842c in __map__zput (map=0x7fffffffa368) at util/map.h:190 5 thread__find_map (thread=0x105b92f0, cpumode=, addr=13835058055283572736, al=al@entry=0x7fffffffa358) at util/event.c:582 6 0x000000001016882c in thread__find_symbol (thread=, cpumode=, addr=, al=0x7fffffffa358) at util/event.c:656 7 0x00000000102e12b4 in arch_skip_callchain_idx (thread=, chain=) at arch/powerpc/util/skip-callchain-idx.c:255 8 0x00000000101d3bf4 in thread__resolve_callchain_sample (thread=0x105b92f0, cursor=0x1053d160, evsel=, sample=0x7fffffffa908, parent=0x7fffffffa778, root_al=0x7fffffffa710, max_stack=) at util/machine.c:2940 9 0x00000000101cd210 in sample__resolve_callchain (sample=, cursor=, parent=, evsel=, al=, max_stack=) at util/callchain.c:1112 10 0x000000001022a9d8 in hist_entry_iter__add (iter=0x7fffffffa750, al=0x7fffffffa710, max_stack_depth=, arg=0x7fffffffbbd0) at util/hist.c:1232 11 0x0000000010056d98 in process_sample_event (tool=0x7fffffffbbd0, event=0x7ffff6223c38, sample=0x7fffffffa908, evsel=, machine=0x10524ef8) at builtin-report.c:332 Here arch_skip_callchain_idx calls thread__find_symbol and which invokes thread__find_map with uninitialised "addr_location". Snippet: thread__find_symbol(thread, PERF_RECORD_MISC_USER, ip, &al); Recent change with commit 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy functions") , introduced "maps__zput" in the function thread__find_map. This could result in segfault while accessing uninitialised map from "struct addr_location". Fix this by adding addr_location__init and addr_location__exit in arch_skip_callchain_idx. Fixes: 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy functions") Reported-by: Aneesh Kumar K.V Signed-off-by: Athira Rajeev Cc: Disha Goel Cc: Ian Rogers Cc: Jiri Olsa Cc: Kajol Jain Cc: Madhavan Srinivasan Cc: Namhyung Kim Cc: linuxppc-dev@lists.ozlabs.org Link: https://lore.kernel.org/r/20230724165815.17810-1-atrajeev@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit f061e2be8689057cb4ec0dbffa9f03e1a23cdcb2 Author: Mark Brown Date: Sun Jul 23 00:27:22 2023 +0100 ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register The WM8904_ADC_TEST_0 register is modified as part of updating the OSR controls but does not have a cache default, leading to errors when we try to modify these controls in cache only mode with no prior read: wm8904 3-001a: ASoC: error at snd_soc_component_update_bits on wm8904.3-001a for register: [0x000000c6] -16 Add a read of the register to probe() to fill the cache and avoid both the error messages and the misconfiguration of the chip which will result. Acked-by: Charles Keepax Signed-off-by: Mark Brown Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230723-asoc-fix-wm8904-adc-test-read-v1-1-2cdf2edd83fd@kernel.org Signed-off-by: Mark Brown commit c918008fe746285dedc9c3037cd484e964859788 Merge: 1bc40efdaf4a0 f0691dc16206f Author: Mark Brown Date: Mon Jul 24 20:09:31 2023 +0100 ASoC: da7219: Patches related to a spurious AAD IRQ Merge series from Dmytro Maluka : This series includes 2 patches related to (but not fixing) the following I2C failure which occurs sometimes during system suspend or resume and indicates a problem with a spurious DA7219 interrupt: [ 355.876211] i2c_designware i2c_designware.3: Transfer while suspended [ 355.876245] WARNING: CPU: 2 PID: 3576 at drivers/i2c/busses/i2c-designware-master.c:570 i2c_dw_xfer+0x411/0x440 ... [ 355.876462] Call Trace: [ 355.876468] [ 355.876475] ? update_load_avg+0x1b3/0x615 [ 355.876484] __i2c_transfer+0x101/0x1d8 [ 355.876494] i2c_transfer+0x74/0x10d [ 355.876504] regmap_i2c_read+0x6a/0x9c [ 355.876513] _regmap_raw_read+0x179/0x223 [ 355.876521] regmap_raw_read+0x1e1/0x28e [ 355.876527] regmap_bulk_read+0x17d/0x1ba [ 355.876532] ? __wake_up+0xed/0x1bb [ 355.876542] da7219_aad_irq_thread+0x54/0x2c9 [snd_soc_da7219 5fb8ebb2179cf2fea29af090f3145d68ed8e2184] [ 355.876556] irq_thread+0x13c/0x231 [ 355.876563] ? irq_forced_thread_fn+0x5f/0x5f [ 355.876570] ? irq_thread_fn+0x4d/0x4d [ 355.876576] kthread+0x13a/0x152 [ 355.876581] ? synchronize_irq+0xc3/0xc3 [ 355.876587] ? kthread_blkcg+0x31/0x31 [ 355.876592] ret_from_fork+0x1f/0x30 [ 355.876601] This log shows that DA7219 AAD interrupt handler da7219_aad_irq_thread() is unexpectedly running when DA7219 is suspended and should not generate interrupts. As a result, the IRQ handler is trying to read AAD IRQ event status over I2C and is hitting the I2C driver "Transfer while suspended" failure. Patch #1 adds synchronize_irq() when suspending DA7219, to prevent the IRQ handler from running after suspending if there is a pending IRQ generated before suspending. With this patch the above failure is still reproducible, so this patch does not fix any real observed issue so far, but at least is useful for confirming that the above issue is not caused by a pending IRQ but rather looks like a DA7219 hardware issue with an unexpectedly generated IRQ. Patch #2 does not fix the above issue either, but it prevents its potentially harmful side effects. With the existing code, if the issue occurs and the IRQ handler fails to read the AAD IRQ events status over I2C, it does not check that and tries to use the garbage uninitialized value of the events status, potentially reporting bogus events. This patch fixes that by adding missing error checking. In fact I'm sending these patches not only to submit them for review but also to ask Renesas folks for any hints on a possible cause of the described DA7219 issue (AAD interrupts spuriously firing after jack detection is already disabled) or how to debug it further. commit 856d8e3c633b183df23549ce760ae84478a7098d Author: Stefan Haberland Date: Fri Jul 21 21:36:47 2023 +0200 s390/dasd: print copy pair message only for the correct error The DASD driver has certain types of requests that might be rejected by the storage server or z/VM because they are not supported. Since the missing support of the command is not a real issue there is no user visible kernel error message for this. For copy pair setups there is a specific error that IO is not allowed on secondary devices. This error case is explicitly handled and an error message is printed. The code checking for the error did use a bitwise 'and' that is used to check for specific bits. But in this case the whole sense byte has to match. This leads to the problem that the copy pair related error message is erroneously printed for other error cases that are usually not reported. This might heavily confuse users and lead to follow on actions that might disrupt application processing. Fix by checking the sense byte for the exact value and not single bits. Cc: stable@vger.kernel.org # 6.1+ Fixes: 1fca631a1185 ("s390/dasd: suppress generic error messages for PPRC secondary devices") Signed-off-by: Stefan Haberland Reviewed-by: Jan Hoeppner Link: https://lore.kernel.org/r/20230721193647.3889634-5-sth@linux.ibm.com Signed-off-by: Jens Axboe commit 8a2278ce9c25048d999fe1a3561def75d963f471 Author: Stefan Haberland Date: Fri Jul 21 21:36:46 2023 +0200 s390/dasd: fix hanging device after request requeue The DASD device driver has a function to requeue requests to the blocklayer. This function is used in various cases when basic settings for the device have to be changed like High Performance Ficon related parameters or copy pair settings. The functions iterates over the device->ccw_queue and also removes the requests from the block->ccw_queue. In case the device is started on an alias device instead of the base device it might be removed from the block->ccw_queue without having it canceled properly before. This might lead to a hanging device since the request is no longer on a queue and can not be handled properly. Fix by iterating over the block->ccw_queue instead of the device->ccw_queue. This will take care of all blocklayer related requests and handle them on all associated DASD devices. Signed-off-by: Stefan Haberland Reviewed-by: Jan Hoeppner Link: https://lore.kernel.org/r/20230721193647.3889634-4-sth@linux.ibm.com Signed-off-by: Jens Axboe commit acea28a6b74f458defda7417d2217b051ba7d444 Author: Stefan Haberland Date: Fri Jul 21 21:36:45 2023 +0200 s390/dasd: use correct number of retries for ERP requests If a DASD request fails an error recovery procedure (ERP) request might be built as a copy of the original request to do error recovery. The ERP request gets a number of retries assigned. This number is always 256 no matter what other value might have been set for the original request. This is not what is expected when a user specifies a certain amount of retries for the device via sysfs. Correctly use the number of retries of the original request for ERP requests. Signed-off-by: Stefan Haberland Reviewed-by: Jan Hoeppner Link: https://lore.kernel.org/r/20230721193647.3889634-3-sth@linux.ibm.com Signed-off-by: Jens Axboe commit 05f1d8ed03f547054efbc4d29bb7991c958ede95 Author: Stefan Haberland Date: Fri Jul 21 21:36:44 2023 +0200 s390/dasd: fix hanging device after quiesce/resume Quiesce and resume are functions that tell the DASD driver to stop/resume issuing I/Os to a specific DASD. On resume dasd_schedule_block_bh() is called to kick handling of IO requests again. This does unfortunately not cover internal requests which are used for path verification for example. This could lead to a hanging device when a path event or anything else that triggers internal requests occurs on a quiesced device. Fix by also calling dasd_schedule_device_bh() which triggers handling of internal requests on resume. Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1") Cc: stable@vger.kernel.org Signed-off-by: Stefan Haberland Reviewed-by: Jan Hoeppner Link: https://lore.kernel.org/r/20230721193647.3889634-2-sth@linux.ibm.com Signed-off-by: Jens Axboe commit ebceec271e552a2b05e47d8ef0597052b1a39449 Author: Yogesh Hegde Date: Tue Jul 18 22:09:41 2023 +0530 arm64: dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boards This patch fixes an issue affecting the Wifi/Bluetooth connectivity on ROCK Pi 4 boards. Commit f471b1b2db08 ("arm64: dts: rockchip: Fix Bluetooth on ROCK Pi 4 boards") introduced a problem with the clock configuration. Specifically, the clock-names property of the sdio-pwrseq node was not updated to 'lpo', causing the driver to wait indefinitely for the wrong clock signal 'ext_clock' instead of the expected one 'lpo'. This prevented the proper initialization of Wifi/Bluetooth chip on ROCK Pi 4 boards. To address this, this patch updates the clock-names property of the sdio-pwrseq node to "lpo" to align with the changes made to the bluetooth node. This patch has been tested on ROCK Pi 4B. Fixes: f471b1b2db08 ("arm64: dts: rockchip: Fix Bluetooth on ROCK Pi 4 boards") Cc: stable@vger.kernel.org Signed-off-by: Yogesh Hegde Link: https://lore.kernel.org/r/ZLbATQRjOl09aLAp@zephyrusG14 Signed-off-by: Heiko Stuebner commit 7b72d661f1f2f950ab8c12de7e2bc48bdac8ed69 Author: Jens Axboe Date: Mon Jul 24 11:28:17 2023 -0600 io_uring: gate iowait schedule on having pending requests A previous commit made all cqring waits marked as iowait, as a way to improve performance for short schedules with pending IO. However, for use cases that have a special reaper thread that does nothing but wait on events on the ring, this causes a cosmetic issue where we know have one core marked as being "busy" with 100% iowait. While this isn't a grave issue, it is confusing to users. Rather than always mark us as being in iowait, gate setting of current->in_iowait to 1 by whether or not the waiting task has pending requests. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/io-uring/CAMEGJJ2RxopfNQ7GNLhr7X9=bHXKo+G5OOe0LUq=+UgLXsv1Xg@mail.gmail.com/ Link: https://bugzilla.kernel.org/show_bug.cgi?id=217699 Link: https://bugzilla.kernel.org/show_bug.cgi?id=217700 Reported-by: Oleksandr Natalenko Reported-by: Phil Elwell Tested-by: Andres Freund Fixes: 8a796565cec3 ("io_uring: Use io_schedule* in cqring wait") Signed-off-by: Jens Axboe commit 20ea1e7d13c1b544fe67c4a8dc3943bb1ab33e6f Author: Christian Brauner Date: Mon Jul 24 17:00:49 2023 +0200 file: always lock position for FMODE_ATOMIC_POS The pidfd_getfd() system call allows a caller with ptrace_may_access() abilities on another process to steal a file descriptor from this process. This system call is used by debuggers, container runtimes, system call supervisors, networking proxies etc. So while it is a special interest system call it is used in common tools. That ability ends up breaking our long-time optimization in fdget_pos(), which "knew" that if we had exclusive access to the file descriptor nobody else could access it, and we didn't need the lock for the file position. That check for file_count(file) was always fairly subtle - it depended on __fdget() not incrementing the file count for single-threaded processes and thus included that as part of the rule - but it did mean that we didn't need to take the lock in all those traditional unix process contexts. So it's sad to see this go, and I'd love to have some way to re-instate the optimization. At the same time, the lock obviously isn't ever contended in the case we optimized, so all we were optimizing away is the atomics and the cacheline dirtying. Let's see if anybody even notices that the optimization is gone. Link: https://lore.kernel.org/linux-fsdevel/20230724-vfs-fdget_pos-v1-1-a4abfd7103f3@kernel.org/ Fixes: 8649c322f75c ("pid: Implement pidfd_getfd syscall") Cc: stable@kernel.org Signed-off-by: Christian Brauner Signed-off-by: Linus Torvalds commit 9754353d0ab123d71bf572a483ecc8b330ef36a3 Author: Haixin Yu Date: Mon Jul 24 13:06:54 2023 +0800 perf pmu arm64: Fix reading the PMU cpu slots in sysfs Commit f8ad6018ce3c065a ("perf pmu: Remove duplication around EVENT_SOURCE_DEVICE_PATH") uses sysfs__read_ull() to read a full sysfs path, which will never succeeds as it already comes with the sysfs mount point in it, which sysfs__read_ull() will add again. Fix it by reading the file using filename__read_ull(), that will not add the sysfs mount point. Fixes: f8ad6018ce3c065a ("perf pmu: Remove duplication around EVENT_SOURCE_DEVICE_PATH") Signed-off-by: Haixin Yu Tested-by: Jing Zhang Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: John Garry Cc: Leo Yan Cc: Mark Rutland Cc: Mike Leach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/ZL4G7rWXkfv-Ectq@B-Q60VQ05P-2326.local Signed-off-by: Arnaldo Carvalho de Melo commit 9e0ee0c7545c7ec012a53878e7687e05b87abc75 Merge: 0a9266b79cacd 0cb1d9c845110 Author: Linus Torvalds Date: Mon Jul 24 09:25:18 2023 -0700 Merge tag 'media/v6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - some warning fixes - verisilicon: an excessive usage of stack fix and changes at reg access - amphion: use dev_err_probe - pulse8-cec: handle possible ping error - imx-jpeg: Support to assign slot for encoder/decoder - amphion: Fix firmware path to match linux-firmware - pci: cx23885: fix error handling for cx23885 ATSC boards - staging: atomisp: select V4L2_FWNODE - mediatek: vcodec: fix cancel_work_sync fail with fluster test * tag 'media/v6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: verisilicon: change confusingly named relaxed register access media: verisilicon: fix excessive stack usage media: mediatek: vcodec: fix cancel_work_sync fail with fluster test media: pci: cx23885: fix error handling for cx23885 ATSC boards media: pulse8-cec: handle possible ping error media: mtk_jpeg_core: avoid unused-variable warning media: imx-jpeg: Support to assign slot for encoder/decoder media: amphion: Fix firmware path to match linux-firmware media: amphion: use dev_err_probe media: staging: atomisp: select V4L2_FWNODE media: tc358746: Address compiler warnings commit bf7ecbe9875061bf3fce1883e3b26b77f847d1e8 Author: Filipe Manana Date: Fri Jul 21 10:49:20 2023 +0100 btrfs: check if the transaction was aborted at btrfs_wait_for_commit() At btrfs_wait_for_commit() we wait for a transaction to finish and then always return 0 (success) without checking if it was aborted, in which case the transaction didn't happen due to some critical error. Fix this by checking if the transaction was aborted. Fixes: 462045928bda ("Btrfs: add START_SYNC, WAIT_SYNC ioctls") CC: stable@vger.kernel.org # 4.19+ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit d8ccbd21918fd7fa6ce3226cffc22c444228e8ad Author: Filipe Manana Date: Fri Jun 30 16:03:44 2023 +0100 btrfs: remove BUG_ON()'s in add_new_free_space() At add_new_free_space() we have these BUG_ON()'s that are there to deal with any failure to add free space to the in memory free space cache. Such failures are mostly -ENOMEM that should be very rare. However there's no need to have these BUG_ON()'s, we can just return any error to the caller and all callers and their upper call chain are already dealing with errors. So just make add_new_free_space() return any errors, while removing the BUG_ON()'s, and returning the total amount of added free space to an optional u64 pointer argument. Reported-by: syzbot+3ba856e07b7127889d8c@syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/000000000000e9cb8305ff4e8327@google.com/ Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0a9266b79cacdd02b888aed1308c308ad6d4ee4e Merge: 6eaae19807608 522b1d69219d8 Author: Linus Torvalds Date: Mon Jul 24 08:55:53 2023 -0700 Merge tag 'x86_bugs_zenbleed' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull Zen 2 errata fix from Borislav Petkov: "Fix an issue on AMD Zen2 processors called Zenbleed. The bug manifests itself as a data corruption issue when executing VZEROUPPER under certain microarchitectural conditions" * tag 'x86_bugs_zenbleed' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpu/amd: Add a Zenbleed fix x86/cpu/amd: Move the errata checking functionality up commit aead78125a987f48944bff2001f61df72b95afc4 Author: Anh Tuan Phan Date: Sun Jul 16 22:44:56 2023 +0700 tools/counter: Makefile: Replace rmdir by rm to avoid make,clean failure Use rm -df instead of rmdir -p since rmdir requires the directory exist so it causes "make -C tools clean" failed if someone only builds other tools but not counter. Fixes: 228354ed692f ("tools/counter: Makefile: Remove lingering 'include' directories on make clean") Signed-off-by: Anh Tuan Phan Link: https://lore.kernel.org/r/d4080db5-1825-2848-079a-8bb674d8ee44@gmail.com/ Signed-off-by: William Breathitt Gray commit 54685abe660a59402344d5045ce08c43c6a5ac42 Author: Gilles Buloz Date: Mon Jul 24 08:04:44 2023 +0000 hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled Because of hex value 0x46 used instead of decimal 46, the temp6 (PECI1) temperature is always declared visible and then displayed even if disabled in the chip Signed-off-by: Gilles Buloz Link: https://lore.kernel.org/r/DU0PR10MB62526435ADBC6A85243B90E08002A@DU0PR10MB6252.EURPRD10.PROD.OUTLOOK.COM Fixes: fcdc5739dce03 ("hwmon: (nct7802) add temperature sensor type attribute") Cc: stable@vger.kernel.org Signed-off-by: Guenter Roeck commit a2777be03236c00466326acba8d39ac4f9c3e971 Author: Brian Norris Date: Fri Jul 21 16:06:04 2023 -0700 MAINTAINERS: Update mwifiex maintainer list We haven't heard anything from these folks in years. I've been reviewing many submissions and plan to keep doing so. Cc: Amitkumar Karwar Cc: Ganapathi Bhat Cc: Sharvari Harisangam Cc: Xinming Hu Signed-off-by: Brian Norris Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230721160603.1.Idf0e8025f59c62d73c08960638249b58cf215acc@changeid commit 421033deb91521aa6a9255e495cb106741a52275 Author: Paul Fertser Date: Mon Jun 5 10:34:07 2023 +0300 wifi: mt76: mt7615: do not advertise 5 GHz on first phy of MT7615D (DBDC) On DBDC devices the first (internal) phy is only capable of using 2.4 GHz band, and the 5 GHz band is exposed via a separate phy object, so avoid the false advertising. Reported-by: Rani Hod Closes: https://github.com/openwrt/openwrt/pull/12361 Fixes: 7660a1bd0c22 ("mt76: mt7615: register ext_phy if DBDC is detected") Cc: stable@vger.kernel.org Signed-off-by: Paul Fertser Reviewed-by: Simon Horman Acked-by: Felix Fietkau Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230605073408.8699-1-fercerpav@gmail.com commit 92d39d018347ead1078dcba3cb1d8aeb9de79e04 Author: Durai Manickam KR Date: Tue Jul 18 12:27:34 2023 +0530 dt-bindings: serial: atmel,at91-usart: update compatible for sam9x60 There is only one debug unit in the sam9x60 SOC and it has the chipid register. So, the dbgu compatible strings are valid only for debug usart. Defining these dbgu compatible strings are not valid for flexcom usart. So adding the items which is valid only for flexcom usart and removing the microchip,sam9x60-usart compatible string from the enum list as no usart node defines only this specific compatible string. Signed-off-by: Durai Manickam KR Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230718065735.10187-2-durai.manickamkr@microchip.com Signed-off-by: Arnd Bergmann commit 1b64daa6020c0cb4443b4a804a573ad67fc35561 Merge: f6ad3c13f1b8c d1ff11d7ad870 Author: Arnd Bergmann Date: Mon Jul 24 15:17:59 2023 +0200 Merge tag 'scmi-smccc-fixes-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm SCMI and SMCCC fixes for v6.5 Set of fixes addressing issues: 1. Possible use of uninitialised results structure in the SMCCC SOC_ID driver if the driver fails to complete the initialisation 2. Missed signed error return value handling from simple_write_to_buffer() used in scmi_dbg_raw_mode_common_write() 3. The OF node reference obtained is not dropped if node is incompatible with "arm,scmi-shmem" in the mailbox as well as SMC transport channel setup 4. The possibility of a late response to an in-flight pending transaction that could end up triggering the interrupt handler after the SCMI core has cleaned up the transport channel as part of core driver remove * tag 'scmi-smccc-fixes-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Fix chan_free cleanup on SMC firmware: arm_scmi: Drop OF node reference in the transport channel setup firmware: arm_scmi: Fix signed error return values handling firmware: smccc: Fix use of uninitialised results structure Link: https://lore.kernel.org/r/20230721114052.3371923-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 922a9bd138101e3e5718f0f4d40dba68ef89bb43 Author: Ben Hutchings Date: Fri Jun 16 17:36:10 2023 +0200 m68k: Fix invalid .section syntax gas supports several different forms for .section for ELF targets, including: .section NAME [, "FLAGS"[, @TYPE[,FLAG_SPECIFIC_ARGUMENTS]]] and: .section "NAME"[, #FLAGS...] In several places we use a mix of these two forms: .section NAME, #FLAGS... A current development snapshot of binutils (2.40.50.20230611) treats this mixed syntax as an error. Change to consistently use: .section NAME, "FLAGS" as is used elsewhere in the kernel. Link: https://buildd.debian.org/status/fetch.php?pkg=linux&arch=m68k&ver=6.4%7Erc6-1%7Eexp1&stamp=1686907300&raw=1 Signed-off-by: Ben Hutchings Tested-by: Jan-Benedict Glaw Link: https://lore.kernel.org/r/ZIyBaueWT9jnTwRC@decadent.org.uk Signed-off-by: Geert Uytterhoeven commit 50164507f6b7b7ed85d8c3ac0266849fbd908db7 Author: Xiubo Li Date: Thu Jul 20 11:33:55 2023 +0800 ceph: never send metrics if disable_send_metrics is set Even the 'disable_send_metrics' is true so when the session is being opened it will always trigger to send the metric for the first time. Cc: stable@vger.kernel.org Signed-off-by: Xiubo Li Reviewed-by: Venky Shankar Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov commit 13c088cf3657d70893d75cf116be937f1509cc0f Author: Harshit Mogalapalli Date: Fri Jul 21 02:05:55 2023 -0700 phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe() The size of array 'priv->ports[]' is INNO_PHY_PORT_NUM. In the for loop, 'i' is used as the index for array 'priv->ports[]' with a check (i > INNO_PHY_PORT_NUM) which indicates that INNO_PHY_PORT_NUM is allowed value for 'i' in the same loop. This > comparison needs to be changed to >=, otherwise it potentially leads to an out of bounds write on the next iteration through the loop Fixes: ba8b0ee81fbb ("phy: add inno-usb2-phy driver for hi3798cv200 SoC") Reported-by: Dan Carpenter Signed-off-by: Harshit Mogalapalli Link: https://lore.kernel.org/r/20230721090558.3588613-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Vinod Koul commit 22117b3ae6e37d07225653d9ae5ae86b3a54f99c Merge: 8d01da0a1db23 b0b672c4d0957 Author: David S. Miller Date: Mon Jul 24 10:47:09 2023 +0100 Merge branch 'vxlan-gro-fixes' Jiri Benc says: ==================== vxlan: fix GRO with VXLAN-GPE The first patch generalizes code for the second patch, which is a fix for broken VXLAN-GPE GRO. Thanks to Paolo for noticing the bug. ==================== Signed-off-by: David S. Miller commit b0b672c4d0957e5897685667fc848132b8bd2d71 Author: Jiri Benc Date: Fri Jul 21 16:30:47 2023 +0200 vxlan: fix GRO with VXLAN-GPE In VXLAN-GPE, there may not be an Ethernet header following the VXLAN header. But in GRO, the vxlan driver calls eth_gro_receive unconditionally, which means the following header is incorrectly parsed as Ethernet. Introduce GPE specific GRO handling. For better performance, do not check for GPE during GRO but rather install a different set of functions at setup time. Fixes: e1e5314de08ba ("vxlan: implement GPE") Reported-by: Paolo Abeni Signed-off-by: Jiri Benc Signed-off-by: David S. Miller commit 17a0a64448b568442a101de09575f81ffdc45d15 Author: Jiri Benc Date: Fri Jul 21 16:30:46 2023 +0200 vxlan: generalize vxlan_parse_gpe_hdr and remove unused args The vxlan_parse_gpe_hdr function extracts the next protocol value from the GPE header and marks GPE bits as parsed. In order to be used in the next patch, split the function into protocol extraction and bit marking. The bit marking is meaningful only in vxlan_rcv; move it directly there. Rename the function to vxlan_parse_gpe_proto to reflect what it now does. Remove unused arguments skb and vxflags. Move the function earlier in the file to allow it to be called from more places in the next patch. Signed-off-by: Jiri Benc Signed-off-by: David S. Miller commit 8d01da0a1db237c44c92859ce3612df7af8d3a53 Author: Yuanjun Gong Date: Thu Jul 20 22:42:08 2023 +0800 ethernet: atheros: fix return value check in atl1c_tso_csum() in atl1c_tso_csum, it should check the return value of pskb_trim(), and return an error code if an unexpected value is returned by pskb_trim(). Signed-off-by: Yuanjun Gong Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 94d166c5318c6edd1e079df8552233443e909c33 Author: Jiri Benc Date: Thu Jul 20 11:05:56 2023 +0200 vxlan: calculate correct header length for GPE VXLAN-GPE does not add an extra inner Ethernet header. Take that into account when calculating header length. This causes problems in skb_tunnel_check_pmtu, where incorrect PMTU is cached. In the collect_md mode (which is the only mode that VXLAN-GPE supports), there's no magic auto-setting of the tunnel interface MTU. It can't be, since the destination and thus the underlying interface may be different for each packet. So, the administrator is responsible for setting the correct tunnel interface MTU. Apparently, the administrators are capable enough to calculate that the maximum MTU for VXLAN-GPE is (their_lower_MTU - 36). They set the tunnel interface MTU to 1464. If you run a TCP stream over such interface, it's then segmented according to the MTU 1464, i.e. producing 1514 bytes frames. Which is okay, this still fits the lower MTU. However, skb_tunnel_check_pmtu (called from vxlan_xmit_one) uses 50 as the header size and thus incorrectly calculates the frame size to be 1528. This leads to ICMP too big message being generated (locally), PMTU of 1450 to be cached and the TCP stream to be resegmented. The fix is to use the correct actual header size, especially for skb_tunnel_check_pmtu calculation. Fixes: e1e5314de08ba ("vxlan: implement GPE") Signed-off-by: Jiri Benc Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit a071c6ace314d7bcc8400275ea79f13b5bcc89e9 Merge: c7b75bea853da 882481b1c55fc Author: David S. Miller Date: Mon Jul 24 09:36:23 2023 +0100 Merge branch 'hns3-fixes' Jijie Shao says: ==================== There are some bugfix for the HNS3 ethernet driver There are some bugfix for the HNS3 ethernet driver ==================== Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 882481b1c55fc44861d7e2d54b4e0936b1b39f2c Author: Jijie Shao Date: Thu Jul 20 10:05:10 2023 +0800 net: hns3: fix wrong bw weight of disabled tc issue In dwrr mode, the default bandwidth weight of disabled tc is set to 0. If the bandwidth weight is 0, the mode will change to sp. Therefore, disabled tc default bandwidth weight need changed to 1, and 0 is returned when query the bandwidth weight of disabled tc. In addition, driver need stop configure bandwidth weight if tc is disabled. Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver") Signed-off-by: Jie Wang Signed-off-by: Jijie Shao Signed-off-by: David S. Miller commit 116d9f732eef634abbd871f2c6f613a5b4677742 Author: Jijie Shao Date: Thu Jul 20 10:05:09 2023 +0800 net: hns3: fix wrong tc bandwidth weight data issue Currently, the weight saved by the driver is used as the query result, which may be different from the actual weight in the register. Therefore, the register value read from the firmware is used as the query result Fixes: 0e32038dc856 ("net: hns3: refactor dump tc of debugfs") Signed-off-by: Jijie Shao Signed-off-by: David S. Miller commit 6d2336120aa6e1a8a64fa5d6ee5c3f3d0809fe9b Author: Hao Lan Date: Thu Jul 20 10:05:08 2023 +0800 net: hns3: add tm flush when setting tm When the tm module is configured with traffic, traffic may be abnormal. This patch fixes this problem. Before the tm module is configured, traffic processing should be stopped. After the tm module is configured, traffic processing is enabled. Signed-off-by: Hao Lan Signed-off-by: Jijie Shao Signed-off-by: David S. Miller commit b27d0232e8897f7c896dc8ad80c9907dd57fd3f3 Author: Hao Lan Date: Thu Jul 20 10:05:07 2023 +0800 net: hns3: fix the imp capability bit cannot exceed 32 bits issue Current only the first 32 bits of the capability flag bit are considered. When the matching capability flag bit is greater than 31 bits, it will get an error bit.This patch use bitmap to solve this issue. It can handle each capability bit whitout bit width limit. Fixes: da77aef9cc58 ("net: hns3: create common cmdq resource allocate/free/query APIs") Signed-off-by: Hao Lan Signed-off-by: Jijie Shao Signed-off-by: David S. Miller commit de990908521073d98a46ad0e29885df447e95242 Merge: 67a4e1a3bf7c6 6fe5c68ee6a1a Author: Thomas Gleixner Date: Mon Jul 24 10:27:43 2023 +0200 Merge tag 'irqchip-fixes-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull irqchip fixes from Marc Zyngier: - Work around an erratum on GIC700, where a race between a CPU handling a wake-up interrupt, a change of affinity, and another CPU going to sleep can result in a lack of wake-up event on the next interrupt. - Fix the locking required on a VPE for GICv4 - Enable Rockchip 3588001 erratum workaround for RK3588S - Fix the irq-bcm6345-l1 assumtions of the boot CPU always be the first CPU in the system Link: https://lore.kernel.org/lkml/20230717113857.304919-1-maz@kernel.org commit 4dd8752a14ca0303fbdf0a6c68ff65f0a50bd2fa Author: Johan Hovold Date: Thu Jul 13 16:57:41 2023 +0200 serial: qcom-geni: drop bogus runtime pm state update The runtime PM state should not be changed by drivers that do not implement runtime PM even if it happens to work around a bug in PM core. With the wake irq arming now fixed, drop the bogus runtime PM state update which left the device in active state (and could potentially prevent a parent device from suspending). Fixes: f3974413cf02 ("tty: serial: qcom_geni_serial: Wakeup IRQ cleanup") Cc: 5.6+ # 5.6+ Signed-off-by: Johan Hovold Reviewed-by: Tony Lindgren Signed-off-by: Rafael J. Wysocki commit e7b915219baa4b2bf30afe1dbaca7a24ff627ad2 Author: Johan Hovold Date: Thu Jul 13 16:57:40 2023 +0200 PM: sleep: wakeirq: drop unused enable helpers Drop the wake-irq enable and disable helpers which have not been used since commit bed570307ed7 ("PM / wakeirq: Fix dedicated wakeirq for drivers not using autosuspend"). Note that these functions are essentially just leftovers from the first iteration of the wake-irq implementation where device drivers were supposed to call these functions themselves instead of PM core (as is also indicated by the bogus kernel doc comments). Signed-off-by: Johan Hovold Reviewed-by: Tony Lindgren Signed-off-by: Rafael J. Wysocki commit 8527beb12087238d4387607597b4020bc393c4b4 Author: Johan Hovold Date: Thu Jul 13 16:57:39 2023 +0200 PM: sleep: wakeirq: fix wake irq arming The decision whether to enable a wake irq during suspend can not be done based on the runtime PM state directly as a driver may use wake irqs without implementing runtime PM. Such drivers specifically leave the state set to the default 'suspended' and the wake irq is thus never enabled at suspend. Add a new wake irq flag to track whether a dedicated wake irq has been enabled at runtime suspend and therefore must not be enabled at system suspend. Note that pm_runtime_enabled() can not be used as runtime PM is always disabled during late suspend. Fixes: 69728051f5bf ("PM / wakeirq: Fix unbalanced IRQ enable for wakeirq") Cc: 4.16+ # 4.16+ Signed-off-by: Johan Hovold Reviewed-by: Tony Lindgren Tested-by: Tony Lindgren Signed-off-by: Rafael J. Wysocki commit ac4436a5b20e0ef1f608a9ef46c08d5d142f8da6 Author: Ahmad Fatoum Date: Sat Jul 8 13:27:20 2023 +0200 thermal: of: fix double-free on unregistration Since commit 3d439b1a2ad3 ("thermal/core: Alloc-copy-free the thermal zone parameters structure"), thermal_zone_device_register() allocates a copy of the tzp argument and frees it when unregistering, so thermal_of_zone_register() now ends up leaking its original tzp and double-freeing the tzp copy. Fix this by locating tzp on stack instead. Fixes: 3d439b1a2ad3 ("thermal/core: Alloc-copy-free the thermal zone parameters structure") Signed-off-by: Ahmad Fatoum Acked-by: Daniel Lezcano Cc: 6.4+ # 6.4+: 8bcbb18c61d6: thermal: core: constify params in thermal_zone_device_register Signed-off-by: Rafael J. Wysocki commit 80ddce5f2dbd0e83eadc9f9d373439180d599fe5 Author: Ahmad Fatoum Date: Sat Jul 8 13:27:19 2023 +0200 thermal: core: constify params in thermal_zone_device_register Since commit 3d439b1a2ad3 ("thermal/core: Alloc-copy-free the thermal zone parameters structure"), thermal_zone_device_register() allocates a copy of the tzp argument and callers need not explicitly manage its lifetime. This means the function no longer cares about the parameter being mutable, so constify it. No functional change. Signed-off-by: Ahmad Fatoum Acked-by: Daniel Lezcano Signed-off-by: Rafael J. Wysocki commit 9e46e4dcd9d6cd88342b028dbfa5f4fb7483d39c Author: Rik van Riel Date: Wed Jul 19 15:41:37 2023 -0400 mm,memblock: reset memblock.reserved to system init state to prevent UAF The memblock_discard function frees the memblock.reserved.regions array, which is good. However, if a subsequent memblock_free (or memblock_phys_free) comes in later, from for example ima_free_kexec_buffer, that will result in a use after free bug in memblock_isolate_range. When running a kernel with CONFIG_KASAN enabled, this will cause a kernel panic very early in boot. Without CONFIG_KASAN, there is a chance that memblock_isolate_range might scribble on memory that is now in use by somebody else. Avoid those issues by making sure that memblock_discard points memblock.reserved.regions back at the static buffer. If memblock_free is called after memblock memory is discarded, that will print a warning in memblock_remove_region. Signed-off-by: Rik van Riel Link: https://lore.kernel.org/r/20230719154137.732d8525@imladris.surriel.com Signed-off-by: Mike Rapoport (IBM) commit ed0cf84e9cc42e6310961c87709621f1825c2bb8 Author: Ani Sinha Date: Wed Jul 5 19:14:07 2023 +0530 vmbus_testing: fix wrong python syntax for integer value comparison It is incorrect in python to compare integer values using the "is" keyword. The "is" keyword in python is used to compare references to two objects, not their values. Newer version of python3 (version 3.8) throws a warning when such incorrect comparison is made. For value comparison, "==" should be used. Fix this in the code and suppress the following warning: /usr/sbin/vmbus_testing:167: SyntaxWarning: "is" with a literal. Did you mean "=="? Signed-off-by: Ani Sinha Link: https://lore.kernel.org/r/20230705134408.6302-1-anisinha@redhat.com Signed-off-by: Wei Liu commit 060f2b979c4e0e894c381c76a4dcad24376feddd Author: ZhiHu Date: Sun Jul 23 23:12:47 2023 +0000 x86/hyperv: fix a warning in mshyperv.h The following checkpatch warning is removed: WARNING: Use #include instead of Signed-off-by: ZhiHu Reviewed-by: Michael Kelley Signed-off-by: Wei Liu commit d5ace2a776442d80674eff9ed42e737f7dd95056 Author: Michael Kelley Date: Fri Jul 21 21:51:16 2023 -0700 x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction On hardware that supports Indirect Branch Tracking (IBT), Hyper-V VMs with ConfigVersion 9.3 or later support IBT in the guest. However, current versions of Hyper-V have a bug in that there's not an ENDBR64 instruction at the beginning of the hypercall page. Since hypercalls are made with an indirect call to the hypercall page, all hypercall attempts fail with an exception and Linux panics. A Hyper-V fix is in progress to add ENDBR64. But guard against the Linux panic by clearing X86_FEATURE_IBT if the hypercall page doesn't start with ENDBR. The VM will boot and run without IBT. If future Linux 32-bit kernels were to support IBT, additional hypercall page hackery would be needed to make IBT work for such kernels in a Hyper-V VM. Cc: stable@vger.kernel.org Signed-off-by: Michael Kelley Link: https://lore.kernel.org/r/1690001476-98594-1-git-send-email-mikelley@microsoft.com Signed-off-by: Wei Liu commit 67cb608838e0aac8efb48828b1165156f99c1af9 Author: Chen-Yu Tsai Date: Fri Jul 21 16:28:55 2023 +0800 regulator: mt6358: Fix incorrect VCN33 sync error message After syncing the enable status of VCN33_WIFI to VCN33_BT, the driver will disable VCN33_WIFI. If it fails it will error out with a message. However the error message incorrectly refers to VCN33_BT. Fix the error message so that it correctly refers to VCN33_WIFI. Suggested-by: Fei Shao Fixes: 65bae54e08c1 ("regulator: mt6358: Merge VCN33_* regulators") Signed-off-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230721082903.2038975-4-wenst@chromium.org Signed-off-by: Mark Brown commit 649fee5a17a7f96152fee2fb9111d9a4db535f35 Author: Chen-Yu Tsai Date: Fri Jul 21 16:28:54 2023 +0800 regulator: mt6358: Sync VCN33_* enable status after checking ID Syncing VCN33_* enable status should be done after checking the PMIC's ID, to avoid setting random bits on other PMICs. Suggested-by: AngeloGioacchino Del Regno Fixes: 65bae54e08c1 ("regulator: mt6358: Merge VCN33_* regulators") Signed-off-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230721082903.2038975-3-wenst@chromium.org Signed-off-by: Mark Brown commit 1bc40efdaf4a0ccfdb10a1c8e4b458f4764e8e5f Author: Edson Juliano Drosdeck Date: Wed Jul 19 17:02:41 2023 -0300 ASoC: nau8821: Add DMI quirk mechanism for active-high jack-detect Add a quirk mechanism to allow specifying that active-high jack-detection should be used on platforms where this info is not available in devicetree. And add an entry for the Positivo CW14Q01P-V2 to the DMI table, so that jack-detection will work properly on this laptop. Signed-off-by: Edson Juliano Drosdeck Link: https://lore.kernel.org/r/20230719200241.4865-1-edson.drosdeck@gmail.com Signed-off-by: Mark Brown commit f0691dc16206f21b13c464434366e2cd632b8ed7 Author: Dmytro Maluka Date: Mon Jul 17 21:37:37 2023 +0200 ASoC: da7219: Check for failure reading AAD IRQ events When handling an AAD interrupt, if IRQ events read failed (for example, due to i2c "Transfer while suspended" failure, i.e. when attempting to read it while DA7219 is suspended, which may happen due to a spurious AAD interrupt), the events array contains garbage uninitialized values. So instead of trying to interprete those values and doing any actions based on them (potentially resulting in misbehavior, e.g. reporting bogus events), refuse to handle the interrupt. Signed-off-by: Dmytro Maluka Link: https://lore.kernel.org/r/20230717193737.161784-3-dmy@semihalf.com Signed-off-by: Mark Brown commit 91e292917dad64ab8d1d5ca2ab3069ad9dac6f72 Author: Dmytro Maluka Date: Mon Jul 17 21:37:36 2023 +0200 ASoC: da7219: Flush pending AAD IRQ when suspending da7219_aad_suspend() disables jack detection, which should prevent generating new interrupts by DA7219 while suspended. However, there is a theoretical possibility that there is a pending interrupt generated just before suspending DA7219 and not handled yet, so the IRQ handler may still run after DA7219 is suspended. To prevent that, wait until the pending IRQ handling is done. This patch arose as an attempt to fix the following I2C failure occurring sometimes during system suspend or resume: [ 355.876211] i2c_designware i2c_designware.3: Transfer while suspended [ 355.876245] WARNING: CPU: 2 PID: 3576 at drivers/i2c/busses/i2c-designware-master.c:570 i2c_dw_xfer+0x411/0x440 ... [ 355.876462] Call Trace: [ 355.876468] [ 355.876475] ? update_load_avg+0x1b3/0x615 [ 355.876484] __i2c_transfer+0x101/0x1d8 [ 355.876494] i2c_transfer+0x74/0x10d [ 355.876504] regmap_i2c_read+0x6a/0x9c [ 355.876513] _regmap_raw_read+0x179/0x223 [ 355.876521] regmap_raw_read+0x1e1/0x28e [ 355.876527] regmap_bulk_read+0x17d/0x1ba [ 355.876532] ? __wake_up+0xed/0x1bb [ 355.876542] da7219_aad_irq_thread+0x54/0x2c9 [snd_soc_da7219 5fb8ebb2179cf2fea29af090f3145d68ed8e2184] [ 355.876556] irq_thread+0x13c/0x231 [ 355.876563] ? irq_forced_thread_fn+0x5f/0x5f [ 355.876570] ? irq_thread_fn+0x4d/0x4d [ 355.876576] kthread+0x13a/0x152 [ 355.876581] ? synchronize_irq+0xc3/0xc3 [ 355.876587] ? kthread_blkcg+0x31/0x31 [ 355.876592] ret_from_fork+0x1f/0x30 [ 355.876601] which indicates that the AAD IRQ handler is unexpectedly running when DA7219 is suspended, and as a result, is trying to read data from DA7219 over I2C and is hitting the I2C driver "Transfer while suspended" failure. However, with this patch the above failure is still reproducible. So this patch does not fix any real observed issue so far, but at least is useful for confirming that the above issue is not caused by a pending IRQ but rather looks like a DA7219 hardware issue with an IRQ unexpectedly generated after jack detection is already disabled. Signed-off-by: Dmytro Maluka Link: https://lore.kernel.org/r/20230717193737.161784-2-dmy@semihalf.com Signed-off-by: Mark Brown commit 1477c794c771be0a873a41421812e7274717dcd1 Merge: 0e4c2b6b0c4a4 6eaae19807608 Author: Mark Brown Date: Sun Jul 23 23:32:05 2023 +0100 ASoC: Merge up fixes from mainline There's several things here that will really help my CI. commit 6eaae198076080886b9e7d57f4ae06fa782f90ef Author: Linus Torvalds Date: Sun Jul 23 15:24:10 2023 -0700 Linux 6.5-rc3 commit 3b4e48b8007105695c913348ca11df50260a5ccb Merge: 12a5336ca384b 4b8b3905165ef Author: Linus Torvalds Date: Sun Jul 23 15:19:14 2023 -0700 Merge tag 'trace-v6.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Swapping the ring buffer for snapshotting (for things like irqsoff) can crash if the ring buffer is being resized. Disable swapping when this happens. The missed swap will be reported to the tracer - Report error if the histogram fails to be created due to an error in adding a histogram variable, in event_hist_trigger_parse() - Remove unused declaration of tracing_map_set_field_descr() * tag 'trace-v6.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/histograms: Return an error if we fail to add histogram to hist_vars list ring-buffer: Do not swap cpu_buffer during resize process tracing: Remove unused extern declaration tracing_map_set_field_descr() commit 12a5336ca384b295093c18e0c66ca60b4518d9b9 Merge: 269f4a4b85a1b df01b7cfcef08 Author: Linus Torvalds Date: Sun Jul 23 14:55:41 2023 -0700 Merge tag 'kbuild-fixes-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - Fix stale help text in gconfig - Support *.S files in compile_commands.json - Flatten KBUILD_CFLAGS - Fix external module builds with Rust so that temporary files are created in the modules directories instead of the kernel tree * tag 'kbuild-fixes-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: rust: avoid creating temporary files kbuild: flatten KBUILD_CFLAGS gen_compile_commands: add assembly files to compilation database kconfig: gconfig: correct program name in help text kconfig: gconfig: drop the Show Debug Info help text commit f00295e890bbc8780cd2076ee17bc7a08a53091c Author: Shazad Hussain Date: Wed Jul 19 16:33:44 2023 +0530 dt-bindings: pinctrl: qcom,sa8775p-tlmm: add gpio function constant Alternative function 'gpio' is not listed in the constants for pin configuration, so adding this constant to the list. Cc: stable@vger.kernel.org Fixes: 9a2aaee23c79 ("dt-bindings: pinctrl: describe sa8775p-tlmm") Signed-off-by: Shazad Hussain Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230719110344.19983-1-quic_shazhuss@quicinc.com Signed-off-by: Linus Walleij commit 010c1e1c5741365dbbf44a5a5bb9f30192875c4c Author: Michael Kelley Date: Thu Jul 20 14:05:02 2023 -0700 scsi: storvsc: Limit max_sectors for virtual Fibre Channel devices The Hyper-V host is queried to get the max transfer size that it supports, and this value is used to set max_sectors for the synthetic SCSI controller. However, this max transfer size may be too large for virtual Fibre Channel devices, which are limited to 512 Kbytes. If a larger transfer size is used with a vFC device, Hyper-V always returns an error, and storvsc logs a message like this where the SRB status and SCSI status are both zero: hv_storvsc : tag#197 cmd 0x8a status: scsi 0x0 srb 0x0 hv 0xc0000001 Add logic to limit the max transfer size to 512 Kbytes for vFC devices. Fixes: 1d3e0980782f ("scsi: storvsc: Correct reporting of Hyper-V I/O size limits") Cc: stable@vger.kernel.org Signed-off-by: Michael Kelley Link: https://lore.kernel.org/r/1689887102-32806-1-git-send-email-mikelley@microsoft.com Signed-off-by: Martin K. Petersen commit df01b7cfcef08bf3fdcac2909d0e1910781d6bfd Author: Miguel Ojeda Date: Sun Jul 23 16:21:28 2023 +0200 kbuild: rust: avoid creating temporary files `rustc` outputs by default the temporary files (i.e. the ones saved by `-Csave-temps`, such as `*.rcgu*` files) in the current working directory when `-o` and `--out-dir` are not given (even if `--emit=x=path` is given, i.e. it does not use those for temporaries). Since out-of-tree modules are compiled from the `linux` tree, `rustc` then tries to create them there, which may not be accessible. Thus pass `--out-dir` explicitly, even if it is just for the temporary files. Similarly, do so for Rust host programs too. Reported-by: Raphael Nestler Closes: https://github.com/Rust-for-Linux/linux/issues/1015 Reported-by: Andrea Righi Tested-by: Raphael Nestler # non-hostprogs Tested-by: Andrea Righi # non-hostprogs Fixes: 295d8398c67e ("kbuild: specify output names separately for each emission type from rustc") Cc: stable@vger.kernel.org Signed-off-by: Miguel Ojeda Tested-by: Martin Rodriguez Reboredo Signed-off-by: Masahiro Yamada commit 269f4a4b85a1b61e94bf935b30c56a938e92f585 Merge: 15b593ba68445 0c189708bfbfa Author: Linus Torvalds Date: Sun Jul 23 10:44:38 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM: - Avoid pKVM finalization if KVM initialization fails - Add missing BTI instructions in the hypervisor, fixing an early boot failure on BTI systems - Handle MMU notifiers correctly for non hugepage-aligned memslots - Work around a bug in the architecture where hypervisor timer controls have UNKNOWN behavior under nested virt - Disable preemption in kvm_arch_hardware_enable(), fixing a kernel BUG in cpu hotplug resulting from per-CPU accessor sanity checking - Make WFI emulation on GICv4 systems robust w.r.t. preemption, consistently requesting a doorbell interrupt on vcpu_put() - Uphold RES0 sysreg behavior when emulating older PMU versions - Avoid macro expansion when initializing PMU register names, ensuring the tracepoints pretty-print the sysreg s390: - Two fixes for asynchronous destroy x86 fixes will come early next week" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: s390: pv: fix index value of replaced ASCE KVM: s390: pv: simplify shutdown and fix race KVM: arm64: Fix the name of sys_reg_desc related to PMU KVM: arm64: Correctly handle RES0 bits PMEVTYPER_EL0.evtCount KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption KVM: arm64: Add missing BTI instructions KVM: arm64: Correctly handle page aging notifiers for unaligned memslot KVM: arm64: Disable preemption in kvm_arch_hardware_enable() KVM: arm64: Handle kvm_arm_init failure correctly in finalize_pkvm KVM: arm64: timers: Use CNTHCTL_EL2 when setting non-CNTKCTL_EL1 bits commit 15b593ba68445a2b436a63044eaecd0679457dc2 Merge: 8266f53b39087 9d3de7ee192a6 Author: Linus Torvalds Date: Sun Jul 23 10:21:49 2023 -0700 Merge tag 'ext4_for_linus-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Bug and regression fixes for 6.5-rc3 for ext4's mballoc and jbd2's checkpoint code" * tag 'ext4_for_linus-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: fix rbtree traversal bug in ext4_mb_use_preallocated ext4: fix off by one issue in ext4_mb_choose_next_group_best_avail() ext4: correct inline offset when handling xattrs in inode body jbd2: remove __journal_try_to_free_buffer() jbd2: fix a race when checking checkpoint buffer busy jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint jbd2: remove journal_clean_one_cp_list() jbd2: remove t_checkpoint_io_list jbd2: recheck chechpointing non-dirty buffer commit 8266f53b39087c195f0d011dc5696cb2e6155242 Merge: c2782531397f5 ba61a03af29a5 Author: Linus Torvalds Date: Sun Jul 23 10:16:44 2023 -0700 Merge tag '6.5-rc2-smb3-client-fixes-ver2' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fix from Steve French: "Add minor debugging improvement. The change improves ability to read a network trace to debug problems on encrypted connections which are very common (e.g. using wireshark or tcpdump). That works today with tools like 'smbinfo keys /mnt/file' but requires passing in a filename on the mount (see e.g. [1]), but it often makes more sense to just pass in the mount point path (ie a directory not a filename). So this fix was needed to debug some types of problems (an obvious example is on an encrypted connection failing operations on an empty share or with no files in the root of the directory) - so you can simply pass in the 'smbinfo keys ' and get the information that wireshark needs" Link: https://wiki.samba.org/index.php/Wireshark_Decryption [1] * tag '6.5-rc2-smb3-client-fixes-ver2' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal module version number for cifs.ko cifs: allow dumping keys for directories too commit 0c189708bfbfa90b458dac5f0fd4379f9a7d547e Merge: 675a15f4db67d c2fceb59bbda1 Author: Paolo Bonzini Date: Sun Jul 23 12:50:30 2023 -0400 Merge tag 'kvm-s390-master-6.5-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD Two fixes for asynchronous destroy commit 675a15f4db67d87710404533ab4a48f692f1f3dd Merge: fdf0eaf11452d 9d2a55b403eea Author: Paolo Bonzini Date: Sun Jul 23 12:50:14 2023 -0400 Merge tag 'kvmarm-fixes-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 6.5, part #1 - Avoid pKVM finalization if KVM initialization fails - Add missing BTI instructions in the hypervisor, fixing an early boot failure on BTI systems - Handle MMU notifiers correctly for non hugepage-aligned memslots - Work around a bug in the architecture where hypervisor timer controls have UNKNOWN behavior under nested virt. - Disable preemption in kvm_arch_hardware_enable(), fixing a kernel BUG in cpu hotplug resulting from per-CPU accessor sanity checking. - Make WFI emulation on GICv4 systems robust w.r.t. preemption, consistently requesting a doorbell interrupt on vcpu_put() - Uphold RES0 sysreg behavior when emulating older PMU versions - Avoid macro expansion when initializing PMU register names, ensuring the tracepoints pretty-print the sysreg. commit 536bb492d39bb6c080c92f31e8a55fe9934f452b Author: Namjae Jeon Date: Sun Jul 23 15:27:37 2023 +0900 ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and then send smb1 negotiate request, init_smb2_rsp_hdr is called for smb1 negotiate request since need_neg is set to false. This patch ignore smb1 packets after ->need_neg is set to false. Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21541 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit e202a1e8634b186da38cbbff85382ea2b9e297cf Author: Namjae Jeon Date: Sun Jul 23 15:22:33 2023 +0900 ksmbd: no response from compound read ksmbd doesn't support compound read. If client send read-read in compound to ksmbd, there can be memory leak from read buffer. Windows and linux clients doesn't send it to server yet. For now, No response from compound read. compound read will be supported soon. Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21587, ZDI-CAN-21588 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 3df0411e132ee74a87aa13142dfd2b190275332e Author: Namjae Jeon Date: Sun Jul 23 15:21:11 2023 +0900 ksmbd: validate session id and tree id in compound request `smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if `SMB2_TREE_CONNECT_HE` is the first command in compound request, will return 0, i.e. The tree id check is skipped. This patch use ksmbd_req_buf_next() to get current command in compound. Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21506 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit dc318846f3dd54574a36ae97fc8d8b75dd7cdb1e Author: Namjae Jeon Date: Sat Jul 22 00:09:28 2023 +0900 ksmbd: fix out of bounds in smb3_decrypt_req() smb3_decrypt_req() validate if pdu_length is smaller than smb2_transform_hdr size. Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21589 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 2b57a4322b1b14348940744fdc02f9a86cbbdbeb Author: Namjae Jeon Date: Mon Jul 17 08:37:40 2023 +0900 ksmbd: check if a mount point is crossed during path lookup Since commit 74d7970febf7 ("ksmbd: fix racy issue from using ->d_parent and ->d_name"), ksmbd can not lookup cross mount points. If last component is a cross mount point during path lookup, check if it is crossed to follow it down. And allow path lookup to cross a mount point when a crossmnt parameter is set to 'yes' in smb.conf. Cc: stable@vger.kernel.org Fixes: 74d7970febf7 ("ksmbd: fix racy issue from using ->d_parent and ->d_name") Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 4b8b3905165ef98386a3c06f196c85d21292d029 Author: Mohamed Khalfella Date: Fri Jul 14 20:33:41 2023 +0000 tracing/histograms: Return an error if we fail to add histogram to hist_vars list Commit 6018b585e8c6 ("tracing/histograms: Add histograms to hist_vars if they have referenced variables") added a check to fail histogram creation if save_hist_vars() failed to add histogram to hist_vars list. But the commit failed to set ret to failed return code before jumping to unregister histogram, fix it. Link: https://lore.kernel.org/linux-trace-kernel/20230714203341.51396-1-mkhalfella@purestorage.com Cc: stable@vger.kernel.org Fixes: 6018b585e8c6 ("tracing/histograms: Add histograms to hist_vars if they have referenced variables") Signed-off-by: Mohamed Khalfella Signed-off-by: Steven Rostedt (Google) commit 8a96c0288d0737ad77882024974c075345c72011 Author: Chen Lin Date: Wed Jul 19 15:58:47 2023 +0800 ring-buffer: Do not swap cpu_buffer during resize process When ring_buffer_swap_cpu was called during resize process, the cpu buffer was swapped in the middle, resulting in incorrect state. Continuing to run in the wrong state will result in oops. This issue can be easily reproduced using the following two scripts: /tmp # cat test1.sh //#! /bin/sh for i in `seq 0 100000` do echo 2000 > /sys/kernel/debug/tracing/buffer_size_kb sleep 0.5 echo 5000 > /sys/kernel/debug/tracing/buffer_size_kb sleep 0.5 done /tmp # cat test2.sh //#! /bin/sh for i in `seq 0 100000` do echo irqsoff > /sys/kernel/debug/tracing/current_tracer sleep 1 echo nop > /sys/kernel/debug/tracing/current_tracer sleep 1 done /tmp # ./test1.sh & /tmp # ./test2.sh & A typical oops log is as follows, sometimes with other different oops logs. [ 231.711293] WARNING: CPU: 0 PID: 9 at kernel/trace/ring_buffer.c:2026 rb_update_pages+0x378/0x3f8 [ 231.713375] Modules linked in: [ 231.714735] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 [ 231.716750] Hardware name: linux,dummy-virt (DT) [ 231.718152] Workqueue: events update_pages_handler [ 231.719714] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 231.721171] pc : rb_update_pages+0x378/0x3f8 [ 231.722212] lr : rb_update_pages+0x25c/0x3f8 [ 231.723248] sp : ffff800082b9bd50 [ 231.724169] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000 [ 231.726102] x26: 0000000000000001 x25: fffffffffffff010 x24: 0000000000000ff0 [ 231.728122] x23: ffff0000c3a0b600 x22: ffff0000c3a0b5c0 x21: fffffffffffffe0a [ 231.730203] x20: ffff0000c3a0b600 x19: ffff0000c0102400 x18: 0000000000000000 [ 231.732329] x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffe7aa8510 [ 231.734212] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000002 [ 231.736291] x11: ffff8000826998a8 x10: ffff800082b9baf0 x9 : ffff800081137558 [ 231.738195] x8 : fffffc00030e82c8 x7 : 0000000000000000 x6 : 0000000000000001 [ 231.740192] x5 : ffff0000ffbafe00 x4 : 0000000000000000 x3 : 0000000000000000 [ 231.742118] x2 : 00000000000006aa x1 : 0000000000000001 x0 : ffff0000c0007208 [ 231.744196] Call trace: [ 231.744892] rb_update_pages+0x378/0x3f8 [ 231.745893] update_pages_handler+0x1c/0x38 [ 231.746893] process_one_work+0x1f0/0x468 [ 231.747852] worker_thread+0x54/0x410 [ 231.748737] kthread+0x124/0x138 [ 231.749549] ret_from_fork+0x10/0x20 [ 231.750434] ---[ end trace 0000000000000000 ]--- [ 233.720486] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 233.721696] Mem abort info: [ 233.721935] ESR = 0x0000000096000004 [ 233.722283] EC = 0x25: DABT (current EL), IL = 32 bits [ 233.722596] SET = 0, FnV = 0 [ 233.722805] EA = 0, S1PTW = 0 [ 233.723026] FSC = 0x04: level 0 translation fault [ 233.723458] Data abort info: [ 233.723734] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 233.724176] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 233.724589] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 233.725075] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000104943000 [ 233.725592] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 233.726231] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 233.726720] Modules linked in: [ 233.727007] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 [ 233.727777] Hardware name: linux,dummy-virt (DT) [ 233.728225] Workqueue: events update_pages_handler [ 233.728655] pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 233.729054] pc : rb_update_pages+0x1a8/0x3f8 [ 233.729334] lr : rb_update_pages+0x154/0x3f8 [ 233.729592] sp : ffff800082b9bd50 [ 233.729792] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000 [ 233.730220] x26: 0000000000000000 x25: ffff800082a8b840 x24: ffff0000c0102418 [ 233.730653] x23: 0000000000000000 x22: fffffc000304c880 x21: 0000000000000003 [ 233.731105] x20: 00000000000001f4 x19: ffff0000c0102400 x18: ffff800082fcbc58 [ 233.731727] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000001 [ 233.732282] x14: ffff8000825fe0c8 x13: 0000000000000001 x12: 0000000000000000 [ 233.732709] x11: ffff8000826998a8 x10: 0000000000000ae0 x9 : ffff8000801b760c [ 233.733148] x8 : fefefefefefefeff x7 : 0000000000000018 x6 : ffff0000c03298c0 [ 233.733553] x5 : 0000000000000002 x4 : 0000000000000000 x3 : 0000000000000000 [ 233.733972] x2 : ffff0000c3a0b600 x1 : 0000000000000000 x0 : 0000000000000000 [ 233.734418] Call trace: [ 233.734593] rb_update_pages+0x1a8/0x3f8 [ 233.734853] update_pages_handler+0x1c/0x38 [ 233.735148] process_one_work+0x1f0/0x468 [ 233.735525] worker_thread+0x54/0x410 [ 233.735852] kthread+0x124/0x138 [ 233.736064] ret_from_fork+0x10/0x20 [ 233.736387] Code: 92400000 910006b5 aa000021 aa0303f7 (f9400060) [ 233.736959] ---[ end trace 0000000000000000 ]--- After analysis, the seq of the error is as follows [1-5]: int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size, int cpu_id) { for_each_buffer_cpu(buffer, cpu) { cpu_buffer = buffer->buffers[cpu]; //1. get cpu_buffer, aka cpu_buffer(A) ... ... schedule_work_on(cpu, &cpu_buffer->update_pages_work); //2. 'update_pages_work' is queue on 'cpu', cpu_buffer(A) is passed to // update_pages_handler, do the update process, set 'update_done' in // complete(&cpu_buffer->update_done) and to wakeup resize process. //----> //3. Just at this moment, ring_buffer_swap_cpu is triggered, //cpu_buffer(A) be swaped to cpu_buffer(B), the max_buffer. //ring_buffer_swap_cpu is called as the 'Call trace' below. Call trace: dump_backtrace+0x0/0x2f8 show_stack+0x18/0x28 dump_stack+0x12c/0x188 ring_buffer_swap_cpu+0x2f8/0x328 update_max_tr_single+0x180/0x210 check_critical_timing+0x2b4/0x2c8 tracer_hardirqs_on+0x1c0/0x200 trace_hardirqs_on+0xec/0x378 el0_svc_common+0x64/0x260 do_el0_svc+0x90/0xf8 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb8 el0_sync+0x180/0x1c0 //<---- /* wait for all the updates to complete */ for_each_buffer_cpu(buffer, cpu) { cpu_buffer = buffer->buffers[cpu]; //4. get cpu_buffer, cpu_buffer(B) is used in the following process, //the state of cpu_buffer(A) and cpu_buffer(B) is totally wrong. //for example, cpu_buffer(A)->update_done will leave be set 1, and will //not 'wait_for_completion' at the next resize round. if (!cpu_buffer->nr_pages_to_update) continue; if (cpu_online(cpu)) wait_for_completion(&cpu_buffer->update_done); cpu_buffer->nr_pages_to_update = 0; } ... } //5. the state of cpu_buffer(A) and cpu_buffer(B) is totally wrong, //Continuing to run in the wrong state, then oops occurs. Link: https://lore.kernel.org/linux-trace-kernel/202307191558478409990@zte.com.cn Signed-off-by: Chen Lin Signed-off-by: Steven Rostedt (Google) commit 1faf7e4a0b6ff13d50c45b4b3469fc125536cf37 Author: YueHaibing Date: Sat Jul 22 11:21:23 2023 +0800 tracing: Remove unused extern declaration tracing_map_set_field_descr() Since commit 08d43a5fa063 ("tracing: Add lock-free tracing_map"), this is never used, so can be removed. Link: https://lore.kernel.org/linux-trace-kernel/20230722032123.24664-1-yuehaibing@huawei.com Cc: Signed-off-by: YueHaibing Signed-off-by: Steven Rostedt (Google) commit 0817d2599cfe894fa4ded7dbaa2b06111f2609b5 Author: Alexey Dobriyan Date: Thu Jul 13 21:52:28 2023 +0300 kbuild: flatten KBUILD_CFLAGS Make it slightly easier to see which compiler options are added and removed (and not worry about column limit too!). Signed-off-by: Alexey Dobriyan Reviewed-by: Nicolas Schier Signed-off-by: Masahiro Yamada commit 1c67921444bf68107f7901d5bcfce954efaa8754 Author: Benjamin Gray Date: Wed Jul 19 13:19:12 2023 +1000 gen_compile_commands: add assembly files to compilation database Like C source files, tooling can find it useful to have the assembly source file compilation recorded. The .S extension appears to used across all architectures. Signed-off-by: Benjamin Gray Reviewed-by: Fangrui Song Reviewed-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit 6811694eb2f6b7a4e97be2029edc7dd6a39460f8 Author: Alejandro Tafalla Date: Fri Jul 14 17:31:26 2023 +0200 iio: imu: lsm6dsx: Fix mount matrix retrieval The function lsm6dsx_get_acpi_mount_matrix should return an error when ACPI support is not enabled to allow executing iio_read_mount_matrix in the probe function. Fixes: dc3d25f22b88 ("iio: imu: lsm6dsx: Add ACPI mount matrix retrieval") Signed-off-by: Alejandro Tafalla Acked-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/20230714153132.27265-1-atafalla@dnyon.com Signed-off-by: Jonathan Cameron commit 9d3de7ee192a6a253f475197fe4d2e2af10a731f Author: Ojaswin Mujoo Date: Sat Jul 22 22:45:24 2023 +0530 ext4: fix rbtree traversal bug in ext4_mb_use_preallocated During allocations, while looking for preallocations(PA) in the per inode rbtree, we can't do a direct traversal of the tree because ext4_mb_discard_group_preallocation() can paralelly mark the pa deleted and that can cause direct traversal to skip some entries. This was leading to a BUG_ON() being hit [1] when we missed a PA that could satisfy our request and ultimately tried to create a new PA that would overlap with the missed one. To makes sure we handle that case while still keeping the performance of the rbtree, we make use of the fact that the only pa that could possibly overlap the original goal start is the one that satisfies the below conditions: 1. It must have it's logical start immediately to the left of (ie less than) original logical start. 2. It must not be deleted To find this pa we use the following traversal method: 1. Descend into the rbtree normally to find the immediate neighboring PA. Here we keep descending irrespective of if the PA is deleted or if it overlaps with our request etc. The goal is to find an immediately adjacent PA. 2. If the found PA is on right of original goal, use rb_prev() to find the left adjacent PA. 3. Check if this PA is deleted and keep moving left with rb_prev() until a non deleted PA is found. 4. This is the PA we are looking for. Now we can check if it can satisfy the original request and proceed accordingly. This approach also takes care of having deleted PAs in the tree. (While we are at it, also fix a possible overflow bug in calculating the end of a PA) [1] https://lore.kernel.org/linux-ext4/CA+G9fYv2FRpLqBZf34ZinR8bU2_ZRAUOjKAD3+tKRFaEQHtt8Q@mail.gmail.com/ Cc: stable@kernel.org # 6.4 Fixes: 3872778664e3 ("ext4: Use rbtrees to manage PAs instead of inode i_prealloc_list") Signed-off-by: Ojaswin Mujoo Reported-by: Naresh Kamboju Reviewed-by: Ritesh Harjani (IBM) ritesh.list@gmail.com Tested-by: Ritesh Harjani (IBM) ritesh.list@gmail.com Link: https://lore.kernel.org/r/edd2efda6a83e6343c5ace9deea44813e71dbe20.1690045963.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 5d5460fa7932bed3a9082a6a8852cfbdb46acbe8 Author: Ojaswin Mujoo Date: Fri Jun 9 16:04:03 2023 +0530 ext4: fix off by one issue in ext4_mb_choose_next_group_best_avail() In ext4_mb_choose_next_group_best_avail(), we want the start order to be 1 less than goal length and the min_order to be, at max, 1 more than the original length. This commit fixes an off by one issue that arose due to the fact that 1 << fls(n) > (n). After all the processing: order = 1 order below goal len min_order = maximum of the three:- - order - trim_order - 1 order below B2C(s_stripe) - 1 order above original len Cc: stable@kernel.org Fixes: 33122aa930 ("ext4: Add allocation criteria 1.5 (CR1_5)") Signed-off-by: Ojaswin Mujoo Link: https://lore.kernel.org/r/20230609103403.112807-1-ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 6909cf5c4101214f4305a62d582a5b93c7e1eb9a Author: Eric Whitney Date: Mon May 22 14:15:20 2023 -0400 ext4: correct inline offset when handling xattrs in inode body When run on a file system where the inline_data feature has been enabled, xfstests generic/269, generic/270, and generic/476 cause ext4 to emit error messages indicating that inline directory entries are corrupted. This occurs because the inline offset used to locate inline directory entries in the inode body is not updated when an xattr in that shared region is deleted and the region is shifted in memory to recover the space it occupied. If the deleted xattr precedes the system.data attribute, which points to the inline directory entries, that attribute will be moved further up in the region. The inline offset continues to point to whatever is located in system.data's former location, with unfortunate effects when used to access directory entries or (presumably) inline data in the inode body. Cc: stable@kernel.org Signed-off-by: Eric Whitney Link: https://lore.kernel.org/r/20230522181520.1570360-1-enwlinux@gmail.com Signed-off-by: Theodore Ts'o commit c7b75bea853daeb64fc831dbf39a6bbabcc402ac Author: Jiawen Wu Date: Wed Jul 19 17:22:33 2023 +0800 net: phy: marvell10g: fix 88x3310 power up Clear MV_V2_PORT_CTRL_PWRDOWN bit to set power up for 88x3310 PHY, it sometimes does not take effect immediately. And a read of this register causes the bit not to clear. This will cause mv3310_reset() to time out, which will fail the config initialization. So add a delay before the next access. Fixes: c9cc1c815d36 ("net: phy: marvell10g: place in powersave mode at probe") Signed-off-by: Jiawen Wu Reviewed-by: Russell King (Oracle) Signed-off-by: David S. Miller commit c2782531397f5cb19ca3f8f9c17727f1cdf5bee8 Merge: 295e1388de2d5 106ea7ffd56b0 Author: Linus Torvalds Date: Sat Jul 22 19:32:00 2023 -0700 Merge tag 'powerpc-6.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Reinstate support for little endian ELFv1 binaries, which it turns out still exist in the wild. - Revert a change which used asm goto for WARN_ON/__WARN_FLAGS, as it lead to dead code generation and seemed to trigger compiler bugs in some edge cases. - Fix a deadlock in the pseries VAS code, between live migration and the driver's mmap handler. - Disable KCOV instrumentation in the powerpc KASAN code. Thanks to Andrew Donnellan, Benjamin Gray, Christophe Leroy, Haren Myneni, Russell Currey, and Uwe Kleine-König. * tag 'powerpc-6.5-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: Revert "powerpc/64s: Remove support for ELFv1 little endian userspace" powerpc/kasan: Disable KCOV in KASAN code powerpc/512x: lpbfifo: Convert to platform remove callback returning void powerpc/crypto: Add gitignore for generated P10 AES/GCM .S files Revert "powerpc/bug: Provide better flexibility to WARN_ON/__WARN_FLAGS() with asm goto" powerpc/pseries/vas: Hold mmap_mutex after mmap lock during window close commit ba61a03af29a5f305cb301eb83b42578474508f7 Author: Steve French Date: Thu Jul 20 08:30:32 2023 -0500 cifs: update internal module version number for cifs.ko From 2.43 to 2.44 Signed-off-by: Steve French commit b3edef6b9cd0b8893a5649ab1fa8bce71045d139 Author: Shyam Prasad N Date: Fri Jun 16 10:37:46 2023 +0000 cifs: allow dumping keys for directories too Dumping the enc/dec keys is a session wide operation. And it should not matter if the ioctl was run on a regular file or a directory. Currently, we obtain the tcon pointer from the cifs file handle. But since there's no dir open call in cifs, this is not populated for dirs. This change allows dumping of session keys using ioctl even for directories. To do this, we'll now get the tcon pointer from the superblock, and not from the file handle. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 295e1388de2d5c0c354adbd65d0319c5d636c222 Merge: f036d67c02b6f 4cfca532ddc34 Author: Linus Torvalds Date: Sat Jul 22 11:24:03 2023 -0700 Merge tag 's390-6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Heiko Carstens: - Fix per vma lock fault handling: add missing !(fault & VM_FAULT_ERROR) check to fault handler to prevent error handling for return values that don't indicate an error - Use kfree_sensitive() instead of kfree() in paes crypto code to clear memory that may contain keys before freeing it - Fix reply buffer size calculation for CCA replies in zcrypt device driver * tag 's390-6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: fix reply buffer calculations for CCA replies s390/crypto: use kfree_sensitive() instead of kfree() s390/mm: fix per vma lock fault handling commit f036d67c02b6f6966b0d45e9a16c9f2e7ede80a3 Merge: bdd1d82e7d02b bb5faa99f0ce4 Author: Linus Torvalds Date: Sat Jul 22 11:05:15 2023 -0700 Merge tag 'block-6.5-2023-07-21' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - Fix for loop regressions (Mauricio) - Fix a potential stall with batched wakeups in sbitmap (David) - Fix for stall with recursive plug flushes (Ross) - Skip accounting of empty requests for blk-iocost (Chengming) - Remove a dead field in struct blk_mq_hw_ctx (Chengming) * tag 'block-6.5-2023-07-21' of git://git.kernel.dk/linux: loop: do not enforce max_loop hard limit by (new) default loop: deprecate autoloading callback loop_probe() sbitmap: fix batching wakeup blk-iocost: skip empty flush bio in iocost blk-mq: delete dead struct blk_mq_hw_ctx->queued field blk-mq: Fix stall due to recursive flush plug commit bdd1d82e7d02bd2764a68a5cc54533dfc2ba452a Merge: 725d444db6b0a 07e981137f17e Author: Linus Torvalds Date: Sat Jul 22 10:46:30 2023 -0700 Merge tag 'io_uring-6.5-2023-07-21' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Fix for io-wq not always honoring REQ_F_NOWAIT, if it was set and punted directly (eg via DRAIN) (me) - Capability check fix (Ondrej) - Regression fix for the mmap changes that went into 6.4, which apparently broke IA64 (Helge) * tag 'io_uring-6.5-2023-07-21' of git://git.kernel.dk/linux: ia64: mmap: Consider pgoff when searching for free mapping io_uring: Fix io_uring mmap() by using architecture-provided get_unmapped_area() io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq io_uring: don't audit the capability check in io_uring_create() commit 725d444db6b0a8ed98461583ed1e6f12b8a7f0e9 Merge: 39b1428639ed2 ffc59c6414f9f Author: Linus Torvalds Date: Sat Jul 22 10:28:22 2023 -0700 Merge tag 'devicetree-fixes-for-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix moortec,mr75203 schema usage of 'multipleOf' keyword - Fix regression in systems depending on "of-display" device name - Build fix for s390 with CONFIG_PCI=n and OF_EARLY_FLATTREE=y - Drop two obsolete serial .txt bindings * tag 'devicetree-fixes-for-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: serial: Remove obsolete nxp,lpc1850-uart.txt dt-bindings: serial: Remove obsolete cavium-uart.txt dt-bindings: hwmon: moortec,mr75203: fix multipleOf for coefficients of: Preserve "of-display" device name for compatibility of: make OF_EARLY_FLATTREE depend on HAS_IOMEM commit 39b1428639ed2224832234f48bfce991786aa4df Merge: c0842db5e5244 a9e26169cfda6 Author: Linus Torvalds Date: Sat Jul 22 10:20:56 2023 -0700 Merge tag 'regmap-fix-v6.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fixes from Mark Brown: "Three fixes here: - The issues with accounting for register and padding length on raw buses turn out to be quite widespread in custom buses. In order to avoid disturbing anything drop the initial fixes and fall back to a point fix in the SMBus code where the issue was originally noticed, a more substantial refactoring of the API which ensures that all buses make the same assumptions will follow. - The generic regcache code had been forcing on async I/O which did not work with the new maple tree sync code when used with SPI. Since that was mainly for the rbtree cache and the assumptions about hardware that drove the choice are probably not true any more fix this by pushing the enablement of async down into the rbtree code. This probably also makes cache syncs for systems faster though it's not the point. - The test code was triggering use of the rbtree and maple tree caches with dynamic allocation of nodes since all the testing is with RAM backed caches with no I/O performance issues. Just disable the locking in the tests to avoid triggering warnings when allocation debugging is turned on, it's not really what's being tested" * tag 'regmap-fix-v6.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: Disable locking for RBTREE and MAPLE unit tests regcache: Push async I/O request down into the rbtree cache regmap: Account for register length in SMBus I/O limits regmap: Drop initial version of maximum transfer length fixes commit c0842db5e52441174f347dd185bb06e841d7cfab Merge: d192f5382581d 644ee70267a93 Author: Linus Torvalds Date: Sat Jul 22 10:14:04 2023 -0700 Merge tag 'gpio-fixes-for-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix initial value handling for output-only pins in gpio-tps68470 - fix two resource leaks in gpio-mvebu * tag 'gpio-fixes-for-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: mvebu: fix irq domain leak gpio: mvebu: Make use of devm_pwmchip_add gpio: tps68470: Make tps68470_gpio_output() always set the initial value commit 09738ccbc4148c62d6c8c4644ff4a099d57f49ad Author: George Stark Date: Fri Jul 21 13:23:08 2023 +0300 iio: adc: meson: fix core clock enable/disable moment Enable core clock at probe stage and disable it at remove stage. Core clock is responsible for turning on/off the entire SoC module so it should be on before the first module register is touched and be off at very last moment. Fixes: 3adbf3427330 ("iio: adc: add a driver for the SAR ADC found in Amlogic Meson SoCs") Signed-off-by: George Stark Link: https://lore.kernel.org/r/20230721102413.255726-2-gnstark@sberdevices.ru Cc: Signed-off-by: Jonathan Cameron commit b2a69969908fcaf68596dfc04369af0fe2e1d2f7 Author: Milan Zamazal Date: Wed Jul 19 10:32:08 2023 +0200 iio: core: Prevent invalid memory access when there is no parent Commit 813665564b3d ("iio: core: Convert to use firmware node handle instead of OF node") switched the kind of nodes to use for label retrieval in device registration. Probably an unwanted change in that commit was that if the device has no parent then NULL pointer is accessed. This is what happens in the stock IIO dummy driver when a new entry is created in configfs: # mkdir /sys/kernel/config/iio/devices/dummy/foo BUG: kernel NULL pointer dereference, address: ... ... Call Trace: __iio_device_register iio_dummy_probe Since there seems to be no reason to make a parent device of an IIO dummy device mandatory, let’s prevent the invalid memory access in __iio_device_register when the parent device is NULL. With this change, the IIO dummy driver works fine with configfs. Fixes: 813665564b3d ("iio: core: Convert to use firmware node handle instead of OF node") Reviewed-by: Andy Shevchenko Signed-off-by: Milan Zamazal Link: https://lore.kernel.org/r/20230719083208.88149-1-mzamazal@redhat.com Signed-off-by: Jonathan Cameron commit 507397d19b5a296aa339f7a1bd16284f668a1906 Author: Dan Carpenter Date: Tue Jul 18 10:02:18 2023 +0300 iio: frequency: admv1013: propagate errors from regulator_get_voltage() The regulator_get_voltage() function returns negative error codes. This function saves it to an unsigned int and then does some range checking and, since the error code falls outside the correct range, it returns -EINVAL. Beyond the messiness, this is bad because the regulator_get_voltage() function can return -EPROBE_DEFER and it's important to propagate that back properly so it can be handled. Fixes: da35a7b526d9 ("iio: frequency: admv1013: add support for ADMV1013") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/ce75aac3-2aba-4435-8419-02e59fdd862b@moroto.mountain Cc: Signed-off-by: Jonathan Cameron commit fd470a8beed88440b160d690344fbae05a0b9b1b Author: Kim Phillips Date: Thu Jul 20 14:47:27 2023 -0500 x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled Unlike Intel's Enhanced IBRS feature, AMD's Automatic IBRS does not provide protection to processes running at CPL3/user mode, see section "Extended Feature Enable Register (EFER)" in the APM v2 at https://bugzilla.kernel.org/attachment.cgi?id=304652 Explicitly enable STIBP to protect against cross-thread CPL3 branch target injections on systems with Automatic IBRS enabled. Also update the relevant documentation. Fixes: e7862eda309e ("x86/cpu: Support AMD Automatic IBRS") Reported-by: Tom Lendacky Signed-off-by: Kim Phillips Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230720194727.67022-1-kim.phillips@amd.com commit 3ba2e83334bed2b1980b59734e6e84dfaf96026c Author: Yazen Ghannam Date: Mon Jun 6 19:45:56 2022 +0000 x86/MCE/AMD: Decrement threshold_bank refcount when removing threshold blocks AMD systems from Family 10h to 16h share MCA bank 4 across multiple CPUs. Therefore, the threshold_bank structure for bank 4, and its threshold_block structures, will be initialized once at boot time. And the kobject for the shared bank will be added to each of the CPUs that share it. Furthermore, the threshold_blocks for the shared bank will be added again to the bank's kobject. These additions will increase the refcount for the bank's kobject. For example, a shared bank with two blocks and shared across two CPUs will be set up like this: CPU0 init bank create and add; bank refcount = 1; threshold_create_bank() block 0 init and add; bank refcount = 2; allocate_threshold_blocks() block 1 init and add; bank refcount = 3; allocate_threshold_blocks() CPU1 init bank add; bank refcount = 3; threshold_create_bank() block 0 add; bank refcount = 4; __threshold_add_blocks() block 1 add; bank refcount = 5; __threshold_add_blocks() Currently in threshold_remove_bank(), if the bank is shared then __threshold_remove_blocks() is called. Here the shared bank's kobject and the bank's blocks' kobjects are deleted. This is done on the first call even while the structures are still shared. Subsequent calls from other CPUs that share the structures will attempt to delete the kobjects. During kobject_del(), kobject->sd is removed. If the kobject is not part of a kset with default_groups, then subsequent kobject_del() calls seem safe even with kobject->sd == NULL. Originally, the AMD MCA thresholding structures did not use default_groups. And so the above behavior was not apparent. However, a recent change implemented default_groups for the thresholding structures. Therefore, kobject_del() will go down the sysfs_remove_groups() code path. In this case, the first kobject_del() may succeed and remove kobject->sd. But subsequent kobject_del() calls will give a WARNing in kernfs_remove_by_name_ns() since kobject->sd == NULL. Use kobject_put() on the shared bank's kobject when "removing" blocks. This decrements the bank's refcount while keeping kobjects enabled until the bank is no longer shared. At that point, kobject_put() will be called on the blocks which drives their refcount to 0 and deletes them and also decrementing the bank's refcount. And finally kobject_put() will be called on the bank driving its refcount to 0 and deleting it. The same example above: CPU1 shutdown bank is shared; bank refcount = 5; threshold_remove_bank() block 0 put parent bank; bank refcount = 4; __threshold_remove_blocks() block 1 put parent bank; bank refcount = 3; __threshold_remove_blocks() CPU0 shutdown bank is no longer shared; bank refcount = 3; threshold_remove_bank() block 0 put block; bank refcount = 2; deallocate_threshold_blocks() block 1 put block; bank refcount = 1; deallocate_threshold_blocks() put bank; bank refcount = 0; threshold_remove_bank() Fixes: 7f99cb5e6039 ("x86/CPU/AMD: Use default_groups in kobj_type") Reported-by: Mikulas Patocka Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Tested-by: Mikulas Patocka Cc: Link: https://lore.kernel.org/r/alpine.LRH.2.02.2205301145540.25840@file01.intranet.prod.int.rdu2.redhat.com commit 32ad45b76990ece9c5dd1fe7aae6e688c3baa647 Author: Jakub Kicinski Date: Thu Jul 20 09:13:23 2023 -0700 docs: net: clarify the NAPI rules around XDP Tx page pool and XDP should not be accessed from IRQ context which may happen if drivers try to clean up XDP TX with NAPI budget of 0. Link: https://lore.kernel.org/r/20230720161323.2025379-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 81ac7e5d741742d650b4ed6186c4826c1a0631a7 Author: Daniel Sneddon Date: Wed Jul 12 19:43:14 2023 -0700 KVM: Add GDS_NO support to KVM Gather Data Sampling (GDS) is a transient execution attack using gather instructions from the AVX2 and AVX512 extensions. This attack allows malicious code to infer data that was previously stored in vector registers. Systems that are not vulnerable to GDS will set the GDS_NO bit of the IA32_ARCH_CAPABILITIES MSR. This is useful for VM guests that may think they are on vulnerable systems that are, in fact, not affected. Guests that are running on affected hosts where the mitigation is enabled are protected as if they were running on an unaffected system. On all hosts that are not affected or that are mitigated, set the GDS_NO bit. Signed-off-by: Daniel Sneddon Signed-off-by: Dave Hansen Acked-by: Josh Poimboeuf commit 53cf5797f114ba2bd86d23a862302119848eff19 Author: Daniel Sneddon Date: Wed Jul 12 19:43:13 2023 -0700 x86/speculation: Add Kconfig option for GDS Gather Data Sampling (GDS) is mitigated in microcode. However, on systems that haven't received the updated microcode, disabling AVX can act as a mitigation. Add a Kconfig option that uses the microcode mitigation if available and disables AVX otherwise. Setting this option has no effect on systems not affected by GDS. This is the equivalent of setting gather_data_sampling=force. Signed-off-by: Daniel Sneddon Signed-off-by: Dave Hansen Acked-by: Josh Poimboeuf commit 553a5c03e90a6087e88f8ff878335ef0621536fb Author: Daniel Sneddon Date: Wed Jul 12 19:43:12 2023 -0700 x86/speculation: Add force option to GDS mitigation The Gather Data Sampling (GDS) vulnerability allows malicious software to infer stale data previously stored in vector registers. This may include sensitive data such as cryptographic keys. GDS is mitigated in microcode, and systems with up-to-date microcode are protected by default. However, any affected system that is running with older microcode will still be vulnerable to GDS attacks. Since the gather instructions used by the attacker are part of the AVX2 and AVX512 extensions, disabling these extensions prevents gather instructions from being executed, thereby mitigating the system from GDS. Disabling AVX2 is sufficient, but we don't have the granularity to do this. The XCR0[2] disables AVX, with no option to just disable AVX2. Add a kernel parameter gather_data_sampling=force that will enable the microcode mitigation if available, otherwise it will disable AVX on affected systems. This option will be ignored if cmdline mitigations=off. This is a *big* hammer. It is known to break buggy userspace that uses incomplete, buggy AVX enumeration. Unfortunately, such userspace does exist in the wild: https://www.mail-archive.com/bug-coreutils@gnu.org/msg33046.html [ dhansen: add some more ominous warnings about disabling AVX ] Signed-off-by: Daniel Sneddon Signed-off-by: Dave Hansen Acked-by: Josh Poimboeuf commit ffc59c6414f9ffd52591786efe3e62e145563deb Author: Rob Herring Date: Fri Jul 7 16:16:06 2023 -0600 dt-bindings: serial: Remove obsolete nxp,lpc1850-uart.txt nxp,lpc1850-uart.txt binding is already covered by 8250.yaml, so remove it. Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230707221607.1064888-1-robh@kernel.org Signed-off-by: Rob Herring commit 5921181cf95aa7d0fe4f008a3d472cc5cb86bde5 Author: Rob Herring Date: Fri Jul 7 16:16:02 2023 -0600 dt-bindings: serial: Remove obsolete cavium-uart.txt cavium-uart.txt binding is already covered by 8250.yaml, so remove it. Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230707221602.1063972-1-robh@kernel.org Signed-off-by: Rob Herring commit bb5faa99f0ce40756ab7bbbce4f16c01ca5ebd5a Author: Mauricio Faria de Oliveira Date: Thu Jul 20 11:30:33 2023 -0300 loop: do not enforce max_loop hard limit by (new) default Problem: The max_loop parameter is used for 2 different purposes: 1) initial number of loop devices to pre-create on init 2) maximum number of loop devices to add on access/open() Historically, its default value (zero) caused 1) to create non-zero number of devices (CONFIG_BLK_DEV_LOOP_MIN_COUNT), and no hard limit on 2) to add devices with autoloading. However, the default value changed in commit 85c50197716c ("loop: Fix the max_loop commandline argument treatment when it is set to 0") to CONFIG_BLK_DEV_LOOP_MIN_COUNT, for max_loop=0 not to pre-create devices. That does improve 1), but unfortunately it breaks 2), as the default behavior changed from no-limit to hard-limit. Example: For example, this userspace code broke for N >= CONFIG, if the user relied on the default value 0 for max_loop: mknod("/dev/loopN"); open("/dev/loopN"); // now fails with ENXIO Though affected users may "fix" it with (loop.)max_loop=0, this means to require a kernel parameter change on stable kernel update (that commit Fixes: an old commit in stable). Solution: The original semantics for the default value in 2) can be applied if the parameter is not set (ie, default behavior). This still keeps the intended function in 1) and 2) if set, and that commit's intended improvement in 1) if max_loop=0. Before 85c50197716c: - default: 1) CONFIG devices 2) no limit - max_loop=0: 1) CONFIG devices 2) no limit - max_loop=X: 1) X devices 2) X limit After 85c50197716c: - default: 1) CONFIG devices 2) CONFIG limit (*) - max_loop=0: 1) 0 devices (*) 2) no limit - max_loop=X: 1) X devices 2) X limit This commit: - default: 1) CONFIG devices 2) no limit (*) - max_loop=0: 1) 0 devices 2) no limit - max_loop=X: 1) X devices 2) X limit Future: The issue/regression from that commit only affects code under the CONFIG_BLOCK_LEGACY_AUTOLOAD deprecation guard, thus the fix too is contained under it. Once that deprecated functionality/code is removed, the purpose 2) of max_loop (hard limit) is no longer in use, so the module parameter description can be changed then. Tests: Linux 6.4-rc7 CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 CONFIG_BLOCK_LEGACY_AUTOLOAD=y - default (original) # ls -1 /dev/loop* /dev/loop-control /dev/loop0 ... /dev/loop7 # ./test-loop open: /dev/loop8: No such device or address - default (patched) # ls -1 /dev/loop* /dev/loop-control /dev/loop0 ... /dev/loop7 # ./test-loop # - max_loop=0 (original & patched): # ls -1 /dev/loop* /dev/loop-control # ./test-loop # - max_loop=8 (original & patched): # ls -1 /dev/loop* /dev/loop-control /dev/loop0 ... /dev/loop7 # ./test-loop open: /dev/loop8: No such device or address - max_loop=0 (patched; CONFIG_BLOCK_LEGACY_AUTOLOAD is not set) # ls -1 /dev/loop* /dev/loop-control # ./test-loop open: /dev/loop8: No such device or address Fixes: 85c50197716c ("loop: Fix the max_loop commandline argument treatment when it is set to 0") Signed-off-by: Mauricio Faria de Oliveira Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230720143033.841001-3-mfo@canonical.com Signed-off-by: Jens Axboe commit 23881aec85f3219e8462e87c708815ee2cd82358 Author: Mauricio Faria de Oliveira Date: Thu Jul 20 11:30:32 2023 -0300 loop: deprecate autoloading callback loop_probe() The 'probe' callback in __register_blkdev() is only used under the CONFIG_BLOCK_LEGACY_AUTOLOAD deprecation guard. The loop_probe() function is only used for that callback, so guard it too, accordingly. See commit fbdee71bb5d8 ("block: deprecate autoloading based on dev_t"). Signed-off-by: Mauricio Faria de Oliveira Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230720143033.841001-2-mfo@canonical.com Signed-off-by: Jens Axboe commit 106397376c0369fcc01c58dd189ff925a2724a57 Author: David Jeffery Date: Fri Jul 21 17:57:15 2023 +0800 sbitmap: fix batching wakeup Current code supposes that it is enough to provide forward progress by just waking up one wait queue after one completion batch is done. Unfortunately this way isn't enough, cause waiter can be added to wait queue just after it is woken up. Follows one example(64 depth, wake_batch is 8) 1) all 64 tags are active 2) in each wait queue, there is only one single waiter 3) each time one completion batch(8 completions) wakes up just one waiter in each wait queue, then immediately one new sleeper is added to this wait queue 4) after 64 completions, 8 waiters are wakeup, and there are still 8 waiters in each wait queue 5) after another 8 active tags are completed, only one waiter can be wakeup, and the other 7 can't be waken up anymore. Turns out it isn't easy to fix this problem, so simply wakeup enough waiters for single batch. Cc: Kemeng Shi Cc: Chengming Zhou Cc: Jan Kara Signed-off-by: David Jeffery Signed-off-by: Ming Lei Reviewed-by: Gabriel Krisman Bertazi Reviewed-by: Keith Busch Link: https://lore.kernel.org/r/20230721095715.232728-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit d192f5382581d972c4ae1b4d72e0b59b34cadeb9 Merge: 892d7c1b29555 d4d5be94a8787 Author: Linus Torvalds Date: Fri Jul 21 10:24:21 2023 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "I've picked up a handful of arm64 fixes while Catalin's been away, so here they are. Below is the usual summary, but we have basically have two cleanups, a fix for an SME crash and a fix for hibernation: - Fix saving of SME state after SVE vector length is changed - Fix sparse warnings for missing vDSO function prototypes - Fix hibernation resume path when kfence is enabled - Fix field names for the HFGxTR_EL2 register" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/fpsimd: Ensure SME storage is allocated after SVE VL changes arm64: vdso: Clear common make C=2 warnings arm64: mm: Make hibernation aware of KFENCE arm64: Fix HFGxTR_EL2 field naming commit 892d7c1b29555cd145f0bf85818148c47bb7ac16 Merge: 3c05547a5fab4 5534f44627418 Author: Linus Torvalds Date: Fri Jul 21 10:16:20 2023 -0700 Merge tag 'pm-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "Revert three recent intel_idle commits that introduced a functional issue, included a coding mistake and have been questioned at the design level" * tag 'pm-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "intel_idle: Add support for using intel_idle in a VM guest using just hlt" Revert "intel_idle: Add a "Long HLT" C1 state for the VM guest mode" Revert "intel_idle: Add __init annotation to matchup_vm_state_with_baremetal()" commit 3c05547a5fab4ca2777afcb61a69ce68f5ef8a6a Merge: 55c225fbd8532 5f69c65e07b99 Author: Linus Torvalds Date: Fri Jul 21 10:10:18 2023 -0700 Merge tag 'sound-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A pile of fixes that have been gathered since the previous pull. Most of changes are device-specific, and nothing looks too scary. - A memory leak fix in ALSA sequencer code in 6.5-rc - Many fixes for ASoC Qualcomm CODEC drivers, covering SoundWire probe problems - A series of ASoC AMD fixes - A few fixes and cleanups of selftest stuff - HD-audio codec fixes and quirks for Clevo, HP, Lenovo, Dell" * tag 'sound-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (52 commits) ALSA: hda/realtek: Add support for DELL Oasis 13/14/16 laptops ALSA: hda/realtek: Fix generic fixup definition for cs35l41 amp ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx selftests: ALSA: Add test-pcmtest-driver to .gitignore ALSA: hda/realtek: Add quirk for Clevo NS70AU ASoC: fsl_sai: Disable bit clock with transmitter ALSA: seq: Fix memory leak at error path in snd_seq_create_port() ASoC: SOF: ipc3-dtrace: uninitialized data in dfsentry_trace_filter_write() ASoC: cs42l51: fix driver to properly autoload with automatic module loading MAINTAINERS: Redo addition of ssm3515 to APPLE SOUND ASoC: rt5640: Fix the issue of speaker noise ALSA: hda/realtek - remove 3k pull low procedure selftests: ALSA: Fix fclose on an already fclosed file pointer ALSA: pcmtest: Don't use static storage to track per device data ALSA: pcmtest: Convert to platform remove callback returning void ASoC: dt-bindings: audio-graph-card2: Drop incomplete example ASoC: dt-bindings: Update maintainer email id ASoC: amd: ps: Fix extraneous error messages ASoC: fsl_sai: Revert "ASoC: fsl_sai: Enable MCTL_MCLK_EN bit for master mode" ASoC: codecs: SND_SOC_WCD934X should select REGMAP_IRQ ... commit 55c225fbd8532a1bac6fd93c5085031650083a4a Merge: 4e076c73e4f6e e8812acb5bf72 Author: Linus Torvalds Date: Fri Jul 21 10:00:09 2023 -0700 Merge tag 'fbdev-for-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes and cleanups from Helge Deller: "Just the usual bunch of code cleanups in various drivers, this time mostly in vgacon and imxfb: - Code cleanup in vgacon (Jiri Slaby) - Explicitly include correct DT includes (Rob Herring) - imxfb code cleanup (Yangtao Li, Martin Kaiser) - kyrofb: make arrays const and smaller (Colin Ian King) - ep93xx-fb: return value check fix (Yuanjun Gong) - au1200fb: add missing IRQ check (Zhang Shurong)" * tag 'fbdev-for-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: Explicitly include correct DT includes fbdev: ep93xx-fb: fix return value check in ep93xxfb_probe fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe fbdev: kyro: make some const read-only arrays static and reduce type size fbcon: remove unused display (p) from fbcon_redraw() sticon: make sticon_set_def_font() void and remove op parameter vgacon: cache vc_cell_height in vgacon_cursor() vgacon: let vgacon_doresize() return void vgacon: remove unused xpos from vgacon_set_cursor_size() vgacon: remove unneeded forward declarations vgacon: switch vgacon_scrolldelta() and vgacon_restore_screen() fbdev: imxfb: remove unneeded labels fbdev: imxfb: Convert to devm_platform_ioremap_resource() fbdev: imxfb: Convert to devm_kmalloc_array() fbdev: imxfb: Removed unneeded release_mem_region fbdev: imxfb: switch to DEFINE_SIMPLE_DEV_PM_OPS fbdev: imxfb: warn about invalid left/right margin commit 4e076c73e4f6e90816b30fcd4a0d7ab365087255 Author: Daniel Vetter Date: Fri Jul 21 15:58:38 2023 +0200 drm/atomic: Fix potential use-after-free in nonblocking commits This requires a bit of background. Properly done a modeset driver's unload/remove sequence should be drm_dev_unplug(); drm_atomic_helper_shutdown(); drm_dev_put(); The trouble is that the drm_dev_unplugged() checks are by design racy, they do not synchronize against all outstanding ioctl. This is because those ioctl could block forever (both for modeset and for driver specific ioctls), leading to deadlocks in hotunplug. Instead the code sections that touch the hardware need to be annotated with drm_dev_enter/exit, to avoid accessing hardware resources after the unload/remove has finished. To avoid use-after-free issues all the involved userspace visible objects are supposed to hold a reference on the underlying drm_device, like drm_file does. The issue now is that we missed one, the atomic modeset ioctl can be run in a nonblocking fashion, and in that case it cannot rely on the implied drm_device reference provided by the ioctl calling context. This can result in a use-after-free if an nonblocking atomic commit is carefully raced against a driver unload. Fix this by unconditionally grabbing a drm_device reference for any drm_atomic_state structures. Strictly speaking this isn't required for blocking commits and TEST_ONLY calls, but it's the simpler approach. Thanks to shanzhulig for the initial idea of grabbing an unconditional reference, I just added comments, a condensed commit message and fixed a minor potential issue in where exactly we drop the final reference. Reported-by: shanzhulig Suggested-by: shanzhulig Reviewed-by: Maxime Ripard Cc: Maarten Lankhorst Cc: Thomas Zimmermann Cc: David Airlie Cc: stable@kernel.org Signed-off-by: Daniel Vetter Signed-off-by: Daniel Vetter Signed-off-by: Linus Torvalds commit 91896c8acce23d33ed078cffd46a9534b1f82be5 Author: Jacob Keller Date: Mon Jul 10 13:41:28 2023 -0700 iavf: check for removal state before IAVF_FLAG_PF_COMMS_FAILED In iavf_adminq_task(), if the function can't acquire the adapter->crit_lock, it checks if the driver is removing. If so, it simply exits without re-enabling the interrupt. This is done to ensure that the task stops processing as soon as possible once the driver is being removed. However, if the IAVF_FLAG_PF_COMMS_FAILED is set, the function checks this before attempting to acquire the lock. In this case, the function exits early and re-enables the interrupt. This will happen even if the driver is already removing. Avoid this, by moving the check to after the adapter->crit_lock is acquired. This way, if the driver is removing, we will not re-enable the interrupt. Fixes: fc2e6b3b132a ("iavf: Rework mutexes for better synchronisation") Signed-off-by: Jacob Keller Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit a2f054c10bef0b54600ec9cb776508443e941343 Author: Jacob Keller Date: Mon Jul 10 13:41:27 2023 -0700 iavf: fix potential deadlock on allocation failure In iavf_adminq_task(), if kzalloc() fails to allocate the event.msg_buf, the function will exit without releasing the adapter->crit_lock. This is unlikely, but if it happens, the next access to that mutex will deadlock. Fix this by moving the unlock to the end of the function, and adding a new label to allow jumping to the unlock portion of the function exit flow. Fixes: fc2e6b3b132a ("iavf: Rework mutexes for better synchronisation") Signed-off-by: Jacob Keller Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 043b1f185fb0f3939b7427f634787706f45411c4 Author: Wang Ming Date: Thu Jul 13 09:42:39 2023 +0800 i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir() The debugfs_create_dir() function returns error pointers. It never returns NULL. Most incorrect error checks were fixed, but the one in i40e_dbg_init() was forgotten. Fix the remaining error check. Fixes: 02e9c290814c ("i40e: debugfs interface") Signed-off-by: Wang Ming Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 07e981137f17e5275b6fa5fd0c28b0ddb4519702 Author: Helge Deller Date: Fri Jul 21 17:24:32 2023 +0200 ia64: mmap: Consider pgoff when searching for free mapping IA64 is the only architecture which does not consider the pgoff value when searching for a possible free memory region with vm_unmapped_area(). Adding this seems to have no negative side effect on IA64, so add it now to make IA64 consistent with all other architectures. Cc: stable@vger.kernel.org # 6.4 Signed-off-by: Helge Deller Tested-by: matoro Cc: Andrew Morton Cc: linux-ia64@vger.kernel.org Link: https://lore.kernel.org/r/20230721152432.196382-3-deller@gmx.de Signed-off-by: Jens Axboe commit 32832a407a7178eec3215fad9b1a3298c14b0d69 Author: Helge Deller Date: Fri Jul 21 17:24:31 2023 +0200 io_uring: Fix io_uring mmap() by using architecture-provided get_unmapped_area() The io_uring testcase is broken on IA-64 since commit d808459b2e31 ("io_uring: Adjust mapping wrt architecture aliasing requirements"). The reason is, that this commit introduced an own architecture independend get_unmapped_area() search algorithm which finds on IA-64 a memory region which is outside of the regular memory region used for shared userspace mappings and which can't be used on that platform due to aliasing. To avoid similar problems on IA-64 and other platforms in the future, it's better to switch back to the architecture-provided get_unmapped_area() function and adjust the needed input parameters before the call. Beside fixing the issue, the function now becomes easier to understand and maintain. This patch has been successfully tested with the io_uring testcase on physical x86-64, ppc64le, IA-64 and PA-RISC machines. On PA-RISC the LTP mmmap testcases did not report any regressions. Cc: stable@vger.kernel.org # 6.4 Signed-off-by: Helge Deller Reported-by: matoro Fixes: d808459b2e31 ("io_uring: Adjust mapping wrt architecture aliasing requirements") Link: https://lore.kernel.org/r/20230721152432.196382-2-deller@gmx.de Signed-off-by: Jens Axboe commit f6ad3c13f1b8c4e785cb7bd423887197142f47b0 Author: Durai Manickam KR Date: Wed Jul 12 15:30:42 2023 +0530 ARM: dts: at91: sam9x60: fix the SOC detection Remove the dbgu compatible strings in the UART submodule of the flexcom for the proper SOC detection. Fixes: 99c808335877 (ARM: dts: at91: sam9x60: Add missing flexcom definitions) Signed-off-by: Durai Manickam KR Link: https://lore.kernel.org/r/20230712100042.317856-1-durai.manickamkr@microchip.com Signed-off-by: Arnd Bergmann commit b44c11d86b7a170e657030cbd4ff6067e233e8fb Author: Sudeep Holla Date: Tue Jul 11 10:26:17 2023 +0100 ARM: dts: nspire: Fix arm primecell compatible string Commit c44e0503e5fd ("docs: dt: fix documented Primecell compatible string") removed the last occurrence of incorrect "arm,amba-primecell" compatible string, but somehow one occurrence of the same is left in the nspire platform. Fix the same by replacing it with the correct "arm,primecell" compatible. Cc: Rob Herring Cc: Krzysztof Kozlowski Cc: Conor Dooley Cc: devicetree@vger.kernel.org Signed-off-by: Sudeep Holla Link: https://lore.kernel.org/r/20230711092617.1412815-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 74d964097fb999c3b2346fba72f64c9e5ab77e22 Merge: fdf0eaf11452d d088d6b648f47 Author: Arnd Bergmann Date: Fri Jul 21 13:38:05 2023 +0200 Merge tag 'juno-fix-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Armv8 Juno/Vexpress DTS fix for v6.5 A single simple fix removing dangling symlink left as part of arm dts files movement to vendor sub-directories. It is harmless and causes no issue for the build but scripts copying files see errors/failures. * tag 'juno-fix-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: arm64: dts: arm: Remove the dangling vexpress-v2m-rs1.dtsi symlink Link: https://lore.kernel.org/r/20230721112359.3369716-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 59ea9138c0753d7af19f9eba0ee29b8b55cecaf2 Author: Wang Weiyang Date: Fri Jul 21 18:31:24 2023 +0800 ALSA: seq: remove redundant unsigned comparison to zero Since struct snd_ump_block_info::first_group is unsigned char, comparison to zero is redundant Signed-off-by: Wang Weiyang Fixes: 81fd444aa371 ("ALSA: seq: Bind UMP device") Link: https://lore.kernel.org/r/20230721103124.18522-1-wangweiyang2@huawei.com Signed-off-by: Takashi Iwai commit d4d5be94a87872421ea2569044092535aff0b886 Author: Mark Brown Date: Thu Jul 20 19:38:58 2023 +0100 arm64/fpsimd: Ensure SME storage is allocated after SVE VL changes When we reconfigure the SVE vector length we discard the backing storage for the SVE vectors and then reallocate on next SVE use, leaving the SME specific state alone. This means that we do not enable SME traps if they were already disabled. That means that userspace code can enter streaming mode without trapping, putting the task in a state where if we try to save the state of the task we will fault. Since the ABI does not specify that changing the SVE vector length disturbs SME state, and since SVE code may not be aware of SME code in the process, we shouldn't simply discard any ZA state. Instead immediately reallocate the storage for SVE, and disable SME if we change the SVE vector length while there is no SME state active. Disabling SME traps on SVE vector length changes would make the overall code more complex since we would have a state where we have valid SME state stored but might get a SME trap. Fixes: 9e4ab6c89109 ("arm64/sme: Implement vector length configuration prctl()s") Reported-by: David Spickett Signed-off-by: Mark Brown Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230720-arm64-fix-sve-sme-vl-change-v2-1-8eea06b82d57@kernel.org Signed-off-by: Will Deacon commit 29b434d1e49252b3ad56ad3197e47fafff5356a1 Author: Ming Lei Date: Tue Jul 11 17:40:41 2023 +0800 nvme-rdma: fix potential unbalanced freeze & unfreeze Move start_freeze into nvme_rdma_configure_io_queues(), and there is at least two benefits: 1) fix unbalanced freeze and unfreeze, since re-connection work may fail or be broken by removal 2) IO during error recovery can be failfast quickly because nvme fabrics unquiesces queues after teardown. One side-effect is that !mpath request may timeout during connecting because of queue topo change, but that looks not one big deal: 1) same problem exists with current code base 2) compared with !mpath, mpath use case is dominant Fixes: 9f98772ba307 ("nvme-rdma: fix controller reset hang during traffic") Cc: stable@vger.kernel.org Signed-off-by: Ming Lei Tested-by: Yi Zhang Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch commit 99dc264014d5aed66ee37ddf136a38b5a2b1b529 Author: Ming Lei Date: Tue Jul 11 17:40:40 2023 +0800 nvme-tcp: fix potential unbalanced freeze & unfreeze Move start_freeze into nvme_tcp_configure_io_queues(), and there is at least two benefits: 1) fix unbalanced freeze and unfreeze, since re-connection work may fail or be broken by removal 2) IO during error recovery can be failfast quickly because nvme fabrics unquiesces queues after teardown. One side-effect is that !mpath request may timeout during connecting because of queue topo change, but that looks not one big deal: 1) same problem exists with current code base 2) compared with !mpath, mpath use case is dominant Fixes: 2875b0aecabe ("nvme-tcp: fix controller reset hang during traffic") Cc: stable@vger.kernel.org Signed-off-by: Ming Lei Tested-by: Yi Zhang Reviewed-by: Sagi Grimberg Signed-off-by: Keith Busch commit 1b95e817916069ec45a7f259d088fd1c091a8cc6 Author: Ming Lei Date: Tue Jul 11 17:40:39 2023 +0800 nvme: fix possible hang when removing a controller during error recovery Error recovery can be interrupted by controller removal, then the controller is left as quiesced, and IO hang can be caused. Fix the issue by unquiescing controller unconditionally when removing namespaces. This way is reasonable and safe given forward progress can be made when removing namespaces. Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Reported-by: Chunguang Xu Closes: https://lore.kernel.org/linux-nvme/cover.1685350577.git.chunguang.xu@shopee.com/ Cc: stable@vger.kernel.org Signed-off-by: Ming Lei Signed-off-by: Keith Busch commit 70d49bbf962ce4579bebd82938ef7f265bc3e6ae Author: Xiao Yang Date: Thu Jul 20 00:31:03 2023 +0800 tools/testing/cxl: Remove unused SZ_512G macro SZ_512G macro has become useless since commit b2f3b74e1072 ("tools/testing/cxl: Move cxl_test resources to the top of memory") so remove it directly. Signed-off-by: Xiao Yang Link: https://lore.kernel.org/r/20230719163103.3392-1-yangx.jy@fujitsu.com Reviewed-by: Dave Jiang Signed-off-by: Vishal Verma commit f7e3a1bafdea735050dfde00523cf505dc7fd309 Merge: 12a5088eb138f 28801cc85906e Author: Linus Torvalds Date: Thu Jul 20 20:35:38 2023 -0700 Merge tag 'drm-fixes-2023-07-21' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Mostly amdgpu fixes, a couple of i915 fixes, some nouveau and then a few misc accel and other fixes. client: - memory leak fix dma-buf: - memory leak fix qaic: - bound check fixes - map_user_pages leak - int overflow fixes habanalabs: - debugfs stub helper nouveau: - aux event slot fixes - anx9805 cards fixes i915: - Add sentinel to xehp_oa_b_counters - Revert "drm/i915: use localized __diag_ignore_all() instead of per file" amdgpu: - More PCIe DPM fixes for Intel platforms - DCN3.0.1 fixes - Virtual display timer fix - Async flip fix - SMU13 clock reporting fixes - Add missing PSP firmware declaration - DP MST fix - DCN3.1.x fixes - Slab out of bounds fix" * tag 'drm-fixes-2023-07-21' of git://anongit.freedesktop.org/drm/drm: (31 commits) accel/habanalabs: add more debugfs stub helpers drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP drm/nouveau/disp: PIOR DP uses GPIO for HPD, not PMGR AUX interrupts drm/nouveau/i2c: fix number of aux event slots drm/amdgpu: use a macro to define no xcp partition case drm/amdgpu/vm: use the same xcp_id from root PD drm/amdgpu: fix slab-out-of-bounds issue in amdgpu_vm_pt_create drm/amdgpu: Allocate root PD on correct partition drm/amd/display: Keep PHY active for DP displays on DCN31 drm/amd/display: Prevent vtotal from being set to 0 drm/amd/display: Disable MPC split by default on special asic drm/amd/display: check TG is non-null before checking if enabled drm/amd/display: Add polling method to handle MST reply packet drm/amd/display: Clean up errors & warnings in amdgpu_dm.c drm/amdgpu: Allow the initramfs generator to include psp_13_0_6_ta drm/amdgpu/pm: make mclk consistent for smu 13.0.7 drm/amdgpu/pm: make gfxclock consistent for sienna cichlid drm/amd/display: only accept async flips for fast updates drm/amdgpu/vkms: relax timer deactivation by hrtimer_try_to_cancel drm/amd/display: add DCN301 specific logic for OTG programming ... commit 28801cc85906ea62043e62c71def7f9daaf1c168 Merge: 534a7915c6043 b13d3e9c6b625 Author: Dave Airlie Date: Fri Jul 21 12:16:41 2023 +1000 Merge tag 'amd-drm-fixes-6.5-2023-07-20' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.5-2023-07-20: amdgpu: - More PCIe DPM fixes for Intel platforms - DCN3.0.1 fixes - Virtual display timer fix - Async flip fix - SMU13 clock reporting fixes - Add missing PSP firmware declaration - DP MST fix - DCN3.1.x fixes - Slab out of bounds fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230720133456.7826-1-alexander.deucher@amd.com commit 534a7915c6043c4abc3e4f44bc30576b361fa2e3 Merge: f4f19c03cfb99 2c27770a7bc88 Author: Dave Airlie Date: Fri Jul 21 12:15:09 2023 +1000 Merge tag 'drm-intel-fixes-2023-07-20' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Add sentinel to xehp_oa_b_counters [perf] (Andrzej Hajda) - Revert "drm/i915: use localized __diag_ignore_all() instead of per file" (Jani Nikula) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/ZLjuwhLhwab5B7RY@tursulin-desk commit f4f19c03cfb99b587cf35ff057be97cb98c5d251 Merge: 78e9b217d78e9 ea293f823a880 Author: Dave Airlie Date: Fri Jul 21 12:02:31 2023 +1000 Merge tag 'drm-misc-fixes-2023-07-20' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Memory leak fixes in drm/client, memory access/leak fixes for accel/qaic, another leak fix in dma-buf and three nouveau fixes around hotplugging. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/fmj5nok7zggux2lcpdtls2iknweba54wfc6o4zxq6i6s3dgi2r@7z3eawwhyhen commit 12a5088eb138fbf14eaa0eea5fe6061c4341401c Merge: 57f1f9dd3abea cec148c2476a6 Author: Linus Torvalds Date: Thu Jul 20 19:10:50 2023 -0700 Merge tag 'ata-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata fix from Damien Le Moal: - Add missing MODULE_DESCRIPTION() in the many of the protocol modules for the pata_parport driver to avoid compilation warnings with "make W=1". * tag 'ata-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: ata: pata_parport: Add missing protocol modules description commit 57f1f9dd3abea322173ea75a15887ccf14bbbe51 Merge: e599e16c16a16 75d42b351f564 Author: Linus Torvalds Date: Thu Jul 20 14:46:39 2023 -0700 Merge tag 'net-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from BPF, netfilter, bluetooth and CAN. Current release - regressions: - eth: r8169: multiple fixes for PCIe ASPM-related problems - vrf: fix RCU lockdep splat in output path Previous releases - regressions: - gso: fall back to SW segmenting with GSO_UDP_L4 dodgy bit set - dsa: mv88e6xxx: do a final check before timing out when polling - nf_tables: fix sleep in atomic in nft_chain_validate Previous releases - always broken: - sched: fix undoing tcf_bind_filter() in multiple classifiers - bpf, arm64: fix BTI type used for freplace attached functions - can: gs_usb: fix time stamp counter initialization - nft_set_pipapo: fix improper element removal (leading to UAF) Misc: - net: support STP on bridge in non-root netns, STP prevents packet loops so not supporting it results in freezing systems of unsuspecting users, and in turn very upset noises being made - fix kdoc warnings - annotate various bits of TCP state to prevent data races" * tag 'net-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (95 commits) net: phy: prevent stale pointer dereference in phy_init() tcp: annotate data-races around fastopenq.max_qlen tcp: annotate data-races around icsk->icsk_user_timeout tcp: annotate data-races around tp->notsent_lowat tcp: annotate data-races around rskq_defer_accept tcp: annotate data-races around tp->linger2 tcp: annotate data-races around icsk->icsk_syn_retries tcp: annotate data-races around tp->keepalive_probes tcp: annotate data-races around tp->keepalive_intvl tcp: annotate data-races around tp->keepalive_time tcp: annotate data-races around tp->tsoffset tcp: annotate data-races around tp->tcp_tx_delay Bluetooth: MGMT: Use correct address for memcpy() Bluetooth: btusb: Fix bluetooth on Intel Macbook 2014 Bluetooth: SCO: fix sco_conn related locking and validity issues Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() Bluetooth: coredump: fix building with coredump disabled Bluetooth: ISO: fix iso_conn related locking and validity issues Bluetooth: hci_event: call disconnect callback before deleting conn ... commit 2e7e5bbb1c3c8d502edeb5c0670eac4995134b6f Author: Peter Zijlstra Date: Wed Jul 19 22:15:38 2023 +0200 x86: Fix kthread unwind The rewrite of ret_from_form() misplaced an unwind hint which caused all kthread stack unwinds to be marked unreliable, breaking livepatching. Restore the annotation and add a comment to explain the how and why of things. Fixes: 3aec4ecb3d1f ("x86: Rewrite ret_from_fork() in C") Reported-by: Petr Mladek Signed-off-by: Peter Zijlstra (Intel) Tested-by: Petr Mladek Link: https://lkml.kernel.org/r/20230719201538.GA3553016@hirez.programming.kicks-ass.net commit 013adcbef165c3eaf73e297b7482290593815ab8 Author: Chengming Zhou Date: Thu Jul 20 20:14:41 2023 +0800 blk-iocost: skip empty flush bio in iocost The flush bio may have data, may have no data (empty flush), we couldn't calculate cost for empty flush bio. So we'd better just skip it for now. Another side effect is that empty flush bio's bio_end_sector() is 0, cause iocg->cursor reset to 0, may break the cost calculation of other bios. This isn't good enough, since flush bio still consume the device bandwidth, but flush request is special, can be merged randomly in the flush state machine, we don't know how to calculate cost for it for now. Its completion time also has flaws, which may include the pre-flush or post-flush completion time, but I don't know if we need to fix that and how to fix it. Signed-off-by: Chengming Zhou Acked-by: Tejun Heo Link: https://lore.kernel.org/r/20230720121441.1408522-1-chengming.zhou@linux.dev Signed-off-by: Jens Axboe commit 75d42b351f564b2568392a4e53cd74a3d9df4af2 Merge: 9b39f758974ff d1f0a9816f5fb Author: Jakub Kicinski Date: Thu Jul 20 12:57:55 2023 -0700 Merge tag 'for-net-2023-07-20' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fix building with coredump disabled - Fix use-after-free in hci_remove_adv_monitor - Use RCU for hci_conn_params and iterate safely in hci_sync - Fix locking issues on ISO and SCO - Fix bluetooth on Intel Macbook 2014 * tag 'for-net-2023-07-20' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: MGMT: Use correct address for memcpy() Bluetooth: btusb: Fix bluetooth on Intel Macbook 2014 Bluetooth: SCO: fix sco_conn related locking and validity issues Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() Bluetooth: coredump: fix building with coredump disabled Bluetooth: ISO: fix iso_conn related locking and validity issues Bluetooth: hci_event: call disconnect callback before deleting conn Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync ==================== Link: https://lore.kernel.org/r/20230720190201.446469-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 9b39f758974ff8dfa721e68c6cecfd37e6ddb206 Merge: 1c613beaf877c 6eaf41e87a223 Author: Jakub Kicinski Date: Thu Jul 20 12:54:21 2023 -0700 Merge tag 'nf-23-07-20' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== Netfilter fixes for net: The following patchset contains Netfilter fixes for net: 1. Fix spurious -EEXIST error from userspace due to padding holes, this was broken since 4.9 days when 'ignore duplicate entries on insert' feature was added. 2. Fix a sched-while-atomic bug, present since 5.19. 3. Properly remove elements if they lack an "end range". nft userspace always sets an end range attribute, even when its the same as the start, but the abi doesn't have such a restriction. Always broken since it was added in 5.6, all three from myself. 4 + 5: Bound chain needs to be skipped in netns release and on rule flush paths, from Pablo Neira. * tag 'nf-23-07-20' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: skip bound chain on rule flush netfilter: nf_tables: skip bound chain in netns release path netfilter: nft_set_pipapo: fix improper element removal netfilter: nf_tables: can't schedule in nft_chain_validate netfilter: nf_tables: fix spurious set element insertion failure ==================== Link: https://lore.kernel.org/r/20230720165143.30208-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 1c613beaf877c0c0d755853dc62687e2013e55c4 Author: Vladimir Oltean Date: Thu Jul 20 03:02:31 2023 +0300 net: phy: prevent stale pointer dereference in phy_init() mdio_bus_init() and phy_driver_register() both have error paths, and if those are ever hit, ethtool will have a stale pointer to the phy_ethtool_phy_ops stub structure, which references memory from a module that failed to load (phylib). It is probably hard to force an error in this code path even manually, but the error teardown path of phy_init() should be the same as phy_exit(), which is now simply not the case. Fixes: 55d8f053ce1b ("net: phy: Register ethtool PHY operations") Link: https://lore.kernel.org/netdev/ZLaiJ4G6TaJYGJyU@shell.armlinux.org.uk/ Suggested-by: Russell King (Oracle) Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20230720000231.1939689-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 7998c0ad4c89cbb0bcd1594d9f989c8a5853daf7 Merge: ac528649f7c63 70f360dd7042c Author: Jakub Kicinski Date: Thu Jul 20 12:34:24 2023 -0700 Merge branch 'tcp-add-missing-annotations' Eric Dumazet says: ==================== tcp: add missing annotations This series was inspired by one syzbot (KCSAN) report. do_tcp_getsockopt() does not lock the socket, we need to annotate most of the reads there (and other places as well). This is a first round, another series will come later. ==================== Link: https://lore.kernel.org/r/20230719212857.3943972-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 70f360dd7042cb843635ece9d28335a4addff9eb Author: Eric Dumazet Date: Wed Jul 19 21:28:57 2023 +0000 tcp: annotate data-races around fastopenq.max_qlen This field can be read locklessly. Fixes: 1536e2857bd3 ("tcp: Add a TCP_FASTOPEN socket option to get a max backlog on its listner") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230719212857.3943972-12-edumazet@google.com Signed-off-by: Jakub Kicinski commit 26023e91e12c68669db416b97234328a03d8e499 Author: Eric Dumazet Date: Wed Jul 19 21:28:56 2023 +0000 tcp: annotate data-races around icsk->icsk_user_timeout This field can be read locklessly from do_tcp_getsockopt() Fixes: dca43c75e7e5 ("tcp: Add TCP_USER_TIMEOUT socket option.") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230719212857.3943972-11-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1aeb87bc1440c5447a7fa2d6e3c2cca52cbd206b Author: Eric Dumazet Date: Wed Jul 19 21:28:55 2023 +0000 tcp: annotate data-races around tp->notsent_lowat tp->notsent_lowat can be read locklessly from do_tcp_getsockopt() and tcp_poll(). Fixes: c9bee3b7fdec ("tcp: TCP_NOTSENT_LOWAT socket option") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230719212857.3943972-10-edumazet@google.com Signed-off-by: Jakub Kicinski commit ae488c74422fb1dcd807c0201804b3b5e8a322a3 Author: Eric Dumazet Date: Wed Jul 19 21:28:54 2023 +0000 tcp: annotate data-races around rskq_defer_accept do_tcp_getsockopt() reads rskq_defer_accept while another cpu might change its value. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230719212857.3943972-9-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9df5335ca974e688389c875546e5819778a80d59 Author: Eric Dumazet Date: Wed Jul 19 21:28:53 2023 +0000 tcp: annotate data-races around tp->linger2 do_tcp_getsockopt() reads tp->linger2 while another cpu might change its value. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230719212857.3943972-8-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3a037f0f3c4bfe44518f2fbb478aa2f99a9cd8bb Author: Eric Dumazet Date: Wed Jul 19 21:28:52 2023 +0000 tcp: annotate data-races around icsk->icsk_syn_retries do_tcp_getsockopt() and reqsk_timer_handler() read icsk->icsk_syn_retries while another cpu might change its value. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230719212857.3943972-7-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6e5e1de616bf5f3df1769abc9292191dfad9110a Author: Eric Dumazet Date: Wed Jul 19 21:28:51 2023 +0000 tcp: annotate data-races around tp->keepalive_probes do_tcp_getsockopt() reads tp->keepalive_probes while another cpu might change its value. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230719212857.3943972-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit 5ecf9d4f52ff2f1d4d44c9b68bc75688e82f13b4 Author: Eric Dumazet Date: Wed Jul 19 21:28:50 2023 +0000 tcp: annotate data-races around tp->keepalive_intvl do_tcp_getsockopt() reads tp->keepalive_intvl while another cpu might change its value. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230719212857.3943972-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 4164245c76ff906c9086758e1c3f87082a7f5ef5 Author: Eric Dumazet Date: Wed Jul 19 21:28:49 2023 +0000 tcp: annotate data-races around tp->keepalive_time do_tcp_getsockopt() reads tp->keepalive_time while another cpu might change its value. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230719212857.3943972-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit dd23c9f1e8d5c1d2e3d29393412385ccb9c7a948 Author: Eric Dumazet Date: Wed Jul 19 21:28:48 2023 +0000 tcp: annotate data-races around tp->tsoffset do_tcp_getsockopt() reads tp->tsoffset while another cpu might change its value. Fixes: 93be6ce0e91b ("tcp: set and get per-socket timestamp") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230719212857.3943972-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 348b81b68b13ebd489a3e6a46aa1c384c731c919 Author: Eric Dumazet Date: Wed Jul 19 21:28:47 2023 +0000 tcp: annotate data-races around tp->tcp_tx_delay do_tcp_getsockopt() reads tp->tcp_tx_delay while another cpu might change its value. Fixes: a842fe1425cb ("tcp: add optional per socket transmit delay") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20230719212857.3943972-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3641c90c4e369c8d0af5483e879174400a152cf8 Author: Chengming Zhou Date: Thu Jul 20 17:55:12 2023 +0800 blk-mq: delete dead struct blk_mq_hw_ctx->queued field This counter is not used anywhere, so delete it. Signed-off-by: Chengming Zhou Reviewed-by: Bart Van Assche Link: https://lore.kernel.org/r/20230720095512.1403123-1-chengming.zhou@linux.dev Signed-off-by: Jens Axboe commit e6ab0b914c12acefbb0880dded48cb930ccab5cf Author: YueHaibing Date: Thu Jul 20 22:35:06 2023 +0800 fs/9p: Remove unused extern declaration commit bd238fb431f3 ("9p: Reorganization of 9p file system code") left behind this. Signed-off-by: YueHaibing Reviewed-by: Christian Schoenebeck Signed-off-by: Eric Van Hensbergen commit a9be202269580ca611c6cebac90eaf1795497800 Author: Jens Axboe Date: Thu Jul 20 13:16:53 2023 -0600 io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq io-wq assumes that an issue is blocking, but it may not be if the request type has asked for a non-blocking attempt. If we get -EAGAIN for that case, then we need to treat it as a final result and not retry or arm poll for it. Cc: stable@vger.kernel.org # 5.10+ Link: https://github.com/axboe/liburing/issues/897 Signed-off-by: Jens Axboe commit cf7c33d332ab67603f159123b691c61270b14c33 Author: Dominique Martinet Date: Wed May 3 16:49:29 2023 +0900 9p: remove dead stores (variable set again without being read) The 9p code for some reason used to initialize variables outside of the declaration, e.g. instead of just initializing the variable like this: int retval = 0 We would be doing this: int retval; retval = 0; This is perfectly fine and the compiler will just optimize dead stores anyway, but scan-build seems to think this is a problem and there are many of these warnings making the output of scan-build full of such warnings: fs/9p/vfs_inode.c:916:2: warning: Value stored to 'retval' is never read [deadcode.DeadStores] retval = 0; ^ ~ I have no strong opinion here, but if we want to regularly run scan-build we should fix these just to silence the messages. I've confirmed these all are indeed ok to remove. Reviewed-by: Simon Horman Signed-off-by: Dominique Martinet Signed-off-by: Eric Van Hensbergen commit f41b402d2572e93bee85669ed05eb5e1f3725704 Author: Dominique Martinet Date: Wed May 3 16:49:28 2023 +0900 9p: virtio: skip incrementing unused variable Fix the following scan-build warning: net/9p/trans_virtio.c:504:3: warning: Value stored to 'in' is never read [deadcode.DeadStores] in += pack_sg_list_p(chan->sg, out + in, VIRTQUEUE_NUM, ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I'm honestly not 100% sure about this one; I'm tempted to think we could (should?) just check the return value of pack_sg_list_p to skip the in_sgs++ and setting sgs[] if it didn't process anything, but I'm not sure it should ever happen so this is probably fine as is. Just removing the assignment at least makes it clear the return value isn't used, so it's an improvement in terms of readability. Reviewed-by: Simon Horman Signed-off-by: Dominique Martinet Signed-off-by: Eric Van Hensbergen commit 4a73edab69d3a6623f03817fe950a2d9585f80e4 Author: Dominique Martinet Date: Wed May 3 16:49:27 2023 +0900 9p: virtio: make sure 'offs' is initialized in zc_request Similarly to the previous patch: offs can be used in handle_rerrors without initializing on small payloads; in this case handle_rerrors will not use it because of the size check, but it doesn't hurt to make sure it is zero to please scan-build. This fixes the following warning: net/9p/trans_virtio.c:539:3: warning: 3rd function call argument is an uninitialized value [core.CallAndMessage] handle_rerror(req, in_hdr_len, offs, in_pages); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Reviewed-by: Simon Horman Signed-off-by: Dominique Martinet Signed-off-by: Eric Van Hensbergen commit 13ade4ac5c28e8a014fa85278f5a4270b215f906 Author: Dominique Martinet Date: Wed May 3 16:49:26 2023 +0900 9p: virtio: fix unlikely null pointer deref in handle_rerror handle_rerror can dereference the pages pointer, but it is not necessarily set for small payloads. In practice these should be filtered out by the size check, but might as well double-check explicitly. This fixes the following scan-build warnings: net/9p/trans_virtio.c:401:24: warning: Dereference of null pointer [core.NullDereference] memcpy_from_page(to, *pages++, offs, n); ^~~~~~~~ net/9p/trans_virtio.c:406:23: warning: Dereference of null pointer (loaded from variable 'pages') [core.NullDereference] memcpy_from_page(to, *pages, offs, size); ^~~~~~ Reviewed-by: Simon Horman Signed-off-by: Dominique Martinet Signed-off-by: Eric Van Hensbergen commit eee4a119e96c2f58cfd1b6d4de42095abc5f8877 Author: Dominique Martinet Date: Wed May 3 16:49:25 2023 +0900 9p: fix ignored return value in v9fs_dir_release retval from filemap_fdatawrite was immediately overwritten by the following p9_fid_put: preserve any error in fdatawrite if there was any first. This fixes the following scan-build warning: fs/9p/vfs_dir.c:220:4: warning: Value stored to 'retval' is never read [deadcode.DeadStores] retval = filemap_fdatawrite(inode->i_mapping); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: 89c58cb395ec ("fs/9p: fix error reporting in v9fs_dir_release") Cc: stable@vger.kernel.org Reviewed-by: Simon Horman Signed-off-by: Dominique Martinet Signed-off-by: Eric Van Hensbergen commit d1f0a9816f5fbc1316355ec1aa4ddfb9b624cca5 Author: Andy Shevchenko Date: Mon Jul 17 12:32:14 2023 +0300 Bluetooth: MGMT: Use correct address for memcpy() In function ‘fortify_memcpy_chk’, inlined from ‘get_conn_info_complete’ at net/bluetooth/mgmt.c:7281:2: include/linux/fortify-string.h:592:25: error: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning] 592 | __read_overflow2_field(q_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors This is due to the wrong member is used for memcpy(). Use correct one. Signed-off-by: Andy Shevchenko Signed-off-by: Luiz Augusto von Dentz commit 95b7015433053cd5f648ad2a7b8f43b2c99c949a Author: Tomasz Moń Date: Thu Jul 13 12:25:14 2023 +0200 Bluetooth: btusb: Fix bluetooth on Intel Macbook 2014 Commit c13380a55522 ("Bluetooth: btusb: Do not require hardcoded interface numbers") inadvertedly broke bluetooth on Intel Macbook 2014. The intention was to keep behavior intact when BTUSB_IFNUM_2 is set and otherwise allow any interface numbers. The problem is that the new logic condition omits the case where bInterfaceNumber is 0. Fix BTUSB_IFNUM_2 handling by allowing both interface number 0 and 2 when the flag is set. Fixes: c13380a55522 ("Bluetooth: btusb: Do not require hardcoded interface numbers") Reported-by: John Holland Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217651 Signed-off-by: Tomasz Moń Tested-by: John Holland Signed-off-by: Luiz Augusto von Dentz commit 3dcaa192ac2159193bc6ab57bc5369dcb84edd8e Author: Pauli Virtanen Date: Mon Jul 10 19:48:19 2023 +0300 Bluetooth: SCO: fix sco_conn related locking and validity issues Operations that check/update sk_state and access conn should hold lock_sock, otherwise they can race. The order of taking locks is hci_dev_lock > lock_sock > sco_conn_lock, which is how it is in connect/disconnect_cfm -> sco_conn_del -> sco_chan_del. Fix locking in sco_connect to take lock_sock around updating sk_state and conn. sco_conn_del must not occur during sco_connect, as it frees the sco_conn. Hold hdev->lock longer to prevent that. sco_conn_add shall return sco_conn with valid hcon. Make it so also when reusing an old SCO connection waiting for disconnect timeout (see __sco_sock_close where conn->hcon is set to NULL). This should not reintroduce the issue fixed in the earlier commit 9a8ec9e8ebb5 ("Bluetooth: SCO: Fix possible circular locking dependency on sco_connect_cfm"), the relevant fix of releasing lock_sock in sco_sock_connect before acquiring hdev->lock is retained. These changes mirror similar fixes earlier in ISO sockets. Fixes: 9a8ec9e8ebb5 ("Bluetooth: SCO: Fix possible circular locking dependency on sco_connect_cfm") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit b4066eb04bb67e7ff66e5aaab0db4a753f37eaad Author: Siddh Raman Pant Date: Tue Jul 11 18:43:53 2023 +0530 Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link hci_connect_sco currently returns NULL when there is no link (i.e. when hci_conn_link() returns NULL). sco_connect() expects an ERR_PTR in case of any error (see line 266 in sco.c). Thus, hcon set as NULL passes through to sco_conn_add(), which tries to get hcon->hdev, resulting in dereferencing a NULL pointer as reported by syzkaller. The same issue exists for iso_connect_cis() calling hci_connect_cis(). Thus, make hci_connect_sco() and hci_connect_cis() return ERR_PTR instead of NULL. Reported-and-tested-by: syzbot+37acd5d80d00d609d233@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=37acd5d80d00d609d233 Fixes: 06149746e720 ("Bluetooth: hci_conn: Add support for linking multiple hcon") Signed-off-by: Siddh Raman Pant Signed-off-by: Luiz Augusto von Dentz commit de6dfcefd107667ce2dbedf4d9337f5ed557a4a1 Author: Douglas Anderson Date: Fri Jun 30 15:33:14 2023 -0700 Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() KASAN reports that there's a use-after-free in hci_remove_adv_monitor(). Trawling through the disassembly, you can see that the complaint is from the access in bt_dev_dbg() under the HCI_ADV_MONITOR_EXT_MSFT case. The problem case happens because msft_remove_monitor() can end up freeing the monitor structure. Specifically: hci_remove_adv_monitor() -> msft_remove_monitor() -> msft_remove_monitor_sync() -> msft_le_cancel_monitor_advertisement_cb() -> hci_free_adv_monitor() Let's fix the problem by just stashing the relevant data when it's still valid. Fixes: 7cf5c2978f23 ("Bluetooth: hci_sync: Refactor remove Adv Monitor") Signed-off-by: Douglas Anderson Signed-off-by: Luiz Augusto von Dentz commit 6910e2eb39254d279bce5bc0f8eb6af45b59357c Author: Arnd Bergmann Date: Mon Jul 3 13:30:48 2023 +0200 Bluetooth: coredump: fix building with coredump disabled The btmtk driver uses an IS_ENABLED() check to conditionally compile the coredump support, but this fails to build because the hdev->dump member is in an #ifdef: drivers/bluetooth/btmtk.c: In function 'btmtk_process_coredump': drivers/bluetooth/btmtk.c:386:30: error: 'struct hci_dev' has no member named 'dump' 386 | schedule_delayed_work(&hdev->dump.dump_timeout, | ^~ The struct member doesn't really make a huge difference in the total size, so just remove the #ifdef around it to avoid adding similar checks around each user. Fixes: 872f8c253cb9e ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support") Fixes: 9695ef876fd12 ("Bluetooth: Add support for hci devcoredump") Signed-off-by: Arnd Bergmann Signed-off-by: Luiz Augusto von Dentz commit d40ae85ee62e3666f45bc61864b22121346f88ef Author: Pauli Virtanen Date: Mon Jun 19 01:04:33 2023 +0300 Bluetooth: ISO: fix iso_conn related locking and validity issues sk->sk_state indicates whether iso_pi(sk)->conn is valid. Operations that check/update sk_state and access conn should hold lock_sock, otherwise they can race. The order of taking locks is hci_dev_lock > lock_sock > iso_conn_lock, which is how it is in connect/disconnect_cfm -> iso_conn_del -> iso_chan_del. Fix locking in iso_connect_cis/bis and sendmsg/recvmsg to take lock_sock around updating sk_state and conn. iso_conn_del must not occur during iso_connect_cis/bis, as it frees the iso_conn. Hold hdev->lock longer to prevent that. This should not reintroduce the issue fixed in commit 241f51931c35 ("Bluetooth: ISO: Avoid circular locking dependency"), since the we acquire locks in order. We retain the fix in iso_sock_connect to release lock_sock before iso_connect_* acquires hdev->lock. Similarly for commit 6a5ad251b7cd ("Bluetooth: ISO: Fix possible circular locking dependency"). We retain the fix in iso_conn_ready to not acquire iso_conn_lock before lock_sock. iso_conn_add shall return iso_conn with valid hcon. Make it so also when reusing an old CIS connection waiting for disconnect timeout (see __iso_sock_close where conn->hcon is set to NULL). Trace with iso_conn_del after iso_chan_add in iso_connect_cis: =============================================================== iso_sock_create:771: sock 00000000be9b69b7 iso_sock_init:693: sk 000000004dff667e iso_sock_bind:827: sk 000000004dff667e 70:1a:b8:98:ff:a2 type 1 iso_sock_setsockopt:1289: sk 000000004dff667e iso_sock_setsockopt:1289: sk 000000004dff667e iso_sock_setsockopt:1289: sk 000000004dff667e iso_sock_connect:875: sk 000000004dff667e iso_connect_cis:353: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da hci_get_route:1199: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da hci_conn_add:1005: hci0 dst 28:3d:c2:4a:7e:da iso_conn_add:140: hcon 000000007b65d182 conn 00000000daf8625e __iso_chan_add:214: conn 00000000daf8625e iso_connect_cfm:1700: hcon 000000007b65d182 bdaddr 28:3d:c2:4a:7e:da status 12 iso_conn_del:187: hcon 000000007b65d182 conn 00000000daf8625e, err 16 iso_sock_clear_timer:117: sock 000000004dff667e state 3 iso_chan_del:153: sk 000000004dff667e, conn 00000000daf8625e, err 16 hci_conn_del:1151: hci0 hcon 000000007b65d182 handle 65535 hci_conn_unlink:1102: hci0: hcon 000000007b65d182 hci_chan_list_flush:2780: hcon 000000007b65d182 iso_sock_getsockopt:1376: sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e iso_sock_getsockopt:1376: sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e iso_sock_getname:1070: sock 00000000be9b69b7, sk 000000004dff667e iso_sock_shutdown:1434: sock 00000000be9b69b7, sk 000000004dff667e, how 1 __iso_sock_close:632: sk 000000004dff667e state 5 socket 00000000be9b69b7 BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 8000000006467067 P4D 8000000006467067 PUD 3f5f067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:__iso_sock_close (net/bluetooth/iso.c:664) bluetooth =============================================================== Trace with iso_conn_del before iso_chan_add in iso_connect_cis: =============================================================== iso_connect_cis:356: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da ... iso_conn_add:140: hcon 0000000093bc551f conn 00000000768ae504 hci_dev_put:1487: hci0 orig refcnt 21 hci_event_packet:7607: hci0: event 0x0e hci_cmd_complete_evt:4231: hci0: opcode 0x2062 hci_cc_le_set_cig_params:3846: hci0: status 0x07 hci_sent_cmd_data:3107: hci0 opcode 0x2062 iso_connect_cfm:1703: hcon 0000000093bc551f bdaddr 28:3d:c2:4a:7e:da status 7 iso_conn_del:187: hcon 0000000093bc551f conn 00000000768ae504, err 12 hci_conn_del:1151: hci0 hcon 0000000093bc551f handle 65535 hci_conn_unlink:1102: hci0: hcon 0000000093bc551f hci_chan_list_flush:2780: hcon 0000000093bc551f __iso_chan_add:214: conn 00000000768ae504 iso_sock_clear_timer:117: sock 0000000098323f95 state 3 general protection fault, probably for non-canonical address 0x30b29c630930aec8: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 1920 Comm: bluetoothd Tainted: G E 6.3.0-rc7+ #4 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:detach_if_pending+0x28/0xd0 Code: 90 90 0f 1f 44 00 00 48 8b 47 08 48 85 c0 0f 84 ad 00 00 00 55 89 d5 53 48 83 3f 00 48 89 fb 74 7d 66 90 48 8b 03 48 8b 53 08 <> RSP: 0018:ffffb90841a67d08 EFLAGS: 00010007 RAX: 0000000000000000 RBX: ffff9141bd5061b8 RCX: 0000000000000000 RDX: 30b29c630930aec8 RSI: ffff9141fdd21e80 RDI: ffff9141bd5061b8 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffb90841a67b88 R10: 0000000000000003 R11: ffffffff8613f558 R12: ffff9141fdd21e80 R13: 0000000000000000 R14: ffff9141b5976010 R15: ffff914185755338 FS: 00007f45768bd840(0000) GS:ffff9141fdd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000619000424074 CR3: 0000000009f5e005 CR4: 0000000000170ee0 Call Trace: timer_delete+0x48/0x80 try_to_grab_pending+0xdf/0x170 __cancel_work+0x37/0xb0 iso_connect_cis+0x141/0x400 [bluetooth] =============================================================== Trace with NULL conn->hcon in state BT_CONNECT: =============================================================== __iso_sock_close:619: sk 00000000f7c71fc5 state 1 socket 00000000d90c5fe5 ... __iso_sock_close:619: sk 00000000f7c71fc5 state 8 socket 00000000d90c5fe5 iso_chan_del:153: sk 00000000f7c71fc5, conn 0000000022c03a7e, err 104 ... iso_sock_connect:862: sk 00000000129b56c3 iso_connect_cis:348: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7d:2a hci_get_route:1199: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7d:2a hci_dev_hold:1495: hci0 orig refcnt 19 __iso_chan_add:214: conn 0000000022c03a7e iso_sock_clear_timer:117: sock 00000000129b56c3 state 3 ... iso_sock_ready:1485: sk 00000000129b56c3 ... iso_sock_sendmsg:1077: sock 00000000e5013966, sk 00000000129b56c3 BUG: kernel NULL pointer dereference, address: 00000000000006a8 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 1403 Comm: wireplumber Tainted: G E 6.3.0-rc7+ #4 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:iso_sock_sendmsg+0x63/0x2a0 [bluetooth] =============================================================== Fixes: 241f51931c35 ("Bluetooth: ISO: Avoid circular locking dependency") Fixes: 6a5ad251b7cd ("Bluetooth: ISO: Fix possible circular locking dependency") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 7f7cfcb6f0825652973b780f248603e23f16ee90 Author: Pauli Virtanen Date: Mon Jun 19 01:04:32 2023 +0300 Bluetooth: hci_event: call disconnect callback before deleting conn In hci_cs_disconnect, we do hci_conn_del even if disconnection failed. ISO, L2CAP and SCO connections refer to the hci_conn without hci_conn_get, so disconn_cfm must be called so they can clean up their conn, otherwise use-after-free occurs. ISO: ========================================================== iso_sock_connect:880: sk 00000000eabd6557 iso_connect_cis:356: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da ... iso_conn_add:140: hcon 000000001696f1fd conn 00000000b6251073 hci_dev_put:1487: hci0 orig refcnt 17 __iso_chan_add:214: conn 00000000b6251073 iso_sock_clear_timer:117: sock 00000000eabd6557 state 3 ... hci_rx_work:4085: hci0 Event packet hci_event_packet:7601: hci0: event 0x0f hci_cmd_status_evt:4346: hci0: opcode 0x0406 hci_cs_disconnect:2760: hci0: status 0x0c hci_sent_cmd_data:3107: hci0 opcode 0x0406 hci_conn_del:1151: hci0 hcon 000000001696f1fd handle 2560 hci_conn_unlink:1102: hci0: hcon 000000001696f1fd hci_conn_drop:1451: hcon 00000000d8521aaf orig refcnt 2 hci_chan_list_flush:2780: hcon 000000001696f1fd hci_dev_put:1487: hci0 orig refcnt 21 hci_dev_put:1487: hci0 orig refcnt 20 hci_req_cmd_complete:3978: opcode 0x0406 status 0x0c ... ... iso_sock_sendmsg:1098: sock 00000000dea5e2e0, sk 00000000eabd6557 BUG: kernel NULL pointer dereference, address: 0000000000000668 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:iso_sock_sendmsg (net/bluetooth/iso.c:1112) bluetooth ========================================================== L2CAP: ================================================================== hci_cmd_status_evt:4359: hci0: opcode 0x0406 hci_cs_disconnect:2760: hci0: status 0x0c hci_sent_cmd_data:3085: hci0 opcode 0x0406 hci_conn_del:1151: hci0 hcon ffff88800c999000 handle 3585 hci_conn_unlink:1102: hci0: hcon ffff88800c999000 hci_chan_list_flush:2780: hcon ffff88800c999000 hci_chan_del:2761: hci0 hcon ffff88800c999000 chan ffff888018ddd280 ... BUG: KASAN: slab-use-after-free in hci_send_acl+0x2d/0x540 [bluetooth] Read of size 8 at addr ffff888018ddd298 by task bluetoothd/1175 CPU: 0 PID: 1175 Comm: bluetoothd Tainted: G E 6.4.0-rc4+ #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 Call Trace: dump_stack_lvl+0x5b/0x90 print_report+0xcf/0x670 ? __virt_addr_valid+0xf8/0x180 ? hci_send_acl+0x2d/0x540 [bluetooth] kasan_report+0xa8/0xe0 ? hci_send_acl+0x2d/0x540 [bluetooth] hci_send_acl+0x2d/0x540 [bluetooth] ? __pfx___lock_acquire+0x10/0x10 l2cap_chan_send+0x1fd/0x1300 [bluetooth] ? l2cap_sock_sendmsg+0xf2/0x170 [bluetooth] ? __pfx_l2cap_chan_send+0x10/0x10 [bluetooth] ? lock_release+0x1d5/0x3c0 ? mark_held_locks+0x1a/0x90 l2cap_sock_sendmsg+0x100/0x170 [bluetooth] sock_write_iter+0x275/0x280 ? __pfx_sock_write_iter+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 do_iter_readv_writev+0x176/0x220 ? __pfx_do_iter_readv_writev+0x10/0x10 ? find_held_lock+0x83/0xa0 ? selinux_file_permission+0x13e/0x210 do_iter_write+0xda/0x340 vfs_writev+0x1b4/0x400 ? __pfx_vfs_writev+0x10/0x10 ? __seccomp_filter+0x112/0x750 ? populate_seccomp_data+0x182/0x220 ? __fget_light+0xdf/0x100 ? do_writev+0x19d/0x210 do_writev+0x19d/0x210 ? __pfx_do_writev+0x10/0x10 ? mark_held_locks+0x1a/0x90 do_syscall_64+0x60/0x90 ? lockdep_hardirqs_on_prepare+0x149/0x210 ? do_syscall_64+0x6c/0x90 ? lockdep_hardirqs_on_prepare+0x149/0x210 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7ff45cb23e64 Code: 15 d1 1f 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 80 3d 9d a7 0d 00 00 74 13 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 RSP: 002b:00007fff21ae09b8 EFLAGS: 00000202 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007ff45cb23e64 RDX: 0000000000000001 RSI: 00007fff21ae0aa0 RDI: 0000000000000017 RBP: 00007fff21ae0aa0 R08: 000000000095a8a0 R09: 0000607000053f40 R10: 0000000000000001 R11: 0000000000000202 R12: 00007fff21ae0ac0 R13: 00000fffe435c150 R14: 00007fff21ae0a80 R15: 000060f000000040 Allocated by task 771: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 __kasan_kmalloc+0xaa/0xb0 hci_chan_create+0x67/0x1b0 [bluetooth] l2cap_conn_add.part.0+0x17/0x590 [bluetooth] l2cap_connect_cfm+0x266/0x6b0 [bluetooth] hci_le_remote_feat_complete_evt+0x167/0x310 [bluetooth] hci_event_packet+0x38d/0x800 [bluetooth] hci_rx_work+0x287/0xb20 [bluetooth] process_one_work+0x4f7/0x970 worker_thread+0x8f/0x620 kthread+0x17f/0x1c0 ret_from_fork+0x2c/0x50 Freed by task 771: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 ____kasan_slab_free+0x169/0x1c0 slab_free_freelist_hook+0x9e/0x1c0 __kmem_cache_free+0xc0/0x310 hci_chan_list_flush+0x46/0x90 [bluetooth] hci_conn_cleanup+0x7d/0x330 [bluetooth] hci_cs_disconnect+0x35d/0x530 [bluetooth] hci_cmd_status_evt+0xef/0x2b0 [bluetooth] hci_event_packet+0x38d/0x800 [bluetooth] hci_rx_work+0x287/0xb20 [bluetooth] process_one_work+0x4f7/0x970 worker_thread+0x8f/0x620 kthread+0x17f/0x1c0 ret_from_fork+0x2c/0x50 ================================================================== Fixes: b8d290525e39 ("Bluetooth: clean up connection in hci_cs_disconnect") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 195ef75e19287b4bc413da3e3e3722b030ac881e Author: Pauli Virtanen Date: Mon Jun 19 01:04:31 2023 +0300 Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync hci_update_accept_list_sync iterates over hdev->pend_le_conns and hdev->pend_le_reports, and waits for controller events in the loop body, without holding hdev lock. Meanwhile, these lists and the items may be modified e.g. by le_scan_cleanup. This can invalidate the list cursor or any other item in the list, resulting to invalid behavior (eg use-after-free). Use RCU for the hci_conn_params action lists. Since the loop bodies in hci_sync block and we cannot use RCU or hdev->lock for the whole loop, copy list items first and then iterate on the copy. Only the flags field is written from elsewhere, so READ_ONCE/WRITE_ONCE should guarantee we read valid values. Free params everywhere with hci_conn_params_free so the cleanup is guaranteed to be done properly. This fixes the following, which can be triggered e.g. by BlueZ new mgmt-tester case "Add + Remove Device Nowait - Success", or by changing hci_le_set_cig_params to always return false, and running iso-tester: ================================================================== BUG: KASAN: slab-use-after-free in hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841) Read of size 8 at addr ffff888001265018 by task kworker/u3:0/32 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 Workqueue: hci0 hci_cmd_sync_work Call Trace: dump_stack_lvl (./arch/x86/include/asm/irqflags.h:134 lib/dump_stack.c:107) print_report (mm/kasan/report.c:320 mm/kasan/report.c:430) ? __virt_addr_valid (./include/linux/mmzone.h:1915 ./include/linux/mmzone.h:2011 arch/x86/mm/physaddr.c:65) ? hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841) kasan_report (mm/kasan/report.c:538) ? hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841) hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841) ? __pfx_hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2780) ? mutex_lock (kernel/locking/mutex.c:282) ? __pfx_mutex_lock (kernel/locking/mutex.c:282) ? __pfx_mutex_unlock (kernel/locking/mutex.c:538) ? __pfx_update_passive_scan_sync (net/bluetooth/hci_sync.c:2861) hci_cmd_sync_work (net/bluetooth/hci_sync.c:306) process_one_work (./arch/x86/include/asm/preempt.h:27 kernel/workqueue.c:2399) worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2538) ? __pfx_worker_thread (kernel/workqueue.c:2480) kthread (kernel/kthread.c:376) ? __pfx_kthread (kernel/kthread.c:331) ret_from_fork (arch/x86/entry/entry_64.S:314) Allocated by task 31: kasan_save_stack (mm/kasan/common.c:46) kasan_set_track (mm/kasan/common.c:52) __kasan_kmalloc (mm/kasan/common.c:374 mm/kasan/common.c:383) hci_conn_params_add (./include/linux/slab.h:580 ./include/linux/slab.h:720 net/bluetooth/hci_core.c:2277) hci_connect_le_scan (net/bluetooth/hci_conn.c:1419 net/bluetooth/hci_conn.c:1589) hci_connect_cis (net/bluetooth/hci_conn.c:2266) iso_connect_cis (net/bluetooth/iso.c:390) iso_sock_connect (net/bluetooth/iso.c:899) __sys_connect (net/socket.c:2003 net/socket.c:2020) __x64_sys_connect (net/socket.c:2027) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) Freed by task 15: kasan_save_stack (mm/kasan/common.c:46) kasan_set_track (mm/kasan/common.c:52) kasan_save_free_info (mm/kasan/generic.c:523) __kasan_slab_free (mm/kasan/common.c:238 mm/kasan/common.c:200 mm/kasan/common.c:244) __kmem_cache_free (mm/slub.c:1807 mm/slub.c:3787 mm/slub.c:3800) hci_conn_params_del (net/bluetooth/hci_core.c:2323) le_scan_cleanup (net/bluetooth/hci_conn.c:202) process_one_work (./arch/x86/include/asm/preempt.h:27 kernel/workqueue.c:2399) worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2538) kthread (kernel/kthread.c:376) ret_from_fork (arch/x86/entry/entry_64.S:314) ================================================================== Fixes: e8907f76544f ("Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 3") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 272ffb925e2020000863748867d91a2407d3e8e9 Author: William Breathitt Gray Date: Tue Jun 20 13:01:59 2023 -0400 counter: Fix menuconfig "Counter support" submenu entries disappearance The current placement of the I8254 Kconfig entry results in the disappearance of the "Counter support" submenu items in menuconfig. Move the I8254 above the menuconfig COUNTER entry to restore the intended submenu behavior. Fixes: d428487471ba ("counter: i8254: Introduce the Intel 8254 interface library module") Reported-by: Jarkko Nikula Closes: https://lore.kernel.org/all/32ddaa7b-53a8-d61f-d526-b545bd561337@linux.intel.com/ Reviewed-by: Randy Dunlap Tested-by: Jarkko Nikula Reviewed-by: Jarkko Nikula Link: https://lore.kernel.org/r/20230620170159.556788-1-william.gray@linaro.org/ Signed-off-by: William Breathitt Gray commit 8dbfc14fc736eb701089aff09645c3d4ad3decb1 Author: Filipe Manana Date: Thu Jul 20 12:44:33 2023 +0100 btrfs: account block group tree when calculating global reserve size When using the block group tree feature, this tree is a critical tree just like the extent, csum and free space trees, and just like them it uses the delayed refs block reserve. So take into account the block group tree, and its current size, when calculating the size for the global reserve. CC: stable@vger.kernel.org # 6.1+ Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 690c8b804ad2eafbd35da5d3c95ad325ca7d5061 Author: Samuel Thibault Date: Mon Jul 10 02:26:45 2023 +0200 TIOCSTI: always enable for CAP_SYS_ADMIN 83efeeeb3d04 ("tty: Allow TIOCSTI to be disabled") broke BRLTTY's ability to simulate keypresses on the console, thus effectively breaking braille keyboards of blind users. This restores the TIOCSTI feature for CAP_SYS_ADMIN processes, which BRLTTY is, thus fixing braille keyboards without re-opening the security issue. Signed-off-by: Samuel Thibault Acked-by: Kees Cook Fixes: 83efeeeb3d04 ("tty: Allow TIOCSTI to be disabled") Cc: stable@vger.kernel.org Reported-by: Nicolas Pitre Link: https://lore.kernel.org/r/20230710002645.v565c7xq5iddruse@begin Acked-by: Jiri Slaby Signed-off-by: Greg Kroah-Hartman commit 95ca6599a589ee84c69f02d0e1d928c8d1367fb1 Author: Naohiro Aota Date: Thu Jun 29 17:37:31 2023 +0900 btrfs: zoned: do not enable async discard The zoned mode need to reset a zone before using it. We rely on btrfs's original discard functionality (discarding unused block group range) to do the resetting. While the commit 63a7cb130718 ("btrfs: auto enable discard=async when possible") made the discard done in an async manner, a zoned reset do not need to be async, as it is fast enough. Even worth, delaying zone rests prevents using those zones again. So, let's disable async discard on the zoned mode. Fixes: 63a7cb130718 ("btrfs: auto enable discard=async when possible") CC: stable@vger.kernel.org # 6.3+ Reviewed-by: Damien Le Moal Reviewed-by: Christoph Hellwig Signed-off-by: Naohiro Aota Reviewed-by: David Sterba [ update message text ] Signed-off-by: David Sterba commit 733c758e509b86a5d38b9af927817258b88ededd Author: Oliver Upton Date: Wed Jul 19 23:18:55 2023 +0000 KVM: arm64: Rephrase percpu enable/disable tracking in terms of hyp kvm_arm_hardware_enabled is rather misleading, since it doesn't track the state of all hardware resources needed for running a VM. What it actually tracks is whether or not the hyp cpu context has been initialized. Since we're now at the point where vgic + timer irq management has been separated from kvm_arm_hardware_enabled, rephrase it (and the associated helpers) to make it clear what state is being tracked. Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20230719231855.262973-1-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit c718ca0e99401d80d2480c08e1b02cf5f7cd7033 Author: Raghavendra Rao Ananta Date: Wed Jul 19 17:54:00 2023 +0000 KVM: arm64: Fix hardware enable/disable flows for pKVM When running in protected mode, the hyp stub is disabled after pKVM is initialized, meaning the host cannot enable/disable the hyp at runtime. As such, kvm_arm_hardware_enabled is always 1 after initialization, and kvm_arch_hardware_enable() never enables the vgic maintenance irq or timer irqs. Unconditionally enable/disable the vgic + timer irqs in the respective calls, instead relying on the percpu bookkeeping in the generic code to keep track of which cpus have the interrupts unmasked. Fixes: 466d27e48d7c ("KVM: arm64: Simplify the CPUHP logic") Reported-by: Oliver Upton Suggested-by: Oliver Upton Signed-off-by: Raghavendra Rao Ananta Link: https://lore.kernel.org/r/20230719175400.647154-1-rananta@google.com Acked-by: Marc Zyngier Signed-off-by: Oliver Upton commit e599e16c16a16be9907fb00608212df56d08d57b Merge: 69435880cf138 efa96cc99793b Author: Linus Torvalds Date: Thu Jul 20 10:10:02 2023 -0700 Merge tag 'iomap-6.5-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap fix from Darrick Wong: "Fix partial write regression. It turns out that fstests doesn't have any test coverage for short writes, but LTP does. Fortunately, this was caught right after -rc1 was tagged. Summary: - Fix a bug wherein a failed write could clobber short write status" * tag 'iomap-6.5-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: micro optimize the ki_pos assignment in iomap_file_buffered_write iomap: fix a regression for partial write errors commit 69435880cf138484c3012f6c38dcbc5605de39ee Merge: 46670259519f4 f6250e205691a Author: Linus Torvalds Date: Thu Jul 20 10:03:41 2023 -0700 Merge tag 'xfs-6.5-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: "Flexarray declaration conversions. This probably should've been done with the merge window open, but I was not aware that the UBSAN knob would be getting turned up for 6.5, and the fstests failures due to the kernel warnings are getting in the way of testing. Summary: - Convert all the array[1] declarations into the accepted flex array[] declarations so that UBSAN and friends will not get confused" * tag 'xfs-6.5-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: convert flex-array declarations in xfs attr shortform objects xfs: convert flex-array declarations in xfs attr leaf blocks xfs: convert flex-array declarations in struct xfs_attrlist* commit 350cd9b959757e7c571f45fab29d116d5f67cbff Author: Eric Van Hensbergen Date: Wed Jul 19 16:22:33 2023 +0000 fs/9p: remove unnecessary invalidate_inode_pages2 There was an invalidate_inode_pages2 added to readonly mmap path that is unnecessary since that path is only entered when writeback cache is disabled on mount. Cc: stable@vger.kernel.org Fixes: 1543b4c5071c ("fs/9p: remove writeback fid and fix per-file modes") Reviewed-by: Christian Schoenebeck Signed-off-by: Eric Van Hensbergen commit 09430aba3a9ffd986834614a3406a13588170bde Author: Eric Van Hensbergen Date: Wed Jul 19 16:22:32 2023 +0000 fs/9p: fix type mismatch in file cache mode helper There were two flags (s_flags and s_cache) which had incorrect signed type in the parameters of the file cache mode helper function. Cc: stable@vger.kernel.org Fixes: 1543b4c5071c ("fs/9p: remove writeback fid and fix per-file modes") Reviewed-by: Dominique Martinet Signed-off-by: Eric Van Hensbergen commit 878cb3e0337d7c3096aee301a2a3cd358dc8aa81 Author: Eric Van Hensbergen Date: Wed Jul 19 16:22:31 2023 +0000 fs/9p: fix typo in comparison logic for cache mode There appears to be a typo in the comparison statement for the logic which sets a file's cache mode based on mount flags. Cc: stable@vger.kernel.org Fixes: 1543b4c5071c ("fs/9p: remove writeback fid and fix per-file modes") Reviewed-by: Christian Schoenebeck Reviewed-by: Dominique Martinet Signed-off-by: Eric Van Hensbergen commit 75b396821cb71164dac3a1ad51dda4781ea8dbad Author: Eric Van Hensbergen Date: Wed Jul 19 16:22:30 2023 +0000 fs/9p: remove unnecessary and overrestrictive check This eliminates a check for shared that was overrestrictive and prevented read-only mmaps when writeback caches weren't enabled. Cc: stable@vger.kernel.org Fixes: 1543b4c5071c ("fs/9p: remove writeback fid and fix per-file modes") Reported-by: Robert Schwebel Closes: https://lore.kernel.org/v9fs/ZK25XZ%2BGpR3KHIB%2F@pengutronix.de Reviewed-by: Dominique Martinet Reviewed-by: Christian Schoenebeck Signed-off-by: Eric Van Hensbergen commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8 Author: Pablo Neira Ayuso Date: Thu Jul 20 09:17:21 2023 +0200 netfilter: nf_tables: skip bound chain on rule flush Skip bound chain when flushing table rules, the rule that owns this chain releases these objects. Otherwise, the following warning is triggered: WARNING: CPU: 2 PID: 1217 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] CPU: 2 PID: 1217 Comm: chain-flush Not tainted 6.1.39 #1 RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") Reported-by: Kevin Rich Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 46670259519f4ee4ab378dc014798aabe77c5057 Merge: 2922800a1803f aa84ce8a78a1a Author: Linus Torvalds Date: Thu Jul 20 08:11:30 2023 -0700 Merge tag 'for-6.5-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Stable fixes: - fix race between balance and cancel/pause - various iput() fixes - fix use-after-free of new block group that became unused - fix warning when putting transaction with qgroups enabled after abort - fix crash in subpage mode when page could be released between map and map read - when scrubbing raid56 verify the P/Q stripes unconditionally - fix minor memory leak in zoned mode when a block group with an unexpected superblock is found Regression fixes: - fix ordered extent split error handling when submitting direct IO - user irq-safe locking when adding delayed iputs" * tag 'for-6.5-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix warning when putting transaction with qgroups enabled after abort btrfs: fix ordered extent split error handling in btrfs_dio_submit_io btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand btrfs: raid56: always verify the P/Q contents for scrub btrfs: use irq safe locking when running and adding delayed iputs btrfs: fix iput() on error pointer after error during orphan cleanup btrfs: fix double iput() on inode after an error during orphan cleanup btrfs: zoned: fix memory leak after finding block group with super blocks btrfs: fix use-after-free of new block group that became unused btrfs: be a bit more careful when setting mirror_num_ret in btrfs_map_block btrfs: fix race between balance and cancel/pause commit bb54e6609977f5140eb0af9b0c42d957cb35b4f4 Author: Rob Herring Date: Mon Jul 17 16:53:58 2023 -0600 ARM: zynq: Explicitly include correct DT includes The DT of_device.h and of_platform.h date back to the separate of_platform_bus_type before it was merged into the regular platform bus. As part of that merge prepping Arm DT support 13 years ago, they "temporarily" include each other. They also include platform_device.h and of.h. As a result, there's a pretty much random mix of those include files used throughout the tree. In order to detangle these headers and replace the implicit includes with struct declarations, users need to explicitly include the correct includes. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20230717225358.3210536-1-robh@kernel.org Signed-off-by: Michal Simek commit 2922800a1803f6319e329bdbfd2962fd83eb5360 Merge: bfa3037d82805 98e2dd5f7a8be Author: Linus Torvalds Date: Thu Jul 20 08:06:18 2023 -0700 Merge tag 'regulator-fix-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One fix for an issue with parsing partially specified DTs" * tag 'regulator-fix-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: da9063: fix null pointer deref with partial DT config commit 751d460ccff3137212f47d876221534bf0490996 Author: Pablo Neira Ayuso Date: Wed Jul 19 20:19:43 2023 +0200 netfilter: nf_tables: skip bound chain in netns release path Skip bound chain from netns release path, the rule that owns this chain releases these objects. Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 4cfca532ddc3474b3fc42592d0e4237544344b1a Author: Harald Freudenberger Date: Mon Jul 17 16:55:29 2023 +0200 s390/zcrypt: fix reply buffer calculations for CCA replies The length information for available buffer space for CCA replies is covered with two fields in the T6 header prepended on each CCA reply: fromcardlen1 and fromcardlen2. The sum of these both values must not exceed the AP bus limit for this card (24KB for CEX8, 12KB CEX7 and older) minus the always present headers. The current code adjusted the fromcardlen2 value in case of exceeding the AP bus limit when there was a non-zero value given from userspace. Some tests now showed that this was the wrong assumption. Instead the userspace value given for this field should always be trusted and if the sum of the two fields exceeds the AP bus limit for this card the first field fromcardlen1 should be adjusted instead. So now the calculation is done with this new insight in mind. Also some additional checks for overflow have been introduced and some comments to provide some documentation for future maintainers of this complicated calculation code. Furthermore the 128 bytes of fix overhead which is used in the current code is not correct. Investigations showed that for a reply always the same two header structs are prepended before a possible payload. So this is also fixed with this patch. Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Cc: stable@vger.kernel.org Signed-off-by: Heiko Carstens commit 1f7e9067756cac5b44b9701bbe0bb83e93011e47 Author: Wang Ming Date: Mon Jul 17 17:45:19 2023 +0800 s390/crypto: use kfree_sensitive() instead of kfree() key might contain private part of the key, so better use kfree_sensitive() to free it. Signed-off-by: Wang Ming Reviewed-by: Harald Freudenberger Link: https://lore.kernel.org/r/20230717094533.18418-1-machel@vivo.com Signed-off-by: Heiko Carstens commit d245aedc00775c4d7265a9f4522cc4e1fd34d102 Author: Johan Hovold Date: Thu Jul 20 09:53:57 2023 +0200 USB: serial: simple: sort driver entries Sort the driver symbols alphabetically in order to make it more obvious where new driver entries should be added. Cc: stable@vger.kernel.org Acked-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold commit 5f69c65e07b99ceb113d304fe31e0c653eb1c4bc Merge: de90f5165b1cd 269f399dc19f0 Author: Takashi Iwai Date: Thu Jul 20 15:16:11 2023 +0200 Merge tag 'asoc-fix-v6.5-rc1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.5 A few more fixes for v6.5, just small driver specific ones. commit a9e26169cfda651802f88262a315146fbe4bc74c Author: Guenter Roeck Date: Wed Jul 19 20:28:47 2023 -0700 regmap: Disable locking for RBTREE and MAPLE unit tests REGCACHE_RBTREE and REGCACHE_MAPLE dynamically allocate memory for regmap operations. This is incompatible with spinlock based locking which is used for fast_io operations. Disable locking for the associated unit tests to avoid lockdep splashes. Fixes: f033c26de5a5 ("regmap: Add maple tree based register cache") Fixes: 2238959b6ad2 ("regmap: Add some basic kunit tests") Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/20230720032848.1306349-1-linux@roeck-us.net Signed-off-by: Mark Brown commit 644ee70267a934be27370f9aa618b29af7290544 Author: Bartosz Golaszewski Date: Wed Jul 19 13:41:01 2023 +0200 gpio: mvebu: fix irq domain leak Uwe Kleine-König pointed out we still have one resource leak in the mvebu driver triggered on driver detach. Let's address it with a custom devm action. Fixes: 812d47889a8e ("gpio/mvebu: Use irq_domain_add_linear") Signed-off-by: Bartosz Golaszewski Reviewed-by: Andy Shevchenko Reviewed-by: Uwe Kleine-König commit d1ff11d7ad8704f8d615f6446041c221b2d2ec4d Author: Cristian Marussi Date: Wed Jul 19 18:35:33 2023 +0100 firmware: arm_scmi: Fix chan_free cleanup on SMC SCMI transport based on SMC can optionally use an additional IRQ to signal message completion. The associated interrupt handler is currently allocated using devres but on shutdown the core SCMI stack will call .chan_free() well before any managed cleanup is invoked by devres. As a consequence, the arrival of a late reply to an in-flight pending transaction could still trigger the interrupt handler well after the SCMI core has cleaned up the channels, with unpleasant results. Inhibit further message processing on the IRQ path by explicitly freeing the IRQ inside .chan_free() callback itself. Fixes: dd820ee21d5e ("firmware: arm_scmi: Augment SMC/HVC to allow optional interrupt") Reported-by: Bjorn Andersson Signed-off-by: Cristian Marussi Link: https://lore.kernel.org/r/20230719173533.2739319-1-cristian.marussi@arm.com Signed-off-by: Sudeep Holla commit dd92c8a1f99bcd166204ffc219ea5a23dd65d64f Author: Oliver Neukum Date: Wed Jul 12 16:16:41 2023 +0200 USB: serial: simple: add Kaufmann RKS+CAN VCP Add the device and product ID for this CAN bus interface / license dongle. The device is usable either directly from user space or can be attached to a kernel CAN interface with slcan_attach. Reported-by: Kaufmann Automotive GmbH Tested-by: Kaufmann Automotive GmbH Signed-off-by: Oliver Neukum [ johan: amend commit message and move entries in sort order ] Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 857ea9005806e2a458016880278f98715873e977 Author: Mohsen Tahmasebi Date: Mon Jul 10 11:22:18 2023 +0330 USB: serial: option: add Quectel EC200A module support Add Quectel EC200A "DIAG, AT, MODEM": 0x6005: ECM / RNDIS + DIAG + AT + MODEM T: Bus=01 Lev=01 Prnt=02 Port=05 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=6005 Rev=03.18 S: Manufacturer=Android S: Product=Android S: SerialNumber=0000 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms Signed-off-by: Mohsen Tahmasebi Tested-by: Mostafa Ghofrani Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 11c9027c983e9e4b408ee5613b6504d24ebd85be Author: Eric Dumazet Date: Thu Jul 20 11:44:38 2023 +0000 can: raw: fix lockdep issue in raw_release() syzbot complained about a lockdep issue [1] Since raw_bind() and raw_setsockopt() first get RTNL before locking the socket, we must adopt the same order in raw_release() [1] WARNING: possible circular locking dependency detected 6.5.0-rc1-syzkaller-00192-g78adb4bcf99e #0 Not tainted ------------------------------------------------------ syz-executor.0/14110 is trying to acquire lock: ffff88804e4b6130 (sk_lock-AF_CAN){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1708 [inline] ffff88804e4b6130 (sk_lock-AF_CAN){+.+.}-{0:0}, at: raw_bind+0xb1/0xab0 net/can/raw.c:435 but task is already holding lock: ffffffff8e3df368 (rtnl_mutex){+.+.}-{3:3}, at: raw_bind+0xa7/0xab0 net/can/raw.c:434 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (rtnl_mutex){+.+.}-{3:3}: __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0x181/0x1340 kernel/locking/mutex.c:747 raw_release+0x1c6/0x9b0 net/can/raw.c:391 __sock_release+0xcd/0x290 net/socket.c:654 sock_close+0x1c/0x20 net/socket.c:1386 __fput+0x3fd/0xac0 fs/file_table.c:384 task_work_run+0x14d/0x240 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x210/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 do_syscall_64+0x44/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd -> #0 (sk_lock-AF_CAN){+.+.}-{0:0}: check_prev_add kernel/locking/lockdep.c:3142 [inline] check_prevs_add kernel/locking/lockdep.c:3261 [inline] validate_chain kernel/locking/lockdep.c:3876 [inline] __lock_acquire+0x2e3d/0x5de0 kernel/locking/lockdep.c:5144 lock_acquire kernel/locking/lockdep.c:5761 [inline] lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5726 lock_sock_nested+0x3a/0xf0 net/core/sock.c:3492 lock_sock include/net/sock.h:1708 [inline] raw_bind+0xb1/0xab0 net/can/raw.c:435 __sys_bind+0x1ec/0x220 net/socket.c:1792 __do_sys_bind net/socket.c:1803 [inline] __se_sys_bind net/socket.c:1801 [inline] __x64_sys_bind+0x72/0xb0 net/socket.c:1801 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(rtnl_mutex); lock(sk_lock-AF_CAN); lock(rtnl_mutex); lock(sk_lock-AF_CAN); *** DEADLOCK *** 1 lock held by syz-executor.0/14110: stack backtrace: CPU: 0 PID: 14110 Comm: syz-executor.0 Not tainted 6.5.0-rc1-syzkaller-00192-g78adb4bcf99e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 check_noncircular+0x311/0x3f0 kernel/locking/lockdep.c:2195 check_prev_add kernel/locking/lockdep.c:3142 [inline] check_prevs_add kernel/locking/lockdep.c:3261 [inline] validate_chain kernel/locking/lockdep.c:3876 [inline] __lock_acquire+0x2e3d/0x5de0 kernel/locking/lockdep.c:5144 lock_acquire kernel/locking/lockdep.c:5761 [inline] lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5726 lock_sock_nested+0x3a/0xf0 net/core/sock.c:3492 lock_sock include/net/sock.h:1708 [inline] raw_bind+0xb1/0xab0 net/can/raw.c:435 __sys_bind+0x1ec/0x220 net/socket.c:1792 __do_sys_bind net/socket.c:1803 [inline] __se_sys_bind net/socket.c:1801 [inline] __x64_sys_bind+0x72/0xb0 net/socket.c:1801 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd89007cb29 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd890d2a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 RAX: ffffffffffffffda RBX: 00007fd89019bf80 RCX: 00007fd89007cb29 RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003 RBP: 00007fd8900c847a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fd89019bf80 R15: 00007ffebf8124f8 Fixes: ee8b94c8510c ("can: raw: fix receiver memory leak") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Ziyang Xuan Cc: Oliver Hartkopp Cc: stable@vger.kernel.org Cc: Marc Kleine-Budde Link: https://lore.kernel.org/all/20230720114438.172434-1-edumazet@google.com Signed-off-by: Marc Kleine-Budde commit 78e9b217d78e9f69c5699ccff18794ea03be597f Author: Arnd Bergmann Date: Fri Jun 9 14:06:32 2023 +0200 accel/habanalabs: add more debugfs stub helpers Two functions got added with normal prototypes for debugfs, but not alternative when building without it: drivers/accel/habanalabs/common/device.c: In function 'hl_device_init': drivers/accel/habanalabs/common/device.c:2177:14: error: implicit declaration of function 'hl_debugfs_device_init'; did you mean 'hl_debugfs_init'? [-Werror=implicit-function-declaration] drivers/accel/habanalabs/common/device.c:2305:9: error: implicit declaration of function 'hl_debugfs_device_fini'; did you mean 'hl_debugfs_remove_file'? [-Werror=implicit-function-declaration] Add stubs for these as well. Fixes: 3b9abb4fa642 ("accel/habanalabs: expose debugfs files later") Signed-off-by: Arnd Bergmann Reviewed-by: Tomer Tayar Acked-by: Oded Gabbay Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20230609120636.3969045-1-arnd@kernel.org commit 71e06e1acecbb50e712a3be9a7d56778509f3538 Author: Zhen Lei Date: Thu Jul 13 19:58:31 2023 +0800 arm64: vdso: Clear common make C=2 warnings make C=2 ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- xxx.o When I use the command above to do a 'make C=2' check on any object file, the following warnings are always output: CHECK arch/arm64/kernel/vdso/vgettimeofday.c arch/arm64/kernel/vdso/vgettimeofday.c:9:5: warning: symbol '__kernel_clock_gettime' was not declared. Should it be static? arch/arm64/kernel/vdso/vgettimeofday.c:15:5: warning: symbol '__kernel_gettimeofday' was not declared. Should it be static? arch/arm64/kernel/vdso/vgettimeofday.c:21:5: warning: symbol '__kernel_clock_getres' was not declared. Should it be static? Therefore, the declaration of the three functions is added to eliminate these common warnings to provide a clean output. Signed-off-by: Zhen Lei Link: https://lore.kernel.org/r/20230713115831.777-1-thunder.leizhen@huawei.com Signed-off-by: Will Deacon commit a8bd38dbc57c2fe074df2c9e549b9c2ad3183c83 Author: Nikhil V Date: Thu Jul 13 12:37:57 2023 +0530 arm64: mm: Make hibernation aware of KFENCE In the restore path, swsusp_arch_suspend_exit uses copy_page() to over-write memory. However, with features like KFENCE enabled, there could be situations where it may have marked some pages as not valid, due to which it could be reported as invalid accesses. Consider a situation where page 'P' was part of the hibernation image. Now, when the resume kernel tries to restore the pages, the same page 'P' is already in use in the resume kernel and is kfence protected, due to which its mapping is removed from linear map. Since restoring pages happens with the resume kernel page tables, we would end up accessing 'P' during copy and results in kernel pagefault. The proposed fix tries to solve this issue by marking PTE as valid for such kfence protected pages. Co-developed-by: Pavankumar Kondeti Signed-off-by: Pavankumar Kondeti Signed-off-by: Nikhil V Link: https://lore.kernel.org/r/20230713070757.4093-1-quic_nprakash@quicinc.com Signed-off-by: Will Deacon commit 87b5a5c209405cb6b57424cdfa226a6dbd349232 Author: Florian Westphal Date: Wed Jul 19 21:08:21 2023 +0200 netfilter: nft_set_pipapo: fix improper element removal end key should be equal to start unless NFT_SET_EXT_KEY_END is present. Its possible to add elements that only have a start key ("{ 1.0.0.0 . 2.0.0.0 }") without an internval end. Insertion treats this via: if (nft_set_ext_exists(ext, NFT_SET_EXT_KEY_END)) end = (const u8 *)nft_set_ext_key_end(ext)->data; else end = start; but removal side always uses nft_set_ext_key_end(). This is wrong and leads to garbage remaining in the set after removal next lookup/insert attempt will give: BUG: KASAN: slab-use-after-free in pipapo_get+0x8eb/0xb90 Read of size 1 at addr ffff888100d50586 by task nft-pipapo_uaf_/1399 Call Trace: kasan_report+0x105/0x140 pipapo_get+0x8eb/0xb90 nft_pipapo_insert+0x1dc/0x1710 nf_tables_newsetelem+0x31f5/0x4e00 .. Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Reported-by: lonial con Reviewed-by: Stefano Brivio Signed-off-by: Florian Westphal commit 314c82841602a111c04a7210c21dc77e0d560242 Author: Florian Westphal Date: Tue Jul 18 01:30:33 2023 +0200 netfilter: nf_tables: can't schedule in nft_chain_validate Can be called via nft set element list iteration, which may acquire rcu and/or bh read lock (depends on set type). BUG: sleeping function called from invalid context at net/netfilter/nf_tables_api.c:3353 in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1232, name: nft preempt_count: 0, expected: 0 RCU nest depth: 1, expected: 0 2 locks held by nft/1232: #0: ffff8881180e3ea8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid #1: ffffffff83f5f540 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire Call Trace: nft_chain_validate nft_lookup_validate_setelem nft_pipapo_walk nft_lookup_validate nft_chain_validate nft_immediate_validate nft_chain_validate nf_tables_validate nf_tables_abort No choice but to move it to nf_tables_validate(). Fixes: 81ea01066741 ("netfilter: nf_tables: add rescheduling points during loop detection walks") Signed-off-by: Florian Westphal commit ddbd8be68941985f166f5107109a90ce13147c44 Author: Florian Westphal Date: Thu Jul 20 00:29:58 2023 +0200 netfilter: nf_tables: fix spurious set element insertion failure On some platforms there is a padding hole in the nft_verdict structure, between the verdict code and the chain pointer. On element insertion, if the new element clashes with an existing one and NLM_F_EXCL flag isn't set, we want to ignore the -EEXIST error as long as the data associated with duplicated element is the same as the existing one. The data equality check uses memcmp. For normal data (NFT_DATA_VALUE) this works fine, but for NFT_DATA_VERDICT padding area leads to spurious failure even if the verdict data is the same. This then makes the insertion fail with 'already exists' error, even though the new "key : data" matches an existing entry and userspace told the kernel that it doesn't want to receive an error indication. Fixes: c016c7e45ddf ("netfilter: nf_tables: honor NLM_F_EXCL flag in set element insertion") Signed-off-by: Florian Westphal commit f8a2da6ec2417cca169fa85a8ab15817bccbb109 Author: Marc Kleine-Budde Date: Tue Jul 18 11:43:54 2023 +0200 can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED After an initial link up the CAN device is in ERROR-ACTIVE mode. Due to a missing CAN_STATE_STOPPED in gs_can_close() it doesn't change to STOPPED after a link down: | ip link set dev can0 up | ip link set dev can0 down | ip --details link show can0 | 13: can0: mtu 16 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 10 | link/can promiscuity 0 allmulti 0 minmtu 0 maxmtu 0 | can state ERROR-ACTIVE restart-ms 1000 Add missing assignment of CAN_STATE_STOPPED in gs_can_close(). Cc: stable@vger.kernel.org Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Link: https://lore.kernel.org/all/20230718-gs_usb-fix-can-state-v1-1-f19738ae2c23@pengutronix.de Signed-off-by: Marc Kleine-Budde commit de90f5165b1cda3f1b5975165e2da8a69dfae1d6 Author: Vitaly Rodionov Date: Thu Jul 20 09:20:22 2023 +0100 ALSA: hda/realtek: Add support for DELL Oasis 13/14/16 laptops Adding support for new Dell laptops using Cirrus Logic CS35L41 smart amplifiers with Realtek codec. Signed-off-by: Stefan Binding Signed-off-by: Vitaly Rodionov Link: https://lore.kernel.org/r/20230720082022.13033-2-vitalyr@opensource.cirrus.com Signed-off-by: Takashi Iwai commit f7b069cf08816252f494d193b9ecdff172bf9aa1 Author: Vitaly Rodionov Date: Thu Jul 20 09:20:21 2023 +0100 ALSA: hda/realtek: Fix generic fixup definition for cs35l41 amp Generic fixup for CS35L41 amplifies should not have vendor specific chained fixup. For ThinkPad laptops with led issue, we can just add specific fixup. Fixes: a6ac60b36dade (ALSA: hda/realtek: Fix mute led issue on thinkpad with cs35l41 s-codec) Signed-off-by: Vitaly Rodionov Link: https://lore.kernel.org/r/20230720082022.13033-1-vitalyr@opensource.cirrus.com Signed-off-by: Takashi Iwai commit ac528649f7c63bc233cc0d33cff11f767cc666e3 Merge: 9f9d4c1a2e821 7ebd00a5a20c4 Author: Paolo Abeni Date: Thu Jul 20 10:46:33 2023 +0200 Merge branch 'net-support-stp-on-bridge-in-non-root-netns' Kuniyuki Iwashima says: ==================== net: Support STP on bridge in non-root netns. Currently, STP does not work in non-root netns as llc_rcv() drops packets from non-root netns. This series fixes it by making some protocol handlers netns-aware, which are called from llc_rcv() as follows: llc_rcv() | |- sap->rcv_func : registered by llc_sap_open() | | * functions : regsitered by register_8022_client() | -> No in-kernel user call register_8022_client() | | * snap_rcv() | | | `- proto->rcvfunc() : registered by register_snap_client() | | * aarp_rcv() : drop packets from non-root netns | * atalk_rcv() : drop packets from non-root netns | | * stp_pdu_rcv() | | | `- garp_protos[]->rcv() : registered by stp_proto_register() | | * garp_pdu_rcv() : netns-aware | * br_stp_rcv() : netns-aware | |- llc_type_handlers[llc_pdu_type(skb) - 1] | | * llc_sap_handler() : NOT netns-aware (Patch 1) | * llc_conn_handler() : NOT netns-aware (Patch 2) | `- llc_station_handler * llc_station_rcv() : netns-aware Patch 1 & 2 convert not-netns-aware functions and Patch 3 remove the netns restriction in llc_rcv(). Note this series does not namespacify AF_LLC so that these patches can be backported to stable without conflicts (at least to 4.14.y). Another series that adds netns support for AF_LLC will be targeted to net-next later. ==================== Link: https://lore.kernel.org/r/20230718174152.57408-1-kuniyu@amazon.com Signed-off-by: Paolo Abeni commit 7ebd00a5a20c48e6020d49a3b2afb3cdfd2da8b7 Author: Kuniyuki Iwashima Date: Tue Jul 18 10:41:52 2023 -0700 Revert "bridge: Add extack warning when enabling STP in netns." This reverts commit 56a16035bb6effb37177867cea94c13a8382f745. Since the previous commit, STP works on bridge in netns. # unshare -n # ip link add br0 type bridge # ip link add veth0 type veth peer name veth1 # ip link set veth0 master br0 up [ 50.558135] br0: port 1(veth0) entered blocking state [ 50.558366] br0: port 1(veth0) entered disabled state [ 50.558798] veth0: entered allmulticast mode [ 50.564401] veth0: entered promiscuous mode # ip link set veth1 master br0 up [ 54.215487] br0: port 2(veth1) entered blocking state [ 54.215657] br0: port 2(veth1) entered disabled state [ 54.215848] veth1: entered allmulticast mode [ 54.219577] veth1: entered promiscuous mode # ip link set br0 type bridge stp_state 1 # ip link set br0 up [ 61.960726] br0: port 2(veth1) entered blocking state [ 61.961097] br0: port 2(veth1) entered listening state [ 61.961495] br0: port 1(veth0) entered blocking state [ 61.961653] br0: port 1(veth0) entered listening state [ 63.998835] br0: port 2(veth1) entered blocking state [ 77.437113] br0: port 1(veth0) entered learning state [ 86.653501] br0: received packet on veth0 with own address as source address (addr:6e:0f:e7:6f:5f:5f, vlan:0) [ 92.797095] br0: port 1(veth0) entered forwarding state [ 92.797398] br0: topology change detected, propagating Let's remove the warning. Signed-off-by: Kuniyuki Iwashima Signed-off-by: Paolo Abeni commit 6631463b6e6673916d2481f692938f393148aa82 Author: Kuniyuki Iwashima Date: Tue Jul 18 10:41:51 2023 -0700 llc: Don't drop packet from non-root netns. Now these upper layer protocol handlers can be called from llc_rcv() as sap->rcv_func(), which is registered by llc_sap_open(). * function which is passed to register_8022_client() -> no in-kernel user calls register_8022_client(). * snap_rcv() `- proto->rcvfunc() : registered by register_snap_client() -> aarp_rcv() and atalk_rcv() drop packets from non-root netns * stp_pdu_rcv() `- garp_protos[]->rcv() : registered by stp_proto_register() -> garp_pdu_rcv() and br_stp_rcv() are netns-aware So, we can safely remove the netns restriction in llc_rcv(). Fixes: e730c15519d0 ("[NET]: Make packet reception network namespace safe") Signed-off-by: Kuniyuki Iwashima Signed-off-by: Paolo Abeni commit 97b1d320f48c21e40cc42b4ac033f2520f9ecc5c Author: Kuniyuki Iwashima Date: Tue Jul 18 10:41:50 2023 -0700 llc: Check netns in llc_estab_match() and llc_listener_match(). We will remove this restriction in llc_rcv() in the following patch, which means that the protocol handler must be aware of netns. if (!net_eq(dev_net(dev), &init_net)) goto drop; llc_rcv() fetches llc_type_handlers[llc_pdu_type(skb) - 1] and calls it if not NULL. If the PDU type is LLC_DEST_CONN, llc_conn_handler() is called to pass skb to corresponding sockets. Then, we must look up a proper socket in the same netns with skb->dev. llc_conn_handler() calls __llc_lookup() to look up a established or litening socket by __llc_lookup_established() and llc_lookup_listener(). Both functions iterate on a list and call llc_estab_match() or llc_listener_match() to check if the socket is the correct destination. However, these functions do not check netns. Also, bind() and connect() call llc_establish_connection(), which finally calls __llc_lookup_established(), to check if there is a conflicting socket. Let's test netns in llc_estab_match() and llc_listener_match(). Signed-off-by: Kuniyuki Iwashima Signed-off-by: Paolo Abeni commit 9b64e93e83c2145a750e780198b41d612e3dfa5d Author: Kuniyuki Iwashima Date: Tue Jul 18 10:41:49 2023 -0700 llc: Check netns in llc_dgram_match(). We will remove this restriction in llc_rcv() soon, which means that the protocol handler must be aware of netns. if (!net_eq(dev_net(dev), &init_net)) goto drop; llc_rcv() fetches llc_type_handlers[llc_pdu_type(skb) - 1] and calls it if not NULL. If the PDU type is LLC_DEST_SAP, llc_sap_handler() is called to pass skb to corresponding sockets. Then, we must look up a proper socket in the same netns with skb->dev. If the destination is a multicast address, llc_sap_handler() calls llc_sap_mcast(). It calculates a hash based on DSAP and skb->dev->ifindex, iterates on a socket list, and calls llc_mcast_match() to check if the socket is the correct destination. Then, llc_mcast_match() checks if skb->dev matches with llc_sk(sk)->dev. So, we need not check netns here. OTOH, if the destination is a unicast address, llc_sap_handler() calls llc_lookup_dgram() to look up a socket, but it does not check the netns. Therefore, we need to add netns check in llc_lookup_dgram(). Signed-off-by: Kuniyuki Iwashima Signed-off-by: Paolo Abeni commit 4f7cab49cecee16120d27c1734cfdf3d6c0e5329 Author: Jerry Meng Date: Thu Jun 29 17:35:22 2023 +0800 USB: serial: option: support Quectel EM060K_128 EM060K_128 is EM060K's sub-model, having the same name "Quectel EM060K-GL" MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0128 Rev= 5.04 S: Manufacturer=Quectel S: Product=Quectel EM060K-GL S: SerialNumber=f6fa08b6 C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Jerry Meng Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit d8e42a2b0addf238be8b3b37dcd9795a5c1be459 Author: Sven Eckelmann Date: Wed Jul 19 10:01:15 2023 +0200 batman-adv: Don't increase MTU when set by user If the user set an MTU value, it usually means that there are special requirements for the MTU. But if an interface gots activated, the MTU was always recalculated and then the user set value was overwritten. The only reason why this user set value has to be overwritten, is when the MTU has to be decreased because batman-adv is not able to transfer packets with the user specified size. Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Cc: stable@vger.kernel.org Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit c6a953cce8d0438391e6da48c8d0793d3fbfcfa6 Author: Sven Eckelmann Date: Wed Jul 19 09:29:29 2023 +0200 batman-adv: Trigger events for auto adjusted MTU If an interface changes the MTU, it is expected that an NETDEV_PRECHANGEMTU and NETDEV_CHANGEMTU notification events is triggered. This worked fine for .ndo_change_mtu based changes because core networking code took care of it. But for auto-adjustments after hard-interfaces changes, these events were simply missing. Due to this problem, non-batman-adv components weren't aware of MTU changes and thus couldn't perform their own tasks correctly. Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Cc: stable@vger.kernel.org Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit e8812acb5bf724f2fc23a500e590c776ebda7b0a Author: Rob Herring Date: Tue Jul 18 08:32:26 2023 -0600 fbdev: Explicitly include correct DT includes The DT of_device.h and of_platform.h date back to the separate of_platform_bus_type before it as merged into the regular platform bus. As part of that merge prepping Arm DT support 13 years ago, they "temporarily" include each other. They also include platform_device.h and of.h. As a result, there's a pretty much random mix of those include files used throughout the tree. In order to detangle these headers and replace the implicit includes with struct declarations, users need to explicitly include the correct includes. Reviewed-by: Thomas Zimmermann Signed-off-by: Rob Herring Signed-off-by: Helge Deller commit 9d5651ad2ae7b2ddfc56ff243a08937d9681f950 Author: Yuanjun Gong Date: Mon Jul 17 22:48:09 2023 +0800 fbdev: ep93xx-fb: fix return value check in ep93xxfb_probe function clk_prepare_enable may fail in ep93xxfb_probe, therefore, add a return value check to clk_prepare_enable and handle the error. Signed-off-by: Yuanjun Gong Signed-off-by: Helge Deller commit 4e88761f5f8c7869f15a2046b1a1116f4fab4ac8 Author: Zhang Shurong Date: Sat Jul 15 16:16:56 2023 +0800 fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe This func misses checking for platform_get_irq()'s call and may passes the negative error codes to request_irq(), which takes unsigned IRQ #, causing it to fail with -EINVAL, overriding an original error code. Fix this by stop calling request_irq() with invalid IRQ #s. Fixes: 1630d85a8312 ("au1200fb: fix hardcoded IRQ") Signed-off-by: Zhang Shurong Signed-off-by: Helge Deller commit 298e082558d86aa904486d087ce45d35c1122f1e Author: Colin Ian King Date: Wed Jul 12 17:11:23 2023 +0100 fbdev: kyro: make some const read-only arrays static and reduce type size Don't populate the const read-only arrays on the stack but instead make them static const. Use smaller types to use less storage for the arrays. Also makes the object code a little smaller. Signed-off-by: Colin Ian King Signed-off-by: Helge Deller commit 933ab3a81cb73d08bc6b4eadeb3a98c9194abdf5 Author: Jiri Slaby (SUSE) Date: Wed Jul 12 10:59:42 2023 +0200 fbcon: remove unused display (p) from fbcon_redraw() The parameter is unused. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Daniel Vetter Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Helge Deller commit 4f2ba39a40480e6019133730f1741fdbb7137290 Author: Jiri Slaby (SUSE) Date: Wed Jul 12 10:59:41 2023 +0200 sticon: make sticon_set_def_font() void and remove op parameter sticon_set_def_font() always returns 0, so make it void. And remove an unused 'op' parameter. Signed-off-by: "Jiri Slaby (SUSE)" Cc: "James E.J. Bottomley" Cc: Helge Deller Cc: linux-parisc@vger.kernel.org Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Helge Deller commit 1023ca1973c6253f7ba9024b2b0c27168f50ab3d Author: Jiri Slaby (SUSE) Date: Wed Jul 12 10:59:40 2023 +0200 vgacon: cache vc_cell_height in vgacon_cursor() There are many places c->vc_cell_height is used in the code of vgacon_cursor(). Caching the value to a local variable makes the code much easier to follow. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Helge Deller commit 93686f6b01df3e904569ee7265ee181d859b201d Author: Jiri Slaby (SUSE) Date: Wed Jul 12 10:59:39 2023 +0200 vgacon: let vgacon_doresize() return void The return value is neither used, nor vgacon_doresize() returns an error. So change the reurn type to void. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Helge Deller commit c900dc6858e87e2f2396954377ae956925b17135 Author: Jiri Slaby (SUSE) Date: Wed Jul 12 10:59:38 2023 +0200 vgacon: remove unused xpos from vgacon_set_cursor_size() xpos is unused, remove it. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Helge Deller commit 6ceed69cde8fe4a78fe50d62d7a88a5c1eed4709 Author: Jiri Slaby (SUSE) Date: Wed Jul 12 10:59:37 2023 +0200 vgacon: remove unneeded forward declarations Most of the forward declarations in vgacon are not needed. Drop them. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Helge Deller commit 03b89a08484a88fb9e0604cab2b3eb0c2f265c74 Author: Jiri Slaby (SUSE) Date: Wed Jul 12 10:59:36 2023 +0200 vgacon: switch vgacon_scrolldelta() and vgacon_restore_screen() Switch vgacon_scrolldelta() and vgacon_restore_screen() positions, so that the former is not needed to be forward-declared. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Signed-off-by: Helge Deller commit 9f9d4c1a2e82174a4e799ec405284a2b0de32b6a Author: Daniel Golle Date: Wed Jul 19 01:39:36 2023 +0100 net: ethernet: mtk_eth_soc: always mtk_get_ib1_pkt_type entries and bind debugfs files would display wrong data on NETSYS_V2 and later because instead of using mtk_get_ib1_pkt_type the driver would use MTK_FOE_IB1_PACKET_TYPE which corresponds to NETSYS_V1(.x) SoCs. Use mtk_get_ib1_pkt_type so entries and bind records display correctly. Fixes: 03a3180e5c09e ("net: ethernet: mtk_eth_soc: introduce flow offloading support for mt7986") Signed-off-by: Daniel Golle Acked-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/c0ae03d0182f4d27b874cbdf0059bc972c317f3c.1689727134.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 88f2e009761d120eea31e71dafd73b8433b0e379 Merge: 81b3ade5d2b98 e31a9fedc7d8d Author: Jakub Kicinski Date: Wed Jul 19 21:09:14 2023 -0700 Merge branch 'r8169-revert-two-changes-that-caused-regressions' Heiner Kallweit says: ==================== r8169: revert two changes that caused regressions This reverts two changes that caused regressions. ==================== Link: https://lore.kernel.org/r/ddadceae-19c9-81b8-47b5-a4ff85e2563a@gmail.com Signed-off-by: Jakub Kicinski commit e31a9fedc7d8d80722b19628e66fcb5a36981780 Author: Heiner Kallweit Date: Tue Jul 18 13:12:32 2023 +0200 Revert "r8169: disable ASPM during NAPI poll" This reverts commit e1ed3e4d91112027b90c7ee61479141b3f948e6a. Turned out the change causes a performance regression. Link: https://lore.kernel.org/netdev/20230713124914.GA12924@green245/T/ Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/055c6bc2-74fa-8c67-9897-3f658abb5ae7@gmail.com Signed-off-by: Jakub Kicinski commit cf2ffdea0839398cb0551762af7f5efb0a6e0fea Author: Heiner Kallweit Date: Tue Jul 18 13:11:31 2023 +0200 r8169: revert 2ab19de62d67 ("r8169: remove ASPM restrictions now that ASPM is disabled during NAPI poll") There have been reports that on a number of systems this change breaks network connectivity. Therefore effectively revert it. Mainly affected seem to be systems where BIOS denies ASPM access to OS. Due to later changes we can't do a direct revert. Fixes: 2ab19de62d67 ("r8169: remove ASPM restrictions now that ASPM is disabled during NAPI poll") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/netdev/e47bac0d-e802-65e1-b311-6acb26d5cf10@freenet.de/T/ Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217596 Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/57f13ec0-b216-d5d8-363d-5b05528ec5fb@gmail.com Signed-off-by: Jakub Kicinski commit 81b3ade5d2b98ad6e0a473b0e1e420a801275592 Author: Kuniyuki Iwashima Date: Mon Jul 17 14:59:18 2023 -0700 Revert "tcp: avoid the lookup process failing to get sk in ehash table" This reverts commit 3f4ca5fafc08881d7a57daa20449d171f2887043. Commit 3f4ca5fafc08 ("tcp: avoid the lookup process failing to get sk in ehash table") reversed the order in how a socket is inserted into ehash to fix an issue that ehash-lookup could fail when reqsk/full sk/twsk are swapped. However, it introduced another lookup failure. The full socket in ehash is allocated from a slab with SLAB_TYPESAFE_BY_RCU and does not have SOCK_RCU_FREE, so the socket could be reused even while it is being referenced on another CPU doing RCU lookup. Let's say a socket is reused and inserted into the same hash bucket during lookup. After the blamed commit, a new socket is inserted at the end of the list. If that happens, we will skip sockets placed after the previous position of the reused socket, resulting in ehash lookup failure. As described in Documentation/RCU/rculist_nulls.rst, we should insert a new socket at the head of the list to avoid such an issue. This issue, the swap-lookup-failure, and another variant reported in [0] can all be handled properly by adding a locked ehash lookup suggested by Eric Dumazet [1]. However, this issue could occur for every packet, thus more likely than the other two races, so let's revert the change for now. Link: https://lore.kernel.org/netdev/20230606064306.9192-1-duanmuquan@baidu.com/ [0] Link: https://lore.kernel.org/netdev/CANn89iK8snOz8TYOhhwfimC7ykYA78GA3Nyv8x06SZYa1nKdyA@mail.gmail.com/ [1] Fixes: 3f4ca5fafc08 ("tcp: avoid the lookup process failing to get sk in ehash table") Signed-off-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230717215918.15723-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit 80b6051085c5fedcb1dfd7b2562a63a83655c4d8 Author: Yu Kuai Date: Wed Jul 5 10:40:01 2023 +0800 scsi: sg: Fix checking return value of blk_get_queue() Commit fcaa174a9c99 ("scsi/sg: don't grab scsi host module reference") make a mess how blk_get_queue() is called, blk_get_queue() returns true on success while the caller expects it returns 0 on success. Fix this problem and also add a corresponding error message on failure. Fixes: fcaa174a9c99 ("scsi/sg: don't grab scsi host module reference") Reported-by: Marc Hartmayer Closes: https://lore.kernel.org/all/87lefv622n.fsf@linux.ibm.com/ Signed-off-by: Yu Kuai Link: https://lore.kernel.org/r/20230705024001.177585-1-yukuai1@huaweicloud.com Tested-by: Shin'ichiro Kawasaki Tested-by: Marc Hartmayer Reviewed-by: Christoph Hellwig Reviewed-by: Marc Hartmayer Signed-off-by: Martin K. Petersen commit 8974eb588283b7d44a7c91fa09fcbaf380339f3a Author: Daniel Sneddon Date: Wed Jul 12 19:43:11 2023 -0700 x86/speculation: Add Gather Data Sampling mitigation Gather Data Sampling (GDS) is a hardware vulnerability which allows unprivileged speculative access to data which was previously stored in vector registers. Intel processors that support AVX2 and AVX512 have gather instructions that fetch non-contiguous data elements from memory. On vulnerable hardware, when a gather instruction is transiently executed and encounters a fault, stale data from architectural or internal vector registers may get transiently stored to the destination vector register allowing an attacker to infer the stale data using typical side channel techniques like cache timing attacks. This mitigation is different from many earlier ones for two reasons. First, it is enabled by default and a bit must be set to *DISABLE* it. This is the opposite of normal mitigation polarity. This means GDS can be mitigated simply by updating microcode and leaving the new control bit alone. Second, GDS has a "lock" bit. This lock bit is there because the mitigation affects the hardware security features KeyLocker and SGX. It needs to be enabled and *STAY* enabled for these features to be mitigated against GDS. The mitigation is enabled in the microcode by default. Disable it by setting gather_data_sampling=off or by disabling all mitigations with mitigations=off. The mitigation status can be checked by reading: /sys/devices/system/cpu/vulnerabilities/gather_data_sampling Signed-off-by: Daniel Sneddon Signed-off-by: Dave Hansen Acked-by: Josh Poimboeuf commit e80698b7f8e9ddc3b23e5fba2eea7bc24c06c537 Merge: aa7cb3789b429 a3f25d614bc73 Author: Jakub Kicinski Date: Wed Jul 19 15:01:10 2023 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2023-07-19 We've added 4 non-merge commits during the last 1 day(s) which contain a total of 3 files changed, 55 insertions(+), 10 deletions(-). The main changes are: 1) Fix stack depth check in presence of async callbacks, from Kumar Kartikeya Dwivedi. 2) Fix BTI type used for freplace attached functions, from Alexander Duyck. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf, arm64: Fix BTI type used for freplace attached functions selftests/bpf: Add more tests for check_max_stack_depth bug bpf: Repeat check_max_stack_depth for async callbacks bpf: Fix subprog idx logic in check_max_stack_depth ==================== Link: https://lore.kernel.org/r/20230719174502.74023-1-alexei.starovoitov@gmail.com Signed-off-by: Jakub Kicinski commit e7dd44f4f3166db45248414f5df8f615392de47a Author: Baoquan He Date: Fri Jul 7 21:58:51 2023 +0800 clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM On s390 systems (aka mainframes), it has classic channel devices for networking and permanent storage that are currently even more common than PCI devices. Hence it could have a fully functional s390 kernel with CONFIG_PCI=n, then the relevant iomem mapping functions [including ioremap(), devm_ioremap(), etc.] are not available. Here let COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM so that it won't be built to cause below compiling error if PCI is unset: ------ ld: drivers/clk/clk-fixed-mmio.o: in function `fixed_mmio_clk_setup': clk-fixed-mmio.c:(.text+0x5e): undefined reference to `of_iomap' ld: clk-fixed-mmio.c:(.text+0xba): undefined reference to `iounmap' ------ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306211329.ticOJCSv-lkp@intel.com/ Signed-off-by: Baoquan He Cc: Michael Turquette Cc: Stephen Boyd Cc: linux-clk@vger.kernel.org Link: https://lore.kernel.org/r/20230707135852.24292-8-bhe@redhat.com Signed-off-by: Stephen Boyd commit a29b2fccf5f2689a9637be85ff1f51c834c6fb33 Author: Geert Uytterhoeven Date: Tue Jul 11 17:08:12 2023 +0200 clk: imx93: Propagate correct error in imx93_clocks_probe() smatch reports: drivers/clk/imx/clk-imx93.c:294 imx93_clocks_probe() error: uninitialized symbol 'base'. Indeed, in case of an error, the wrong (yet uninitialized) variable is converted to an error code and returned. Fix this by propagating the error code in the correct variable. Fixes: e02ba11b45764705 ("clk: imx93: fix memory leak and missing unwind goto in imx93_clocks_probe") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/9c2acd81-3ad8-485d-819e-9e4201277831@kadam.mountain Reported-by: kernel test robot Closes: https://lore.kernel.org/all/202306161533.4YDmL22b-lkp@intel.com/ Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230711150812.3562221-1-geert+renesas@glider.be Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit 13558a2e6341d1ba6dff9f8e2febf97877067885 Author: Ahmad Khalifa Date: Wed Jul 19 20:28:48 2023 +0100 hwmon: (nct6775) Fix IN scaling factors for 6798/6799 Scaling for VTT/VIN5/VIN6 registers were based on prior chips * Split scaling factors for 6798/6799 and assign at probe() * Pass them through driver data to sysfs functions Tested on nct6799 with old/new input/min/max Fixes: 0599682b826f ("hwmon: (nct6775) Add support for NCT6798D") Signed-off-by: Ahmad Khalifa Link: https://lore.kernel.org/r/20230719192848.337508-1-ahmad@khalifa.ws Signed-off-by: Guenter Roeck commit 1eb8d61ac5c9c7ec56bb96d433532807509b9288 Author: Chen-Yu Tsai Date: Wed Jul 19 15:42:50 2023 +0800 clk: mediatek: mt8183: Add back SSPM related clocks This reverts commit 860690a93ef23b567f781c1b631623e27190f101. On the MT8183, the SSPM related clocks were removed claiming a lack of usage. This however causes some issues when the driver was converted to the new simple-probe mechanism. This mechanism allocates enough space for all the clocks defined in the clock driver, not the highest index in the DT binding. This leads to out-of-bound writes if their are holes in the DT binding or the driver (due to deprecated or unimplemented clocks). These errors can go unnoticed and cause memory corruption, leading to crashes in unrelated areas, or nothing at all. KASAN will detect them. Add the SSPM related clocks back to the MT8183 clock driver to fully implement the DT binding. The SSPM clocks are for the power management co-processor, and should never be turned off. They are marked as such. Fixes: 3f37ba7cc385 ("clk: mediatek: mt8183: Convert all remaining clocks to common probe") Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20230719074251.1219089-1-wenst@chromium.org Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Stephen Boyd commit 5534f44627418897cd901d725303ce3dedd7bc1e Author: Rafael J. Wysocki Date: Wed Jul 19 20:10:03 2023 +0200 Revert "intel_idle: Add support for using intel_idle in a VM guest using just hlt" This reverts commit 2f3d08f074b0 ("intel_idle: Add support for using intel_idle in a VM guest using just hlt"), because it causes functional issues to appear and it is not really useful without a related commit that got reverted previously. Link: https://lore.kernel.org/linux-pm/5c7de6d5-7706-c4a5-7c41-146db1269aff@intel.com Reported-by: Xiaoyao Li Requested-by: Peter Zijlstra Signed-off-by: Rafael J. Wysocki commit 0e4c2b6b0c4a4b4014d9424c27e5e79d185229c5 Author: Matus Gajdos Date: Wed Jul 19 18:47:29 2023 +0200 ASoC: fsl_spdif: Silence output on stop Clear TX registers on stop to prevent the SPDIF interface from sending last written word over and over again. Fixes: a2388a498ad2 ("ASoC: fsl: Add S/PDIF CPU DAI driver") Signed-off-by: Matus Gajdos Reviewed-by: Fabio Estevam Link: https://lore.kernel.org/r/20230719164729.19969-1-matuszpd@gmail.com Signed-off-by: Mark Brown commit a5155c023d6a2c9ff5f4fad5f75117578a58affc Author: Rafael J. Wysocki Date: Wed Jul 19 19:57:39 2023 +0200 Revert "intel_idle: Add a "Long HLT" C1 state for the VM guest mode" This reverts commit 0fac214bb75e ("intel_idle: Add a "Long HLT" C1 state for the VM guest mode"), because there is a coding mistake in it and its validity is questioned. Link: https://lore.kernel.org/all/20230711132553.GN3062772@hirez.programming.kicks-ass.net Requested-by: Peter Zijlstra Signed-off-by: Rafael J. Wysocki commit bfa3037d828050896ae52f6467b6ca2489ae6fb1 Merge: ccff6d117d8dc 6a567e920fd04 Author: Linus Torvalds Date: Wed Jul 19 11:00:27 2023 -0700 Merge tag 'fuse-update-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse fixes from Miklos Szeredi: "Small but important fixes and a trivial cleanup" * tag 'fuse-update-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: ioctl: translate ENOSYS in outarg fuse: revalidate: don't invalidate if interrupted fuse: Apply flags2 only when userspace set the FUSE_INIT_EXT fuse: remove duplicate check for nodeid fuse: add feature flag for expire-only commit d46b0a05bdc849d39c75268ddaf654c59bd6785c Author: Rafael J. Wysocki Date: Wed Jul 19 19:56:08 2023 +0200 Revert "intel_idle: Add __init annotation to matchup_vm_state_with_baremetal()" This reverts commit b2918089d5cb ("intel_idle: Add __init annotation to matchup_vm_state_with_baremetal()"), because the commit fixed by it will be reverted. Signed-off-by: Rafael J. Wysocki commit da042eb4f061a0b54aedadcaa15391490c48e1ad Author: Krzysztof Kozlowski Date: Wed Jul 19 08:16:52 2023 +0200 firmware: arm_scmi: Drop OF node reference in the transport channel setup The OF node reference obtained from of_parse_phandle() should be dropped if node is not compatible with arm,scmi-shmem. Fixes: 507cd4d2c5eb ("firmware: arm_scmi: Add compatibility checks for shmem node") Cc: Signed-off-by: Krzysztof Kozlowski Reviewed-by: Cristian Marussi Link: https://lore.kernel.org/r/20230719061652.8850-1-krzysztof.kozlowski@linaro.org Signed-off-by: Sudeep Holla commit 84f68679032147dcdac9bb4d8eb8f4638e995dc6 Author: Oliver Upton Date: Tue Jul 18 18:45:37 2023 +0000 KVM: arm64: Allow pKVM on v1.0 compatible FF-A implementations pKVM initialization fails on systems with v1.1+ FF-A implementations, as the hyp does a strict match on the returned version from FFA_VERSION. This is a stronger assertion than required by the specification, which requires minor revisions be backwards compatible with earlier revisions of the same major version. Relax the check in hyp_ffa_init() to only test the returned major version. Even though v1.1 broke ABI, the expectation is that firmware incapable of using the v1.0 ABI return NOT_SUPPORTED instead of a valid version. Acked-by: Marc Zyngier Acked-by: Will Deacon Link: https://lore.kernel.org/r/20230718184537.3220867-1-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 0659400f18c0e6c0c69d74fe5d09e7f6fbbd52a2 Author: Luka Guzenko Date: Tue Jul 18 18:12:41 2023 +0200 ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx The HP Laptop 15s-eq2xxx uses ALC236 codec and controls the mute LED using COEF 0x07 index 1. No existing quirk covers this configuration. Adds a new quirk and enables it for the device. Signed-off-by: Luka Guzenko Cc: Link: https://lore.kernel.org/r/20230718161241.393181-1-l.guzenko@web.de Signed-off-by: Takashi Iwai commit a2a93f4e2fd400907f89753025d1e4bebb64d4db Author: Takashi Iwai Date: Wed Jul 19 13:43:36 2023 +0200 selftests: ALSA: Add test-pcmtest-driver to .gitignore It was forgotten to add the new binary to .gitignore. Let's fix it. Fixes: 10b98a4db11a ("selftests: ALSA: Add test for the 'pcmtest' driver") Link: https://lore.kernel.org/r/20230719114336.18409-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit b460a52257b1f5299ca70b7d1bb32442d3ce7bf6 Author: Mark Brown Date: Wed Jul 19 00:30:40 2023 +0100 regcache: Push async I/O request down into the rbtree cache Currently the regcache core unconditionally enables async I/O for all cache types, causing problems for the maple tree cache which dynamically allocates the buffers used to write registers to the device since async requires the buffers to be kept around until the I/O has been completed. This use of async I/O is mainly for the rbtree cache which stores data in a format directly usable for regmap_raw_write(), though there is a special case for single register writes which would also have allowed it to be used with the flat cache. It is a bit of a landmine for other caches since it implicitly converts sync operations to async, and with modern hardware it is not clear that async I/O is actually a performance win as shown by the performance work David Jander did with SPI. In multi core systems the cost of managing concurrency ends up swamping the performance benefit and almost all modern systems are multi core. Address this by pushing the enablement of async I/O down into the rbtree cache where it is actively used, avoiding surprises for other cache implementations. Reported-by: Charles Keepax Fixes: bfa0b38c1483 ("regmap: maple: Implement block sync for the maple tree cache") Reviewed-by: Charles Keepax Tested-by: Charles Keepax Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230719-regcache-async-rbtree-v1-1-b03d30cf1daf@kernel.org Signed-off-by: Mark Brown commit 1945063eb59e64d2919cb14d54d081476d9e53bb Author: Uwe Kleine-König Date: Mon Jul 17 16:27:43 2023 +0200 gpio: mvebu: Make use of devm_pwmchip_add This allows to get rid of a call to pwmchip_remove() in the error path. There is no .remove function for this driver, so this change fixes a resource leak when a gpio-mvebu device is unbound. Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support") Signed-off-by: Uwe Kleine-König Reviewed-by: Andy Shevchenko Signed-off-by: Bartosz Golaszewski commit 106ea7ffd56b0f9454cd4f625474967f12ac4dbd Author: Andrew Donnellan Date: Wed Jul 19 17:18:21 2023 +1000 Revert "powerpc/64s: Remove support for ELFv1 little endian userspace" This reverts commit 606787fed7268feb256957872586370b56af697a. ELFv1 with LE has never been a thing, and people who try to make ELFv1 LE binaries are maniacs who need to be stopped, but unfortunately there are ELFv1 LE binaries out there in the wild. One such binary is the ppc64el (as Debian calls it) helper for arch-test[0], a tool for detecting architectures that can be executed on a given machine by means of attempting to execute helper binaries compiled for each architecture and seeing which binaries succeed and fail. The helpers are small snippets of assembly, and the ppc64el assembly doesn't include the right directives to generate an ELFv2 binary. This results in arch-test incorrectly determining that a ppc64el kernel can't execute a ppc64el userspace, which in turn means that a number of developer tools such as debootstrap will break (assuming arch-test is installed). [0] https://github.com/kilobyte/arch-test Signed-off-by: Andrew Donnellan Signed-off-by: Michael Ellerman Link: https://msgid.link/20230719071821.320594-1-ajd@linux.ibm.com commit aa7cb3789b429d4fdfbe767e0e0cf8c769299d7a Author: Yuanjun Gong Date: Mon Jul 17 22:49:18 2023 +0800 ipv4: ip_gre: fix return value check in erspan_xmit() goto free_skb if an unexpected result is returned by pskb_tirm() in erspan_xmit(). Signed-off-by: Yuanjun Gong Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 02d84f3eb53a5be982b17c88410fa6c58806356b Author: Yuanjun Gong Date: Mon Jul 17 22:49:02 2023 +0800 ipv4: ip_gre: fix return value check in erspan_fb_xmit() goto err_free_skb if an unexpected result is returned by pskb_tirm() in erspan_fb_xmit(). Signed-off-by: Yuanjun Gong Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit bce5603365d8184734ba7e6b22e74bd2c90a7167 Author: Yuanjun Gong Date: Mon Jul 17 22:46:52 2023 +0800 drivers:net: fix return value check in ocelot_fdma_receive_skb ocelot_fdma_receive_skb should return false if an unexpected value is returned by pskb_trim. Signed-off-by: Yuanjun Gong Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 78a93c31003cc53aca5d67b1bbe2d5b9fc37cc4d Author: Yuanjun Gong Date: Mon Jul 17 22:46:21 2023 +0800 drivers: net: fix return value check in emac_tso_csum() in emac_tso_csum(), return an error code if an unexpected value is returned by pskb_trim(). Signed-off-by: Yuanjun Gong Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 4258faa130be4ea43e5e2d839467da421b8ff274 Author: Yuanjun Gong Date: Mon Jul 17 22:45:19 2023 +0800 net:ipv6: check return value of pskb_trim() goto tx_err if an unexpected result is returned by pskb_tirm() in ip6erspan_tunnel_xmit(). Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support") Signed-off-by: Yuanjun Gong Reviewed-by: David Ahern Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit 5a7adc6c1069ce31ef4f606ae9c05592c80a6ab5 Author: Hans de Goede Date: Mon Jul 10 14:34:25 2023 +0200 gpio: tps68470: Make tps68470_gpio_output() always set the initial value Make tps68470_gpio_output() call tps68470_gpio_set() for output-only pins too, so that the initial value passed to gpiod_direction_output() is honored for these pins too. Fixes: 275b13a65547 ("gpio: Add support for TPS68470 GPIOs") Reviewed-by: Andy Shevchenko Reviewed-by: Daniel Scally Tested-by: Daniel Scally Reviewed-by: Sakari Ailus Signed-off-by: Hans de Goede Signed-off-by: Bartosz Golaszewski commit daa751444fd9d4184270b1479d8af49aaf1a1ee6 Author: Wang Ming Date: Mon Jul 17 17:59:19 2023 +0800 net: ipv4: Use kfree_sensitive instead of kfree key might contain private part of the key, so better use kfree_sensitive to free it. Fixes: 38320c70d282 ("[IPSEC]: Use crypto_aead and authenc in ESP") Signed-off-by: Wang Ming Reviewed-by: Tariq Toukan Reviewed-by: Kuniyuki Iwashima Signed-off-by: David S. Miller commit ea293f823a8805735d9e00124df81a8f448ed1ae Author: Ben Skeggs Date: Wed Jul 19 14:40:51 2023 +1000 drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP Fixes OOPS on boards with ANX9805 DP encoders. Cc: stable@vger.kernel.org # 6.4+ Signed-off-by: Ben Skeggs Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20230719044051.6975-3-skeggsb@gmail.com commit 2b5d1c29f6c4cb19369ef92881465e5ede75f4ef Author: Ben Skeggs Date: Wed Jul 19 14:40:50 2023 +1000 drm/nouveau/disp: PIOR DP uses GPIO for HPD, not PMGR AUX interrupts Fixes crash on boards with ANX9805 TMDS/DP encoders. Cc: stable@vger.kernel.org # 6.4+ Signed-off-by: Ben Skeggs Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20230719044051.6975-2-skeggsb@gmail.com commit 752a281032b2d6f4564be827e082bde6f7d2fd4f Author: Ben Skeggs Date: Wed Jul 19 14:40:49 2023 +1000 drm/nouveau/i2c: fix number of aux event slots This was completely bogus before, using maximum DCB device index rather than maximum AUX ID to size the buffer that stores event refcounts. *Pretty* unlikely to have been an actual problem on most configurations, that is, unless you've got one of the rare boards that have off-chip DP. There, it'll likely crash. Cc: stable@vger.kernel.org # 6.4+ Signed-off-by: Ben Skeggs Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20230719044051.6975-1-skeggsb@gmail.com commit 53cab4d871690c49fac87c657cbf459e39c5b93b Author: Lucas Stach Date: Mon Jul 17 16:54:09 2023 +0200 soc: imx: imx8mp-blk-ctrl: register HSIO PLL clock as bus_power_dev child The blk-ctrl device is deliberately placed outside of the GPC power domain as it needs to control the power sequencing of the blk-ctrl domains together with the GPC domains. Clock runtime PM works by operating on the clock parent device, which doesn't translate into the neccessary GPC power domain action if the clk parent is not part of the GPC power domain. Use the bus_power_device as the parent for the clock to trigger the proper GPC domain actions on clock runtime power management. Fixes: 2cbee26e5d59 ("soc: imx: imx8mp-blk-ctrl: expose high performance PLL clock") Reported-by: Yannic Moog Signed-off-by: Lucas Stach Tested-by: Yannic Moog Signed-off-by: Shawn Guo commit 7f5acea727e7a41ed40ed07d45e88ccdb01a87f5 Merge: e9b2bd96af6fc c34743daca0eb Author: Jakub Kicinski Date: Tue Jul 18 19:49:08 2023 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-07-17 (iavf) This series contains updates to iavf driver only. Ding Hui fixes use-after-free issue by calling netif_napi_del() for all allocated q_vectors. He also resolves out-of-bounds issue by not updating to new values when timeout is encountered. Marcin and Ahmed change the way resets are handled so that the callback operating under the RTNL lock will wait for the reset to finish, the rtnl_lock sensitive functions in reset flow will schedule the netdev update for later in order to remove circular dependency with the critical lock. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: iavf: fix reset task race with iavf_remove() iavf: fix a deadlock caused by rtnl and driver's lock circular dependencies Revert "iavf: Do not restart Tx queues after reset task failure" Revert "iavf: Detach device during reset task" iavf: Wait for reset in callbacks which trigger it iavf: use internal state to free traffic IRQs iavf: Fix out-of-bounds when setting channels on remove iavf: Fix use-after-free in free_netdev ==================== Link: https://lore.kernel.org/r/20230717175205.3217774-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit e9b2bd96af6fc35a81e37bbc2f3277d3677e6126 Merge: e7002b3b20c58 eba20811f3265 Author: Jakub Kicinski Date: Tue Jul 18 19:45:29 2023 -0700 Merge branch 'tcp-annotate-data-races-in-tcp_rsk-req' Eric Dumazet says: ==================== tcp: annotate data-races in tcp_rsk(req) Small series addressing two syzbot reports around tcp_rsk(req) ==================== Link: https://lore.kernel.org/r/20230717144445.653164-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit eba20811f32652bc1a52d5e7cc403859b86390d9 Author: Eric Dumazet Date: Mon Jul 17 14:44:45 2023 +0000 tcp: annotate data-races around tcp_rsk(req)->ts_recent TCP request sockets are lockless, tcp_rsk(req)->ts_recent can change while being read by another cpu as syzbot noticed. This is harmless, but we should annotate the known races. Note that tcp_check_req() changes req->ts_recent a bit early, we might change this in the future. BUG: KCSAN: data-race in tcp_check_req / tcp_check_req write to 0xffff88813c8afb84 of 4 bytes by interrupt on cpu 1: tcp_check_req+0x694/0xc70 net/ipv4/tcp_minisocks.c:762 tcp_v4_rcv+0x12db/0x1b70 net/ipv4/tcp_ipv4.c:2071 ip_protocol_deliver_rcu+0x356/0x6d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x13c/0x1a0 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:303 [inline] ip_local_deliver+0xec/0x1c0 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:468 [inline] ip_rcv_finish net/ipv4/ip_input.c:449 [inline] NF_HOOK include/linux/netfilter.h:303 [inline] ip_rcv+0x197/0x270 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5493 [inline] __netif_receive_skb+0x90/0x1b0 net/core/dev.c:5607 process_backlog+0x21f/0x380 net/core/dev.c:5935 __napi_poll+0x60/0x3b0 net/core/dev.c:6498 napi_poll net/core/dev.c:6565 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6698 __do_softirq+0xc1/0x265 kernel/softirq.c:571 do_softirq+0x7e/0xb0 kernel/softirq.c:472 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:396 local_bh_enable+0x1f/0x20 include/linux/bottom_half.h:33 rcu_read_unlock_bh include/linux/rcupdate.h:843 [inline] __dev_queue_xmit+0xabb/0x1d10 net/core/dev.c:4271 dev_queue_xmit include/linux/netdevice.h:3088 [inline] neigh_hh_output include/net/neighbour.h:528 [inline] neigh_output include/net/neighbour.h:542 [inline] ip_finish_output2+0x700/0x840 net/ipv4/ip_output.c:229 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:317 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:431 dst_output include/net/dst.h:458 [inline] ip_local_out net/ipv4/ip_output.c:126 [inline] __ip_queue_xmit+0xa4d/0xa70 net/ipv4/ip_output.c:533 ip_queue_xmit+0x38/0x40 net/ipv4/ip_output.c:547 __tcp_transmit_skb+0x1194/0x16e0 net/ipv4/tcp_output.c:1399 tcp_transmit_skb net/ipv4/tcp_output.c:1417 [inline] tcp_write_xmit+0x13ff/0x2fd0 net/ipv4/tcp_output.c:2693 __tcp_push_pending_frames+0x6a/0x1a0 net/ipv4/tcp_output.c:2877 tcp_push_pending_frames include/net/tcp.h:1952 [inline] __tcp_sock_set_cork net/ipv4/tcp.c:3336 [inline] tcp_sock_set_cork+0xe8/0x100 net/ipv4/tcp.c:3343 rds_tcp_xmit_path_complete+0x3b/0x40 net/rds/tcp_send.c:52 rds_send_xmit+0xf8d/0x1420 net/rds/send.c:422 rds_send_worker+0x42/0x1d0 net/rds/threads.c:200 process_one_work+0x3e6/0x750 kernel/workqueue.c:2408 worker_thread+0x5f2/0xa10 kernel/workqueue.c:2555 kthread+0x1d7/0x210 kernel/kthread.c:379 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 read to 0xffff88813c8afb84 of 4 bytes by interrupt on cpu 0: tcp_check_req+0x32a/0xc70 net/ipv4/tcp_minisocks.c:622 tcp_v4_rcv+0x12db/0x1b70 net/ipv4/tcp_ipv4.c:2071 ip_protocol_deliver_rcu+0x356/0x6d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x13c/0x1a0 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:303 [inline] ip_local_deliver+0xec/0x1c0 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:468 [inline] ip_rcv_finish net/ipv4/ip_input.c:449 [inline] NF_HOOK include/linux/netfilter.h:303 [inline] ip_rcv+0x197/0x270 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5493 [inline] __netif_receive_skb+0x90/0x1b0 net/core/dev.c:5607 process_backlog+0x21f/0x380 net/core/dev.c:5935 __napi_poll+0x60/0x3b0 net/core/dev.c:6498 napi_poll net/core/dev.c:6565 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6698 __do_softirq+0xc1/0x265 kernel/softirq.c:571 run_ksoftirqd+0x17/0x20 kernel/softirq.c:939 smpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164 kthread+0x1d7/0x210 kernel/kthread.c:379 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 value changed: 0x1cd237f1 -> 0x1cd237f2 Fixes: 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table") Signed-off-by: Eric Dumazet Reported-by: syzbot Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230717144445.653164-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 5e5265522a9a7f91d1b0bd411d634bdaf16c80cd Author: Eric Dumazet Date: Mon Jul 17 14:44:44 2023 +0000 tcp: annotate data-races around tcp_rsk(req)->txhash TCP request sockets are lockless, some of their fields can change while being read by another cpu as syzbot noticed. This is usually harmless, but we should annotate the known races. This patch takes care of tcp_rsk(req)->txhash, a separate one is needed for tcp_rsk(req)->ts_recent. BUG: KCSAN: data-race in tcp_make_synack / tcp_rtx_synack write to 0xffff8881362304bc of 4 bytes by task 32083 on cpu 1: tcp_rtx_synack+0x9d/0x2a0 net/ipv4/tcp_output.c:4213 inet_rtx_syn_ack+0x38/0x80 net/ipv4/inet_connection_sock.c:880 tcp_check_req+0x379/0xc70 net/ipv4/tcp_minisocks.c:665 tcp_v6_rcv+0x125b/0x1b20 net/ipv6/tcp_ipv6.c:1673 ip6_protocol_deliver_rcu+0x92f/0xf30 net/ipv6/ip6_input.c:437 ip6_input_finish net/ipv6/ip6_input.c:482 [inline] NF_HOOK include/linux/netfilter.h:303 [inline] ip6_input+0xbd/0x1b0 net/ipv6/ip6_input.c:491 dst_input include/net/dst.h:468 [inline] ip6_rcv_finish+0x1e2/0x2e0 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:303 [inline] ipv6_rcv+0x74/0x150 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core net/core/dev.c:5452 [inline] __netif_receive_skb+0x90/0x1b0 net/core/dev.c:5566 netif_receive_skb_internal net/core/dev.c:5652 [inline] netif_receive_skb+0x4a/0x310 net/core/dev.c:5711 tun_rx_batched+0x3bf/0x400 tun_get_user+0x1d24/0x22b0 drivers/net/tun.c:1997 tun_chr_write_iter+0x18e/0x240 drivers/net/tun.c:2043 call_write_iter include/linux/fs.h:1871 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x4ab/0x7d0 fs/read_write.c:584 ksys_write+0xeb/0x1a0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x42/0x50 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff8881362304bc of 4 bytes by task 32078 on cpu 0: tcp_make_synack+0x367/0xb40 net/ipv4/tcp_output.c:3663 tcp_v6_send_synack+0x72/0x420 net/ipv6/tcp_ipv6.c:544 tcp_conn_request+0x11a8/0x1560 net/ipv4/tcp_input.c:7059 tcp_v6_conn_request+0x13f/0x180 net/ipv6/tcp_ipv6.c:1175 tcp_rcv_state_process+0x156/0x1de0 net/ipv4/tcp_input.c:6494 tcp_v6_do_rcv+0x98a/0xb70 net/ipv6/tcp_ipv6.c:1509 tcp_v6_rcv+0x17b8/0x1b20 net/ipv6/tcp_ipv6.c:1735 ip6_protocol_deliver_rcu+0x92f/0xf30 net/ipv6/ip6_input.c:437 ip6_input_finish net/ipv6/ip6_input.c:482 [inline] NF_HOOK include/linux/netfilter.h:303 [inline] ip6_input+0xbd/0x1b0 net/ipv6/ip6_input.c:491 dst_input include/net/dst.h:468 [inline] ip6_rcv_finish+0x1e2/0x2e0 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:303 [inline] ipv6_rcv+0x74/0x150 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core net/core/dev.c:5452 [inline] __netif_receive_skb+0x90/0x1b0 net/core/dev.c:5566 netif_receive_skb_internal net/core/dev.c:5652 [inline] netif_receive_skb+0x4a/0x310 net/core/dev.c:5711 tun_rx_batched+0x3bf/0x400 tun_get_user+0x1d24/0x22b0 drivers/net/tun.c:1997 tun_chr_write_iter+0x18e/0x240 drivers/net/tun.c:2043 call_write_iter include/linux/fs.h:1871 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x4ab/0x7d0 fs/read_write.c:584 ksys_write+0xeb/0x1a0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x42/0x50 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x91d25731 -> 0xe79325cd Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 32078 Comm: syz-executor.4 Not tainted 6.5.0-rc1-syzkaller-00033-geb26cbb1a754 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 Fixes: 58d607d3e52f ("tcp: provide skb->hash to synack packets") Signed-off-by: Eric Dumazet Reported-by: syzbot Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230717144445.653164-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 957961b6dcc813e6222a4f7e8e3626fcd1f1e098 Author: Joaquín Ignacio Aramendía Date: Mon Jul 17 19:25:15 2023 -0300 hwmon: (oxp-sensors) Move tt_toggle attribute to dev_groups A driver should not be manually adding groups in its probe function (it will race with userspace), so replace the call to devm_device_add_groups() to use the platform dev_groups callback instead. This will allow for removal of the devm_device_add_groups() function. Signed-off-by: Joaquín Ignacio Aramendía Fixes: be144ee49127 ("hwmon: (oxp-sensors) Add tt_toggle attribute on supported boards") Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20230717222526.229984-2-samsagax@gmail.com Signed-off-by: Guenter Roeck commit e7002b3b20c58bce4a88c15aca8e6cc894e3a7ed Author: Subbaraya Sundeep Date: Mon Jul 17 11:46:43 2023 +0530 octeontx2-pf: mcs: Generate hash key using ecb(aes) Hardware generated encryption and ICV tags are found to be wrong when tested with IEEE MACSEC test vectors. This is because as per the HRM, the hash key (derived by AES-ECB block encryption of an all 0s block with the SAK) has to be programmed by the software in MCSX_RS_MCS_CPM_TX_SLAVE_SA_PLCY_MEM_4X register. Hence fix this by generating hash key in software and configuring in hardware. Fixes: c54ffc73601c ("octeontx2-pf: mcs: Introduce MACSEC hardware offloading") Signed-off-by: Subbaraya Sundeep Reviewed-by: Kalesh AP Link: https://lore.kernel.org/r/1689574603-28093-1-git-send-email-sbhatta@marvell.com Signed-off-by: Jakub Kicinski commit c486762fb17c99fd642beea3e1e4744d093c262a Author: Dmitry Baryshkov Date: Sun Jul 9 23:30:19 2023 +0300 ARM: dts: nxp/imx: limit sk-imx53 supported frequencies The SK-IMX53 board, bearing i.MX536A CPU, is not stable when running at 1.2 GHz (default iMX53 maximum). The SoC is only rated up to 800 MHz. Disable 1.2 GHz and 1 GHz frequencies. Fixes: 0b8576d8440a ("ARM: dts: imx: Add support for SK-iMX53 board") Signed-off-by: Dmitry Baryshkov Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit 78adb4bcf99effbb960c5f9091e2e062509d1030 Author: Florian Kauer Date: Mon Jul 17 10:54:44 2023 -0700 igc: Prevent garbled TX queue with XDP ZEROCOPY In normal operation, each populated queue item has next_to_watch pointing to the last TX desc of the packet, while each cleaned item has it set to 0. In particular, next_to_use that points to the next (necessarily clean) item to use has next_to_watch set to 0. When the TX queue is used both by an application using AF_XDP with ZEROCOPY as well as a second non-XDP application generating high traffic, the queue pointers can get in an invalid state where next_to_use points to an item where next_to_watch is NOT set to 0. However, the implementation assumes at several places that this is never the case, so if it does hold, bad things happen. In particular, within the loop inside of igc_clean_tx_irq(), next_to_clean can overtake next_to_use. Finally, this prevents any further transmission via this queue and it never gets unblocked or signaled. Secondly, if the queue is in this garbled state, the inner loop of igc_clean_tx_ring() will never terminate, completely hogging a CPU core. The reason is that igc_xdp_xmit_zc() reads next_to_use before acquiring the lock, and writing it back (potentially unmodified) later. If it got modified before locking, the outdated next_to_use is written pointing to an item that was already used elsewhere (and thus next_to_watch got written). Fixes: 9acf59a752d4 ("igc: Enable TX via AF_XDP zero-copy") Signed-off-by: Florian Kauer Reviewed-by: Kurt Kanzenbach Tested-by: Kurt Kanzenbach Acked-by: Vinicius Costa Gomes Reviewed-by: Simon Horman Tested-by: Naama Meir Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20230717175444.3217831-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 936fd2c50bddd8c1dbe49bc7bb31c5e5975fdf2e Merge: 195e903b342a7 9efa1a5407e81 Author: Jakub Kicinski Date: Tue Jul 18 18:33:34 2023 -0700 Merge tag 'linux-can-fixes-for-6.5-20230717' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2023-07-17 The 1st patch is by Ziyang Xuan and fixes a possible memory leak in the receiver handling in the CAN RAW protocol. YueHaibing contributes a use after free in bcm_proc_show() of the Broad Cast Manager (BCM) CAN protocol. The next 2 patches are by me and fix a possible null pointer dereference in the RX path of the gs_usb driver with activated hardware timestamps and the candlelight firmware. The last patch is by Fedor Ross, Marek Vasut and me and targets the mcp251xfd driver. The polling timeout of __mcp251xfd_chip_set_mode() is increased to fix bus joining on busy CAN buses and very low bit rate. * tag 'linux-can-fixes-for-6.5-20230717' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: mcp251xfd: __mcp251xfd_chip_set_mode(): increase poll timeout can: gs_usb: fix time stamp counter initialization can: gs_usb: gs_can_open(): improve error handling can: bcm: Fix UAF in bcm_proc_show() can: raw: fix receiver memory leak ==================== Link: https://lore.kernel.org/r/20230717180938.230816-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 195e903b342a73c08c3249cec55b07bf3f23200a Author: John Fastabend Date: Mon Jul 17 10:33:06 2023 -0700 mailmap: Add entry for old intel email Fix old email to avoid bouncing email from net/drivers and older netdev work. Anyways my @intel email hasn't been active for years. Signed-off-by: John Fastabend Link: https://lore.kernel.org/r/20230717173306.38407-1-john.fastabend@gmail.com Signed-off-by: Jakub Kicinski commit d1998e505a995f5305a6add46f3d806fa38dae06 Author: Shannon Nelson Date: Mon Jul 17 12:32:42 2023 -0700 mailmap: add entries for past lives Update old emails for my current work email. Signed-off-by: Shannon Nelson Link: https://lore.kernel.org/r/20230717193242.43670-1-shannon.nelson@amd.com Signed-off-by: Jakub Kicinski commit 2187d6ca8209d34a29aec3cd5c7b6c05dc6da43f Merge: 8fcd7c7b3a38a 031c99e71fedc Author: Jakub Kicinski Date: Tue Jul 18 16:52:15 2023 -0700 Merge branch 'selftests-tc-increase-timeout-and-add-missing-kconfig' Matthieu Baerts says: ==================== selftests: tc: increase timeout and add missing kconfig When looking for something else in LKFT reports [1], I noticed that the TC selftest ended with a timeout error: not ok 1 selftests: tc-testing: tdc.sh # TIMEOUT 45 seconds I also noticed most of the tests were skipped because the "teardown stage" did not complete successfully. It was due to missing kconfig. These patches fix these two errors plus an extra one because this selftest reads info from "/proc/net/nf_conntrack". Thank you Pedro for having helped me fixing these issues [2]. Link: https://qa-reports.linaro.org/lkft/linux-next-master/build/next-20230711/testrun/18267241/suite/kselftest-tc-testing/test/tc-testing_tdc_sh/log [1] Link: https://lore.kernel.org/netdev/0e061d4a-9a23-9f58-3b35-d8919de332d7@tessares.net/T/ [2] ==================== Link: https://lore.kernel.org/r/20230713-tc-selftests-lkft-v1-0-1eb4fd3a96e7@tessares.net Signed-off-by: Jakub Kicinski commit 031c99e71fedcce93b6785d38b7d287bf59e3952 Author: Matthieu Baerts Date: Thu Jul 13 23:16:46 2023 +0200 selftests: tc: add ConnTrack procfs kconfig When looking at the TC selftest reports, I noticed one test was failing because /proc/net/nf_conntrack was not available. not ok 373 3992 - Add ct action triggering DNAT tuple conflict Could not match regex pattern. Verify command output: cat: /proc/net/nf_conntrack: No such file or directory It is only available if NF_CONNTRACK_PROCFS kconfig is set. So the issue can be fixed simply by adding it to the list of required kconfig. Fixes: e46905641316 ("tc-testing: add test for ct DNAT tuple collision") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/netdev/0e061d4a-9a23-9f58-3b35-d8919de332d7@tessares.net/T/ [1] Signed-off-by: Matthieu Baerts Tested-by: Zhengchao Shao Link: https://lore.kernel.org/r/20230713-tc-selftests-lkft-v1-3-1eb4fd3a96e7@tessares.net Acked-by: Jamal Hadi Salim Signed-off-by: Jakub Kicinski commit 719b4774a8cb1a501e2d22a5a4a3a0a870e427d5 Author: Matthieu Baerts Date: Thu Jul 13 23:16:45 2023 +0200 selftests: tc: add 'ct' action kconfig dep When looking for something else in LKFT reports [1], I noticed most of the tests were skipped because the "teardown stage" did not complete successfully. Pedro found out this is due to the fact CONFIG_NF_FLOW_TABLE is required but not listed in the 'config' file. Adding it to the list fixes the issues on LKFT side. CONFIG_NET_ACT_CT is now set to 'm' in the final kconfig. Fixes: c34b961a2492 ("net/sched: act_ct: Create nf flow table per zone") Cc: stable@vger.kernel.org Link: https://qa-reports.linaro.org/lkft/linux-next-master/build/next-20230711/testrun/18267241/suite/kselftest-tc-testing/test/tc-testing_tdc_sh/log [1] Link: https://lore.kernel.org/netdev/0e061d4a-9a23-9f58-3b35-d8919de332d7@tessares.net/T/ [2] Suggested-by: Pedro Tammela Signed-off-by: Matthieu Baerts Tested-by: Zhengchao Shao Link: https://lore.kernel.org/r/20230713-tc-selftests-lkft-v1-2-1eb4fd3a96e7@tessares.net Acked-by: Jamal Hadi Salim Signed-off-by: Jakub Kicinski commit fda05798c22a354efde09a76bdfc276b2d591829 Author: Matthieu Baerts Date: Thu Jul 13 23:16:44 2023 +0200 selftests: tc: set timeout to 15 minutes When looking for something else in LKFT reports [1], I noticed that the TC selftest ended with a timeout error: not ok 1 selftests: tc-testing: tdc.sh # TIMEOUT 45 seconds The timeout had been introduced 3 years ago, see the Fixes commit below. This timeout is only in place when executing the selftests via the kselftests runner scripts. I guess this is not what most TC devs are using and nobody noticed the issue before. The new timeout is set to 15 minutes as suggested by Pedro [2]. It looks like it is plenty more time than what it takes in "normal" conditions. Fixes: 852c8cbf34d3 ("selftests/kselftest/runner.sh: Add 45 second timeout per test") Cc: stable@vger.kernel.org Link: https://qa-reports.linaro.org/lkft/linux-next-master/build/next-20230711/testrun/18267241/suite/kselftest-tc-testing/test/tc-testing_tdc_sh/log [1] Link: https://lore.kernel.org/netdev/0e061d4a-9a23-9f58-3b35-d8919de332d7@tessares.net/T/ [2] Suggested-by: Pedro Tammela Signed-off-by: Matthieu Baerts Reviewed-by: Zhengchao Shao Link: https://lore.kernel.org/r/20230713-tc-selftests-lkft-v1-1-1eb4fd3a96e7@tessares.net Acked-by: Jamal Hadi Salim Signed-off-by: Jakub Kicinski commit a3f25d614bc73b45e8f02adc6769876dfd16ca84 Author: Alexander Duyck Date: Thu Jul 13 09:49:31 2023 -0700 bpf, arm64: Fix BTI type used for freplace attached functions When running an freplace attached bpf program on an arm64 system w were seeing the following issue: Unhandled 64-bit el1h sync exception on CPU47, ESR 0x0000000036000003 -- BTI After a bit of work to track it down I determined that what appeared to be happening is that the 'bti c' at the start of the program was somehow being reached after a 'br' instruction. Further digging pointed me toward the fact that the function was attached via freplace. This in turn led me to build_plt which I believe is invoking the long jump which is triggering this error. To resolve it we can replace the 'bti c' with 'bti jc' and add a comment explaining why this has to be modified as such. Fixes: b2ad54e1533e ("bpf, arm64: Implement bpf_arch_text_poke() for arm64") Signed-off-by: Alexander Duyck Acked-by: Xu Kuohai Link: https://lore.kernel.org/r/168926677665.316237.9953845318337455525.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Alexei Starovoitov commit a8237cc87e3de1adb3f2f6a8056621e7e578cc00 Merge: 8fcd7c7b3a38a 824adae4530b4 Author: Alexei Starovoitov Date: Tue Jul 18 15:21:09 2023 -0700 Merge branch 'two-more-fixes-for-check_max_stack_depth' Kumar Kartikeya Dwivedi says: ==================== Two more fixes for check_max_stack_depth I noticed two more bugs while reviewing the code, description and examples available in the patches. One leads to incorrect subprog index to be stored in the frame stack maintained by the function (leading to incorrect tail_call_reachable marks, among other things). The other problem is missing exploration pass of other async callbacks when they are not called from the main prog. Call chains rooted at them can thus bypass the stack limits (32 call frames * max permitted stack depth per function). Changelog: ---------- v1 -> v2 v1: https://lore.kernel.org/bpf/20230713003118.1327943-1-memxor@gmail.com * Fix commit message for patch 2 (Alexei) ==================== Link: https://lore.kernel.org/r/20230717161530.1238-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 824adae4530b4db1d06987d8dd31a0adef37044f Author: Kumar Kartikeya Dwivedi Date: Mon Jul 17 21:45:30 2023 +0530 selftests/bpf: Add more tests for check_max_stack_depth bug Another test which now exercies the path of the verifier where it will explore call chains rooted at the async callback. Without the prior fixes, this program loads successfully, which is incorrect. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20230717161530.1238-4-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit b5e9ad522c4ccd32d322877515cff8d47ed731b9 Author: Kumar Kartikeya Dwivedi Date: Mon Jul 17 21:45:29 2023 +0530 bpf: Repeat check_max_stack_depth for async callbacks While the check_max_stack_depth function explores call chains emanating from the main prog, which is typically enough to cover all possible call chains, it doesn't explore those rooted at async callbacks unless the async callback will have been directly called, since unlike non-async callbacks it skips their instruction exploration as they don't contribute to stack depth. It could be the case that the async callback leads to a callchain which exceeds the stack depth, but this is never reachable while only exploring the entry point from main subprog. Hence, repeat the check for the main subprog *and* all async callbacks marked by the symbolic execution pass of the verifier, as execution of the program may begin at any of them. Consider functions with following stack depths: main: 256 async: 256 foo: 256 main: rX = async bpf_timer_set_callback(...) async: foo() Here, async is not descended as it does not contribute to stack depth of main (since it is referenced using bpf_pseudo_func and not bpf_pseudo_call). However, when async is invoked asynchronously, it will end up breaching the MAX_BPF_STACK limit by calling foo. Hence, in addition to main, we also need to explore call chains beginning at all async callback subprogs in a program. Fixes: 7ddc80a476c2 ("bpf: Teach stack depth check about async callbacks.") Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20230717161530.1238-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit ba7b3e7d5f9014be65879ede8fd599cb222901c9 Author: Kumar Kartikeya Dwivedi Date: Mon Jul 17 21:45:28 2023 +0530 bpf: Fix subprog idx logic in check_max_stack_depth The assignment to idx in check_max_stack_depth happens once we see a bpf_pseudo_call or bpf_pseudo_func. This is not an issue as the rest of the code performs a few checks and then pushes the frame to the frame stack, except the case of async callbacks. If the async callback case causes the loop iteration to be skipped, the idx assignment will be incorrect on the next iteration of the loop. The value stored in the frame stack (as the subprogno of the current subprog) will be incorrect. This leads to incorrect checks and incorrect tail_call_reachable marking. Save the target subprog in a new variable and only assign to idx once we are done with the is_async_cb check which may skip pushing of frame to the frame stack and subsequent stack depth checks and tail call markings. Fixes: 7ddc80a476c2 ("bpf: Teach stack depth check about async callbacks.") Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20230717161530.1238-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit ccff6d117d8dc8d8d86e8695a75e5f8b01e573bf Merge: 4806364acf770 2480232c61b88 Author: Linus Torvalds Date: Tue Jul 18 14:51:29 2023 -0700 Merge tag 'perf-tools-fixes-for-v6.5-1-2023-07-18' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Arnaldo Carvalho de Melo: - Don't group events when computing metrics that require more than the maximum number of simultaneously enabled events on AMD systems. - Fix multi CU handling in 'perf probe', add a 'perf test' entry to regress test it. - Make the 'perf test task_exit' stop generating samples by using the 'dummy' event, all it is testing is if a PERF_RECORD_EXIT is generated at the end of a perf session. This makes this perf test to stop sometimes failing on some systems due to a full ring buffer. - Avoid SEGV if PMU lookup fails for legacy cache terms. - Fix libsubcmd SEGV/use-after-free when commands aren't excluded. - Fix OpenCSD (ARM64's CoreSight hardware tracing) library path resolution when specifying CSLIBS= in the make command line. - Fix broken feature check for libtracefs due to external lib changes, use the provided pkgconfig file instead future proof it. - Sync drm, fcntl, kvm, mount, prctl, socket, vhost, asound, arm64's cputype headers with the kernel sources, in some cases this made the tools become aware of new kernel APIs such as ioctls and the cachestat sysctl. * tag 'perf-tools-fixes-for-v6.5-1-2023-07-18' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf test task_exit: No need for a cycles event to check if we get an PERF_RECORD_EXIT tools headers arm64: Sync arm64's cputype.h with the kernel sources tools include UAPI: Sync the sound/asound.h copy with the kernel sources tools include UAPI: Sync linux/vhost.h with the kernel sources perf beauty: Update copy of linux/socket.h with the kernel sources perf parse-events: Avoid SEGV if PMU lookup fails for legacy cache terms libsubcmd: Avoid SEGV/use-after-free when commands aren't excluded tools headers UAPI: Sync linux/prctl.h with the kernel sources perf build: Fix broken feature check for libtracefs due to external lib changes tools include UAPI: Sync linux/mount.h copy with the kernel sources tools headers UAPI: Sync linux/kvm.h with the kernel sources tools headers uapi: Sync linux/fcntl.h with the kernel sources perf vendor events amd: Fix large metrics perf build: Fix library not found error when using CSLIBS tools headers UAPI: Sync files changed by new cachestat syscall with the kernel sources tools headers UAPI: Sync drm/i915_drm.h with the kernel sources perf probe: Read DWARF files from the correct CU perf probe: Add test for regression introduced by switch to die_get_decl_file() commit 4806364acf770fa1d24ccc98169ca6f5c6979caa Merge: 74f1456c4a5f3 ef5c3de5211b5 Author: Linus Torvalds Date: Tue Jul 18 14:19:42 2023 -0700 Merge tag 'mm-hotfixes-stable-2023-07-18-12-28' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull hotfixes from Andrew Morton: "Seven hotfixes, six of which are cc:stable and one of which addresses a post-6.5 issue" * tag 'mm-hotfixes-stable-2023-07-18-12-28' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: maple_tree: fix node allocation testing on 32 bit maple_tree: fix 32 bit mas_next testing selftests/mm: mkdirty: fix incorrect position of #endif maple_tree: set the node limit when creating a new root node mm/mlock: fix vma iterator conversion of apply_vma_lock_flags() prctl: move PR_GET_AUXV out of PR_MCE_KILL selftests/mm: give scripts execute permission commit 2356d198d2b4ddec24efea98271cb3be230bc787 Author: Yury Norov Date: Mon Jul 17 12:17:03 2023 -0700 lib/bitmap: workaround const_eval test build failure When building with Clang, and when KASAN and GCOV_PROFILE_ALL are both enabled, the test fails to build [1]: >> lib/test_bitmap.c:920:2: error: call to '__compiletime_assert_239' declared with 'error' attribute: BUILD_BUG_ON failed: !__builtin_constant_p(res) BUILD_BUG_ON(!__builtin_constant_p(res)); ^ include/linux/build_bug.h:50:2: note: expanded from macro 'BUILD_BUG_ON' BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition) ^ include/linux/build_bug.h:39:37: note: expanded from macro 'BUILD_BUG_ON_MSG' #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg) ^ include/linux/compiler_types.h:352:2: note: expanded from macro 'compiletime_assert' _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ^ include/linux/compiler_types.h:340:2: note: expanded from macro '_compiletime_assert' __compiletime_assert(condition, msg, prefix, suffix) ^ include/linux/compiler_types.h:333:4: note: expanded from macro '__compiletime_assert' prefix ## suffix(); \ ^ :185:1: note: expanded from here __compiletime_assert_239 Originally it was attributed to s390, which now looks seemingly wrong. The issue is not related to bitmap code itself, but it breaks build for a given configuration. Disabling the const_eval test under that config may potentially hide other bugs. Instead, workaround it by disabling GCOV for the test_bitmap unless the compiler will get fixed. [1] https://github.com/ClangBuiltLinux/linux/issues/1874 Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202307171254.yFcH97ej-lkp@intel.com/ Fixes: dc34d5036692 ("lib: test_bitmap: add compile-time optimization/evaluations assertions") Co-developed-by: Nathan Chancellor Signed-off-by: Nathan Chancellor Signed-off-by: Yury Norov Reviewed-by: Nick Desaulniers Reviewed-by: Alexander Lobakin commit 6adc2272aaaf84f34b652cf77f770c6fcc4b8336 Author: Ondrej Mosnacek Date: Tue Jul 18 13:56:07 2023 +0200 io_uring: don't audit the capability check in io_uring_create() The check being unconditional may lead to unwanted denials reported by LSMs when a process has the capability granted by DAC, but denied by an LSM. In the case of SELinux such denials are a problem, since they can't be effectively filtered out via the policy and when not silenced, they produce noise that may hide a true problem or an attack. Since not having the capability merely means that the created io_uring context will be accounted against the current user's RLIMIT_MEMLOCK limit, we can disable auditing of denials for this check by using ns_capable_noaudit() instead of capable(). Fixes: 2b188cc1bb85 ("Add io_uring IO interface") Link: https://bugzilla.redhat.com/show_bug.cgi?id=2193317 Signed-off-by: Ondrej Mosnacek Reviewed-by: Jeff Moyer Link: https://lore.kernel.org/r/20230718115607.65652-1-omosnace@redhat.com Signed-off-by: Jens Axboe commit 28f47693a920ed66e985feafc1937b4c96008b95 Author: Greg Kroah-Hartman Date: Tue Jun 27 13:26:43 2023 +0200 Documentation: embargoed-hardware-issues.rst: clean out empty and unused entries There are a few empty entries in the company/project list, which confuses people as to why they are there, so remove them entirely, and also remove an entry that doesn't wish to participate in this process. Cc: Tom Lendacky Reviewed-by: Thomas Gleixner Link: https://lore.kernel.org/r/2023062742-mouse-appease-7917@gregkh Signed-off-by: Greg Kroah-Hartman commit b13d3e9c6b62597a5c31fdc74febb3bc588893bf Author: Guchun Chen Date: Fri Jul 14 19:38:16 2023 +0800 drm/amdgpu: use a macro to define no xcp partition case ~0 as no xcp partition is used in several places, so improve its definition by a macro for code consistency. Suggested-by: Christian König Signed-off-by: Guchun Chen Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 8e78127143086bd89aa099740c1767d64fe80631 Author: Guchun Chen Date: Thu Jul 13 15:55:58 2023 +0800 drm/amdgpu/vm: use the same xcp_id from root PD Other PDs/PTs allocation should just use the same xcp_id as that stored in root PD. Suggested-by: Christian König Signed-off-by: Guchun Chen Reviewed-by: Felix Kuehling Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 8ecee4cbc72b53551c1d33251a48c912d70282ea Author: Guchun Chen Date: Thu Jul 13 15:09:37 2023 +0800 drm/amdgpu: fix slab-out-of-bounds issue in amdgpu_vm_pt_create Recent code set xcp_id stored from file private data when opening device to amdgpu bo for accounting memory usage etc, but not all VMs are attached to this fpriv structure like the vm cases in amdgpu_mes_self_test, otherwise, KASAN will complain below out of bound access. And more importantly, VM code should not touch fpriv structure, so drop fpriv code handling from amdgpu_vm_pt. [ 77.292314] BUG: KASAN: slab-out-of-bounds in amdgpu_vm_pt_create+0x17e/0x4b0 [amdgpu] [ 77.293845] Read of size 4 at addr ffff888102c48a48 by task modprobe/1069 [ 77.294146] Call Trace: [ 77.294178] [ 77.294208] dump_stack_lvl+0x49/0x63 [ 77.294260] print_report+0x16f/0x4a6 [ 77.294307] ? amdgpu_vm_pt_create+0x17e/0x4b0 [amdgpu] [ 77.295979] ? kasan_complete_mode_report_info+0x3c/0x200 [ 77.296057] ? amdgpu_vm_pt_create+0x17e/0x4b0 [amdgpu] [ 77.297556] kasan_report+0xb4/0x130 [ 77.297609] ? amdgpu_vm_pt_create+0x17e/0x4b0 [amdgpu] [ 77.299202] __asan_load4+0x6f/0x90 [ 77.299272] amdgpu_vm_pt_create+0x17e/0x4b0 [amdgpu] [ 77.300796] ? amdgpu_init+0x6e/0x1000 [amdgpu] [ 77.302222] ? amdgpu_vm_pt_clear+0x750/0x750 [amdgpu] [ 77.303721] ? preempt_count_sub+0x18/0xc0 [ 77.303786] amdgpu_vm_init+0x39e/0x870 [amdgpu] [ 77.305186] ? amdgpu_vm_wait_idle+0x90/0x90 [amdgpu] [ 77.306683] ? kasan_set_track+0x25/0x30 [ 77.306737] ? kasan_save_alloc_info+0x1b/0x30 [ 77.306795] ? __kasan_kmalloc+0x87/0xa0 [ 77.306852] amdgpu_mes_self_test+0x169/0x620 [amdgpu] v2: without specifying xcp partition for PD/PT bo, the xcp id is -1. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2686 Fixes: 3ebfd221c1a8 ("drm/amdkfd: Store xcp partition id to amdgpu bo") Signed-off-by: Guchun Chen Tested-by: Mikhail Gavrilov Reviewed-by: Felix Kuehling Reviewed-by: Christian König Signed-off-by: Alex Deucher commit dcaa32e1f58473b9f4ac566fadd326956be83138 Author: Guchun Chen Date: Mon Jul 17 09:55:07 2023 +0800 drm/amdgpu: Allocate root PD on correct partition file_priv needs to be setup firstly, otherwise, root PD will always be allocated on partition 0, even if opening the device from other partitions. Fixes: 3ebfd221c1a8 ("drm/amdkfd: Store xcp partition id to amdgpu bo") Signed-off-by: Guchun Chen Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 2387ccf43e3c6cb5dbd757c5ef410cca9f14b971 Author: Nicholas Kazlauskas Date: Thu Jun 29 10:35:59 2023 -0400 drm/amd/display: Keep PHY active for DP displays on DCN31 [Why & How] Port of a change that went into DCN314 to keep the PHY enabled when we have a connected and active DP display. The PHY can hang if PHY refclk is disabled inadvertently. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Josip Pavic Acked-by: Alan Liu Signed-off-by: Nicholas Kazlauskas Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 2a9482e55968ed7368afaa9c2133404069117320 Author: Daniel Miess Date: Thu Jun 22 08:11:48 2023 -0400 drm/amd/display: Prevent vtotal from being set to 0 [Why] In dcn314 DML the destination pipe vtotal was being set to the crtc adjustment vtotal_min value even in cases where that value is 0. [How] Only set vtotal to the crtc adjustment vtotal_min value in cases where the value is non-zero. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Nicholas Kazlauskas Acked-by: Alan Liu Signed-off-by: Daniel Miess Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit a460beefe77d780ac48f19d39333852a7f93ffc1 Author: Zhikai Zhai Date: Fri Jun 30 11:35:14 2023 +0800 drm/amd/display: Disable MPC split by default on special asic [WHY] All of pipes will be used when the MPC split enable on the dcn which just has 2 pipes. Then MPO enter will trigger the minimal transition which need programe dcn from 2 pipes MPC split to 2 pipes MPO. This action will cause lag if happen frequently. [HOW] Disable the MPC split for the platform which dcn resource is limited Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Alvin Lee Acked-by: Alan Liu Signed-off-by: Zhikai Zhai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 5a25cefc0920088bb9afafeb80ad3dcd84fe278b Author: Taimur Hassan Date: Tue Jun 20 17:00:28 2023 -0400 drm/amd/display: check TG is non-null before checking if enabled [Why & How] If there is no TG allocation we can dereference a NULL pointer when checking if the TG is enabled. Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Nicholas Kazlauskas Acked-by: Alan Liu Signed-off-by: Taimur Hassan Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 4f6d9e38c4d244ad106eb9ebd8c0e1215e866f35 Author: Wayne Lin Date: Wed Mar 9 17:05:05 2022 +0800 drm/amd/display: Add polling method to handle MST reply packet [Why] Specific TBT4 dock doesn't send out short HPD to notify source that IRQ event DOWN_REP_MSG_RDY is set. Which violates the spec and cause source can't send out streams to mst sinks. [How] To cover this misbehavior, add an additional polling method to detect DOWN_REP_MSG_RDY is set. HPD driven handling method is still kept. Just hook up our handler to drm mgr->cbs->poll_hpd_irq(). Cc: Mario Limonciello Cc: Alex Deucher Cc: stable@vger.kernel.org Reviewed-by: Jerry Zuo Acked-by: Alan Liu Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 87279fdf5ee0ad1360765ef70389d1c4d0f81bb6 Author: Srinivasan Shanmugam Date: Sat Jun 17 21:09:46 2023 +0530 drm/amd/display: Clean up errors & warnings in amdgpu_dm.c Fix the following errors & warnings reported by checkpatch: ERROR: space required before the open brace '{' ERROR: space required before the open parenthesis '(' ERROR: that open brace { should be on the previous line ERROR: space prohibited before that ',' (ctx:WxW) ERROR: else should follow close brace '}' ERROR: open brace '{' following function definitions go on the next line ERROR: code indent should use tabs where possible WARNING: braces {} are not necessary for single statement blocks WARNING: void function return statements are not generally useful WARNING: Block comments use * on subsequent lines WARNING: Block comments use a trailing */ on a separate line Cc: Rodrigo Siqueira Cc: Aurabindo Pillai Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Reviewed-by: Rodrigo Siqueira Signed-off-by: Alex Deucher commit b9c2213cdf254fba71b6bd602a0afe051e554ad9 Author: Candice Li Date: Wed Jul 5 15:00:45 2023 +0800 drm/amdgpu: Allow the initramfs generator to include psp_13_0_6_ta Allow the initramfs generator to automatically include psp_13_0_6_ta firmware to initramfs. Signed-off-by: Candice Li Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 068c8bb10f37bb84824625dbbda053a3a3e0d6e1 Author: Alex Deucher Date: Tue Jun 13 12:36:17 2023 -0400 drm/amdgpu/pm: make mclk consistent for smu 13.0.7 Use current uclk to be consistent with other dGPUs. Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit a4eb11824170d742531998f4ebd1c6a18b63db47 Author: Alex Deucher Date: Tue Jun 13 12:15:38 2023 -0400 drm/amdgpu/pm: make gfxclock consistent for sienna cichlid Use average gfxclock for consistency with other dGPUs. Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 1ca67aba8d11c2849d395013e1fdce02918d5657 Author: Simon Ser Date: Wed Jun 21 17:24:59 2023 -0300 drm/amd/display: only accept async flips for fast updates Up until now, amdgpu was silently degrading to vsync when user-space requested an async flip but the hardware didn't support it. The hardware doesn't support immediate flips when the update changes the FB pitch, the DCC state, the rotation, enables or disables CRTCs or planes, etc. This is reflected in the dm_crtc_state.update_type field: UPDATE_TYPE_FAST means that immediate flip is supported. Silently degrading async flips to vsync is not the expected behavior from a uAPI point-of-view. Xorg expects async flips to fail if unsupported, to be able to fall back to a blit. i915 already behaves this way. This patch aligns amdgpu with uAPI expectations and returns a failure when an async flip is not possible. Signed-off-by: Simon Ser Reviewed-by: André Almeida Reviewed-by: Alex Deucher Reviewed-by: Harry Wentland Signed-off-by: André Almeida Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit b42ae87a7b3878afaf4c3852ca66c025a5b996e0 Author: Guchun Chen Date: Thu Jul 6 15:57:21 2023 +0800 drm/amdgpu/vkms: relax timer deactivation by hrtimer_try_to_cancel In below thousands of screen rotation loop tests with virtual display enabled, a CPU hard lockup issue may happen, leading system to unresponsive and crash. do { xrandr --output Virtual --rotate inverted xrandr --output Virtual --rotate right xrandr --output Virtual --rotate left xrandr --output Virtual --rotate normal } while (1); NMI watchdog: Watchdog detected hard LOCKUP on cpu 1 ? hrtimer_run_softirq+0x140/0x140 ? store_vblank+0xe0/0xe0 [drm] hrtimer_cancel+0x15/0x30 amdgpu_vkms_disable_vblank+0x15/0x30 [amdgpu] drm_vblank_disable_and_save+0x185/0x1f0 [drm] drm_crtc_vblank_off+0x159/0x4c0 [drm] ? record_print_text.cold+0x11/0x11 ? wait_for_completion_timeout+0x232/0x280 ? drm_crtc_wait_one_vblank+0x40/0x40 [drm] ? bit_wait_io_timeout+0xe0/0xe0 ? wait_for_completion_interruptible+0x1d7/0x320 ? mutex_unlock+0x81/0xd0 amdgpu_vkms_crtc_atomic_disable It's caused by a stuck in lock dependency in such scenario on different CPUs. CPU1 CPU2 drm_crtc_vblank_off hrtimer_interrupt grab event_lock (irq disabled) __hrtimer_run_queues grab vbl_lock/vblank_time_block amdgpu_vkms_vblank_simulate amdgpu_vkms_disable_vblank drm_handle_vblank hrtimer_cancel grab dev->event_lock So CPU1 stucks in hrtimer_cancel as timer callback is running endless on current clock base, as that timer queue on CPU2 has no chance to finish it because of failing to hold the lock. So NMI watchdog will throw the errors after its threshold, and all later CPUs are impacted/blocked. So use hrtimer_try_to_cancel to fix this, as disable_vblank callback does not need to wait the handler to finish. And also it's not necessary to check the return value of hrtimer_try_to_cancel, because even if it's -1 which means current timer callback is running, it will be reprogrammed in hrtimer_start with calling enable_vblank to make it works. v2: only re-arm timer when vblank is enabled (Christian) and add a Fixes tag as well v3: drop warn printing (Christian) v4: drop superfluous check of blank->enabled in timer function, as it's guaranteed in drm_handle_vblank (Christian) Fixes: 84ec374bd580 ("drm/amdgpu: create amdgpu_vkms (v4)") Cc: stable@vger.kernel.org Suggested-by: Christian König Signed-off-by: Guchun Chen Reviewed-by: Christian König Signed-off-by: Alex Deucher commit d1792509e1031a6750f82bc7faa5fc9d7203b5b7 Author: Aurabindo Pillai Date: Wed Jul 12 12:35:16 2023 -0400 drm/amd/display: add DCN301 specific logic for OTG programming [Why&How] DCN301 does not have FAMS hence the workaround needed on other DCN3x variants related to OTG min/max selector programming is not applicable for it. Hence isolate it and have it use the old sequence without workaround. Fixes: 1598fc576420 ("drm/amd/display: Program OTG vtotal min/max selectors unconditionally for DCN1+") Reviewed-by: Swapnil Patel Signed-off-by: Aurabindo Pillai Tested-by: Guilherme G. Piccoli Signed-off-by: Alex Deucher commit 2ed5a4c4615b47c70dcd8d7d942207e5a607561d Author: Aurabindo Pillai Date: Tue Jul 11 14:14:43 2023 -0400 drm/amd/display: export some optc function for reuse [Why&How] Make a few functions non static so that they can be reused for other asic. This is in preparation for separating out OTG programming sequence for DCN301 Fixes: 1598fc576420 ("drm/amd/display: Program OTG vtotal min/max selectors unconditionally for DCN1+") Reviewed-by: Swapnil Patel Signed-off-by: Aurabindo Pillai Tested-by: Guilherme G. Piccoli Signed-off-by: Alex Deucher commit 60a2dae4902015f43d144f5a4710f655b2955b9b Author: Mario Limonciello Date: Fri Jul 7 21:26:10 2023 -0500 drm/amd: Use amdgpu_device_pcie_dynamic_switching_supported() for SMU7 SMU7 does a check if the dGPU is inserted into a Rocket Lake system, to turn off DPM. Extend this check to all systems that have problems with dynamic switching by using the amdgpu_device_pcie_dynamic_switching_supported() helper. Signed-off-by: Mario Limonciello Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 91019b5bc7c2c5e6f676cce80ee6d12b2753d018 Author: Breno Leitao Date: Fri Jul 14 02:31:46 2023 -0700 cxl/acpi: Return 'rc' instead of '0' in cxl_parse_cfmws() Driver initialization returned success (return 0) even if the initialization (cxl_decoder_add() or acpi_table_parse_cedt()) failed. Return the error instead of swallowing it. Fixes: f4ce1f766f1e ("cxl/acpi: Convert CFMWS parsing to ACPI sub-table helpers") Signed-off-by: Breno Leitao Link: https://lore.kernel.org/r/20230714093146.2253438-2-leitao@debian.org Reviewed-by: Alison Schofield Signed-off-by: Vishal Verma commit 4cf67d3cc9994a59cf77bb9c0ccf9007fe916afe Author: Breno Leitao Date: Fri Jul 14 02:31:45 2023 -0700 cxl/acpi: Fix a use-after-free in cxl_parse_cfmws() KASAN and KFENCE detected an user-after-free in the CXL driver. This happens in the cxl_decoder_add() fail path. KASAN prints the following error: BUG: KASAN: slab-use-after-free in cxl_parse_cfmws (drivers/cxl/acpi.c:299) This happens in cxl_parse_cfmws(), where put_device() is called, releasing cxld, which is accessed later. Use the local variables in the dev_err() instead of pointing to the released memory. Since the dev_err() is printing a resource, change the open coded print format to use the %pr format specifier. Fixes: e50fe01e1f2a ("cxl/core: Drop ->platform_res attribute for root decoders") Signed-off-by: Breno Leitao Link: https://lore.kernel.org/r/20230714093146.2253438-1-leitao@debian.org Reviewed-by: Alison Schofield Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: Vishal Verma commit 74f1456c4a5f3d7da4102ecae5c20370f89c6ed1 Merge: f2f393c385af0 569f8b501b177 Author: Linus Torvalds Date: Tue Jul 18 08:56:02 2023 -0700 Merge tag 'linux-kselftest-fixes-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest fixes from Shuah Khan: "Fixes to bugs that are interfering with arm64 and risc workflows. Also two fixes to timer and mincore tests that are causing test failures" * tag 'linux-kselftest-fixes-6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/arm64: fix build failure during the "emit_tests" step selftests/riscv: fix potential build failure during the "emit_tests" step tools: timers: fix freq average calculation selftests/mincore: fix skip condition for check_huge_pages test commit f2f393c385af0635eddb58df8bcd645cb6a18f5d Merge: fdf0eaf11452d 481c2d14627de Author: Linus Torvalds Date: Tue Jul 18 08:43:35 2023 -0700 Merge tag 'tpmdd-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm fixes from Jarkko Sakkinen. Mostly interrupt storm fixes, with some other minor changes. * tag 'tpmdd-v6.5-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm,tpm_tis: Disable interrupts after 1000 unhandled IRQs tpm/tpm_tis: Disable interrupts for Lenovo L590 devices tpm: Do not remap from ACPI resources again for Pluton TPM tpm/tpm_tis: Disable interrupts for Framework Laptop Intel 13th gen tpm/tpm_tis: Disable interrupts for Framework Laptop Intel 12th gen security: keys: Modify mismatched function name tpm: return false from tpm_amd_is_rng_defective on non-x86 platforms keys: Fix linking a duplicate key to a keyring's assoc_array tpm: tis_i2c: Limit write bursts to I2C_SMBUS_BLOCK_MAX (32) bytes tpm: tis_i2c: Limit read bursts to I2C_SMBUS_BLOCK_MAX (32) bytes tpm_tis_spi: Release chip select when flow control fails tpm: tpm_tis: Disable interrupts *only* for AEON UPX-i11 tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation commit f75546f58a70da5cfdcec5a45ffc377885ccbee8 Author: Trond Myklebust Date: Tue Jul 18 08:38:37 2023 -0400 nfsd: Remove incorrect check in nfsd4_validate_stateid If the client is calling TEST_STATEID, then it is because some event occurred that requires it to check all the stateids for validity and call FREE_STATEID on the ones that have been revoked. In this case, either the stateid exists in the list of stateids associated with that nfs4_client, in which case it should be tested, or it does not. There are no additional conditions to be considered. Reported-by: "Frank Ch. Eigler" Fixes: 7df302f75ee2 ("NFSD: TEST_STATEID should not return NFS4ERR_STALE_STATEID") Cc: stable@vger.kernel.org # v5.7+ Signed-off-by: Trond Myklebust Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit c250ef8954eda2024c8861c36e9fc1b589481fe7 Author: Christoffer Sandberg Date: Tue Jul 18 16:57:22 2023 +0200 ALSA: hda/realtek: Add quirk for Clevo NS70AU Fixes headset detection on Clevo NS70AU. Co-developed-by: Werner Sembach Signed-off-by: Werner Sembach Signed-off-by: Christoffer Sandberg Cc: Link: https://lore.kernel.org/r/20230718145722.10592-1-wse@tuxedocomputers.com Signed-off-by: Takashi Iwai commit 7686762d1ed092db4d120e29b565712c969dc075 Author: Sven Schnelle Date: Thu Jul 13 15:54:23 2023 +0200 s390/mm: fix per vma lock fault handling With per-vma locks, handle_mm_fault() may return non-fatal error flags. In this case the code should reset the fault flags before returning. Fixes: e06f47a16573 ("s390/mm: try VMA lock-based page fault handling first") Signed-off-by: Sven Schnelle Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens commit 8fcd7c7b3a38ab5e452f542fda8f7940e77e479a Author: Geetha sowjanya Date: Sun Jul 16 15:07:41 2023 +0530 octeontx2-pf: Dont allocate BPIDs for LBK interfaces Current driver enables backpressure for LBK interfaces. But these interfaces do not support this feature. Hence, this patch fixes the issue by skipping the backpressure configuration for these interfaces. Fixes: 75f36270990c ("octeontx2-pf: Support to enable/disable pause frames via ethtool"). Signed-off-by: Geetha sowjanya Signed-off-by: Sunil Goutham Link: https://lore.kernel.org/r/20230716093741.28063-1-gakula@marvell.com Signed-off-by: Paolo Abeni commit 5c719d7aef298e9b727f39b45e88528a96df3620 Author: Christophe JAILLET Date: Mon Jul 17 21:55:56 2023 +0200 RDMA/rxe: Fix an error handling path in rxe_bind_mw() All errors go to the error handling path, except this one. Be consistent and also branch to it. Fixes: 02ed253770fb ("RDMA/rxe: Introduce rxe access supported flags") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/43698d8a3ed4e720899eadac887427f73d7ec2eb.1689623735.git.christophe.jaillet@wanadoo.fr Reviewed-by: Bob Pearson Acked-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit 2033ab90380d46e0e9f0520fd6776a73d107fd95 Author: Ido Schimmel Date: Sat Jul 15 18:36:05 2023 +0300 vrf: Fix lockdep splat in output path Cited commit converted the neighbour code to use the standard RCU variant instead of the RCU-bh variant, but the VRF code still uses rcu_read_lock_bh() / rcu_read_unlock_bh() around the neighbour lookup code in its IPv4 and IPv6 output paths, resulting in lockdep splats [1][2]. Can be reproduced using [3]. Fix by switching to rcu_read_lock() / rcu_read_unlock(). [1] ============================= WARNING: suspicious RCU usage 6.5.0-rc1-custom-g9c099e6dbf98 #403 Not tainted ----------------------------- include/net/neighbour.h:302 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by ping/183: #0: ffff888105ea1d80 (sk_lock-AF_INET){+.+.}-{0:0}, at: raw_sendmsg+0xc6c/0x33c0 #1: ffffffff85b46820 (rcu_read_lock_bh){....}-{1:2}, at: vrf_output+0x2e3/0x2030 stack backtrace: CPU: 0 PID: 183 Comm: ping Not tainted 6.5.0-rc1-custom-g9c099e6dbf98 #403 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc37 04/01/2014 Call Trace: dump_stack_lvl+0xc1/0xf0 lockdep_rcu_suspicious+0x211/0x3b0 vrf_output+0x1380/0x2030 ip_push_pending_frames+0x125/0x2a0 raw_sendmsg+0x200d/0x33c0 inet_sendmsg+0xa2/0xe0 __sys_sendto+0x2aa/0x420 __x64_sys_sendto+0xe5/0x1c0 do_syscall_64+0x38/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [2] ============================= WARNING: suspicious RCU usage 6.5.0-rc1-custom-g9c099e6dbf98 #403 Not tainted ----------------------------- include/net/neighbour.h:302 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by ping6/182: #0: ffff888114b63000 (sk_lock-AF_INET6){+.+.}-{0:0}, at: rawv6_sendmsg+0x1602/0x3e50 #1: ffffffff85b46820 (rcu_read_lock_bh){....}-{1:2}, at: vrf_output6+0xe9/0x1310 stack backtrace: CPU: 0 PID: 182 Comm: ping6 Not tainted 6.5.0-rc1-custom-g9c099e6dbf98 #403 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc37 04/01/2014 Call Trace: dump_stack_lvl+0xc1/0xf0 lockdep_rcu_suspicious+0x211/0x3b0 vrf_output6+0xd32/0x1310 ip6_local_out+0xb4/0x1a0 ip6_send_skb+0xbc/0x340 ip6_push_pending_frames+0xe5/0x110 rawv6_sendmsg+0x2e6e/0x3e50 inet_sendmsg+0xa2/0xe0 __sys_sendto+0x2aa/0x420 __x64_sys_sendto+0xe5/0x1c0 do_syscall_64+0x38/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [3] #!/bin/bash ip link add name vrf-red up numtxqueues 2 type vrf table 10 ip link add name swp1 up master vrf-red type dummy ip address add 192.0.2.1/24 dev swp1 ip address add 2001:db8:1::1/64 dev swp1 ip neigh add 192.0.2.2 lladdr 00:11:22:33:44:55 nud perm dev swp1 ip neigh add 2001:db8:1::2 lladdr 00:11:22:33:44:55 nud perm dev swp1 ip vrf exec vrf-red ping 192.0.2.2 -c 1 &> /dev/null ip vrf exec vrf-red ping6 2001:db8:1::2 -c 1 &> /dev/null Fixes: 09eed1192cec ("neighbour: switch to standard rcu, instead of rcu_bh") Reported-by: Naresh Kamboju Link: https://lore.kernel.org/netdev/CA+G9fYtEr-=GbcXNDYo3XOkwR+uYgehVoDjsP0pFLUpZ_AZcyg@mail.gmail.com/ Signed-off-by: Ido Schimmel Reviewed-by: David Ahern Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20230715153605.4068066-1-idosch@nvidia.com Signed-off-by: Paolo Abeni commit 81b233b8dd72f2d1df3da8bd4bd4f8c5e84937b9 Author: Sukrut Bellary Date: Tue Jul 18 01:55:29 2023 -0700 firmware: arm_scmi: Fix signed error return values handling Handle signed error return values returned by simple_write_to_buffer(). In case of an error, return the error code. Fixes: 3c3d818a9317 ("firmware: arm_scmi: Add core raw transmission support") Reported-by: Dan Carpenter Signed-off-by: Sukrut Bellary Reviewed-by: Cristian Marussi Tested-by: Cristian Marussi Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20230718085529.258899-1-sukrut.bellary@linux.com Signed-off-by: Sudeep Holla commit 03803083a9b4d88886fb059458682301a8c7219a Merge: 162d626f30132 b3e7b3a6ee92a Author: Paolo Abeni Date: Tue Jul 18 11:50:10 2023 +0200 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-07-14 (ice) This series contains updates to ice driver only. Petr Oros removes multiple calls made to unregister netdev and devlink_port. Michal fixes null pointer dereference that can occur during reload. ==================== Link: https://lore.kernel.org/r/20230714201041.1717834-1-anthony.l.nguyen@intel.com Signed-off-by: Paolo Abeni commit c2fceb59bbda16468bda82b002383bff59de89ab Author: Claudio Imbrenda Date: Wed Jul 5 13:19:37 2023 +0200 KVM: s390: pv: fix index value of replaced ASCE The index field of the struct page corresponding to a guest ASCE should be 0. When replacing the ASCE in s390_replace_asce(), the index of the new ASCE should also be set to 0. Having the wrong index might lead to the wrong addresses being passed around when notifying pte invalidations, and eventually to validity intercepts (VM crash) if the prefix gets unmapped and the notifier gets called with the wrong address. Reviewed-by: Philippe Mathieu-Daudé Fixes: faa2f72cb356 ("KVM: s390: pv: leak the topmost page table when destroy fails") Reviewed-by: Janosch Frank Signed-off-by: Claudio Imbrenda Message-ID: <20230705111937.33472-3-imbrenda@linux.ibm.com> commit 5ff92181577a89ed12ad4e0e5813751faf16a139 Author: Claudio Imbrenda Date: Wed Jul 5 13:19:36 2023 +0200 KVM: s390: pv: simplify shutdown and fix race Simplify the shutdown of non-protected VMs. There is no need to do complex manipulations of the counter if it was zero. This also fixes a very rare race which caused pages to be torn down from the address space with a non-zero counter even on older machines that don't support the UVC instruction, causing a crash. Reported-by: Marc Hartmayer Fixes: fb491d5500a7 ("KVM: s390: pv: asynchronous destroy for reboot") Reviewed-by: Nico Boehr Signed-off-by: Claudio Imbrenda Message-ID: <20230705111937.33472-2-imbrenda@linux.ibm.com> commit d05799d7b4a39fa71c65aa277128ac7c843ffcdc Author: Punit Agrawal Date: Mon Jul 17 18:17:02 2023 +0100 firmware: smccc: Fix use of uninitialised results structure Commit 35727af2b15d ("irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4") moved the initialisation of the SoC version to arm_smccc_version_init() but forgot to update the results structure and it's usage. Fix the use of the uninitialised results structure and update the error strings. Fixes: 35727af2b15d ("irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4") Signed-off-by: Punit Agrawal Cc: Sudeep Holla Cc: Marc Zyngier Cc: Vikram Sethi Cc: Shanker Donthineni Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20230717171702.424253-1-punit.agrawal@bytedance.com Signed-off-by: Sudeep Holla commit 0e52740ffd10c6c316837c6c128f460f1aaba1ea Author: Borislav Petkov (AMD) Date: Sat Jul 8 10:21:35 2023 +0200 x86/bugs: Increase the x86 bugs vector size to two u32s There was never a doubt in my mind that they would not fit into a single u32 eventually. Signed-off-by: Borislav Petkov (AMD) commit b27bfc5103c72f84859bd32731b6a09eafdeda05 Author: Benjamin Gaignard Date: Fri Jul 7 11:42:00 2023 +0200 arm64: dts: freescale: Fix VPU G2 clock Set VPU G2 clock to 300MHz like described in documentation. This fixes pixels error occurring with large resolution ( >= 2560x1600) HEVC test stream when using the postprocessor to produce NV12. Fixes: 4ac7e4a81272 ("arm64: dts: imx8mq: Enable both G1 and G2 VPU's with vpu-blk-ctrl") Signed-off-by: Benjamin Gaignard Signed-off-by: Shawn Guo commit 253be5b53c2792fb4384f8005b05421e6f040ee3 Author: Hugo Villeneuve Date: Tue Jul 4 09:48:00 2023 -0400 arm64: dts: imx8mn-var-som: add missing pull-up for onboard PHY reset pinmux For SOMs with an onboard PHY, the RESET_N pull-up resistor is currently deactivated in the pinmux configuration. When the pinmux code selects the GPIO function for this pin, with a default direction of input, this prevents the RESET_N pin from being taken to the proper 3.3V level (deasserted), and this results in the PHY being not detected since it is held in reset. Taken from RESET_N pin description in ADIN13000 datasheet: This pin requires a 1K pull-up resistor to AVDD_3P3. Activate the pull-up resistor to fix the issue. Fixes: ade0176dd8a0 ("arm64: dts: imx8mn-var-som: Add Variscite VAR-SOM-MX8MN System on Module") Signed-off-by: Hugo Villeneuve Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit 1ef0aa137a96c5f0564f2db0c556a4f0f60ce8f5 Author: Yashwanth Varakala Date: Fri Jun 16 11:50:09 2023 +0200 arm64: dts: phycore-imx8mm: Correction in gpio-line-names Remove unused nINT_ETHPHY entry from gpio-line-names in gpio1 nodes of phyCORE-i.MX8MM and phyBOARD-Polis-i.MX8MM devicetrees. Fixes: ae6847f26ac9 ("arm64: dts: freescale: Add phyBOARD-Polis-i.MX8MM support") Signed-off-by: Yashwanth Varakala Signed-off-by: Cem Tenruh Signed-off-by: Shawn Guo commit cddeefc1663294fb74b31ff5029a83c0e819ff3a Author: Yashwanth Varakala Date: Fri Jun 16 11:50:07 2023 +0200 arm64: dts: phycore-imx8mm: Label typo-fix of VPU Corrected the label of the VPU regulator node (buck 3) from reg_vdd_gpu to reg_vdd_vpu. Fixes: ae6847f26ac9 ("arm64: dts: freescale: Add phyBOARD-Polis-i.MX8MM support") Signed-off-by: Yashwanth Varakala Signed-off-by: Cem Tenruh Signed-off-by: Shawn Guo commit aa84ce8a78a1a5c10cdf9c7a5fb0c999fbc2c8d6 Author: Filipe Manana Date: Fri Jul 14 13:42:06 2023 +0100 btrfs: fix warning when putting transaction with qgroups enabled after abort If we have a transaction abort with qgroups enabled we get a warning triggered when doing the final put on the transaction, like this: [552.6789] ------------[ cut here ]------------ [552.6815] WARNING: CPU: 4 PID: 81745 at fs/btrfs/transaction.c:144 btrfs_put_transaction+0x123/0x130 [btrfs] [552.6817] Modules linked in: btrfs blake2b_generic xor (...) [552.6819] CPU: 4 PID: 81745 Comm: btrfs-transacti Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1 [552.6819] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [552.6819] RIP: 0010:btrfs_put_transaction+0x123/0x130 [btrfs] [552.6821] Code: bd a0 01 00 (...) [552.6821] RSP: 0018:ffffa168c0527e28 EFLAGS: 00010286 [552.6821] RAX: ffff936042caed00 RBX: ffff93604a3eb448 RCX: 0000000000000000 [552.6821] RDX: ffff93606421b028 RSI: ffffffff92ff0878 RDI: ffff93606421b010 [552.6821] RBP: ffff93606421b000 R08: 0000000000000000 R09: ffffa168c0d07c20 [552.6821] R10: 0000000000000000 R11: ffff93608dc52950 R12: ffffa168c0527e70 [552.6821] R13: ffff93606421b000 R14: ffff93604a3eb420 R15: ffff93606421b028 [552.6821] FS: 0000000000000000(0000) GS:ffff93675fb00000(0000) knlGS:0000000000000000 [552.6821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [552.6821] CR2: 0000558ad262b000 CR3: 000000014feda005 CR4: 0000000000370ee0 [552.6822] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [552.6822] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [552.6822] Call Trace: [552.6822] [552.6822] ? __warn+0x80/0x130 [552.6822] ? btrfs_put_transaction+0x123/0x130 [btrfs] [552.6824] ? report_bug+0x1f4/0x200 [552.6824] ? handle_bug+0x42/0x70 [552.6824] ? exc_invalid_op+0x14/0x70 [552.6824] ? asm_exc_invalid_op+0x16/0x20 [552.6824] ? btrfs_put_transaction+0x123/0x130 [btrfs] [552.6826] btrfs_cleanup_transaction+0xe7/0x5e0 [btrfs] [552.6828] ? _raw_spin_unlock_irqrestore+0x23/0x40 [552.6828] ? try_to_wake_up+0x94/0x5e0 [552.6828] ? __pfx_process_timeout+0x10/0x10 [552.6828] transaction_kthread+0x103/0x1d0 [btrfs] [552.6830] ? __pfx_transaction_kthread+0x10/0x10 [btrfs] [552.6832] kthread+0xee/0x120 [552.6832] ? __pfx_kthread+0x10/0x10 [552.6832] ret_from_fork+0x29/0x50 [552.6832] [552.6832] ---[ end trace 0000000000000000 ]--- This corresponds to this line of code: void btrfs_put_transaction(struct btrfs_transaction *transaction) { (...) WARN_ON(!RB_EMPTY_ROOT( &transaction->delayed_refs.dirty_extent_root)); (...) } The warning happens because btrfs_qgroup_destroy_extent_records(), called in the transaction abort path, we free all entries from the rbtree "dirty_extent_root" with rbtree_postorder_for_each_entry_safe(), but we don't actually empty the rbtree - it's still pointing to nodes that were freed. So set the rbtree's root node to NULL to avoid this warning (assign RB_ROOT). Fixes: 81f7eb00ff5b ("btrfs: destroy qgroup extent records on transaction abort") CC: stable@vger.kernel.org # 5.10+ Reviewed-by: Josef Bacik Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 7cad645ebf20d777b2a48750ebd80fd81593b78c Author: Christoph Hellwig Date: Fri Jul 14 10:42:41 2023 +0200 btrfs: fix ordered extent split error handling in btrfs_dio_submit_io When the call to btrfs_extract_ordered_extent in btrfs_dio_submit_io fails to allocate memory for a new ordered_extent, it calls into the btrfs_dio_end_io for error handling. btrfs_dio_end_io then assumes that bbio->ordered is set because it is supposed to be at this point, except for this error handling corner case. Try to not overload the btrfs_dio_end_io with error handling of a bio in a non-canonical state, and instead call btrfs_finish_ordered_extent and iomap_dio_bio_end_io directly for this error case. Reported-by: syzbot Fixes: b41b6f6937dc ("btrfs: use btrfs_finish_ordered_extent to complete direct writes") Reviewed-by: Josef Bacik Tested-by: syzbot Signed-off-by: Christoph Hellwig Signed-off-by: David Sterba commit 17b17fcd6d446b95904a6929c40012ee7f0afc0c Author: Josef Bacik Date: Wed Jul 12 12:44:12 2023 -0400 btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand While trying to get the subpage blocksize tests running, I hit the following panic on generic/476 assertion failed: PagePrivate(page) && page->private, in fs/btrfs/subpage.c:229 kernel BUG at fs/btrfs/subpage.c:229! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 1 PID: 1453 Comm: fsstress Not tainted 6.4.0-rc7+ #12 Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20230301gitf80f052277c8-26.fc38 03/01/2023 pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : btrfs_subpage_assert+0xbc/0xf0 lr : btrfs_subpage_assert+0xbc/0xf0 Call trace: btrfs_subpage_assert+0xbc/0xf0 btrfs_subpage_clear_checked+0x38/0xc0 btrfs_page_clear_checked+0x48/0x98 btrfs_truncate_block+0x5d0/0x6a8 btrfs_cont_expand+0x5c/0x528 btrfs_write_check.isra.0+0xf8/0x150 btrfs_buffered_write+0xb4/0x760 btrfs_do_write_iter+0x2f8/0x4b0 btrfs_file_write_iter+0x1c/0x30 do_iter_readv_writev+0xc8/0x158 do_iter_write+0x9c/0x210 vfs_iter_write+0x24/0x40 iter_file_splice_write+0x224/0x390 direct_splice_actor+0x38/0x68 splice_direct_to_actor+0x12c/0x260 do_splice_direct+0x90/0xe8 generic_copy_file_range+0x50/0x90 vfs_copy_file_range+0x29c/0x470 __arm64_sys_copy_file_range+0xcc/0x498 invoke_syscall.constprop.0+0x80/0xd8 do_el0_svc+0x6c/0x168 el0_svc+0x50/0x1b0 el0t_64_sync_handler+0x114/0x120 el0t_64_sync+0x194/0x198 This happens because during btrfs_cont_expand we'll get a page, set it as mapped, and if it's not Uptodate we'll read it. However between the read and re-locking the page we could have called release_folio() on the page, but left the page in the file mapping. release_folio() can clear the page private, and thus further down we blow up when we go to modify the subpage bits. Fix this by putting the set_page_extent_mapped() after the read. This is safe because read_folio() will call set_page_extent_mapped() before it does the read, and then if we clear page private but leave it on the mapping we're completely safe re-setting set_page_extent_mapped(). With this patch I can now run generic/476 without panicing. CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Christoph Hellwig Signed-off-by: Josef Bacik Signed-off-by: David Sterba commit 486c737f7fdc0c3f6464cf27ede811daec2769a1 Author: Qu Wenruo Date: Fri Jun 30 08:56:40 2023 +0800 btrfs: raid56: always verify the P/Q contents for scrub [REGRESSION] Commit 75b470332965 ("btrfs: raid56: migrate recovery and scrub recovery path to use error_bitmap") changed the behavior of scrub_rbio(). Initially if we have no error reading the raid bio, we will assign @need_check to true, then finish_parity_scrub() would later verify the content of P/Q stripes before writeback. But after that commit we never verify the content of P/Q stripes and just writeback them. This can lead to unrepaired P/Q stripes during scrub, or already corrupted P/Q copied to the dev-replace target. [FIX] The situation is more complex than the regression, in fact the initial behavior is not 100% correct either. If we have the following rare case, it can still lead to the same problem using the old behavior: 0 16K 32K 48K 64K Data 1: |IIIIIII| | Data 2: | | Parity: | |CCCCCCC| | Where "I" means IO error, "C" means corruption. In the above case, we're scrubbing the parity stripe, then read out all the contents of Data 1, Data 2, Parity stripes. But found IO error in Data 1, which leads to rebuild using Data 2 and Parity and got the correct data. In that case, we would not verify if the Parity is correct for range [16K, 32K). So here we have to always verify the content of Parity no matter if we did recovery or not. This patch would remove the @need_check parameter of finish_parity_scrub() completely, and would always do the P/Q verification before writeback. Fixes: 75b470332965 ("btrfs: raid56: migrate recovery and scrub recovery path to use error_bitmap") CC: stable@vger.kernel.org # 6.2+ Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 866e98a4d95d93de2d485f82c69ffeabd712e48b Author: Filipe Manana Date: Thu Jul 6 00:41:16 2023 +0100 btrfs: use irq safe locking when running and adding delayed iputs Running delayed iputs, which never happens in an irq context, needs to lock the spinlock fs_info->delayed_iput_lock. When finishing bios for data writes (irq context, bio.c) we call btrfs_put_ordered_extent() which needs to add a delayed iput and for that it needs to acquire the spinlock fs_info->delayed_iput_lock. Without disabling irqs when running delayed iputs we can therefore deadlock on that spinlock. The same deadlock can also happen when adding an inode to the delayed iputs list, since this can be done outside an irq context as well. Syzbot recently reported this, which results in the following trace: ================================ WARNING: inconsistent lock state 6.4.0-syzkaller-09904-ga507db1d8fdc #0 Not tainted -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. btrfs-cleaner/16079 [HC0[0]:SC0[0]:HE1:SE1] takes: ffff888107804d20 (&fs_info->delayed_iput_lock){+.?.}-{2:2}, at: spin_lock include/linux/spinlock.h:350 [inline] ffff888107804d20 (&fs_info->delayed_iput_lock){+.?.}-{2:2}, at: btrfs_run_delayed_iputs+0x28/0xe0 fs/btrfs/inode.c:3523 {IN-SOFTIRQ-W} state was registered at: lock_acquire kernel/locking/lockdep.c:5761 [inline] lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5726 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:350 [inline] btrfs_add_delayed_iput+0x128/0x390 fs/btrfs/inode.c:3490 btrfs_put_ordered_extent fs/btrfs/ordered-data.c:559 [inline] btrfs_put_ordered_extent+0x2f6/0x610 fs/btrfs/ordered-data.c:547 __btrfs_bio_end_io fs/btrfs/bio.c:118 [inline] __btrfs_bio_end_io+0x136/0x180 fs/btrfs/bio.c:112 btrfs_orig_bbio_end_io+0x86/0x2b0 fs/btrfs/bio.c:163 btrfs_simple_end_io+0x105/0x380 fs/btrfs/bio.c:378 bio_endio+0x589/0x690 block/bio.c:1617 req_bio_endio block/blk-mq.c:766 [inline] blk_update_request+0x5c5/0x1620 block/blk-mq.c:911 blk_mq_end_request+0x59/0x680 block/blk-mq.c:1032 lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370 blk_complete_reqs+0xb3/0xf0 block/blk-mq.c:1110 __do_softirq+0x1d4/0x905 kernel/softirq.c:553 run_ksoftirqd kernel/softirq.c:921 [inline] run_ksoftirqd+0x31/0x60 kernel/softirq.c:913 smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164 kthread+0x344/0x440 kernel/kthread.c:389 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 irq event stamp: 39 hardirqs last enabled at (39): [] __do_kmem_cache_free mm/slab.c:3558 [inline] hardirqs last enabled at (39): [] kmem_cache_free mm/slab.c:3582 [inline] hardirqs last enabled at (39): [] kmem_cache_free+0x244/0x370 mm/slab.c:3575 hardirqs last disabled at (38): [] __do_kmem_cache_free mm/slab.c:3553 [inline] hardirqs last disabled at (38): [] kmem_cache_free mm/slab.c:3582 [inline] hardirqs last disabled at (38): [] kmem_cache_free+0x1de/0x370 mm/slab.c:3575 softirqs last enabled at (0): [] copy_process+0x227f/0x75c0 kernel/fork.c:2448 softirqs last disabled at (0): [<0000000000000000>] 0x0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&fs_info->delayed_iput_lock); lock(&fs_info->delayed_iput_lock); *** DEADLOCK *** 1 lock held by btrfs-cleaner/16079: #0: ffff888107804860 (&fs_info->cleaner_mutex){+.+.}-{3:3}, at: cleaner_kthread+0x103/0x4b0 fs/btrfs/disk-io.c:1463 stack backtrace: CPU: 3 PID: 16079 Comm: btrfs-cleaner Not tainted 6.4.0-syzkaller-09904-ga507db1d8fdc #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_usage_bug kernel/locking/lockdep.c:3978 [inline] valid_state kernel/locking/lockdep.c:4020 [inline] mark_lock_irq kernel/locking/lockdep.c:4223 [inline] mark_lock.part.0+0x1102/0x1960 kernel/locking/lockdep.c:4685 mark_lock kernel/locking/lockdep.c:4649 [inline] mark_usage kernel/locking/lockdep.c:4598 [inline] __lock_acquire+0x8e4/0x5e20 kernel/locking/lockdep.c:5098 lock_acquire kernel/locking/lockdep.c:5761 [inline] lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5726 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:350 [inline] btrfs_run_delayed_iputs+0x28/0xe0 fs/btrfs/inode.c:3523 cleaner_kthread+0x2e5/0x4b0 fs/btrfs/disk-io.c:1478 kthread+0x344/0x440 kernel/kthread.c:389 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 So fix this by using spin_lock_irq() and spin_unlock_irq() when running delayed iputs, and using spin_lock_irqsave() and spin_unlock_irqrestore() when adding a delayed iput(). Reported-by: syzbot+da501a04be5ff533b102@syzkaller.appspotmail.com Fixes: ec63b84d4611 ("btrfs: add an ordered_extent pointer to struct btrfs_bio") Link: https://lore.kernel.org/linux-btrfs/000000000000d5c89a05ffbd39dd@google.com/ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit cbaee87f2ef628c10331b69a2f3def6bc32402d7 Author: Filipe Manana Date: Mon Jul 3 18:15:31 2023 +0100 btrfs: fix iput() on error pointer after error during orphan cleanup At btrfs_orphan_cleanup(), if we can't find an inode (btrfs_iget() returns an -ENOENT error pointer), we proceed with 'ret' set to -ENOENT and the inode pointer set to ERR_PTR(-ENOENT). Later when we proceed to the body of the following if statement: if (ret == -ENOENT || inode->i_nlink) { (...) trans = btrfs_start_transaction(root, 1); if (IS_ERR(trans)) { ret = PTR_ERR(trans); iput(inode); goto out; } (...) ret = btrfs_del_orphan_item(trans, root, found_key.objectid); btrfs_end_transaction(trans); if (ret) { iput(inode); goto out; } continue; } If we get an error from btrfs_start_transaction() or from the call to btrfs_del_orphan_item() we end calling iput() against an inode pointer that has a value of ERR_PTR(-ENOENT), resulting in a crash with the following trace: [876.667] BUG: kernel NULL pointer dereference, address: 0000000000000096 [876.667] #PF: supervisor read access in kernel mode [876.667] #PF: error_code(0x0000) - not-present page [876.667] PGD 0 P4D 0 [876.668] Oops: 0000 [#1] PREEMPT SMP PTI [876.668] CPU: 0 PID: 2356187 Comm: mount Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1 [876.668] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [876.668] RIP: 0010:iput+0xa/0x20 [876.668] Code: ff ff ff 66 (...) [876.669] RSP: 0018:ffffafa9c0c9f9d0 EFLAGS: 00010282 [876.669] RAX: ffffffffffffffe4 RBX: 000000000009453b RCX: 0000000000000000 [876.669] RDX: 0000000000000001 RSI: ffffafa9c0c9f930 RDI: fffffffffffffffe [876.669] RBP: ffff95c612f3b800 R08: 0000000000000001 R09: ffffffffffffffe4 [876.670] R10: 00018f2a71010000 R11: 000000000ead96e3 R12: ffff95cb7d6909a0 [876.670] R13: fffffffffffffffe R14: ffff95c60f477000 R15: 00000000ffffffe4 [876.670] FS: 00007f5fbe30a840(0000) GS:ffff95ccdfa00000(0000) knlGS:0000000000000000 [876.670] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [876.671] CR2: 0000000000000096 CR3: 000000055e9f6004 CR4: 0000000000370ef0 [876.671] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [876.671] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [876.672] Call Trace: [876.744] [876.744] ? __die_body+0x1b/0x60 [876.744] ? page_fault_oops+0x15d/0x450 [876.745] ? __kmem_cache_alloc_node+0x47/0x410 [876.745] ? do_user_addr_fault+0x65/0x8a0 [876.745] ? exc_page_fault+0x74/0x170 [876.746] ? asm_exc_page_fault+0x22/0x30 [876.746] ? iput+0xa/0x20 [876.746] btrfs_orphan_cleanup+0x221/0x330 [btrfs] [876.746] btrfs_lookup_dentry+0x58f/0x5f0 [btrfs] [876.747] btrfs_lookup+0xe/0x30 [btrfs] [876.747] __lookup_slow+0x82/0x130 [876.785] walk_component+0xe5/0x160 [876.786] path_lookupat.isra.0+0x6e/0x150 [876.786] filename_lookup+0xcf/0x1a0 [876.786] ? mod_objcg_state+0xd2/0x360 [876.786] ? obj_cgroup_charge+0xf5/0x110 [876.787] ? should_failslab+0xa/0x20 [876.787] ? kmem_cache_alloc+0x47/0x450 [876.787] vfs_path_lookup+0x51/0x90 [876.788] mount_subtree+0x8d/0x130 [876.788] btrfs_mount+0x149/0x410 [btrfs] [876.788] ? __kmem_cache_alloc_node+0x47/0x410 [876.788] ? vfs_parse_fs_param+0xc0/0x110 [876.789] legacy_get_tree+0x24/0x50 [876.834] vfs_get_tree+0x22/0xd0 [876.852] path_mount+0x2d8/0x9c0 [876.852] do_mount+0x79/0x90 [876.852] __x64_sys_mount+0x8e/0xd0 [876.853] do_syscall_64+0x38/0x90 [876.899] entry_SYSCALL_64_after_hwframe+0x72/0xdc [876.958] RIP: 0033:0x7f5fbe50b76a [876.959] Code: 48 8b 0d a9 (...) [876.959] RSP: 002b:00007fff01925798 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [876.959] RAX: ffffffffffffffda RBX: 00007f5fbe694264 RCX: 00007f5fbe50b76a [876.960] RDX: 0000561bde6c8720 RSI: 0000561bde6bdec0 RDI: 0000561bde6c31a0 [876.960] RBP: 0000561bde6bdc70 R08: 0000000000000000 R09: 0000000000000001 [876.960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [876.960] R13: 0000561bde6c31a0 R14: 0000561bde6c8720 R15: 0000561bde6bdc70 [876.960] So fix this by setting 'inode' to NULL whenever we get an error from btrfs_iget(), and to make the code simpler, stop testing for 'ret' being -ENOENT to check if we have an inode - instead test for 'inode' being NULL or not. Having a NULL 'inode' prevents any iput() call from crashing, as iput() ignores NULL inode pointers. Also, stop testing for a NULL return value from btrfs_iget() with PTR_ERR_OR_ZERO(), because btrfs_iget() never returns NULL - in case an inode is not found, it returns ERR_PTR(-ENOENT), and in case of memory allocation failure, it returns ERR_PTR(-ENOMEM). We also don't need the extra iput() calls on the error branches for the btrfs_start_transaction() and btrfs_del_orphan_item() calls, as we have already called iput() before, so remove them. Fixes: a13bb2c03848 ("btrfs: add missing iputs on orphan cleanup failure") CC: stable@vger.kernel.org # 6.4 Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit b777d279ff31979add57e8a3f810bceb7ef0cfb7 Author: Filipe Manana Date: Mon Jul 3 18:15:30 2023 +0100 btrfs: fix double iput() on inode after an error during orphan cleanup At btrfs_orphan_cleanup(), if we were able to find the inode, we do an iput() on the inode, then if btrfs_drop_verity_items() succeeds and then either btrfs_start_transaction() or btrfs_del_orphan_item() fail, we do another iput() in the respective error paths, resulting in an extra iput() on the inode. Fix this by setting inode to NULL after the first iput(), as iput() ignores a NULL inode pointer argument. Fixes: a13bb2c03848 ("btrfs: add missing iputs on orphan cleanup failure") CC: stable@vger.kernel.org # 6.4 Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit f1a07c2b4e2c473ec322b8b9ece071b8c88a3512 Author: Filipe Manana Date: Mon Jul 3 12:03:21 2023 +0100 btrfs: zoned: fix memory leak after finding block group with super blocks At exclude_super_stripes(), if we happen to find a block group that has super blocks mapped to it and we are on a zoned filesystem, we error out as this is not supposed to happen, indicating either a bug or maybe some memory corruption for example. However we are exiting the function without freeing the memory allocated for the logical address of the super blocks. Fix this by freeing the logical address. Fixes: 12659251ca5d ("btrfs: implement log-structured superblock for ZONED mode") CC: stable@vger.kernel.org # 5.10+ Reviewed-by: Johannes Thumshirn Reviewed-by: Anand Jain Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit ee70b908f77a9d8f689dea986f09e6d7dc481934 Author: Xu Yang Date: Mon Jul 17 10:28:33 2023 +0800 ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node Property name "phy-3p0-supply" is used instead of "phy-reg_3p0-supply". Fixes: 9f30b6b1a957 ("ARM: dts: imx: Add basic dtsi file for imx6sll") cc: Signed-off-by: Xu Yang Signed-off-by: Shawn Guo commit dcb60f9c403e03133363563ac8ea5d8bba6c2be1 Author: Randy Dunlap Date: Wed Jul 12 20:08:32 2023 -0700 cpumask: eliminate kernel-doc warnings Update lib/cpumask.c and to fix all kernel-doc warnings: include/linux/cpumask.h:185: warning: Function parameter or member 'srcp1' not described in 'cpumask_first_and' include/linux/cpumask.h:185: warning: Function parameter or member 'srcp2' not described in 'cpumask_first_and' include/linux/cpumask.h:185: warning: Excess function parameter 'src1p' description in 'cpumask_first_and' include/linux/cpumask.h:185: warning: Excess function parameter 'src2p' description in 'cpumask_first_and' lib/cpumask.c:59: warning: Function parameter or member 'node' not described in 'alloc_cpumask_var_node' lib/cpumask.c:169: warning: Function parameter or member 'src1p' not described in 'cpumask_any_and_distribute' lib/cpumask.c:169: warning: Function parameter or member 'src2p' not described in 'cpumask_any_and_distribute' Fixes: 7b4967c53204 ("cpumask: Add alloc_cpumask_var_node()") Fixes: 839cad5fa54b ("cpumask: fix function description kernel-doc notation") Fixes: 93ba139ba819 ("cpumask: use find_first_and_bit()") Signed-off-by: Randy Dunlap Reviewed-by: Andy Shevchenko Signed-off-by: Yury Norov commit 1cd0787f082e1a179f2b6e749d08daff1a9f6b1b Author: Rob Clark Date: Wed Jul 12 15:25:23 2023 -0700 drm/msm: Fix hw_fence error path cleanup In an error path where the submit is free'd without the job being run, the hw_fence pointer is simply a kzalloc'd block of memory. In this case we should just kfree() it, rather than trying to decrement it's reference count. Fortunately we can tell that this is the case by checking for a zero refcount, since if the job was run, the submit would be holding a reference to the hw_fence. Fixes: f94e6a51e17c ("drm/msm: Pre-allocate hw_fence") Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/547088/ commit ef5c3de5211b5a3a8102b25aa83eb4cde65ac2fd Author: Liam R. Howlett Date: Wed Jul 12 13:39:16 2023 -0400 maple_tree: fix node allocation testing on 32 bit Internal node counting was altered and the 64 bit test was updated, however the 32bit test was missed. Restore the 32bit test to a functional state. Link: https://lore.kernel.org/linux-mm/CAMuHMdV4T53fOw7VPoBgPR7fP6RYqf=CBhD_y_vOg53zZX_DnA@mail.gmail.com/ Link: https://lkml.kernel.org/r/20230712173916.168805-2-Liam.Howlett@oracle.com Fixes: 541e06b772c1 ("maple_tree: remove GFP_ZERO from kmem_cache_alloc() and kmem_cache_alloc_bulk()") Signed-off-by: Liam R. Howlett Cc: Signed-off-by: Andrew Morton commit 7a93c71a6714ca1a9c03d70432dac104b0cfb815 Author: Liam R. Howlett Date: Wed Jul 12 13:39:15 2023 -0400 maple_tree: fix 32 bit mas_next testing The test setup of mas_next is dependent on node entry size to create a 2 level tree, but the tests did not account for this in the expected value when shifting beyond the scope of the tree. Fix this by setting up the test to succeed depending on the node entries which is dependent on the 32/64 bit setup. Link: https://lkml.kernel.org/r/20230712173916.168805-1-Liam.Howlett@oracle.com Fixes: 120b116208a0 ("maple_tree: reorganize testing to restore module testing") Signed-off-by: Liam R. Howlett Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/linux-mm/CAMuHMdV4T53fOw7VPoBgPR7fP6RYqf=CBhD_y_vOg53zZX_DnA@mail.gmail.com/ Tested-by: Geert Uytterhoeven Cc: Signed-off-by: Andrew Morton commit 25b5949c30938c7f26dbadc948b491e0e0811c78 Author: Colin Ian King Date: Wed Jul 12 14:46:48 2023 +0100 selftests/mm: mkdirty: fix incorrect position of #endif The #endif is the wrong side of a } causing a build failure when __NR_userfaultfd is not defined. Fix this by moving the #end to enclose the } Link: https://lkml.kernel.org/r/20230712134648.456349-1-colin.i.king@gmail.com Fixes: 9eac40fc0cc7 ("selftests/mm: mkdirty: test behavior of (pte|pmd)_mkdirty on VMAs without write permissions") Signed-off-by: Colin Ian King Reviewed-by: David Hildenbrand Cc: Shuah Khan Cc: Signed-off-by: Andrew Morton commit 3c769fd88b9742954763a968e84de09f7ad78cfe Author: Peng Zhang Date: Tue Jul 11 11:54:37 2023 +0800 maple_tree: set the node limit when creating a new root node Set the node limit of the root node so that the last pivot of all nodes is the node limit (if the node is not full). This patch also fixes a bug in mas_rev_awalk(). Effectively, always setting a maximum makes mas_logical_pivot() behave as mas_safe_pivot(). Without this fix, it is possible that very small tasks would fail to find the correct gap. Although this has not been observed with real tasks, it has been reported to happen in m68k nommu running the maple tree tests. Link: https://lkml.kernel.org/r/20230711035444.526-1-zhangpeng.00@bytedance.com Link: https://lore.kernel.org/linux-mm/CAMuHMdV4T53fOw7VPoBgPR7fP6RYqf=CBhD_y_vOg53zZX_DnA@mail.gmail.com/ Link: https://lkml.kernel.org/r/20230711035444.526-2-zhangpeng.00@bytedance.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Peng Zhang Reviewed-by: Liam R. Howlett Tested-by: Geert Uytterhoeven Cc: Signed-off-by: Andrew Morton commit 2658f94d679243209889cdfa8de3743cde1abea9 Author: Liam R. Howlett Date: Tue Jul 11 13:50:20 2023 -0400 mm/mlock: fix vma iterator conversion of apply_vma_lock_flags() apply_vma_lock_flags() calls mlock_fixup(), which could merge the VMA after where the vma iterator is located. Although this is not an issue, the next iteration of the loop will check the start of the vma to be equal to the locally saved 'tmp' variable and cause an incorrect failure scenario. Fix the error by setting tmp to the end of the vma iterator value before restarting the loop. There is also a potential of the error code being overwritten when the loop terminates early. Fix the return issue by directly returning when an error is encountered since there is nothing to undo after the loop. Link: https://lkml.kernel.org/r/20230711175020.4091336-1-Liam.Howlett@oracle.com Fixes: 37598f5a9d8b ("mlock: convert mlock to vma iterator") Signed-off-by: Liam R. Howlett Reported-by: Ryan Roberts Link: https://lore.kernel.org/linux-mm/50341ca1-d582-b33a-e3d0-acb08a65166f@arm.com/ Tested-by: Ryan Roberts Cc: Signed-off-by: Andrew Morton commit 636e348353a7cc52609fdba5ff3270065da140d5 Author: Miguel Ojeda Date: Sun Jul 9 01:33:44 2023 +0200 prctl: move PR_GET_AUXV out of PR_MCE_KILL Somehow PR_GET_AUXV got added into PR_MCE_KILL's switch when the patch was applied [1]. Thus move it out of the switch, to the place the patch added it. In the recently released v6.4 kernel some user could, in principle, be already using this feature by mapping the right page and passing the PR_GET_AUXV constant as a pointer: prctl(PR_MCE_KILL, PR_GET_AUXV, ...) So this does change the behavior for users. We could keep the bug since the other subcases in PR_MCE_KILL (PR_MCE_KILL_CLEAR and PR_MCE_KILL_SET) do not overlap. However, v6.4 may be recent enough (2 weeks old) that moving the lines (rather than just adding a new case) does not break anybody? Moreover, the documentation in man-pages was just committed today [2]. Link: https://lkml.kernel.org/r/20230708233344.361854-1-ojeda@kernel.org Fixes: ddc65971bb67 ("prctl: add PR_GET_AUXV to copy auxv to userspace") Link: https://lore.kernel.org/all/d81864a7f7f43bca6afa2a09fc2e850e4050ab42.1680611394.git.josh@joshtriplett.org/ [1] Link: https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/commit/?id=8cf0c06bfd3c2b219b044d4151c96f0da50af9ad [2] Signed-off-by: Miguel Ojeda Cc: Josh Triplett Cc: Signed-off-by: Andrew Morton commit 481c2d14627de8ecbb54dd125466e4b4a5069b47 Author: Lino Sanfilippo Date: Thu Jul 13 21:01:08 2023 +0200 tpm,tpm_tis: Disable interrupts after 1000 unhandled IRQs After activation of interrupts for TPM TIS drivers 0-day reports an interrupt storm on an Inspur NF5180M6 server. Fix this by detecting the storm and falling back to polling: Count the number of unhandled interrupts within a 10 ms time interval. In case that more than 1000 were unhandled deactivate interrupts entirely, deregister the handler and use polling instead. Also print a note to point to the tpm_tis_dmi_table. Since the interrupt deregistration function devm_free_irq() waits for all interrupt handlers to finish, only trigger a worker in the interrupt handler and do the unregistration in the worker to avoid a deadlock. Note: the storm detection logic equals the implementation in note_interrupt() which uses timestamps and counters stored in struct irq_desc. Since this structure is private to the generic interrupt core the TPM TIS core uses its own timestamps and counters. Furthermore the TPM interrupt handler always returns IRQ_HANDLED to prevent the generic interrupt core from processing the interrupt storm. Cc: stable@vger.kernel.org # v6.4+ Fixes: e644b2f498d2 ("tpm, tpm_tis: Enable interrupt test") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202305041325.ae8b0c43-yujie.liu@intel.com/ Suggested-by: Lukas Wunner Signed-off-by: Lino Sanfilippo Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 393f362389cecc2e4f2e3520a6c8ee9dbb1e3d15 Author: Florian Bezdeka Date: Tue Jun 20 13:11:01 2023 +0200 tpm/tpm_tis: Disable interrupts for Lenovo L590 devices The Lenovo L590 suffers from an irq storm issue like the T490, T490s and P360 Tiny, so add an entry for it to tpm_tis_dmi_table and force polling. Cc: stable@vger.kernel.org # v6.4+ Link: https://bugzilla.redhat.com/show_bug.cgi?id=2214069#c0 Fixes: e644b2f498d2 ("tpm, tpm_tis: Enable interrupt test") Signed-off-by: Florian Bezdeka Reviewed-by: Jerry Snitselaar Reviewed-by: Hans de Goede Signed-off-by: Jarkko Sakkinen commit b1c1b98962d17a922989aa3b2822946bbb5c091f Author: Valentin David Date: Mon Jul 10 22:27:49 2023 +0200 tpm: Do not remap from ACPI resources again for Pluton TPM For Pluton TPM devices, it was assumed that there was no ACPI memory regions. This is not true for ASUS ROG Ally. ACPI advertises 0xfd500000-0xfd5fffff. Since remapping is already done in `crb_map_pluton`, remapping again in `crb_map_io` causes EBUSY error: [ 3.510453] tpm_crb MSFT0101:00: can't request region for resource [mem 0xfd500000-0xfd5fffff] [ 3.510463] tpm_crb: probe of MSFT0101:00 failed with error -16 Cc: stable@vger.kernel.org # v6.3+ Fixes: 4d2732882703 ("tpm_crb: Add support for CRB devices based on Pluton") Signed-off-by: Valentin David Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit bc825e851c2fe89c127cac1e0e5cf344c4940619 Author: Christian Hesse Date: Mon Jul 10 23:16:10 2023 +0200 tpm/tpm_tis: Disable interrupts for Framework Laptop Intel 13th gen This device suffer an irq storm, so add it in tpm_tis_dmi_table to force polling. Cc: stable@vger.kernel.org # v6.4+ Link: https://community.frame.work/t/boot-and-shutdown-hangs-with-arch-linux-kernel-6-4-1-mainline-and-arch/33118 Fixes: e644b2f498d2 ("tpm, tpm_tis: Enable interrupt test") Reported-by: Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217631 Signed-off-by: Christian Hesse Signed-off-by: Jarkko Sakkinen commit 08b0af4478bacb8bb701c172c99a34ea32da89f5 Author: Christian Hesse Date: Mon Jul 10 23:16:09 2023 +0200 tpm/tpm_tis: Disable interrupts for Framework Laptop Intel 12th gen This device suffer an irq storm, so add it in tpm_tis_dmi_table to force polling. Cc: stable@vger.kernel.org # v6.4+ Link: https://community.frame.work/t/boot-and-shutdown-hangs-with-arch-linux-kernel-6-4-1-mainline-and-arch/33118 Fixes: e644b2f498d2 ("tpm, tpm_tis: Enable interrupt test") Reported-by: Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217631 Signed-off-by: Christian Hesse Signed-off-by: Jarkko Sakkinen commit 2a4152742025c5f21482e8cebc581702a0fa5b01 Author: Jiapeng Chong Date: Wed Jun 14 10:18:25 2023 +0800 security: keys: Modify mismatched function name No functional modification involved. security/keys/trusted-keys/trusted_tpm2.c:203: warning: expecting prototype for tpm_buf_append_auth(). Prototype was for tpm2_buf_append_auth() instead. Fixes: 2e19e10131a0 ("KEYS: trusted: Move TPM2 trusted keys code") Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=5524 Signed-off-by: Jiapeng Chong Reviewed-by: Paul Moore Signed-off-by: Jarkko Sakkinen commit ecff6813d2bcf0c670881a9ba3f51cb032dd405a Author: Jerry Snitselaar Date: Thu Jun 29 13:41:47 2023 -0700 tpm: return false from tpm_amd_is_rng_defective on non-x86 platforms tpm_amd_is_rng_defective is for dealing with an issue related to the AMD firmware TPM, so on non-x86 architectures just have it inline and return false. Cc: stable@vger.kernel.org # v6.3+ Reported-by: Sachin Sant Reported-by: Aneesh Kumar K. V Closes: https://lore.kernel.org/lkml/99B81401-DB46-49B9-B321-CF832B50CAC3@linux.ibm.com/ Fixes: f1324bbc4011 ("tpm: disable hwrng for fTPM on some AMD designs") Signed-off-by: Jerry Snitselaar Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit d55901522f96082a43b9842d34867363c0cdbac5 Author: Petr Pavlu Date: Thu Mar 23 14:04:12 2023 +0100 keys: Fix linking a duplicate key to a keyring's assoc_array When making a DNS query inside the kernel using dns_query(), the request code can in rare cases end up creating a duplicate index key in the assoc_array of the destination keyring. It is eventually found by a BUG_ON() check in the assoc_array implementation and results in a crash. Example report: [2158499.700025] kernel BUG at ../lib/assoc_array.c:652! [2158499.700039] invalid opcode: 0000 [#1] SMP PTI [2158499.700065] CPU: 3 PID: 31985 Comm: kworker/3:1 Kdump: loaded Not tainted 5.3.18-150300.59.90-default #1 SLE15-SP3 [2158499.700096] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 [2158499.700351] Workqueue: cifsiod cifs_resolve_server [cifs] [2158499.700380] RIP: 0010:assoc_array_insert+0x85f/0xa40 [2158499.700401] Code: ff 74 2b 48 8b 3b 49 8b 45 18 4c 89 e6 48 83 e7 fe e8 95 ec 74 00 3b 45 88 7d db 85 c0 79 d4 0f 0b 0f 0b 0f 0b e8 41 f2 be ff <0f> 0b 0f 0b 81 7d 88 ff ff ff 7f 4c 89 eb 4c 8b ad 58 ff ff ff 0f [2158499.700448] RSP: 0018:ffffc0bd6187faf0 EFLAGS: 00010282 [2158499.700470] RAX: ffff9f1ea7da2fe8 RBX: ffff9f1ea7da2fc1 RCX: 0000000000000005 [2158499.700492] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000000 [2158499.700515] RBP: ffffc0bd6187fbb0 R08: ffff9f185faf1100 R09: 0000000000000000 [2158499.700538] R10: ffff9f1ea7da2cc0 R11: 000000005ed8cec8 R12: ffffc0bd6187fc28 [2158499.700561] R13: ffff9f15feb8d000 R14: ffff9f1ea7da2fc0 R15: ffff9f168dc0d740 [2158499.700585] FS: 0000000000000000(0000) GS:ffff9f185fac0000(0000) knlGS:0000000000000000 [2158499.700610] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [2158499.700630] CR2: 00007fdd94fca238 CR3: 0000000809d8c006 CR4: 00000000003706e0 [2158499.700702] Call Trace: [2158499.700741] ? key_alloc+0x447/0x4b0 [2158499.700768] ? __key_link_begin+0x43/0xa0 [2158499.700790] __key_link_begin+0x43/0xa0 [2158499.700814] request_key_and_link+0x2c7/0x730 [2158499.700847] ? dns_resolver_read+0x20/0x20 [dns_resolver] [2158499.700873] ? key_default_cmp+0x20/0x20 [2158499.700898] request_key_tag+0x43/0xa0 [2158499.700926] dns_query+0x114/0x2ca [dns_resolver] [2158499.701127] dns_resolve_server_name_to_ip+0x194/0x310 [cifs] [2158499.701164] ? scnprintf+0x49/0x90 [2158499.701190] ? __switch_to_asm+0x40/0x70 [2158499.701211] ? __switch_to_asm+0x34/0x70 [2158499.701405] reconn_set_ipaddr_from_hostname+0x81/0x2a0 [cifs] [2158499.701603] cifs_resolve_server+0x4b/0xd0 [cifs] [2158499.701632] process_one_work+0x1f8/0x3e0 [2158499.701658] worker_thread+0x2d/0x3f0 [2158499.701682] ? process_one_work+0x3e0/0x3e0 [2158499.701703] kthread+0x10d/0x130 [2158499.701723] ? kthread_park+0xb0/0xb0 [2158499.701746] ret_from_fork+0x1f/0x40 The situation occurs as follows: * Some kernel facility invokes dns_query() to resolve a hostname, for example, "abcdef". The function registers its global DNS resolver cache as current->cred.thread_keyring and passes the query to request_key_net() -> request_key_tag() -> request_key_and_link(). * Function request_key_and_link() creates a keyring_search_context object. Its match_data.cmp method gets set via a call to type->match_preparse() (resolves to dns_resolver_match_preparse()) to dns_resolver_cmp(). * Function request_key_and_link() continues and invokes search_process_keyrings_rcu() which returns that a given key was not found. The control is then passed to request_key_and_link() -> construct_alloc_key(). * Concurrently to that, a second task similarly makes a DNS query for "abcdef." and its result gets inserted into the DNS resolver cache. * Back on the first task, function construct_alloc_key() first runs __key_link_begin() to determine an assoc_array_edit operation to insert a new key. Index keys in the array are compared exactly as-is, using keyring_compare_object(). The operation finds that "abcdef" is not yet present in the destination keyring. * Function construct_alloc_key() continues and checks if a given key is already present on some keyring by again calling search_process_keyrings_rcu(). This search is done using dns_resolver_cmp() and "abcdef" gets matched with now present key "abcdef.". * The found key is linked on the destination keyring by calling __key_link() and using the previously calculated assoc_array_edit operation. This inserts the "abcdef." key in the array but creates a duplicity because the same index key is already present. Fix the problem by postponing __key_link_begin() in construct_alloc_key() until an actual key which should be linked into the destination keyring is determined. [jarkko@kernel.org: added a fixes tag and cc to stable] Cc: stable@vger.kernel.org # v5.3+ Fixes: df593ee23e05 ("keys: Hoist locking out of __key_link_begin()") Signed-off-by: Petr Pavlu Reviewed-by: Joey Lee Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 83e7e5d89f04d1c417492940f7922bc8416a8cc4 Author: Alexander Sverdlin Date: Wed May 24 17:40:40 2023 +0200 tpm: tis_i2c: Limit write bursts to I2C_SMBUS_BLOCK_MAX (32) bytes Underlying I2C bus drivers not always support longer transfers and imx-lpi2c for instance doesn't. The fix is symmetric to previous patch which fixed the read direction. Cc: stable@vger.kernel.org # v5.20+ Fixes: bbc23a07b072 ("tpm: Add tpm_tis_i2c backend for tpm_tis_core") Tested-by: Michael Haener Signed-off-by: Alexander Sverdlin Reviewed-by: Jarkko Sakkinen Reviewed-by: Jerry Snitselaar Signed-off-by: Jarkko Sakkinen commit f3b70b6e3390bfdf18fdd7d278a72a12784fdcce Author: Alexander Sverdlin Date: Wed May 24 17:40:39 2023 +0200 tpm: tis_i2c: Limit read bursts to I2C_SMBUS_BLOCK_MAX (32) bytes Underlying I2C bus drivers not always support longer transfers and imx-lpi2c for instance doesn't. SLB 9673 offers 427-bytes packets. Visible symptoms are: tpm tpm0: Error left over data tpm tpm0: tpm_transmit: tpm_recv: error -5 tpm_tis_i2c: probe of 1-002e failed with error -5 Cc: stable@vger.kernel.org # v5.20+ Fixes: bbc23a07b072 ("tpm: Add tpm_tis_i2c backend for tpm_tis_core") Tested-by: Michael Haener Signed-off-by: Alexander Sverdlin Reviewed-by: Jarkko Sakkinen Reviewed-by: Jerry Snitselaar Signed-off-by: Jarkko Sakkinen commit f0afba4042bd902d290405c0638bc1295872d8a7 Author: Peijie Shao Date: Tue May 23 10:45:36 2023 +0800 tpm_tis_spi: Release chip select when flow control fails The failure paths in tpm_tis_spi_transfer() do not deactivate chip select. Send an empty message (cs_select == 0) to overcome this. The patch is tested by two ways. One way needs to touch hardware: 1. force pull MISO pin down to GND, it emulates a forever 'WAIT' timing. 2. probe cs pin by an oscilloscope. 3. load tpm_tis_spi.ko. After loading, dmesg prints: "probe of spi0.0 failed with error -110" and oscilloscope shows cs pin goes high(deactivated) after the failure. Before the patch, cs pin keeps low. Second way is by writing a fake spi controller. 1. implement .transfer_one method, fill all rx buf with 0. 2. implement .set_cs method, print the state of cs pin. we can see cs goes high after the failure. Signed-off-by: Peijie Shao Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit edb13d7bb034c4d5523f15e9aeea31c504af6f91 Author: Peter Ujfalusi Date: Wed May 17 15:29:31 2023 +0300 tpm: tpm_tis: Disable interrupts *only* for AEON UPX-i11 Further restrict with DMI_PRODUCT_VERSION. Cc: stable@vger.kernel.org # v6.4+ Link: https://lore.kernel.org/linux-integrity/20230517122931.22385-1-peter.ujfalusi@linux.intel.com/ Fixes: 95a9359ee22f ("tpm: tpm_tis: Disable interrupts for AEON UPX-i11") Signed-off-by: Peter Ujfalusi Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit f4032d615f90970d6c3ac1d9c0bce3351eb4445c Author: Jarkko Sakkinen Date: Tue May 16 01:25:54 2023 +0300 tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation /dev/vtpmx is made visible before 'workqueue' is initialized, which can lead to a memory corruption in the worst case scenario. Address this by initializing 'workqueue' as the very first step of the driver initialization. Cc: stable@vger.kernel.org Fixes: 6f99612e2500 ("tpm: Proxy driver for supporting multiple emulated TPMs") Reviewed-by: Stefan Berger Signed-off-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 6e8a996563ecbe68e49c49abd4aaeef69f11f2dc Author: Gaosheng Cui Date: Mon Jul 17 09:47:38 2023 +0800 drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb() The msm_gem_get_vaddr() returns an ERR_PTR() on failure, and a null is catastrophic here, so we should use IS_ERR_OR_NULL() to check the return value. Fixes: 6a8bd08d0465 ("drm/msm: add sudo flag to submit ioctl") Signed-off-by: Gaosheng Cui Reviewed-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Reviewed-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/547712/ Signed-off-by: Rob Clark commit 269f399dc19f0e5c51711c3ba3bd06e0ef6ef403 Author: Matus Gajdos Date: Wed Jul 12 14:49:33 2023 +0200 ASoC: fsl_sai: Disable bit clock with transmitter Otherwise bit clock remains running writing invalid data to the DAC. Signed-off-by: Matus Gajdos Acked-by: Shengjiu Wang Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230712124934.32232-1-matuszpd@gmail.com Signed-off-by: Mark Brown commit 9efa1a5407e81265ea502cab83be4de503decc49 Author: Fedor Ross Date: Thu May 4 21:50:59 2023 +0200 can: mcp251xfd: __mcp251xfd_chip_set_mode(): increase poll timeout The mcp251xfd controller needs an idle bus to enter 'Normal CAN 2.0 mode' or . The maximum length of a CAN frame is 736 bits (64 data bytes, CAN-FD, EFF mode, worst case bit stuffing and interframe spacing). For low bit rates like 10 kbit/s the arbitrarily chosen MCP251XFD_POLL_TIMEOUT_US of 1 ms is too small. Otherwise during polling for the CAN controller to enter 'Normal CAN 2.0 mode' the timeout limit is exceeded and the configuration fails with: | $ ip link set dev can1 up type can bitrate 10000 | [ 731.911072] mcp251xfd spi2.1 can1: Controller failed to enter mode CAN 2.0 Mode (6) and stays in Configuration Mode (4) (con=0x068b0760, osc=0x00000468). | [ 731.927192] mcp251xfd spi2.1 can1: CRC read error at address 0x0e0c (length=4, data=00 00 00 00, CRC=0x0000) retrying. | [ 731.938101] A link change request failed with some changes committed already. Interface can1 may have been left with an inconsistent configuration, please check. | RTNETLINK answers: Connection timed out Make MCP251XFD_POLL_TIMEOUT_US timeout calculation dynamic. Use maximum of 1ms and bit time of 1 full 64 data bytes CAN-FD frame in EFF mode, worst case bit stuffing and interframe spacing at the current bit rate. For easier backporting define the macro MCP251XFD_FRAME_LEN_MAX_BITS that holds the max frame length in bits, which is 736. This can be replaced by can_frame_bits(true, true, true, true, CANFD_MAX_DLEN) in a cleanup patch later. Fixes: 55e5b97f003e8 ("can: mcp25xxfd: add driver for Microchip MCP25xxFD SPI CAN") Signed-off-by: Fedor Ross Signed-off-by: Marek Vasut Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20230717-mcp251xfd-fix-increase-poll-timeout-v5-1-06600f34c684@pengutronix.de Signed-off-by: Marc Kleine-Budde commit c34743daca0eb1dc855831a5210f0800a850088e Author: Ahmed Zaki Date: Mon Jun 5 10:52:26 2023 -0400 iavf: fix reset task race with iavf_remove() The reset task is currently scheduled from the watchdog or adminq tasks. First, all direct calls to schedule the reset task are replaced with the iavf_schedule_reset(), which is modified to accept the flag showing the type of reset. To prevent the reset task from starting once iavf_remove() starts, we need to check the __IAVF_IN_REMOVE_TASK bit before we schedule it. This is now easily added to iavf_schedule_reset(). Finally, remove the check for IAVF_FLAG_RESET_NEEDED in the watchdog task. It is redundant since all callers who set the flag immediately schedules the reset task. Fixes: 3ccd54ef44eb ("iavf: Fix init state closure on remove") Fixes: 14756b2ae265 ("iavf: Fix __IAVF_RESETTING state usage") Signed-off-by: Ahmed Zaki Signed-off-by: Mateusz Palczewski Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit d1639a17319ba78a018280cd2df6577a7e5d9fab Author: Ahmed Zaki Date: Mon Jun 5 10:52:25 2023 -0400 iavf: fix a deadlock caused by rtnl and driver's lock circular dependencies A driver's lock (crit_lock) is used to serialize all the driver's tasks. Lockdep, however, shows a circular dependency between rtnl and crit_lock. This happens when an ndo that already holds the rtnl requests the driver to reset, since the reset task (in some paths) tries to grab rtnl to either change real number of queues of update netdev features. [566.241851] ====================================================== [566.241893] WARNING: possible circular locking dependency detected [566.241936] 6.2.14-100.fc36.x86_64+debug #1 Tainted: G OE [566.241984] ------------------------------------------------------ [566.242025] repro.sh/2604 is trying to acquire lock: [566.242061] ffff9280fc5ceee8 (&adapter->crit_lock){+.+.}-{3:3}, at: iavf_close+0x3c/0x240 [iavf] [566.242167] but task is already holding lock: [566.242209] ffffffff9976d350 (rtnl_mutex){+.+.}-{3:3}, at: iavf_remove+0x6b5/0x730 [iavf] [566.242300] which lock already depends on the new lock. [566.242353] the existing dependency chain (in reverse order) is: [566.242401] -> #1 (rtnl_mutex){+.+.}-{3:3}: [566.242451] __mutex_lock+0xc1/0xbb0 [566.242489] iavf_init_interrupt_scheme+0x179/0x440 [iavf] [566.242560] iavf_watchdog_task+0x80b/0x1400 [iavf] [566.242627] process_one_work+0x2b3/0x560 [566.242663] worker_thread+0x4f/0x3a0 [566.242696] kthread+0xf2/0x120 [566.242730] ret_from_fork+0x29/0x50 [566.242763] -> #0 (&adapter->crit_lock){+.+.}-{3:3}: [566.242815] __lock_acquire+0x15ff/0x22b0 [566.242869] lock_acquire+0xd2/0x2c0 [566.242901] __mutex_lock+0xc1/0xbb0 [566.242934] iavf_close+0x3c/0x240 [iavf] [566.242997] __dev_close_many+0xac/0x120 [566.243036] dev_close_many+0x8b/0x140 [566.243071] unregister_netdevice_many_notify+0x165/0x7c0 [566.243116] unregister_netdevice_queue+0xd3/0x110 [566.243157] iavf_remove+0x6c1/0x730 [iavf] [566.243217] pci_device_remove+0x33/0xa0 [566.243257] device_release_driver_internal+0x1bc/0x240 [566.243299] pci_stop_bus_device+0x6c/0x90 [566.243338] pci_stop_and_remove_bus_device+0xe/0x20 [566.243380] pci_iov_remove_virtfn+0xd1/0x130 [566.243417] sriov_disable+0x34/0xe0 [566.243448] ice_free_vfs+0x2da/0x330 [ice] [566.244383] ice_sriov_configure+0x88/0xad0 [ice] [566.245353] sriov_numvfs_store+0xde/0x1d0 [566.246156] kernfs_fop_write_iter+0x15e/0x210 [566.246921] vfs_write+0x288/0x530 [566.247671] ksys_write+0x74/0xf0 [566.248408] do_syscall_64+0x58/0x80 [566.249145] entry_SYSCALL_64_after_hwframe+0x72/0xdc [566.249886] other info that might help us debug this: [566.252014] Possible unsafe locking scenario: [566.253432] CPU0 CPU1 [566.254118] ---- ---- [566.254800] lock(rtnl_mutex); [566.255514] lock(&adapter->crit_lock); [566.256233] lock(rtnl_mutex); [566.256897] lock(&adapter->crit_lock); [566.257388] *** DEADLOCK *** The deadlock can be triggered by a script that is continuously resetting the VF adapter while doing other operations requiring RTNL, e.g: while :; do ip link set $VF up ethtool --set-channels $VF combined 2 ip link set $VF down ip link set $VF up ethtool --set-channels $VF combined 4 ip link set $VF down done Any operation that triggers a reset can substitute "ethtool --set-channles" As a fix, add a new task "finish_config" that do all the work which needs rtnl lock. With the exception of iavf_remove(), all work that require rtnl should be called from this task. As for iavf_remove(), at the point where we need to call unregister_netdevice() (and grab rtnl_lock), we make sure the finish_config task is not running (cancel_work_sync()) to safely grab rtnl. Subsequent finish_config work cannot restart after that since the task is guarded by the __IAVF_IN_REMOVE_TASK bit in iavf_schedule_finish_config(). Fixes: 5ac49f3c2702 ("iavf: use mutexes for locking of critical sections") Signed-off-by: Ahmed Zaki Signed-off-by: Mateusz Palczewski Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit d916d273041b0b5652434ff27aec716ff90992ac Author: Marcin Szycik Date: Mon Jun 5 10:52:24 2023 -0400 Revert "iavf: Do not restart Tx queues after reset task failure" This reverts commit 08f1c147b7265245d67321585c68a27e990e0c4b. Netdev is no longer being detached during reset, so this fix can be reverted. We leave the removal of "hacky" IFF_UP flag update. Signed-off-by: Marcin Szycik Signed-off-by: Mateusz Palczewski Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit d2806d960e8387945b53edf7ed9d71ab3ab5f073 Author: Marcin Szycik Date: Mon Jun 5 10:52:23 2023 -0400 Revert "iavf: Detach device during reset task" This reverts commit aa626da947e9cd30c4cf727493903e1adbb2c0a0. Detaching device during reset was not fully fixing the rtnl locking issue, as there could be a situation where callback was already in progress before detaching netdev. Furthermore, detaching netdevice causes TX timeouts if traffic is running. To reproduce: ip netns exec ns1 iperf3 -c $PEER_IP -t 600 --logfile /dev/null & while :; do for i in 200 7000 400 5000 300 3000 ; do ip netns exec ns1 ip link set $VF1 mtu $i sleep 2 done sleep 10 done Currently, callbacks such as iavf_change_mtu() wait for the reset. If the reset fails to acquire the rtnl_lock, they schedule the netdev update for later while continuing the reset flow. Operations like MTU changes are performed under the rtnl_lock. Therefore, when the operation finishes, another callback that uses rtnl_lock can start. Signed-off-by: Dawid Wesierski Signed-off-by: Marcin Szycik Signed-off-by: Mateusz Palczewski Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit c2ed2403f12c74a74a0091ed5d830e72c58406e8 Author: Marcin Szycik Date: Mon Jun 5 10:52:22 2023 -0400 iavf: Wait for reset in callbacks which trigger it There was a fail when trying to add the interface to bonding right after changing the MTU on the interface. It was caused by bonding interface unable to open the interface due to interface being in __RESETTING state because of MTU change. Add new reset_waitqueue to indicate that reset has finished. Add waiting for reset to finish in callbacks which trigger hw reset: iavf_set_priv_flags(), iavf_change_mtu() and iavf_set_ringparam(). We use a 5000ms timeout period because on Hyper-V based systems, this operation takes around 3000-4000ms. In normal circumstances, it doesn't take more than 500ms to complete. Add a function iavf_wait_for_reset() to reuse waiting for reset code and use it also in iavf_set_channels(), which already waits for reset. We don't use error handling in iavf_set_channels() as this could cause the device to be in incorrect state if the reset was scheduled but hit timeout or the waitng function was interrupted by a signal. Fixes: 4e5e6b5d9d13 ("iavf: Fix return of set the new channel count") Signed-off-by: Marcin Szycik Co-developed-by: Dawid Wesierski Signed-off-by: Dawid Wesierski Signed-off-by: Sylwester Dziedziuch Signed-off-by: Kamil Maziarz Signed-off-by: Mateusz Palczewski Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit a77ed5c5b768e9649be240a2d864e5cd9c6a2015 Author: Ahmed Zaki Date: Fri May 19 15:46:02 2023 -0600 iavf: use internal state to free traffic IRQs If the system tries to close the netdev while iavf_reset_task() is running, __LINK_STATE_START will be cleared and netif_running() will return false in iavf_reinit_interrupt_scheme(). This will result in iavf_free_traffic_irqs() not being called and a leak as follows: [7632.489326] remove_proc_entry: removing non-empty directory 'irq/999', leaking at least 'iavf-enp24s0f0v0-TxRx-0' [7632.490214] WARNING: CPU: 0 PID: 10 at fs/proc/generic.c:718 remove_proc_entry+0x19b/0x1b0 is shown when pci_disable_msix() is later called. Fix by using the internal adapter state. The traffic IRQs will always exist if state == __IAVF_RUNNING. Fixes: 5b36e8d04b44 ("i40evf: Enable VF to request an alternate queue allocation") Signed-off-by: Ahmed Zaki Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 7c4bced3caa749ce468b0c5de711c98476b23a52 Author: Ding Hui Date: Tue May 9 19:11:48 2023 +0800 iavf: Fix out-of-bounds when setting channels on remove If we set channels greater during iavf_remove(), and waiting reset done would be timeout, then returned with error but changed num_active_queues directly, that will lead to OOB like the following logs. Because the num_active_queues is greater than tx/rx_rings[] allocated actually. Reproducer: [root@host ~]# cat repro.sh #!/bin/bash pf_dbsf="0000:41:00.0" vf0_dbsf="0000:41:02.0" g_pids=() function do_set_numvf() { echo 2 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs sleep $((RANDOM%3+1)) echo 0 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs sleep $((RANDOM%3+1)) } function do_set_channel() { local nic=$(ls -1 --indicator-style=none /sys/bus/pci/devices/${vf0_dbsf}/net/) [ -z "$nic" ] && { sleep $((RANDOM%3)) ; return 1; } ifconfig $nic 192.168.18.5 netmask 255.255.255.0 ifconfig $nic up ethtool -L $nic combined 1 ethtool -L $nic combined 4 sleep $((RANDOM%3)) } function on_exit() { local pid for pid in "${g_pids[@]}"; do kill -0 "$pid" &>/dev/null && kill "$pid" &>/dev/null done g_pids=() } trap "on_exit; exit" EXIT while :; do do_set_numvf ; done & g_pids+=($!) while :; do do_set_channel ; done & g_pids+=($!) wait Result: [ 3506.152887] iavf 0000:41:02.0: Removing device [ 3510.400799] ================================================================== [ 3510.400820] BUG: KASAN: slab-out-of-bounds in iavf_free_all_tx_resources+0x156/0x160 [iavf] [ 3510.400823] Read of size 8 at addr ffff88b6f9311008 by task repro.sh/55536 [ 3510.400823] [ 3510.400830] CPU: 101 PID: 55536 Comm: repro.sh Kdump: loaded Tainted: G O --------- -t - 4.18.0 #1 [ 3510.400832] Hardware name: Powerleader PR2008AL/H12DSi-N6, BIOS 2.0 04/09/2021 [ 3510.400835] Call Trace: [ 3510.400851] dump_stack+0x71/0xab [ 3510.400860] print_address_description+0x6b/0x290 [ 3510.400865] ? iavf_free_all_tx_resources+0x156/0x160 [iavf] [ 3510.400868] kasan_report+0x14a/0x2b0 [ 3510.400873] iavf_free_all_tx_resources+0x156/0x160 [iavf] [ 3510.400880] iavf_remove+0x2b6/0xc70 [iavf] [ 3510.400884] ? iavf_free_all_rx_resources+0x160/0x160 [iavf] [ 3510.400891] ? wait_woken+0x1d0/0x1d0 [ 3510.400895] ? notifier_call_chain+0xc1/0x130 [ 3510.400903] pci_device_remove+0xa8/0x1f0 [ 3510.400910] device_release_driver_internal+0x1c6/0x460 [ 3510.400916] pci_stop_bus_device+0x101/0x150 [ 3510.400919] pci_stop_and_remove_bus_device+0xe/0x20 [ 3510.400924] pci_iov_remove_virtfn+0x187/0x420 [ 3510.400927] ? pci_iov_add_virtfn+0xe10/0xe10 [ 3510.400929] ? pci_get_subsys+0x90/0x90 [ 3510.400932] sriov_disable+0xed/0x3e0 [ 3510.400936] ? bus_find_device+0x12d/0x1a0 [ 3510.400953] i40e_free_vfs+0x754/0x1210 [i40e] [ 3510.400966] ? i40e_reset_all_vfs+0x880/0x880 [i40e] [ 3510.400968] ? pci_get_device+0x7c/0x90 [ 3510.400970] ? pci_get_subsys+0x90/0x90 [ 3510.400982] ? pci_vfs_assigned.part.7+0x144/0x210 [ 3510.400987] ? __mutex_lock_slowpath+0x10/0x10 [ 3510.400996] i40e_pci_sriov_configure+0x1fa/0x2e0 [i40e] [ 3510.401001] sriov_numvfs_store+0x214/0x290 [ 3510.401005] ? sriov_totalvfs_show+0x30/0x30 [ 3510.401007] ? __mutex_lock_slowpath+0x10/0x10 [ 3510.401011] ? __check_object_size+0x15a/0x350 [ 3510.401018] kernfs_fop_write+0x280/0x3f0 [ 3510.401022] vfs_write+0x145/0x440 [ 3510.401025] ksys_write+0xab/0x160 [ 3510.401028] ? __ia32_sys_read+0xb0/0xb0 [ 3510.401031] ? fput_many+0x1a/0x120 [ 3510.401032] ? filp_close+0xf0/0x130 [ 3510.401038] do_syscall_64+0xa0/0x370 [ 3510.401041] ? page_fault+0x8/0x30 [ 3510.401043] entry_SYSCALL_64_after_hwframe+0x65/0xca [ 3510.401073] RIP: 0033:0x7f3a9bb842c0 [ 3510.401079] Code: 73 01 c3 48 8b 0d d8 cb 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 24 2d 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 fe dd 01 00 48 89 04 24 [ 3510.401080] RSP: 002b:00007ffc05f1fe18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 3510.401083] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f3a9bb842c0 [ 3510.401085] RDX: 0000000000000002 RSI: 0000000002327408 RDI: 0000000000000001 [ 3510.401086] RBP: 0000000002327408 R08: 00007f3a9be53780 R09: 00007f3a9c8a4700 [ 3510.401086] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000002 [ 3510.401087] R13: 0000000000000001 R14: 00007f3a9be52620 R15: 0000000000000001 [ 3510.401090] [ 3510.401093] Allocated by task 76795: [ 3510.401098] kasan_kmalloc+0xa6/0xd0 [ 3510.401099] __kmalloc+0xfb/0x200 [ 3510.401104] iavf_init_interrupt_scheme+0x26f/0x1310 [iavf] [ 3510.401108] iavf_watchdog_task+0x1d58/0x4050 [iavf] [ 3510.401114] process_one_work+0x56a/0x11f0 [ 3510.401115] worker_thread+0x8f/0xf40 [ 3510.401117] kthread+0x2a0/0x390 [ 3510.401119] ret_from_fork+0x1f/0x40 [ 3510.401122] 0xffffffffffffffff [ 3510.401123] In timeout handling, we should keep the original num_active_queues and reset num_req_queues to 0. Fixes: 4e5e6b5d9d13 ("iavf: Fix return of set the new channel count") Signed-off-by: Ding Hui Cc: Donglin Peng Cc: Huang Cun Reviewed-by: Leon Romanovsky Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 5f4fa1672d98fe99d2297b03add35346f1685d6b Author: Ding Hui Date: Tue May 9 19:11:47 2023 +0800 iavf: Fix use-after-free in free_netdev We do netif_napi_add() for all allocated q_vectors[], but potentially do netif_napi_del() for part of them, then kfree q_vectors and leave invalid pointers at dev->napi_list. Reproducer: [root@host ~]# cat repro.sh #!/bin/bash pf_dbsf="0000:41:00.0" vf0_dbsf="0000:41:02.0" g_pids=() function do_set_numvf() { echo 2 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs sleep $((RANDOM%3+1)) echo 0 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs sleep $((RANDOM%3+1)) } function do_set_channel() { local nic=$(ls -1 --indicator-style=none /sys/bus/pci/devices/${vf0_dbsf}/net/) [ -z "$nic" ] && { sleep $((RANDOM%3)) ; return 1; } ifconfig $nic 192.168.18.5 netmask 255.255.255.0 ifconfig $nic up ethtool -L $nic combined 1 ethtool -L $nic combined 4 sleep $((RANDOM%3)) } function on_exit() { local pid for pid in "${g_pids[@]}"; do kill -0 "$pid" &>/dev/null && kill "$pid" &>/dev/null done g_pids=() } trap "on_exit; exit" EXIT while :; do do_set_numvf ; done & g_pids+=($!) while :; do do_set_channel ; done & g_pids+=($!) wait Result: [ 4093.900222] ================================================================== [ 4093.900230] BUG: KASAN: use-after-free in free_netdev+0x308/0x390 [ 4093.900232] Read of size 8 at addr ffff88b4dc145640 by task repro.sh/6699 [ 4093.900233] [ 4093.900236] CPU: 10 PID: 6699 Comm: repro.sh Kdump: loaded Tainted: G O --------- -t - 4.18.0 #1 [ 4093.900238] Hardware name: Powerleader PR2008AL/H12DSi-N6, BIOS 2.0 04/09/2021 [ 4093.900239] Call Trace: [ 4093.900244] dump_stack+0x71/0xab [ 4093.900249] print_address_description+0x6b/0x290 [ 4093.900251] ? free_netdev+0x308/0x390 [ 4093.900252] kasan_report+0x14a/0x2b0 [ 4093.900254] free_netdev+0x308/0x390 [ 4093.900261] iavf_remove+0x825/0xd20 [iavf] [ 4093.900265] pci_device_remove+0xa8/0x1f0 [ 4093.900268] device_release_driver_internal+0x1c6/0x460 [ 4093.900271] pci_stop_bus_device+0x101/0x150 [ 4093.900273] pci_stop_and_remove_bus_device+0xe/0x20 [ 4093.900275] pci_iov_remove_virtfn+0x187/0x420 [ 4093.900277] ? pci_iov_add_virtfn+0xe10/0xe10 [ 4093.900278] ? pci_get_subsys+0x90/0x90 [ 4093.900280] sriov_disable+0xed/0x3e0 [ 4093.900282] ? bus_find_device+0x12d/0x1a0 [ 4093.900290] i40e_free_vfs+0x754/0x1210 [i40e] [ 4093.900298] ? i40e_reset_all_vfs+0x880/0x880 [i40e] [ 4093.900299] ? pci_get_device+0x7c/0x90 [ 4093.900300] ? pci_get_subsys+0x90/0x90 [ 4093.900306] ? pci_vfs_assigned.part.7+0x144/0x210 [ 4093.900309] ? __mutex_lock_slowpath+0x10/0x10 [ 4093.900315] i40e_pci_sriov_configure+0x1fa/0x2e0 [i40e] [ 4093.900318] sriov_numvfs_store+0x214/0x290 [ 4093.900320] ? sriov_totalvfs_show+0x30/0x30 [ 4093.900321] ? __mutex_lock_slowpath+0x10/0x10 [ 4093.900323] ? __check_object_size+0x15a/0x350 [ 4093.900326] kernfs_fop_write+0x280/0x3f0 [ 4093.900329] vfs_write+0x145/0x440 [ 4093.900330] ksys_write+0xab/0x160 [ 4093.900332] ? __ia32_sys_read+0xb0/0xb0 [ 4093.900334] ? fput_many+0x1a/0x120 [ 4093.900335] ? filp_close+0xf0/0x130 [ 4093.900338] do_syscall_64+0xa0/0x370 [ 4093.900339] ? page_fault+0x8/0x30 [ 4093.900341] entry_SYSCALL_64_after_hwframe+0x65/0xca [ 4093.900357] RIP: 0033:0x7f16ad4d22c0 [ 4093.900359] Code: 73 01 c3 48 8b 0d d8 cb 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 24 2d 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 fe dd 01 00 48 89 04 24 [ 4093.900360] RSP: 002b:00007ffd6491b7f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 4093.900362] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f16ad4d22c0 [ 4093.900363] RDX: 0000000000000002 RSI: 0000000001a41408 RDI: 0000000000000001 [ 4093.900364] RBP: 0000000001a41408 R08: 00007f16ad7a1780 R09: 00007f16ae1f2700 [ 4093.900364] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000002 [ 4093.900365] R13: 0000000000000001 R14: 00007f16ad7a0620 R15: 0000000000000001 [ 4093.900367] [ 4093.900368] Allocated by task 820: [ 4093.900371] kasan_kmalloc+0xa6/0xd0 [ 4093.900373] __kmalloc+0xfb/0x200 [ 4093.900376] iavf_init_interrupt_scheme+0x63b/0x1320 [iavf] [ 4093.900380] iavf_watchdog_task+0x3d51/0x52c0 [iavf] [ 4093.900382] process_one_work+0x56a/0x11f0 [ 4093.900383] worker_thread+0x8f/0xf40 [ 4093.900384] kthread+0x2a0/0x390 [ 4093.900385] ret_from_fork+0x1f/0x40 [ 4093.900387] 0xffffffffffffffff [ 4093.900387] [ 4093.900388] Freed by task 6699: [ 4093.900390] __kasan_slab_free+0x137/0x190 [ 4093.900391] kfree+0x8b/0x1b0 [ 4093.900394] iavf_free_q_vectors+0x11d/0x1a0 [iavf] [ 4093.900397] iavf_remove+0x35a/0xd20 [iavf] [ 4093.900399] pci_device_remove+0xa8/0x1f0 [ 4093.900400] device_release_driver_internal+0x1c6/0x460 [ 4093.900401] pci_stop_bus_device+0x101/0x150 [ 4093.900402] pci_stop_and_remove_bus_device+0xe/0x20 [ 4093.900403] pci_iov_remove_virtfn+0x187/0x420 [ 4093.900404] sriov_disable+0xed/0x3e0 [ 4093.900409] i40e_free_vfs+0x754/0x1210 [i40e] [ 4093.900415] i40e_pci_sriov_configure+0x1fa/0x2e0 [i40e] [ 4093.900416] sriov_numvfs_store+0x214/0x290 [ 4093.900417] kernfs_fop_write+0x280/0x3f0 [ 4093.900418] vfs_write+0x145/0x440 [ 4093.900419] ksys_write+0xab/0x160 [ 4093.900420] do_syscall_64+0xa0/0x370 [ 4093.900421] entry_SYSCALL_64_after_hwframe+0x65/0xca [ 4093.900422] 0xffffffffffffffff [ 4093.900422] [ 4093.900424] The buggy address belongs to the object at ffff88b4dc144200 which belongs to the cache kmalloc-8k of size 8192 [ 4093.900425] The buggy address is located 5184 bytes inside of 8192-byte region [ffff88b4dc144200, ffff88b4dc146200) [ 4093.900425] The buggy address belongs to the page: [ 4093.900427] page:ffffea00d3705000 refcount:1 mapcount:0 mapping:ffff88bf04415c80 index:0x0 compound_mapcount: 0 [ 4093.900430] flags: 0x10000000008100(slab|head) [ 4093.900433] raw: 0010000000008100 dead000000000100 dead000000000200 ffff88bf04415c80 [ 4093.900434] raw: 0000000000000000 0000000000030003 00000001ffffffff 0000000000000000 [ 4093.900434] page dumped because: kasan: bad access detected [ 4093.900435] [ 4093.900435] Memory state around the buggy address: [ 4093.900436] ffff88b4dc145500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 4093.900437] ffff88b4dc145580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 4093.900438] >ffff88b4dc145600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 4093.900438] ^ [ 4093.900439] ffff88b4dc145680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 4093.900440] ffff88b4dc145700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 4093.900440] ================================================================== Although the patch #2 (of 2) can avoid the issue triggered by this repro.sh, there still are other potential risks that if num_active_queues is changed to less than allocated q_vectors[] by unexpected, the mismatched netif_napi_add/del() can also cause UAF. Since we actually call netif_napi_add() for all allocated q_vectors unconditionally in iavf_alloc_q_vectors(), so we should fix it by letting netif_napi_del() match to netif_napi_add(). Fixes: 5eae00c57f5e ("i40evf: main driver core") Signed-off-by: Ding Hui Cc: Donglin Peng Cc: Huang Cun Reviewed-by: Simon Horman Reviewed-by: Madhu Chittim Reviewed-by: Leon Romanovsky Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit efa96cc99793bafe96bdbff6abab94d81472a32d Author: Christoph Hellwig Date: Mon Jul 17 08:49:57 2023 -0700 iomap: micro optimize the ki_pos assignment in iomap_file_buffered_write We have the new value for ki_pos right at hand in iter.pos, so assign that instead of recalculating it from ret. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Reviewed-by: Ritesh Harjani (IBM) commit 20c64ec83a9f779a750bbbcc1d07d065702313a5 Author: Christoph Hellwig Date: Mon Jul 17 08:49:57 2023 -0700 iomap: fix a regression for partial write errors When write* wrote some data it should return the amount of written data and not the error code that caused it to stop. Fix a recent regression in iomap_file_buffered_write that caused it to return the errno instead. Fixes: 219580eea1ee ("iomap: update ki_pos in iomap_file_buffered_write") Reported-by: kernel test robot Reported-by: Cyril Hrubis Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Reviewed-by: Ritesh Harjani (IBM) commit f6250e205691a58c81be041b1809a2e706852641 Author: Darrick J. Wong Date: Mon Jul 10 09:32:11 2023 -0700 xfs: convert flex-array declarations in xfs attr shortform objects As of 6.5-rc1, UBSAN trips over the ondisk extended attribute shortform definitions using an array length of 1 to pretend to be a flex array. Kernel compilers have to support unbounded array declarations, so let's correct this. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Kees Cook commit a49bbce58ea90b14d4cb1d00681023a8606955f2 Author: Darrick J. Wong Date: Mon Jul 10 09:12:20 2023 -0700 xfs: convert flex-array declarations in xfs attr leaf blocks As of 6.5-rc1, UBSAN trips over the ondisk extended attribute leaf block definitions using an array length of 1 to pretend to be a flex array. Kernel compilers have to support unbounded array declarations, so let's correct this. ================================================================================ UBSAN: array-index-out-of-bounds in fs/xfs/libxfs/xfs_attr_leaf.c:2535:24 index 2 is out of range for type '__u8 [1]' Call Trace: dump_stack_lvl+0x33/0x50 __ubsan_handle_out_of_bounds+0x9c/0xd0 xfs_attr3_leaf_getvalue+0x2ce/0x2e0 [xfs 4a986a89a77bb77402ab8a87a37da369ef6a3f09] xfs_attr_leaf_get+0x148/0x1c0 [xfs 4a986a89a77bb77402ab8a87a37da369ef6a3f09] xfs_attr_get_ilocked+0xae/0x110 [xfs 4a986a89a77bb77402ab8a87a37da369ef6a3f09] xfs_attr_get+0xee/0x150 [xfs 4a986a89a77bb77402ab8a87a37da369ef6a3f09] xfs_xattr_get+0x7d/0xc0 [xfs 4a986a89a77bb77402ab8a87a37da369ef6a3f09] __vfs_getxattr+0xa3/0x100 vfs_getxattr+0x87/0x1d0 do_getxattr+0x17a/0x220 getxattr+0x89/0xf0 Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Kees Cook commit 371baf5c9750a258fee21d0cb8c8d683bb057429 Author: Darrick J. Wong Date: Mon Jul 10 09:02:33 2023 -0700 xfs: convert flex-array declarations in struct xfs_attrlist* As of 6.5-rc1, UBSAN trips over the attrlist ioctl definitions using an array length of 1 to pretend to be a flex array. Kernel compilers have to support unbounded array declarations, so let's correct this. This may cause friction with userspace header declarations, but suck is life. ================================================================================ UBSAN: array-index-out-of-bounds in fs/xfs/xfs_ioctl.c:345:18 index 1 is out of range for type '__s32 [1]' Call Trace: dump_stack_lvl+0x33/0x50 __ubsan_handle_out_of_bounds+0x9c/0xd0 xfs_ioc_attr_put_listent+0x413/0x420 [xfs 4a986a89a77bb77402ab8a87a37da369ef6a3f09] xfs_attr_list_ilocked+0x170/0x850 [xfs 4a986a89a77bb77402ab8a87a37da369ef6a3f09] xfs_attr_list+0xb7/0x120 [xfs 4a986a89a77bb77402ab8a87a37da369ef6a3f09] xfs_ioc_attr_list+0x13b/0x2e0 [xfs 4a986a89a77bb77402ab8a87a37da369ef6a3f09] xfs_attrlist_by_handle+0xab/0x120 [xfs 4a986a89a77bb77402ab8a87a37da369ef6a3f09] xfs_file_ioctl+0x1ff/0x15e0 [xfs 4a986a89a77bb77402ab8a87a37da369ef6a3f09] vfs_ioctl+0x1f/0x60 The kernel and xfsprogs code that uses these structures will not have problems, but the long tail of external user programs might. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Reviewed-by: Kees Cook commit dc050849d93f4c5d8a88dc6789668212b7785967 Merge: 55c3b96074f3f 5886e4d5ecec3 Author: Marc Kleine-Budde Date: Mon Jul 17 16:41:23 2023 +0200 Merge patch series "can: gs_usb: fix time stamp counter initialization" Marc Kleine-Budde says: During testing I noticed a crash if unloading/loading the gs_usb driver during high CAN bus load. The current version of the candlelight firmware doesn't flush the queues of the received CAN frames during the reset command. This leads to a crash if hardware timestamps are enabled, and an URB from the device is received before the cycle counter/time counter infrastructure has been setup. First clean up then error handling in gs_can_open(). Then, fix the problem by converting the cycle counter/time counter infrastructure from a per-channel to per-device and set it up before submitting RX-URBs to the USB stack. Link: https://lore.kernel.org/all/20230716-gs_usb-fix-time-stamp-counter-v1-0-9017cefcd9d5@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 522b1d69219d8f083173819fde04f994aa051a98 Author: Borislav Petkov (AMD) Date: Sat Jul 15 13:41:28 2023 +0200 x86/cpu/amd: Add a Zenbleed fix Add a fix for the Zen2 VZEROUPPER data corruption bug where under certain circumstances executing VZEROUPPER can cause register corruption or leak data. The optimal fix is through microcode but in the case the proper microcode revision has not been applied, enable a fallback fix using a chicken bit. Signed-off-by: Borislav Petkov (AMD) commit 8b6f687743dacce83dbb0c7cfacf88bab00f808a Author: Borislav Petkov (AMD) Date: Sat Jul 15 13:31:32 2023 +0200 x86/cpu/amd: Move the errata checking functionality up Avoid new and remove old forward declarations. No functional changes. Signed-off-by: Borislav Petkov (AMD) commit 2480232c61b888a160153b9022858ac8c4362d5f Author: Arnaldo Carvalho de Melo Date: Fri Jul 14 15:29:31 2023 -0300 perf test task_exit: No need for a cycles event to check if we get an PERF_RECORD_EXIT The intent of this test is to check we get a PERF_RECORD_EXIT as asked for by setting perf_event_attr.task=1. When the test was written we didn't had the "dummy" event so we went with the default event, "cycles". There were reports of this test failing sometimes, one of these reports was with a PREEMPT_RT_FULL, but I noticed it failing sometimes with an aarch64 Firefly board. In the kernel the call to perf_event_task_output(), that generates the PERF_RECORD_EXIT may fail when there is not enough memory in the ring buffer, if the ring buffer is paused, etc. So switch to using the "dummy" event to use the ring buffer just for what the test was designed for, avoiding uneeded PERF_RECORD_SAMPLEs. Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Jiri Olsa Cc: Juri Lelli Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/ZLGXmMuNRpx1ubFm@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit ccb381e1af1ace292153c88eb1fffa5683d16a20 Author: Benjamin Gray Date: Mon Jul 10 14:41:43 2023 +1000 powerpc/kasan: Disable KCOV in KASAN code As per the generic KASAN code in mm/kasan, disable KCOV with KCOV_INSTRUMENT := n in the makefile. This fixes a ppc64 boot hang when KCOV and KASAN are enabled. kasan_early_init() gets called before a PACA is initialised, but the KCOV hook expects a valid PACA. Suggested-by: Christophe Leroy Signed-off-by: Benjamin Gray Signed-off-by: Michael Ellerman Link: https://msgid.link/20230710044143.146840-1-bgray@linux.ibm.com commit 2c27770a7bc88ef7f6614d11d96d8e62017d0b78 Author: Jani Nikula Date: Tue Jul 11 14:02:14 2023 +0300 Revert "drm/i915: use localized __diag_ignore_all() instead of per file" This reverts commit 88e9664434c994e97a9f6f8cdd1535495c660cea. __diag_ignore_all() only works for GCC 8 or later. -Woverride-init (from -Wextra, enabled in i915 Makefile) combined with CONFIG_WERROR=y or W=e breaks the build for older GCC. With i386_defconfig and x86_64_defconfig enabling CONFIG_WERROR=y by default, we really need to roll back the change. An alternative would be to disable -Woverride-init in the Makefile for GCC <8, but the revert seems like the safest bet now. Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8768 Reported-by: John Garry References: https://lore.kernel.org/r/ad2601c0-84bb-c574-3702-a83ff8faf98c@oracle.com References: https://lore.kernel.org/r/87wmzezns4.fsf@intel.com Fixes: 88e9664434c9 ("drm/i915: use localized __diag_ignore_all() instead of per file") Cc: Gustavo Sousa Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Tvrtko Ursulin Signed-off-by: Jani Nikula Reviewed-by: Gustavo Sousa Tested-by: John Garry Link: https://patchwork.freedesktop.org/patch/msgid/20230711110214.25093-1-jani.nikula@intel.com (cherry picked from commit 290d161045753240f2100b8f44660426ecc97be5) Signed-off-by: Tvrtko Ursulin commit 785b3f667b4bf98804cad135005e964df0c750de Author: Andrzej Hajda Date: Tue Jul 11 17:34:10 2023 +0200 drm/i915/perf: add sentinel to xehp_oa_b_counters Arrays passed to reg_in_range_table should end with empty record. The patch solves KASAN detected bug with signature: BUG: KASAN: global-out-of-bounds in xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915] Read of size 4 at addr ffffffffa1555d90 by task perf/1518 CPU: 4 PID: 1518 Comm: perf Tainted: G U 6.4.0-kasan_438-g3303d06107f3+ #1 Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P DDR5 SODIMM SBS RVP, BIOS MTLPFWI1.R00.3223.D80.2305311348 05/31/2023 Call Trace: ... xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915] Fixes: 0fa9349dda03 ("drm/i915/perf: complete programming whitelisting for XEHPSDV") Signed-off-by: Andrzej Hajda Reviewed-by: Andi Shyti Reviewed-by: Nirmoy Das Link: https://patchwork.freedesktop.org/patch/msgid/20230711153410.1224997-1-andrzej.hajda@intel.com (cherry picked from commit 2f42c5afb34b5696cf5fe79e744f99be9b218798) Signed-off-by: Tvrtko Ursulin commit f7853c34241807bb97673a5e97719123be39a09e Author: Peter Zijlstra Date: Fri Jul 7 16:19:09 2023 +0200 locking/rtmutex: Fix task->pi_waiters integrity Henry reported that rt_mutex_adjust_prio_check() has an ordering problem and puts the lie to the comment in [7]. Sharing the sort key between lock->waiters and owner->pi_waiters *does* create problems, since unlike what the comment claims, holding [L] is insufficient. Notably, consider: A / \ M1 M2 | | B C That is, task A owns both M1 and M2, B and C block on them. In this case a concurrent chain walk (B & C) will modify their resp. sort keys in [7] while holding M1->wait_lock and M2->wait_lock. So holding [L] is meaningless, they're different Ls. This then gives rise to a race condition between [7] and [11], where the requeue of pi_waiters will observe an inconsistent tree order. B C (holds M1->wait_lock, (holds M2->wait_lock, holds B->pi_lock) holds A->pi_lock) [7] waiter_update_prio(); ... [8] raw_spin_unlock(B->pi_lock); ... [10] raw_spin_lock(A->pi_lock); [11] rt_mutex_enqueue_pi(); // observes inconsistent A->pi_waiters // tree order Fixing this means either extending the range of the owner lock from [10-13] to [6-13], with the immediate problem that this means [6-8] hold both blocked and owner locks, or duplicating the sort key. Since the locking in chain walk is horrible enough without having to consider pi_lock nesting rules, duplicate the sort key instead. By giving each tree their own sort key, the above race becomes harmless, if C sees B at the old location, then B will correct things (if they need correcting) when it walks up the chain and reaches A. Fixes: fb00aca47440 ("rtmutex: Turn the plist into an rb-tree") Reported-by: Henry Wu Signed-off-by: Peter Zijlstra (Intel) Acked-by: Thomas Gleixner Tested-by: Henry Wu Link: https://lkml.kernel.org/r/20230707161052.GF2883469%40hirez.programming.kicks-ass.net commit 5886e4d5ecec3e22844efed90b2dd383ef804b3a Author: Marc Kleine-Budde Date: Fri Jul 7 18:44:23 2023 +0200 can: gs_usb: fix time stamp counter initialization If the gs_usb device driver is unloaded (or unbound) before the interface is shut down, the USB stack first calls the struct usb_driver::disconnect and then the struct net_device_ops::ndo_stop callback. In gs_usb_disconnect() all pending bulk URBs are killed, i.e. no more RX'ed CAN frames are send from the USB device to the host. Later in gs_can_close() a reset control message is send to each CAN channel to remove the controller from the CAN bus. In this race window the USB device can still receive CAN frames from the bus and internally queue them to be send to the host. At least in the current version of the candlelight firmware, the queue of received CAN frames is not emptied during the reset command. After loading (or binding) the gs_usb driver, new URBs are submitted during the struct net_device_ops::ndo_open callback and the candlelight firmware starts sending its already queued CAN frames to the host. However, this scenario was not considered when implementing the hardware timestamp function. The cycle counter/time counter infrastructure is set up (gs_usb_timestamp_init()) after the USBs are submitted, resulting in a NULL pointer dereference if timecounter_cyc2time() (via the call chain: gs_usb_receive_bulk_callback() -> gs_usb_set_timestamp() -> gs_usb_skb_set_timestamp()) is called too early. Move the gs_usb_timestamp_init() function before the URBs are submitted to fix this problem. For a comprehensive solution, we need to consider gs_usb devices with more than 1 channel. The cycle counter/time counter infrastructure is setup per channel, but the RX URBs are per device. Once gs_can_open() of _a_ channel has been called, and URBs have been submitted, the gs_usb_receive_bulk_callback() can be called for _all_ available channels, even for channels that are not running, yet. As cycle counter/time counter has not set up, this will again lead to a NULL pointer dereference. Convert the cycle counter/time counter from a "per channel" to a "per device" functionality. Also set it up, before submitting any URBs to the device. Further in gs_usb_receive_bulk_callback(), don't process any URBs for not started CAN channels, only resubmit the URB. Fixes: 45dfa45f52e6 ("can: gs_usb: add RX and TX hardware timestamp support") Closes: https://github.com/candle-usb/candleLight_fw/issues/137#issuecomment-1623532076 Cc: stable@vger.kernel.org Cc: John Whittington Link: https://lore.kernel.org/all/20230716-gs_usb-fix-time-stamp-counter-v1-2-9017cefcd9d5@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 2603be9e8167ddc7bea95dcfab9ffc33414215aa Author: Marc Kleine-Budde Date: Fri Jul 7 13:43:10 2023 +0200 can: gs_usb: gs_can_open(): improve error handling The gs_usb driver handles USB devices with more than 1 CAN channel. The RX path for all channels share the same bulk endpoint (the transmitted bulk data encodes the channel number). These per-device resources are allocated and submitted by the first opened channel. During this allocation, the resources are either released immediately in case of a failure or the URBs are anchored. All anchored URBs are finally killed with gs_usb_disconnect(). Currently, gs_can_open() returns with an error if the allocation of a URB or a buffer fails. However, if usb_submit_urb() fails, the driver continues with the URBs submitted so far, even if no URBs were successfully submitted. Treat every error as fatal and free all allocated resources immediately. Switch to goto-style error handling, to prepare the driver for more per-device resource allocation. Cc: stable@vger.kernel.org Cc: John Whittington Link: https://lore.kernel.org/all/20230716-gs_usb-fix-time-stamp-counter-v1-1-9017cefcd9d5@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 55c3b96074f3f9b0aee19bf93cd71af7516582bb Author: YueHaibing Date: Sat Jul 15 17:25:43 2023 +0800 can: bcm: Fix UAF in bcm_proc_show() BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 Read of size 8 at addr ffff888155846230 by task cat/7862 CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: dump_stack_lvl+0xd5/0x150 print_report+0xc1/0x5e0 kasan_report+0xba/0xf0 bcm_proc_show+0x969/0xa80 seq_read_iter+0x4f6/0x1260 seq_read+0x165/0x210 proc_reg_read+0x227/0x300 vfs_read+0x1d5/0x8d0 ksys_read+0x11e/0x240 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Allocated by task 7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x9e/0xa0 bcm_sendmsg+0x264b/0x44e0 sock_sendmsg+0xda/0x180 ____sys_sendmsg+0x735/0x920 ___sys_sendmsg+0x11d/0x1b0 __sys_sendmsg+0xfa/0x1d0 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x27/0x40 ____kasan_slab_free+0x161/0x1c0 slab_free_freelist_hook+0x119/0x220 __kmem_cache_free+0xb4/0x2e0 rcu_core+0x809/0x1bd0 bcm_op is freed before procfs entry be removed in bcm_release(), this lead to bcm_proc_show() may read the freed bcm_op. Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol") Signed-off-by: YueHaibing Reviewed-by: Oliver Hartkopp Acked-by: Oliver Hartkopp Link: https://lore.kernel.org/all/20230715092543.15548-1-yuehaibing@huawei.com Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde commit ee8b94c8510ce64afe0b87ef548d23e00915fb10 Author: Ziyang Xuan Date: Tue Jul 11 09:17:37 2023 +0800 can: raw: fix receiver memory leak Got kmemleak errors with the following ltp can_filter testcase: for ((i=1; i<=100; i++)) do ./can_filter & sleep 0.1 done ============================================================== [<00000000db4a4943>] can_rx_register+0x147/0x360 [can] [<00000000a289549d>] raw_setsockopt+0x5ef/0x853 [can_raw] [<000000006d3d9ebd>] __sys_setsockopt+0x173/0x2c0 [<00000000407dbfec>] __x64_sys_setsockopt+0x61/0x70 [<00000000fd468496>] do_syscall_64+0x33/0x40 [<00000000b7e47d51>] entry_SYSCALL_64_after_hwframe+0x61/0xc6 It's a bug in the concurrent scenario of unregister_netdevice_many() and raw_release() as following: cpu0 cpu1 unregister_netdevice_many(can_dev) unlist_netdevice(can_dev) // dev_get_by_index() return NULL after this net_set_todo(can_dev) raw_release(can_socket) dev = dev_get_by_index(, ro->ifindex); // dev == NULL if (dev) { // receivers in dev_rcv_lists not free because dev is NULL raw_disable_allfilters(, dev, ); dev_put(dev); } ... ro->bound = 0; ... call_netdevice_notifiers(NETDEV_UNREGISTER, ) raw_notify(, NETDEV_UNREGISTER, ) if (ro->bound) // invalid because ro->bound has been set 0 raw_disable_allfilters(, dev, ); // receivers in dev_rcv_lists will never be freed Add a net_device pointer member in struct raw_sock to record bound can_dev, and use rtnl_lock to serialize raw_socket members between raw_bind(), raw_release(), raw_setsockopt() and raw_notify(). Use ro->dev to decide whether to free receivers in dev_rcv_lists. Fixes: 8d0caedb7596 ("can: bcm/raw/isotp: use per module netdevice notifier") Reviewed-by: Oliver Hartkopp Acked-by: Oliver Hartkopp Signed-off-by: Ziyang Xuan Link: https://lore.kernel.org/all/20230711011737.1969582-1-william.xuanziyang@huawei.com Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde commit 162d626f3013215b82b6514ca14f20932c7ccce5 Author: Heiner Kallweit Date: Fri Jul 14 07:39:36 2023 +0200 r8169: fix ASPM-related problem for chip version 42 and 43 Referenced commit missed that for chip versions 42 and 43 ASPM remained disabled in the respective rtl_hw_start_...() routines. This resulted in problems as described in the referenced bug ticket. Therefore re-instantiate the previous logic. Fixes: 5fc3f6c90cca ("r8169: consolidate disabling ASPM before EPHY access") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217635 Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller commit 4bdf79d686b49ac49373b36466acfb93972c7d7c Author: Tristram Ha Date: Thu Jul 13 17:46:22 2023 -0700 net: dsa: microchip: correct KSZ8795 static MAC table access The KSZ8795 driver code was modified to use on KSZ8863/73, which has different register definitions. Some of the new KSZ8795 register information are wrong compared to previous code. KSZ8795 also behaves differently in that the STATIC_MAC_TABLE_USE_FID and STATIC_MAC_TABLE_FID bits are off by 1 when doing MAC table reading than writing. To compensate that a special code was added to shift the register value by 1 before applying those bits. This is wrong when the code is running on KSZ8863, so this special code is only executed when KSZ8795 is detected. Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips") Signed-off-by: Tristram Ha Reviewed-by: Horatiu Vultur Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 6e8778f8e0f58cac4955b17130549b156cf9d25f Merge: 0dd1805fe498e ac177a330077f Author: David S. Miller Date: Mon Jul 17 07:33:39 2023 +0100 Merge branch 'sched-fixes' Victor Nogueira says: ==================== net: sched: Fixes for classifiers Four different classifiers (bpf, u32, matchall, and flower) are calling tcf_bind_filter in their callbacks, but arent't undoing it by calling tcf_unbind_filter if their was an error after binding. This patch set fixes all this by calling tcf_unbind_filter in such cases. This set also undoes a refcount decrement in cls_u32 when an update fails under specific conditions which are described in patch #3. v1 -> v2: * Remove blank line after fixes tag * Fix reverse xmas tree issues pointed out by Simon v2 -> v3: * Inline functions cls_bpf_set_parms and fl_set_parms to avoid adding yet another parameter (and a return value at it) to them. * Remove similar fixes for u32 and matchall, which will be sent soon, once we find a way to do the fixes without adding a return parameter to their set_parms functions. v3 -> v4: * Inline mall_set_parms to avoid adding yet another parameter. * Remove set_flags parameter from u32_set_parms and create a separate function for calling tcf_bind_filter and tcf_unbind_filter in case of failure. * Change cover letter title to also encompass refcnt fix for u32 v4 -> v5: * Change back tag to net ==================== Signed-off-by: David S. Miller commit ac177a330077f264664f56259038e121bb214bec Author: Victor Nogueira Date: Thu Jul 13 15:05:14 2023 -0300 net: sched: cls_flower: Undo tcf_bind_filter in case of an error If TCA_FLOWER_CLASSID is specified in the netlink message, the code will call tcf_bind_filter. However, if any error occurs after that, the code should undo this by calling tcf_unbind_filter. Fixes: 77b9900ef53a ("tc: introduce Flower classifier") Signed-off-by: Victor Nogueira Acked-by: Jamal Hadi Salim Reviewed-by: Pedro Tammela Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 26a22194927e8521e304ed75c2f38d8068d55fc7 Author: Victor Nogueira Date: Thu Jul 13 15:05:13 2023 -0300 net: sched: cls_bpf: Undo tcf_bind_filter in case of an error If cls_bpf_offload errors out, we must also undo tcf_bind_filter that was done before the error. Fix that by calling tcf_unbind_filter in errout_parms. Fixes: eadb41489fd2 ("net: cls_bpf: add support for marking filters as hardware-only") Signed-off-by: Victor Nogueira Acked-by: Jamal Hadi Salim Reviewed-by: Pedro Tammela Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit e8d3d78c19be0264a5692bed477c303523aead31 Author: Victor Nogueira Date: Thu Jul 13 15:05:12 2023 -0300 net: sched: cls_u32: Undo refcount decrement in case update failed In the case of an update, when TCA_U32_LINK is set, u32_set_parms will decrement the refcount of the ht_down (struct tc_u_hnode) pointer present in the older u32 filter which we are replacing. However, if u32_replace_hw_knode errors out, the update command fails and that ht_down pointer continues decremented. To fix that, when u32_replace_hw_knode fails, check if ht_down's refcount was decremented and undo the decrement. Fixes: d34e3e181395 ("net: cls_u32: Add support for skip-sw flag to tc u32 classifier.") Signed-off-by: Victor Nogueira Acked-by: Jamal Hadi Salim Reviewed-by: Pedro Tammela Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 9cb36faedeafb9720ac236aeae2ea57091d90a09 Author: Victor Nogueira Date: Thu Jul 13 15:05:11 2023 -0300 net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode When u32_replace_hw_knode fails, we need to undo the tcf_bind_filter operation done at u32_set_parms. Fixes: d34e3e181395 ("net: cls_u32: Add support for skip-sw flag to tc u32 classifier.") Signed-off-by: Victor Nogueira Acked-by: Jamal Hadi Salim Reviewed-by: Pedro Tammela Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit b3d0e0489430735e2e7626aa37e6462cdd136e9d Author: Victor Nogueira Date: Thu Jul 13 15:05:10 2023 -0300 net: sched: cls_matchall: Undo tcf_bind_filter in case of failure after mall_set_parms In case an error occurred after mall_set_parms executed successfully, we must undo the tcf_bind_filter call it issues. Fix that by calling tcf_unbind_filter in err_replace_hw_filter label. Fixes: ec2507d2a306 ("net/sched: cls_matchall: Fix error path") Signed-off-by: Victor Nogueira Acked-by: Jamal Hadi Salim Reviewed-by: Pedro Tammela Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 057849ccc3d898b8a2dc21933b50ed8fbddc963b Author: Takashi Iwai Date: Mon Jul 17 08:25:55 2023 +0200 ALSA: seq: Fix memory leak at error path in snd_seq_create_port() We forgot to release a newly allocated item at the error path in snd_seq_create_port(). This patch fixes it. Fixes: 7c3f0d3d3a11 ("ALSA: seq: Check the conflicting port at port creation") Reported-by: syzbot+cf8e7fa4eeec59b3d485@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/00000000000098ed3a0600965f89@google.com Link: https://lore.kernel.org/r/20230717062555.31592-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit b2cb84d7802b75bc4029519bce2c4e0c9319ac42 Merge: 69ea4c9d02b79 e8bf1741c14eb Author: Takashi Iwai Date: Mon Jul 17 08:21:09 2023 +0200 Merge tag 'asoc-fix-v6.5-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.5 A lot of fixes here for the Qualcomm CODEC drivers, there was quite a bit of fragility with the SoundWire probe due to the combined DT and hotplug approach that the bus has which Johan Hovold fixed along with a bunch of other issues that came up in the process. Srivinvas Kandagatla also fixed some separate issues that have been lurking for a while in the Qualcomm AP side, and there's a good set of AMD fixes from Vijendar Mukunda too. commit 3c1897ae4b6bc7cc586eda2feaa2cd68325ec29c Author: Greg Kroah-Hartman Date: Fri Jun 30 09:14:21 2023 +0200 Documentation: security-bugs.rst: clarify CVE handling The kernel security team does NOT assign CVEs, so document that properly and provide the "if you want one, ask MITRE for it" response that we give on a weekly basis in the document, so we don't have to constantly say it to everyone who asks. Link: https://lore.kernel.org/r/2023063022-retouch-kerosene-7e4a@gregkh Signed-off-by: Greg Kroah-Hartman commit 4fee0915e649bd0cea56dece6d96f8f4643df33c Author: Greg Kroah-Hartman Date: Fri Jun 30 09:14:20 2023 +0200 Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group Because the linux-distros group forces reporters to release information about reported bugs, and they impose arbitrary deadlines in having those bugs fixed despite not actually being kernel developers, the kernel security team recommends not interacting with them at all as this just causes confusion and the early-release of reported security problems. Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/2023063020-throat-pantyhose-f110@gregkh Signed-off-by: Greg Kroah-Hartman commit 98e2dd5f7a8be5cb2501a897e96910393a49f0ff Author: Martin Fuzzey Date: Fri Jun 16 16:36:28 2023 +0200 regulator: da9063: fix null pointer deref with partial DT config When some of the da9063 regulators do not have corresponding DT nodes a null pointer dereference occurs on boot because such regulators have no init_data causing the pointers calculated in da9063_check_xvp_constraints() to be invalid. Do not dereference them in this case. Fixes: b8717a80e6ee ("regulator: da9063: implement setter for voltage monitoring") Signed-off-by: Martin Fuzzey Link: https://lore.kernel.org/r/20230616143736.2946173-1-martin.fuzzey@flowbird.group Signed-off-by: Mark Brown commit 0c9d2eb5e94792fe64019008a04d4df5e57625af Author: Mark Brown Date: Wed Jul 12 12:16:40 2023 +0100 regmap: Account for register length in SMBus I/O limits The SMBus I2C buses have limits on the size of transfers they can do but do not factor in the register length meaning we may try to do a transfer longer than our length limit, the core will not take care of this. Future changes will factor this out into the core but there are a number of users that assume current behaviour so let's just do something conservative here. This does not take account padding bits but practically speaking these are very rarely if ever used on I2C buses given that they generally run slowly enough to mean there's no issue. Cc: stable@kernel.org Signed-off-by: Mark Brown Reviewed-by: Xu Yilun Link: https://lore.kernel.org/r/20230712-regmap-max-transfer-v1-2-80e2aed22e83@kernel.org Signed-off-by: Mark Brown commit bc64734825c59e18a27ac266b07e14944c111fd8 Author: Mark Brown Date: Wed Jul 12 12:16:39 2023 +0100 regmap: Drop initial version of maximum transfer length fixes When problems were noticed with the register address not being taken into account when limiting raw transfers with I2C devices we fixed this in the core. Unfortunately it has subsequently been realised that a lot of buses were relying on the prior behaviour, partly due to unclear documentation not making it obvious what was intended in the core. This is all more involved to fix than is sensible for a fix commit so let's just drop the original fixes, a separate commit will fix the originally observed problem in an I2C specific way Fixes: 3981514180c9 ("regmap: Account for register length when chunking") Fixes: c8e796895e23 ("regmap: spi-avmm: Fix regmap_bus max_raw_write") Signed-off-by: Mark Brown Reviewed-by: Xu Yilun Cc: stable@kernel.org Link: https://lore.kernel.org/r/20230712-regmap-max-transfer-v1-1-80e2aed22e83@kernel.org Signed-off-by: Mark Brown commit 469e2f28c2cbee2430058c1c9bb6d1675d7195fb Author: Dan Carpenter Date: Fri Jul 7 14:25:23 2023 +0300 ASoC: SOF: ipc3-dtrace: uninitialized data in dfsentry_trace_filter_write() This doesn't check how many bytes the simple_write_to_buffer() writes to the buffer. The only thing that we know is that the first byte is initialized and the last byte of the buffer is set to NUL. However the middle bytes could be uninitialized. There is no need to use simple_write_to_buffer(). This code does not support partial writes but instead passes "pos = 0" as the starting offset regardless of what the user passed as "*ppos". Just use the copy_from_user() function and initialize the whole buffer. Fixes: 671e0b90051e ("ASoC: SOF: Clone the trace code to ipc3-dtrace as fw_tracing implementation") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/74148292-ce4d-4e01-a1a7-921e6767da14@moroto.mountain Signed-off-by: Mark Brown commit e51df4f81b02bcdd828a04de7c1eb6a92988b61e Author: Thomas Petazzoni Date: Thu Jul 13 13:21:12 2023 +0200 ASoC: cs42l51: fix driver to properly autoload with automatic module loading In commit 2cb1e0259f50 ("ASoC: cs42l51: re-hook of_match_table pointer"), 9 years ago, some random guy fixed the cs42l51 after it was split into a core part and an I2C part to properly match based on a Device Tree compatible string. However, the fix in this commit is wrong: the MODULE_DEVICE_TABLE(of, ....) is in the core part of the driver, not the I2C part. Therefore, automatic module loading based on module.alias, based on matching with the DT compatible string, loads the core part of the driver, but not the I2C part. And threfore, the i2c_driver is not registered, and the codec is not known to the system, nor matched with a DT node with the corresponding compatible string. In order to fix that, we move the MODULE_DEVICE_TABLE(of, ...) into the I2C part of the driver. The cs42l51_of_match[] array is also moved as well, as it is not possible to have this definition in one file, and the MODULE_DEVICE_TABLE(of, ...) invocation in another file, due to how MODULE_DEVICE_TABLE works. Thanks to this commit, the I2C part of the driver now properly autoloads, and thanks to its dependency on the core part, the core part gets autoloaded as well, resulting in a functional sound card without having to manually load kernel modules. Fixes: 2cb1e0259f50 ("ASoC: cs42l51: re-hook of_match_table pointer") Cc: stable@vger.kernel.org Signed-off-by: Thomas Petazzoni Link: https://lore.kernel.org/r/20230713112112.778576-1-thomas.petazzoni@bootlin.com Signed-off-by: Mark Brown commit 8739312ed2faa79df61d157ac44fda840646d444 Author: Uwe Kleine-König Date: Tue Jul 11 16:31:45 2023 +0200 powerpc/512x: lpbfifo: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Signed-off-by: Michael Ellerman Link: https://msgid.link/20230711143145.1192651-1-u.kleine-koenig@pengutronix.de commit 0791faebfe750292a8a842b64795a390ca4a3b51 Merge: e8bf1741c14eb fdf0eaf11452d Author: Mark Brown Date: Mon Jul 17 06:12:31 2023 +0100 ASoC: Merge v6.5-rc2 Get a similar baseline to my other branches, and fixes for people using the branch. commit 29900bf351e1a7e4643da5c3c3cd9df75c577b88 Author: Selvin Xavier Date: Fri Jul 14 01:22:49 2023 -0700 RDMA/bnxt_re: Fix hang during driver unload Driver unload hits a hang during stress testing of load/unload. stack trace snippet - tasklet_kill at ffffffff9aabb8b2 bnxt_qplib_nq_stop_irq at ffffffffc0a805fb [bnxt_re] bnxt_qplib_disable_nq at ffffffffc0a80c5b [bnxt_re] bnxt_re_dev_uninit at ffffffffc0a67d15 [bnxt_re] bnxt_re_remove_device at ffffffffc0a6af1d [bnxt_re] tasklet_kill can hang if the tasklet is scheduled after it is disabled. Modified the sequences to disable the interrupt first and synchronize irq before disabling the tasklet. Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") Signed-off-by: Kashyap Desai Signed-off-by: Selvin Xavier Link: https://lore.kernel.org/r/1689322969-25402-3-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Leon Romanovsky commit b5bbc6551297447d3cca55cf907079e206e9cd82 Author: Kashyap Desai Date: Fri Jul 14 01:22:48 2023 -0700 RDMA/bnxt_re: Prevent handling any completions after qp destroy HW may generate completions that indicates QP is destroyed. Driver should not be scheduling any more completion handlers for this QP, after the QP is destroyed. Since CQs are active during the QP destroy, driver may still schedule completion handlers. This can cause a race where the destroy_cq and poll_cq running simultaneously. Snippet of kernel panic while doing bnxt_re driver load unload in loop. This indicates a poll after the CQ is freed.  [77786.481636] Call Trace: [77786.481640]   [77786.481644]  bnxt_re_poll_cq+0x14a/0x620 [bnxt_re] [77786.481658]  ? kvm_clock_read+0x14/0x30 [77786.481693]  __ib_process_cq+0x57/0x190 [ib_core] [77786.481728]  ib_cq_poll_work+0x26/0x80 [ib_core] [77786.481761]  process_one_work+0x1e5/0x3f0 [77786.481768]  worker_thread+0x50/0x3a0 [77786.481785]  ? __pfx_worker_thread+0x10/0x10 [77786.481790]  kthread+0xe2/0x110 [77786.481794]  ? __pfx_kthread+0x10/0x10 [77786.481797]  ret_from_fork+0x2c/0x50 To avoid this, complete all completion handlers before returning the destroy QP. If free_cq is called soon after destroy_qp, IB stack will cancel the CQ work before invoking the destroy_cq verb and this will prevent any race mentioned. Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") Signed-off-by: Kashyap Desai Signed-off-by: Selvin Xavier Link: https://lore.kernel.org/r/1689322969-25402-2-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Leon Romanovsky commit dc52aadbc1849cbe3fcf6bc54d35f6baa396e0a1 Author: Thomas Bogendoerfer Date: Thu Jul 13 16:16:58 2023 +0200 RDMA/mthca: Fix crash when polling CQ for shared QPs Commit 21c2fe94abb2 ("RDMA/mthca: Combine special QP struct with mthca QP") introduced a new struct mthca_sqp which doesn't contain struct mthca_qp any longer. Placing a pointer of this new struct into qptable leads to crashes, because mthca_poll_one() expects a qp pointer. Fix this by putting the correct pointer into qptable. Fixes: 21c2fe94abb2 ("RDMA/mthca: Combine special QP struct with mthca QP") Signed-off-by: Thomas Bogendoerfer Link: https://lore.kernel.org/r/20230713141658.9426-1-tbogendoerfer@suse.de Signed-off-by: Leon Romanovsky commit 0e15863015d97c1ee2cc29d599abcc7fa2dc3e95 Author: Shiraz Saleem Date: Wed Jul 12 18:41:33 2023 -0500 RDMA/core: Update CMA destination address on rdma_resolve_addr 8d037973d48c ("RDMA/core: Refactor rdma_bind_addr") intoduces as regression on irdma devices on certain tests which uses rdma CM, such as cmtime. No connections can be established with the MAD QP experiences a fatal error on the active side. The cma destination address is not updated with the dst_addr when ULP on active side calls rdma_bind_addr followed by rdma_resolve_addr. The id_priv state is 'bound' in resolve_prepare_src and update is skipped. This leaves the dgid passed into irdma driver to create an Address Handle (AH) for the MAD QP at 0. The create AH descriptor as well as the ARP cache entry is invalid and HW throws an asynchronous events as result. [ 1207.656888] resolve_prepare_src caller: ucma_resolve_addr+0xff/0x170 [rdma_ucm] daddr=200.0.4.28 id_priv->state=7 [....] [ 1207.680362] ice 0000:07:00.1 rocep7s0f1: caller: irdma_create_ah+0x3e/0x70 [irdma] ah_id=0 arp_idx=0 dest_ip=0.0.0.0 destMAC=00:00:64:ca:b7:52 ipvalid=1 raw=0000:0000:0000:0000:0000:ffff:0000:0000 [ 1207.682077] ice 0000:07:00.1 rocep7s0f1: abnormal ae_id = 0x401 bool qp=1 qp_id = 1, ae_src=5 [ 1207.691657] infiniband rocep7s0f1: Fatal error (1) on MAD QP (1) Fix this by updating the CMA destination address when the ULP calls a resolve address with the CM state already bound. Fixes: 8d037973d48c ("RDMA/core: Refactor rdma_bind_addr") Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20230712234133.1343-1-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky commit f0842bb3d38863777e3454da5653d80b5fde6321 Author: Shiraz Saleem Date: Tue Jul 11 12:52:53 2023 -0500 RDMA/irdma: Fix data race on CQP request done KCSAN detects a data race on cqp_request->request_done memory location which is accessed locklessly in irdma_handle_cqp_op while being updated in irdma_cqp_ce_handler. Annotate lockless intent with READ_ONCE/WRITE_ONCE to avoid any compiler optimizations like load fusing and/or KCSAN warning. [222808.417128] BUG: KCSAN: data-race in irdma_cqp_ce_handler [irdma] / irdma_wait_event [irdma] [222808.417532] write to 0xffff8e44107019dc of 1 bytes by task 29658 on cpu 5: [222808.417610] irdma_cqp_ce_handler+0x21e/0x270 [irdma] [222808.417725] cqp_compl_worker+0x1b/0x20 [irdma] [222808.417827] process_one_work+0x4d1/0xa40 [222808.417835] worker_thread+0x319/0x700 [222808.417842] kthread+0x180/0x1b0 [222808.417852] ret_from_fork+0x22/0x30 [222808.417918] read to 0xffff8e44107019dc of 1 bytes by task 29688 on cpu 1: [222808.417995] irdma_wait_event+0x1e2/0x2c0 [irdma] [222808.418099] irdma_handle_cqp_op+0xae/0x170 [irdma] [222808.418202] irdma_cqp_cq_destroy_cmd+0x70/0x90 [irdma] [222808.418308] irdma_puda_dele_rsrc+0x46d/0x4d0 [irdma] [222808.418411] irdma_rt_deinit_hw+0x179/0x1d0 [irdma] [222808.418514] irdma_ib_dealloc_device+0x11/0x40 [irdma] [222808.418618] ib_dealloc_device+0x2a/0x120 [ib_core] [222808.418823] __ib_unregister_device+0xde/0x100 [ib_core] [222808.418981] ib_unregister_device+0x22/0x40 [ib_core] [222808.419142] irdma_ib_unregister_device+0x70/0x90 [irdma] [222808.419248] i40iw_close+0x6f/0xc0 [irdma] [222808.419352] i40e_client_device_unregister+0x14a/0x180 [i40e] [222808.419450] i40iw_remove+0x21/0x30 [irdma] [222808.419554] auxiliary_bus_remove+0x31/0x50 [222808.419563] device_remove+0x69/0xb0 [222808.419572] device_release_driver_internal+0x293/0x360 [222808.419582] driver_detach+0x7c/0xf0 [222808.419592] bus_remove_driver+0x8c/0x150 [222808.419600] driver_unregister+0x45/0x70 [222808.419610] auxiliary_driver_unregister+0x16/0x30 [222808.419618] irdma_exit_module+0x18/0x1e [irdma] [222808.419733] __do_sys_delete_module.constprop.0+0x1e2/0x310 [222808.419745] __x64_sys_delete_module+0x1b/0x30 [222808.419755] do_syscall_64+0x39/0x90 [222808.419763] entry_SYSCALL_64_after_hwframe+0x63/0xcd [222808.419829] value changed: 0x01 -> 0x03 Fixes: 915cc7ac0f8e ("RDMA/irdma: Add miscellaneous utility definitions") Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20230711175253.1289-4-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky commit f2c3037811381f9149243828c7eb9a1631df9f9c Author: Shiraz Saleem Date: Tue Jul 11 12:52:52 2023 -0500 RDMA/irdma: Fix data race on CQP completion stats CQP completion statistics is read lockesly in irdma_wait_event and irdma_check_cqp_progress while it can be updated in the completion thread irdma_sc_ccq_get_cqe_info on another CPU as KCSAN reports. Make completion statistics an atomic variable to reflect coherent updates to it. This will also avoid load/store tearing logic bug potentially possible by compiler optimizations. [77346.170861] BUG: KCSAN: data-race in irdma_handle_cqp_op [irdma] / irdma_sc_ccq_get_cqe_info [irdma] [77346.171383] write to 0xffff8a3250b108e0 of 8 bytes by task 9544 on cpu 4: [77346.171483] irdma_sc_ccq_get_cqe_info+0x27a/0x370 [irdma] [77346.171658] irdma_cqp_ce_handler+0x164/0x270 [irdma] [77346.171835] cqp_compl_worker+0x1b/0x20 [irdma] [77346.172009] process_one_work+0x4d1/0xa40 [77346.172024] worker_thread+0x319/0x700 [77346.172037] kthread+0x180/0x1b0 [77346.172054] ret_from_fork+0x22/0x30 [77346.172136] read to 0xffff8a3250b108e0 of 8 bytes by task 9838 on cpu 2: [77346.172234] irdma_handle_cqp_op+0xf4/0x4b0 [irdma] [77346.172413] irdma_cqp_aeq_cmd+0x75/0xa0 [irdma] [77346.172592] irdma_create_aeq+0x390/0x45a [irdma] [77346.172769] irdma_rt_init_hw.cold+0x212/0x85d [irdma] [77346.172944] irdma_probe+0x54f/0x620 [irdma] [77346.173122] auxiliary_bus_probe+0x66/0xa0 [77346.173137] really_probe+0x140/0x540 [77346.173154] __driver_probe_device+0xc7/0x220 [77346.173173] driver_probe_device+0x5f/0x140 [77346.173190] __driver_attach+0xf0/0x2c0 [77346.173208] bus_for_each_dev+0xa8/0xf0 [77346.173225] driver_attach+0x29/0x30 [77346.173240] bus_add_driver+0x29c/0x2f0 [77346.173255] driver_register+0x10f/0x1a0 [77346.173272] __auxiliary_driver_register+0xbc/0x140 [77346.173287] irdma_init_module+0x55/0x1000 [irdma] [77346.173460] do_one_initcall+0x7d/0x410 [77346.173475] do_init_module+0x81/0x2c0 [77346.173491] load_module+0x1232/0x12c0 [77346.173506] __do_sys_finit_module+0x101/0x180 [77346.173522] __x64_sys_finit_module+0x3c/0x50 [77346.173538] do_syscall_64+0x39/0x90 [77346.173553] entry_SYSCALL_64_after_hwframe+0x63/0xcd [77346.173634] value changed: 0x0000000000000094 -> 0x0000000000000095 Fixes: 915cc7ac0f8e ("RDMA/irdma: Add miscellaneous utility definitions") Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20230711175253.1289-3-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky commit 4984eb51453ff7eddee9e5ce816145be39c0ec5c Author: Shiraz Saleem Date: Tue Jul 11 12:52:51 2023 -0500 RDMA/irdma: Add missing read barriers On code inspection, there are many instances in the driver where CEQE and AEQE fields written to by HW are read without guaranteeing that the polarity bit has been read and checked first. Add a read barrier to avoid reordering of loads on the CEQE/AEQE fields prior to checking the polarity bit. Fixes: 3f49d6842569 ("RDMA/irdma: Implement HW Admin Queue OPs") Signed-off-by: Shiraz Saleem Link: https://lore.kernel.org/r/20230711175253.1289-2-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky commit fb74c4e3bee283ad8ce981fb744aa8239bed2d7a Author: Russell Currey Date: Thu Jul 13 14:21:45 2023 +1000 powerpc/crypto: Add gitignore for generated P10 AES/GCM .S files aesp10-ppc.S and ghashp10-ppc.S are autogenerated and not tracked by git, so they should be ignored. This is doing the same as the P8 files in drivers/crypto/vmx/.gitignore but for the P10 files in arch/powerpc/crypto. Signed-off-by: Russell Currey Signed-off-by: Michael Ellerman Link: https://msgid.link/20230713042206.85669-1-ruscur@russell.cc commit b49e578b9314db051da0ad72bba24094193f9bd0 Author: Christophe Leroy Date: Wed Jul 12 23:45:02 2023 +1000 Revert "powerpc/bug: Provide better flexibility to WARN_ON/__WARN_FLAGS() with asm goto" This partly reverts commit 1e688dd2a3d6759d416616ff07afc4bb836c4213. That commit aimed at optimising the code around generation of WARN_ON/BUG_ON but this leads to a lot of dead code erroneously generated by GCC. That dead code becomes a problem when we start using objtool validation because objtool will abort validation with a warning as soon as it detects unreachable code. This is because unreachable code might be the indication that objtool doesn't properly decode object text. text data bss dec hex filename 9551585 3627834 224376 13403795 cc8693 vmlinux.before 9535281 3628358 224376 13388015 cc48ef vmlinux.after Once this change is reverted, in a standard configuration (pmac32 + function tracer) the text is reduced by 16k which is around 1.7% We already had problem with it when starting to use objtool on powerpc as a replacement for recordmcount, see commit 93e3f45a2631 ("powerpc: Fix __WARN_FLAGS() for use with Objtool") There is also a problem with at least GCC 12, on ppc64_defconfig + CONFIG_CC_OPTIMIZE_FOR_SIZE=y + CONFIG_DEBUG_SECTION_MISMATCH=y : LD .tmp_vmlinux.kallsyms1 powerpc64-linux-ld: net/ipv4/tcp_input.o:(__ex_table+0xc4): undefined reference to `.L2136' make[2]: *** [scripts/Makefile.vmlinux:36: vmlinux] Error 1 make[1]: *** [/home/chleroy/linux-powerpc/Makefile:1238: vmlinux] Error 2 Taking into account that other problems are encountered with that 'asm goto' in WARN_ON(), including build failures, keeping that change is not worth it allthough it is primarily a compiler bug. Revert it for now. mpe: Retain EMIT_WARN_ENTRY as a synonym for EMIT_BUG_ENTRY to reduce churn, as there are now nearly as many uses of EMIT_WARN_ENTRY as EMIT_BUG_ENTRY. Signed-off-by: Christophe Leroy Acked-by: Naveen N Rao Signed-off-by: Michael Ellerman Link: https://msgid.link/20230712134552.534955-1-mpe@ellerman.id.au commit b59c9dc4d9d47b3c4572d826603fde507055b656 Author: Haren Myneni Date: Sun Jul 16 03:05:06 2023 -0700 powerpc/pseries/vas: Hold mmap_mutex after mmap lock during window close Commit 8ef7b9e1765a ("powerpc/pseries/vas: Close windows with DLPAR core removal") unmaps the window paste address and issues HCALL to close window in the hypervisor for migration or DLPAR core removal events. So holds mmap_mutex and then mmap lock before unmap the paste address. But if the user space issue mmap paste address at the same time with the migration event, coproc_mmap() is called after holding the mmap lock which can trigger deadlock when trying to acquire mmap_mutex in coproc_mmap(). t1: mmap() call to mmap t2: Migration event window paste address do_mmap2() migration_store() ksys_mmap_pgoff() pseries_migrate_partition() vm_mmap_pgoff() vas_migration_handler() Acquire mmap lock reconfig_close_windows() do_mmap() lock mmap_mutex mmap_region() Acquire mmap lock call_mmap() //Wait for mmap lock coproc_mmap() unmap vma lock mmap_mutex update window status //wait for mmap_mutex Release mmap lock mmap vma unlock mmap_mutex update window status unlock mmap_mutex ... Release mmap lock Fix this deadlock issue by holding mmap lock first before mmap_mutex in reconfig_close_windows(). Fixes: 8ef7b9e1765a ("powerpc/pseries/vas: Close windows with DLPAR core removal") Signed-off-by: Haren Myneni Signed-off-by: Michael Ellerman Link: https://msgid.link/20230716100506.7833-1-haren@linux.ibm.com commit f7a0b57524cf811ac06257a5099f1b7c19ee7310 Author: Tim Harvey Date: Tue Jun 6 08:40:30 2023 -0700 arm64: dts: imx8mm-venice-gw7904: disable disp_blk_ctrl The GW7904 does not connect the VDD_MIPI power rails thus MIPI is disabled. However we must also disable disp_blk_ctrl as it uses the pgc_mipi power domain and without it being disabled imx8m-blk-ctrl will fail to probe: imx8m-blk-ctrl 32e28000.blk-ctrl: error -ETIMEDOUT: failed to attach power domain "mipi-dsi" imx8m-blk-ctrl: probe of 32e28000.blk-ctrl failed with error -110 Fixes: b999bdaf0597 ("arm64: dts: imx: Add i.mx8mm Gateworks gw7904 dts support") Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit 3e7d3c5e13b05dda9db92d98803a626378e75438 Author: Tim Harvey Date: Tue Jun 6 08:39:45 2023 -0700 arm64: dts: imx8mm-venice-gw7903: disable disp_blk_ctrl The GW7903 does not connect the VDD_MIPI power rails thus MIPI is disabled. However we must also disable disp_blk_ctrl as it uses the pgc_mipi power domain and without it being disabled imx8m-blk-ctrl will fail to probe: imx8m-blk-ctrl 32e28000.blk-ctrl: error -ETIMEDOUT: failed to attach power domain "mipi-dsi" imx8m-blk-ctrl: probe of 32e28000.blk-ctrl failed with error -110 Fixes: a72ba91e5bc7 ("arm64: dts: imx: Add i.mx8mm Gateworks gw7903 dts support") Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit cec148c2476a6e06cf8190b20de81f98983b53ca Author: Damien Le Moal Date: Tue Jul 4 08:32:40 2023 +0900 ata: pata_parport: Add missing protocol modules description Most of the protocol modules for the pata_parport driver are missing a module description, causing warnings such as: WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/ata/pata_parport/aten.o when compiling with W=1. Add the missing MODULE_DESCRIPTION() definitions to avoid these warnings. While at it, also add the missing MODULE_AUTHOR() definitions. Signed-off-by: Damien Le Moal commit fdf0eaf11452d72945af31804e2a1048ee1b574c Author: Linus Torvalds Date: Sun Jul 16 15:10:37 2023 -0700 Linux 6.5-rc2 commit 5b8d6e8539498e8b2fa67fbcce3fe87834d44a7a Merge: 1667e630c228c a160e9414d8a1 Author: Linus Torvalds Date: Sun Jul 16 14:12:49 2023 -0700 Merge tag 'xtensa-20230716' of https://github.com/jcmvbkbc/linux-xtensa Pull xtensa fixes from Max Filippov: - fix interaction between unaligned exception handler and load/store exception handler - fix parsing ISS network interface specification string - add comment about etherdev freeing to ISS network driver * tag 'xtensa-20230716' of https://github.com/jcmvbkbc/linux-xtensa: xtensa: fix unaligned and load/store configuration interaction xtensa: ISS: fix call to split_if_spec xtensa: ISS: add comment about etherdev freeing commit 1667e630c228ca2e7577de7a404c89de3d9f7772 Merge: 8a3e4a64849eb 27c68c216ee1f Author: Linus Torvalds Date: Sun Jul 16 13:46:08 2023 -0700 Merge tag 'perf_urgent_for_v6.5_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Borislav Petkov: - Fix a lockdep warning when the event given is the first one, no event group exists yet but the code still goes and iterates over event siblings * tag 'perf_urgent_for_v6.5_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86: Fix lockdep warning in for_each_sibling_event() on SPR commit 8a3e4a64849eb9da0e8c7e693978499562581631 Merge: f61a89ca1182c 719a937b70039 Author: Linus Torvalds Date: Sun Jul 16 13:34:29 2023 -0700 Merge tag 'objtool_urgent_for_v6.5_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fixes from Borislav Petkov: - Mark copy_iovec_from_user() __noclone in order to prevent gcc from doing an inter-procedural optimization and confuse objtool - Initialize struct elf fully to avoid build failures * tag 'objtool_urgent_for_v6.5_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: iov_iter: Mark copy_iovec_from_user() noclone objtool: initialize all of struct elf commit f61a89ca1182c43aa7a141c40f4063be81bd2562 Merge: ede950b019227 aff037078ecae Author: Linus Torvalds Date: Sun Jul 16 13:22:08 2023 -0700 Merge tag 'sched_urgent_for_v6.5_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Borislav Petkov: - Remove a cgroup from under a polling process properly - Fix the idle sibling selection * tag 'sched_urgent_for_v6.5_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/psi: use kernfs polling functions for PSI trigger polling sched/fair: Use recent_used_cpu to test p->cpus_ptr commit ede950b01922778ade5ba0d0834f25fca4ed1d88 Merge: fe756ad021461 04e601f2a71c8 Author: Linus Torvalds Date: Sun Jul 16 12:55:31 2023 -0700 Merge tag 'pinctrl-v6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "I'm mostly on vacation but what would vacation be without a few critical fixes so people can use their gaming laptops when hiding away from the sun (or rain)? - Fix a really annoying interrupt storm in the AMD driver affecting Asus TUF gaming notebooks - Fix device tree parsing in the Renesas driver" * tag 'pinctrl-v6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: amd: Unify debounce handling into amd_pinconf_set() pinctrl: amd: Drop pull up select configuration pinctrl: amd: Use amd_pinconf_set() for all config options pinctrl: amd: Only use special debounce behavior for GPIO 0 pinctrl: renesas: rzg2l: Handle non-unique subnode names pinctrl: renesas: rzv2m: Handle non-unique subnode names commit fe756ad0214619ac01503c37f43ca5b912d760d4 Merge: 20edcec23f92d 69cba9d3c1284 Author: Linus Torvalds Date: Sun Jul 16 12:49:05 2023 -0700 Merge tag '6.5-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Two reconnect fixes: important fix to address inFlight count to leak (which can leak credits), and fix for better handling a deleted share - DFS fix - SMB1 cleanup fix - deferred close fix * tag '6.5-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: fix mid leak during reconnection after timeout threshold cifs: is_network_name_deleted should return a bool smb: client: fix missed ses refcounting smb: client: Fix -Wstringop-overflow issues cifs: if deferred close is disabled then close files immediately commit 20edcec23f92db47ca1ab33b4c6025bb8b3db7d7 Merge: 6eede0686f2f4 cf53564b11cef Author: Linus Torvalds Date: Sun Jul 16 12:28:04 2023 -0700 Merge tag 'powerpc-6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix Speculation_Store_Bypass reporting in /proc/self/status on Power10 - Fix HPT with 4K pages since recent changes by implementing pmd_same() - Fix 64-bit native_hpte_remove() to be irq-safe Thanks to Aneesh Kumar K.V, Nageswara R Sastry, and Russell Currey. * tag 'powerpc-6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/mm/book3s64/hash/4k: Add pmd_same callback for 4K page size powerpc/64e: Fix obtool warnings in exceptions-64e.S powerpc/security: Fix Speculation_Store_Bypass reporting on Power10 powerpc/64s: Fix native_hpte_remove() to be irq-safe commit 6eede0686f2f4a1b026a5714cb0481d074085855 Merge: 4b4eef57e6135 ec7633de404e7 Author: Linus Torvalds Date: Sun Jul 16 12:18:18 2023 -0700 Merge tag 'hardening-v6.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - Remove LTO-only suffixes from promoted global function symbols (Yonghong Song) - Remove unused .text..refcount section from vmlinux.lds.h (Petr Pavlu) - Add missing __always_inline to sparc __arch_xchg() (Arnd Bergmann) - Claim maintainership of string routines * tag 'hardening-v6.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: sparc: mark __arch_xchg() as __always_inline MAINTAINERS: Foolishly claim maintainership of string routines kallsyms: strip LTO-only suffixes from promoted global functions vmlinux.lds.h: Remove a reference to no longer used sections .text..refcount commit 4b4eef57e6135ebd28de8c6a3e7898e04172a897 Merge: 831fe284d8275 797311bce5c2a Author: Linus Torvalds Date: Sun Jul 16 12:13:51 2023 -0700 Merge tag 'probes-fixes-v6.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probe fixes from Masami Hiramatsu: - fprobe: Add a comment why fprobe will be skipped if another kprobe is running in fprobe_kprobe_handler(). - probe-events: Fix some issues related to fetch-arguments: - Fix double counting of the string length for user-string and symstr. This will require longer buffer in the array case. - Fix not to count error code (minus value) for the total used length in array argument. This makes the total used length shorter. - Fix to update dynamic used data size counter only if fetcharg uses the dynamic size data. This may mis-count the used dynamic data size and corrupt data. - Revert "tracing: Add "(fault)" name injection to kernel probes" because that did not work correctly with a bug, and we agreed the current '(fault)' output (instead of '"(fault)"' like a string) explains what happened more clearly. - Fix to record 0-length (means fault access) data_loc data in fetch function itself, instead of store_trace_args(). If we record an array of string, this will fix to save fault access data on each entry of the array correctly. * tag 'probes-fixes-v6.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/probes: Fix to record 0-length data_loc in fetch_store_string*() if fails Revert "tracing: Add "(fault)" name injection to kernel probes" tracing/probes: Fix to update dynamic data counter if fetcharg uses it tracing/probes: Fix not to count error code to total length tracing/probes: Fix to avoid double count of the string length on the array fprobes: Add a comment why fprobe_kprobe_handler exits if kprobe is running commit 48faabfb3634e519fc49ef01525448ad2ba96751 Author: Krzysztof Kozlowski Date: Wed Jul 12 10:05:12 2023 +0200 dt-bindings: iio: adi,ad74115: remove ref from -nanoamp dtschema v2023.06 comes with support for properties with -nanoamp suffix, thus bindings should not have a ref for it: adi,ad74115.yaml: properties:adi,ext1-burnout-current-nanoamp: '$ref' should not be valid under {'const': '$ref'} Cc: Cosmin Tanislav Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230712080512.94964-1-krzysztof.kozlowski@linaro.org Signed-off-by: Jonathan Cameron commit a41e19cc0d6b6a445a4133170b90271e4a2553dc Author: Alvin Šipraga Date: Mon Jun 19 16:12:39 2023 +0200 iio: adc: ina2xx: avoid NULL pointer dereference on OF device match The affected lines were resulting in a NULL pointer dereference on our platform because the device tree contained the following list of compatible strings: power-sensor@40 { compatible = "ti,ina232", "ti,ina231"; ... }; Since the driver doesn't declare a compatible string "ti,ina232", the OF matching succeeds on "ti,ina231". But the I2C device ID info is populated via the first compatible string, cf. modalias population in of_i2c_get_board_info(). Since there is no "ina232" entry in the legacy I2C device ID table either, the struct i2c_device_id *id pointer in the probe function is NULL. Fix this by using the already populated type variable instead, which points to the proper driver data. Since the name is also wanted, add a generic one to the ina2xx_config table. Signed-off-by: Alvin Šipraga Fixes: c43a102e67db ("iio: ina2xx: add support for TI INA2xx Power Monitors") Link: https://lore.kernel.org/r/20230619141239.2257392-1-alvin@pqrs.dk Cc: Signed-off-by: Jonathan Cameron commit 95fb1e7b23bc82130016daefa02a87e83185ca95 Author: Matti Vaittinen Date: Tue Jun 13 12:35:12 2023 +0300 iio: light: bu27008: Fix intensity data type The intensity data from bu27008 is unsigned. The type of the scan data was incorrectly marked as signed resulting large intensity values to be interpreted as negative ones. Fix the scan data type. Fixes: 41ff93d14f78 ("iio: light: ROHM BU27008 color sensor") Signed-off-by: Matti Vaittinen Link: https://lore.kernel.org/r/240a7ca5fc1b76da20d81f930d00f31a54b1fdf8.1686648422.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit 096649cd7cb0fc1c8f684829f816d938ad1eb808 Author: Matti Vaittinen Date: Tue Jun 13 12:34:55 2023 +0300 iio: light: bu27008: Fix scale format The driver is expecting accuracy of NANOs for intensity scale in raw_write. The IIO core is however defaulting to MICROs. This leads the raw-write of smallest scales to never succeed as correct selector(s) are not found. Fix this by implementing the .write_raw_get_fmt callback to use NANO accuracy for writes of IIO_CHAN_INFO_SCALE. Fixes: 41ff93d14f78 ("iio: light: ROHM BU27008 color sensor") Signed-off-by: Matti Vaittinen Link: https://lore.kernel.org/r/e4778b74cde41431f77bc8dd88ec18605da0b400.1686648422.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit d47b9b84292706784482a661324bbc178153781f Author: Matti Vaittinen Date: Tue Jun 13 12:34:36 2023 +0300 iio: light: bu27034: Fix scale format The driver is expecting accuracy of NANOs for intensity scale in raw_write. The IIO core is however defaulting to MICROs. This leads the raw-write of smallest scales to never succeed as correct selector(s) are not found. Fix this by implementing the .write_raw_get_fmt callback to use NANO accuracy for writes of IIO_CHAN_INFO_SCALE. Signed-off-by: Matti Vaittinen Fixes: e52afbd61039 ("iio: light: ROHM BU27034 Ambient Light Sensor") Link: https://lore.kernel.org/r/5369117315cf05b88cf0ccb87373fd77190f6ca2.1686648422.git.mazziesaccount@gmail.com Signed-off-by: Jonathan Cameron commit 6bc471b6c3aeaa7b95d1b86a1bb8d91a3c341fa5 Author: Alisa Roman Date: Wed Jun 14 18:52:43 2023 +0300 iio: adc: ad7192: Fix ac excitation feature AC excitation enable feature exposed to user on AD7192, allowing a bit which should be 0 to be set. This feature is specific only to AD7195. AC excitation attribute moved accordingly. In the AD7195 documentation, the AC excitation enable bit is on position 22 in the Configuration register. ACX macro changed to match correct register and bit. Note that the fix tag is for the commit that moved the driver out of staging. Fixes: b581f748cce0 ("staging: iio: adc: ad7192: move out of staging") Signed-off-by: Alisa Roman Cc: stable@vger.kernel.org Reviewed-by: Nuno Sa Link: https://lore.kernel.org/r/20230614155242.160296-1-alisa.roman@analog.com Signed-off-by: Jonathan Cameron commit ea690ad78dd611e3906df5b948a516000b05c1cb Author: Johan Jonker Date: Fri Jul 14 17:21:21 2023 +0200 mtd: rawnand: rockchip: Align hwecc vs. raw page helper layouts Currently, read/write_page_hwecc() and read/write_page_raw() are not aligned: there is a mismatch in the OOB bytes which are not read/written at the same offset in both cases (raw vs. hwecc). This is a real problem when relying on the presence of the Page Addresses (PA) when using the NAND chip as a boot device, as the BootROM expects additional data in the OOB area at specific locations. Rockchip boot blocks are written per 4 x 512 byte sectors per page. Each page with boot blocks must have a page address (PA) pointer in OOB to the next page. Pages are written in a pattern depending on the NAND chip ID. Generate boot block page address and pattern for hwecc in user space and copy PA data to/from the already reserved last 4 bytes before ECC in the chip->oob_poi data layout. Align the different helpers. This change breaks existing jffs2 users. Fixes: 058e0e847d54 ("mtd: rawnand: rockchip: NFC driver for RK3308, RK2928 and others") Signed-off-by: Johan Jonker Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/5e782c08-862b-51ae-47ff-3299940928ca@gmail.com commit d0ca3b92b7a6f42841ea9da8492aaf649db79780 Author: Johan Jonker Date: Fri Jul 14 17:21:01 2023 +0200 mtd: rawnand: rockchip: fix oobfree offset and description Rockchip boot blocks are written per 4 x 512 byte sectors per page. Each page with boot blocks must have a page address (PA) pointer in OOB to the next page. The currently advertised free OOB area starts at offset 6, like if 4 PA bytes were located right after the BBM. This is wrong as the PA bytes are located right before the ECC bytes. Fix the layout by allowing access to all bytes between the BBM and the PA bytes instead of reserving 4 bytes right after the BBM. This change breaks existing jffs2 users. Fixes: 058e0e847d54 ("mtd: rawnand: rockchip: NFC driver for RK3308, RK2928 and others") Signed-off-by: Johan Jonker Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/d202f12d-188c-20e8-f2c2-9cc874ad4d22@gmail.com commit a746b3689546da27125da9ccaea62b1dbaaf927c Author: Aleksa Savic Date: Fri Jul 14 14:07:11 2023 +0200 hwmon: (aquacomputer_d5next) Fix incorrect PWM value readout Commit 662d20b3a5af ("hwmon: (aquacomputer_d5next) Add support for temperature sensor offsets") changed aqc_get_ctrl_val() to return the value through a parameter instead of through the return value, but didn't fix up a case that relied on the old behavior. Fix it to use the proper received value and not the return code. Fixes: 662d20b3a5af ("hwmon: (aquacomputer_d5next) Add support for temperature sensor offsets") Cc: stable@vger.kernel.org Signed-off-by: Aleksa Savic Link: https://lore.kernel.org/r/20230714120712.16721-1-savicaleksa83@gmail.com Signed-off-by: Guenter Roeck commit 368da76be8df60e9228a41b7d46e7836a67158fd Author: Ahmad Khalifa Date: Sat Jul 15 15:58:31 2023 +0100 hwmon: (nct6775) Fix register for nct6799 Datasheet and variable name point to 0xe6 Fixes: aee395bb1905 ("hwmon: (nct6755) Add support for NCT6799D") Signed-off-by: Ahmad Khalifa Link: https://lore.kernel.org/r/20230715145831.1304633-1-ahmad@khalifa.ws Signed-off-by: Guenter Roeck commit 831fe284d8275987596b7d640518dddba5735f61 Merge: 393ea78172cdc 54ccc8758ef4d Author: Linus Torvalds Date: Sat Jul 15 08:51:02 2023 -0700 Merge tag 'spi-fix-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of fairly minor driver specific fixes here, plus a bunch of maintainership and admin updates. Nothing too remarkable" * tag 'spi-fix-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: mailmap: add entry for Jonas Gorski MAINTAINERS: add myself for spi-bcm63xx spi: s3c64xx: clear loopback bit after loopback test spi: bcm63xx: fix max prepend length MAINTAINERS: Add myself as a maintainer for Microchip SPI commit 393ea78172cdc68800285cb43855c9531abc26a1 Merge: 82678ab2a4af2 963b54df82b6d Author: Linus Torvalds Date: Sat Jul 15 08:46:09 2023 -0700 Merge tag 'regmap-fix-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fix from Mark Brown: "One fix for an out of bounds access in the interupt code here" * tag 'regmap-fix-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap-irq: Fix out-of-bounds access when allocating config buffers commit 82678ab2a4af2b827d2b44b35b1295de8a1d312d Merge: b6e6cc1f78c77 c20ecf7bb6153 Author: Linus Torvalds Date: Sat Jul 15 08:40:00 2023 -0700 Merge tag 'iommu-fixes-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu fixes from Joerg Roedel: - Fix a regression causing a crash on sysfs access of iommu-group specific files - Fix signedness bug in SVA code * tag 'iommu-fixes-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/sva: Fix signedness bug in iommu_sva_alloc_pasid() iommu: Fix crash during syfs iommu_groups/N/type commit bd846ceee9c478d0397428f02696602ba5eb264a Author: Rob Clark Date: Tue Jul 11 10:54:07 2023 -0700 drm/msm/adreno: Fix snapshot BINDLESS_DATA size The incorrect size was causing "CP | AHB bus error" when snapshotting the GPU state on a6xx gen4 (a660 family). Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/26 Signed-off-by: Rob Clark Reviewed-by: Akhil P Oommen Fixes: 1707add81551 ("drm/msm/a6xx: Add a6xx gpu state") Patchwork: https://patchwork.freedesktop.org/patch/546763/ commit 317ab1b90e593eba5b65165e959991837f5593bf Author: Rob Clark Date: Tue Jul 4 09:36:40 2023 -0700 drm/msm/a690: Remove revn and name These fields are deprecated. But any userspace new enough to support a690 also knows how to identify the GPU based on chip-id. Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/545552/ commit 7164360030ea43c0a309fcff1cd728648501dfb7 Author: Rob Clark Date: Tue Jul 4 09:36:39 2023 -0700 drm/msm/adreno: Fix warn splat for devices without revn Recently, a WARN_ON() was introduced to ensure that revn is filled before adreno_is_aXYZ is called. This however doesn't work very well when revn is 0 by design (such as for A635). Cc: Konrad Dybcio Fixes: cc943f43ece7 ("drm/msm/adreno: warn if chip revn is verified before being set") Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Tested-by: Abhinav Kumar # sc7280 Patchwork: https://patchwork.freedesktop.org/patch/545554/ commit e8bf1741c14eb8e4a4e1364d45aeeab66660ab9b Author: Martin Povišer Date: Wed Jul 12 14:15:56 2023 +0200 MAINTAINERS: Redo addition of ssm3515 to APPLE SOUND The MAINTAINERS entries added in commit 4ac690bbae02 ("ASoC: ssm3515: Add new amp driver") were later erased in a merge commit. Re-add those. Cc: Mark Brown Fixes: af53b00fa3ac ("Merge tag 'v6.4-rc2' into asoc-6.5 to get fixes for CI") Signed-off-by: Martin Povišer Link: https://lore.kernel.org/r/20230712121556.93500-1-povik+lin@cutebit.org Signed-off-by: Mark Brown commit 05abb3be91d8788328231ee02973ab3d47f5e3d2 Author: Ville Syrjälä Date: Thu Jul 13 22:47:45 2023 +0300 dma-buf/dma-resv: Stop leaking on krealloc() failure Currently dma_resv_get_fences() will leak the previously allocated array if the fence iteration got restarted and the krealloc_array() fails. Free the old array by hand, and make sure we still clear the returned *fences so the caller won't end up accessing freed memory. Some (but not all) of the callers of dma_resv_get_fences() seem to still trawl through the array even when dma_resv_get_fences() failed. And let's zero out *num_fences as well for good measure. Cc: Sumit Semwal Cc: Christian König Cc: linux-media@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: linaro-mm-sig@lists.linaro.org Fixes: d3c80698c9f5 ("dma-buf: use new iterator in dma_resv_get_fences v3") Signed-off-by: Ville Syrjälä Reviewed-by: Christian König Cc: stable@vger.kernel.org Link: https://patchwork.freedesktop.org/patch/msgid/20230713194745.1751-1-ville.syrjala@linux.intel.com Signed-off-by: Christian König commit 0dd1805fe498e0cf64f68e451a8baff7e64494ec Merge: 9840036786d90 04be3c95da826 Author: Jakub Kicinski Date: Fri Jul 14 20:39:35 2023 -0700 Merge branch 'net-fix-kernel-doc-problems-in-include-net' Randy Dunlap says: ==================== net: fix kernel-doc problems in include/net/ Fix many (but not all) kernel-doc warnings in include/net/. [PATCH v2 net 1/9] net: bonding: remove kernel-doc comment marker [PATCH v2 net 2/9] net: cfg802154: fix kernel-doc notation warnings [PATCH v2 net 3/9] codel: fix kernel-doc notation warnings [PATCH v2 net 4/9] devlink: fix kernel-doc notation warnings [PATCH v2 net 5/9] inet: frags: remove kernel-doc comment marker [PATCH v2 net 6/9] net: llc: fix kernel-doc notation warnings [PATCH v2 net 7/9] net: NSH: fix kernel-doc notation warning [PATCH v2 net 8/9] pie: fix kernel-doc notation warning [PATCH v2 net 9/9] rsi: remove kernel-doc comment marker ==================== Link: https://lore.kernel.org/r/20230714045127.18752-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit 04be3c95da8266a099c8446b6d1205ccf8a62e66 Author: Randy Dunlap Date: Thu Jul 13 21:51:27 2023 -0700 rsi: remove kernel-doc comment marker Change an errant kernel-doc comment marker (/**) to a regular comment to prevent a kernel-doc warning. rsi_91x.h:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (c) 2017 Redpine Signals Inc. Fixes: 4c10d56a76bb ("rsi: add header file rsi_91x") Signed-off-by: Randy Dunlap Cc: Prameela Rani Garnepudi Cc: Siva Rebbagondla Acked-by: Kalle Valo Link: https://lore.kernel.org/r/20230714045127.18752-10-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit d1cca974548d76e0fa8b6761d25f7b47376a3780 Author: Randy Dunlap Date: Thu Jul 13 21:51:26 2023 -0700 pie: fix kernel-doc notation warning Spell a struct member's name correctly to prevent a kernel-doc warning. pie.h:38: warning: Function parameter or member 'tupdate' not described in 'pie_params' Fixes: b42a3d7c7cff ("pie: improve comments and commenting style") Signed-off-by: Randy Dunlap Cc: Leslie Monis Cc: "Mohit P. Tahiliani" Cc: Gautam Ramakrishnan Cc: Jamal Hadi Salim Cc: Cong Wang Cc: Jiri Pirko Link: https://lore.kernel.org/r/20230714045127.18752-9-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit d1533d726aa1efca3a7ae8f40c94ccb149d22e6a Author: Randy Dunlap Date: Thu Jul 13 21:51:25 2023 -0700 net: NSH: fix kernel-doc notation warning Use the struct member's name and the correct format to prevent a kernel-doc warning. nsh.h:200: warning: Function parameter or member 'context' not described in 'nsh_md1_ctx' Fixes: 1f0b7744c505 ("net: add NSH header structures and helpers") Signed-off-by: Randy Dunlap Cc: Jiri Benc Link: https://lore.kernel.org/r/20230714045127.18752-8-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit 201a08830d8c4698f97ce65329ba92e36b7f402a Author: Randy Dunlap Date: Thu Jul 13 21:51:24 2023 -0700 net: llc: fix kernel-doc notation warnings Use the corrent function parameter name or format to prevent kernel-doc warnings. Add 2 function parameter descriptions to prevent kernel-doc warnings. llc_pdu.h:278: warning: Function parameter or member 'da' not described in 'llc_pdu_decode_da' llc_pdu.h:278: warning: Excess function parameter 'sa' description in 'llc_pdu_decode_da' llc_pdu.h:330: warning: Function parameter or member 'skb' not described in 'llc_pdu_init_as_test_cmd' llc_pdu.h:379: warning: Function parameter or member 'svcs_supported' not described in 'llc_pdu_init_as_xid_cmd' llc_pdu.h:379: warning: Function parameter or member 'rx_window' not described in 'llc_pdu_init_as_xid_cmd' Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20230714045127.18752-7-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit d20909a0689f585fb6443da2d8797f7ad549f931 Author: Randy Dunlap Date: Thu Jul 13 21:51:23 2023 -0700 inet: frags: eliminate kernel-doc warning Modify the anonymous enum kernel-doc content so that it doesn't cause a kernel-doc warning. inet_frag.h:33: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst Fixes: 1ab1934ed80a ("inet: frags: enum the flag definitions and add descriptions") Signed-off-by: Randy Dunlap Cc: Nikolay Aleksandrov Link: https://lore.kernel.org/r/20230714045127.18752-6-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit 839f55c5ebdfc2c0825bc7e711a7dedaca11f84e Author: Randy Dunlap Date: Thu Jul 13 21:51:22 2023 -0700 devlink: fix kernel-doc notation warnings Spell function or struct member names correctly. Use ':' instead of '-' for struct member entries. Mark one field as private in kernel-doc. Add a few entries that were missing. Fix a typo. These changes prevent kernel-doc warnings: devlink.h:252: warning: Function parameter or member 'field_id' not described in 'devlink_dpipe_match' devlink.h:267: warning: Function parameter or member 'field_id' not described in 'devlink_dpipe_action' devlink.h:310: warning: Function parameter or member 'match_values_count' not described in 'devlink_dpipe_entry' devlink.h:355: warning: Function parameter or member 'list' not described in 'devlink_dpipe_table' devlink.h:374: warning: Function parameter or member 'actions_dump' not described in 'devlink_dpipe_table_ops' devlink.h:374: warning: Function parameter or member 'matches_dump' not described in 'devlink_dpipe_table_ops' devlink.h:374: warning: Function parameter or member 'entries_dump' not described in 'devlink_dpipe_table_ops' devlink.h:374: warning: Function parameter or member 'counters_set_update' not described in 'devlink_dpipe_table_ops' devlink.h:374: warning: Function parameter or member 'size_get' not described in 'devlink_dpipe_table_ops' devlink.h:384: warning: Function parameter or member 'headers' not described in 'devlink_dpipe_headers' devlink.h:384: warning: Function parameter or member 'headers_count' not described in 'devlink_dpipe_headers' devlink.h:398: warning: Function parameter or member 'unit' not described in 'devlink_resource_size_params' devlink.h:487: warning: Function parameter or member 'id' not described in 'devlink_param' devlink.h:645: warning: Function parameter or member 'overwrite_mask' not described in 'devlink_flash_update_params' Fixes: 1555d204e743 ("devlink: Support for pipeline debug (dpipe)") Fixes: d9f9b9a4d05f ("devlink: Add support for resource abstraction") Fixes: eabaef1896bc ("devlink: Add devlink_param register and unregister") Fixes: 5d5b4128c4ca ("devlink: introduce flash update overwrite mask") Signed-off-by: Randy Dunlap Cc: Jiri Pirko Cc: Moshe Shemesh Cc: Jacob Keller Link: https://lore.kernel.org/r/20230714045127.18752-5-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit cfe57122bba5dc16ad64b162d97e42923fc7587e Author: Randy Dunlap Date: Thu Jul 13 21:51:21 2023 -0700 codel: fix kernel-doc notation warnings Use '@' before the struct member names in kernel-doc notation to prevent kernel-doc warnings. codel.h:158: warning: Function parameter or member 'ecn_mark' not described in 'codel_stats' codel.h:158: warning: Function parameter or member 'ce_mark' not described in 'codel_stats' Fixes: 76e3cc126bb2 ("codel: Controlled Delay AQM") Signed-off-by: Randy Dunlap Cc: Jamal Hadi Salim Cc: Cong Wang Cc: Jiri Pirko Cc: Dave Taht Link: https://lore.kernel.org/r/20230714045127.18752-4-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit a63e40444e1bdb2ccdcd7c2e4afa51fdbc6c8589 Author: Randy Dunlap Date: Thu Jul 13 21:51:20 2023 -0700 net: cfg802154: fix kernel-doc notation warnings Add an enum heading to the kernel-doc comments to prevent kernel-doc warnings. cfg802154.h:174: warning: Cannot understand * @WPAN_PHY_FLAG_TRANSMIT_POWER: Indicates that transceiver will support on line 174 - I thought it was a doc line cfg802154.h:192: warning: Enum value 'WPAN_PHY_FLAG_TXPOWER' not described in enum 'wpan_phy_flags' cfg802154.h:192: warning: Excess enum value 'WPAN_PHY_FLAG_TRANSMIT_POWER' description in 'wpan_phy_flags' Fixes: edea8f7c75ec ("cfg802154: introduce wpan phy flags") Signed-off-by: Randy Dunlap Cc: Alexander Aring Cc: Stefan Schmidt Cc: Marcel Holtmann Acked-by: Miquel Raynal Link: https://lore.kernel.org/r/20230714045127.18752-3-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit a66557c790208610bdc21c0c788e7b9524b1a356 Author: Randy Dunlap Date: Thu Jul 13 21:51:19 2023 -0700 net: bonding: remove kernel-doc comment marker Change an errant kernel-doc comment marker (/**) to a regular comment to prevent a kernel-doc warning. bonding.h:282: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Returns NULL if the net_device does not belong to any of the bond's slaves Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Randy Dunlap Cc: Jay Vosburgh Cc: Andy Gospodarek Link: https://lore.kernel.org/r/20230714045127.18752-2-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit b6e6cc1f78c772e952495b7416c9ac9029f9390c Merge: be522ac7cdcc1 535d0ae39185a Author: Linus Torvalds Date: Fri Jul 14 20:19:25 2023 -0700 Merge tag 'x86_urgent_for_6.5_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 CFI fixes from Peter Zijlstra: "Fix kCFI/FineIBT weaknesses The primary bug Alyssa noticed was that with FineIBT enabled function prologues have a spurious ENDBR instruction: __cfi_foo: endbr64 subl $hash, %r10d jz 1f ud2 nop 1: foo: endbr64 <--- *sadface* This means that any indirect call that fails to target the __cfi symbol and instead targets (the regular old) foo+0, will succeed due to that second ENDBR. Fixing this led to the discovery of a single indirect call that was still doing this: ret_from_fork(). Since that's an assembly stub the compiler would not generate the proper kCFI indirect call magic and it would not get patched. Brian came up with the most comprehensive fix -- convert the thing to C with only a very thin asm wrapper. This ensures the kernel thread boostrap is a proper kCFI call. While discussing all this, Kees noted that kCFI hashes could/should be poisoned to seal all functions whose address is never taken, further limiting the valid kCFI targets -- much like we already do for IBT. So what was a 'simple' observation and fix cascaded into a bunch of inter-related CFI infrastructure fixes" * tag 'x86_urgent_for_6.5_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cfi: Only define poison_cfi() if CONFIG_X86_KERNEL_IBT=y x86/fineibt: Poison ENDBR at +0 x86: Rewrite ret_from_fork() in C x86/32: Remove schedule_tail_wrapper() x86/cfi: Extend ENDBR sealing to kCFI x86/alternative: Rename apply_ibt_endbr() x86/cfi: Extend {JMP,CAKK}_NOSPEC comment commit be522ac7cdcc1b7dd19fa348205363041ab65a98 Merge: b3bd86a049656 f4d1a8e011909 Author: Linus Torvalds Date: Fri Jul 14 19:57:29 2023 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is a bunch of small driver fixes and a larger rework of zone disk handling (which reaches into blk and nvme). The aacraid array-bounds fix is now critical since the security people turned on -Werror for some build tests, which now fail without it" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: storvsc: Handle SRB status value 0x30 scsi: block: Improve checks in blk_revalidate_disk_zones() scsi: block: virtio_blk: Set zone limits before revalidating zones scsi: block: nullblk: Set zone limits before revalidating zones scsi: nvme: zns: Set zone limits before revalidating zones scsi: sd_zbc: Set zone limits before revalidating zones scsi: ufs: core: Add support for qTimestamp attribute scsi: aacraid: Avoid -Warray-bounds warning scsi: ufs: ufs-mediatek: Add dependency for RESET_CONTROLLER scsi: ufs: core: Update contact email for monitor sysfs nodes scsi: scsi_debug: Remove dead code scsi: qla2xxx: Use vmalloc_array() and vcalloc() scsi: fnic: Use vmalloc_array() and vcalloc() scsi: qla2xxx: Fix error code in qla2x00_start_sp() scsi: qla2xxx: Silence a static checker warning scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan() commit b3bd86a0496565272ee1fc003b4b75ddb2f6427f Merge: ec17f16432058 9f87fc4d72f52 Author: Linus Torvalds Date: Fri Jul 14 19:52:18 2023 -0700 Merge tag 'block-6.5-2023-07-14' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith: - Don't require quirk to use duplicate namespace identifiers (Christoph, Sagi) - One more BOGUS_NID quirk (Pankaj) - IO timeout and error hanlding fixes for PCI (Keith) - Enhanced metadata format mask fix (Ankit) - Association race condition fix for fibre channel (Michael) - Correct debugfs error checks (Minjie) - Use PAGE_SECTORS_SHIFT where needed (Damien) - Reduce kernel logs for legacy nguid attribute (Keith) - Use correct dma direction when unmapping metadata (Ming) - Fix for a flush handling regression in this release (Christoph) - Fix for batched request time stamping (Chengming) - Fix for a regression in the mq-deadline position calculation (Bart) - Lockdep fix for blk-crypto (Eric) - Fix for a regression in the Amiga partition handling changes (Michael) * tag 'block-6.5-2023-07-14' of git://git.kernel.dk/linux: block: queue data commands from the flush state machine at the head blk-mq: fix start_time_ns and alloc_time_ns for pre-allocated rq nvme-pci: fix DMA direction of unmapping integrity data nvme: don't reject probe due to duplicate IDs for single-ported PCIe devices block/mq-deadline: Fix a bug in deadline_from_pos() nvme: ensure disabling pairs with unquiesce nvme-fc: fix race between error recovery and creating association nvme-fc: return non-zero status code when fails to create association nvme: fix parameter check in nvme_fault_inject_init() nvme: warn only once for legacy uuid attribute block: remove dead struc request->completion_data field nvme: fix the NVME_ID_NS_NVM_STS_MASK definition nvmet: use PAGE_SECTORS_SHIFT nvme: add BOGUS_NID quirk for Samsung SM953 blk-crypto: use dynamic lock class for blk_crypto_profile::lock block/partition: fix signedness issue for Amiga partitions commit ec17f16432058e1406c763a81acfc1394578bc8c Merge: 2772d7df3c93f 8a796565cec36 Author: Linus Torvalds Date: Fri Jul 14 19:46:54 2023 -0700 Merge tag 'io_uring-6.5-2023-07-14' of git://git.kernel.dk/linux Pull io_uring fix from Jens Axboe: "Just a single tweak for the wait logic in io_uring" * tag 'io_uring-6.5-2023-07-14' of git://git.kernel.dk/linux: io_uring: Use io_schedule* in cqring wait commit ff84772fd45d486e4fc78c82e2f70ce5333543e6 Author: Sungjong Seo Date: Fri Jul 14 17:43:54 2023 +0900 exfat: release s_lock before calling dir_emit() There is a potential deadlock reported by syzbot as below: ====================================================== WARNING: possible circular locking dependency detected 6.4.0-next-20230707-syzkaller #0 Not tainted ------------------------------------------------------ syz-executor330/5073 is trying to acquire lock: ffff8880218527a0 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable include/linux/mmap_lock.h:151 [inline] ffff8880218527a0 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:5293 [inline] ffff8880218527a0 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x369/0x510 mm/memory.c:5344 but task is already holding lock: ffff888019f760e0 (&sbi->s_lock){+.+.}-{3:3}, at: exfat_iterate+0x117/0xb50 fs/exfat/dir.c:232 which lock already depends on the new lock. Chain exists of: &mm->mmap_lock --> mapping.invalidate_lock#3 --> &sbi->s_lock Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sbi->s_lock); lock(mapping.invalidate_lock#3); lock(&sbi->s_lock); rlock(&mm->mmap_lock); Let's try to avoid above potential deadlock condition by moving dir_emit*() out of sbi->s_lock coverage. Fixes: ca06197382bd ("exfat: add directory operations") Cc: stable@vger.kernel.org #v5.7+ Reported-by: syzbot+1741a5d9b79989c10bdc@syzkaller.appspotmail.com Link: https://lore.kernel.org/lkml/00000000000078ee7e060066270b@google.com/T/#u Tested-by: syzbot+1741a5d9b79989c10bdc@syzkaller.appspotmail.com Signed-off-by: Sungjong Seo Signed-off-by: Namjae Jeon commit 9d2a55b403eea26cab7c831d8e1c00ef1e6a6850 Author: Xiang Chen Date: Fri Jul 14 11:38:40 2023 +0800 KVM: arm64: Fix the name of sys_reg_desc related to PMU For those PMU system registers defined in sys_reg_descs[], use macro PMU_SYS_REG() / PMU_PMEVCNTR_EL0 / PMU_PMEVTYPER_EL0 to define them, and later two macros call macro PMU_SYS_REG() actually. Currently the input parameter of PMU_SYS_REG() is another macro which is calculation formula of the value of system registers, so for example, if we want to "SYS_PMINTENSET_EL1" as the name of sys register, actually the name we get is as following: (((3) << 19) | ((0) << 16) | ((9) << 12) | ((14) << 8) | ((1) << 5)) The name of system register is used in some tracepoints such as trace_kvm_sys_access(), if not set correctly, we need to analyze the inaccurate name to get the exact name (which also is inconsistent with other system registers), and also the inaccurate name occupies more space. To fix the issue, use the name as a input parameter of PMU_SYS_REG like MTE_REG or EL2_REG. Signed-off-by: Xiang Chen Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/1689305920-170523-1-git-send-email-chenxiang66@hisilicon.com Signed-off-by: Oliver Upton commit 6d4f9236cd678e0bf0c09fd0e1fa20435bb2e5a2 Author: Oliver Upton Date: Thu Jul 13 22:16:49 2023 +0000 KVM: arm64: Correctly handle RES0 bits PMEVTYPER_EL0.evtCount The PMU event ID varies from 10 to 16 bits, depending on the PMU version. If the PMU only supports 10 bits of event ID, bits [15:10] of the evtCount field behave as RES0. While the actual PMU emulation code gets this right (i.e. RES0 bits are masked out when programming the perf event), the sysreg emulation writes an unmasked value to the in-memory cpu context. The net effect is that guest reads and writes of PMEVTYPER_EL0 will see non-RES0 behavior in the reserved bits of the field. As it so happens, kvm_pmu_set_counter_event_type() already writes a masked value to the in-memory context that gets overwritten by access_pmu_evtyper(). Fix the issue by removing the unnecessary (and incorrect) register write in access_pmu_evtyper(). Reviewed-by: Marc Zyngier Reviewed-by: Reiji Watanabe Link: https://lore.kernel.org/r/20230713221649.3889210-1-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 030d2a0ce5dc621e5c6b2f5f65a77a4bb1620adb Author: Krzysztof Kozlowski Date: Wed Jul 12 10:11:24 2023 +0200 dt-bindings: hwmon: moortec,mr75203: fix multipleOf for coefficients Few coefficients use default values multiple of 100, not 1000 (in the example DTS and in the Linux driver): moortec,mr75203.example.dtb: pvt@e0680000: moortec,ts-coeff-g:0:0: 61400 is not a multiple of 1000 Fixes: bf1fdafdbc61 ("dt-bindings: hwmon: (mr75203) add coefficient properties for the thermal equation") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230712081124.110345-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 004ff1b049dda0ec484328a78fc550a9cfc0942b Author: Dan Williams Date: Wed Jul 12 18:50:36 2023 -0700 cxl: Update MAINTAINERS Ben, thank you for all the work to get the CXL subsystem off the ground and establishing QEMU as a place where hardware vendors can collaborate on the new advancements and mechanisms appearing in the CXL specification. Jonathan, thank you for your continued review and collaboration, you have been a defacto CXL maintainer for a while now. Davidlohr, thank you for getting the background command infrastructure off the ground and your leadership on and off the lists. Dave Jiang, thank you for yor continued attention to all the cross-subsytem plumbing issues that CXL continues to create. Cc: Davidlohr Bueso Cc: Jonathan Cameron Cc: Ben Widawsky Cc: Adam Manzanares Cc: Alison Schofield Cc: Vishal Verma Cc: Ira Weiny Cc: Dave Jiang Acked-by: Davidlohr Bueso Acked-by: Jonathan Cameron Reviewed-by: Adam Manzanares Signed-off-by: Dan Williams Link: https://lore.kernel.org/r/168921298745.190279.14706856880354094471.stgit@dwillia2-xfh.jf.intel.com Reviewed-by: Alison Schofield Reviewed-by: Vishal Verma Acked-by: Dave Jiang Signed-off-by: Vishal Verma commit 95c6bff72b02ca084be60c08503d563e506b733f Author: Dan Carpenter Date: Mon Jul 3 17:17:45 2023 +0300 cxl/mem: Fix a double shift bug The CXL_FW_CANCEL macro is used with set/test_bit() so it should be a bit number and not the shifted value. The original code is the equivalent of using BIT(BIT(0)) so it's 0x2 instead of 0x1. This has no effect on runtime because it's done consistently and nothing else was using the 0x2 bit. Fixes: 9521875bbe00 ("cxl: add a firmware update mechanism using the sysfs firmware loader") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/a11b0c78-4717-4f4e-90be-f47f300d607c@moroto.mountain Reviewed-by: Vishal Verma Reviewed-by: Davidlohr Bueso Reviewed-by: Dave Jiang Signed-off-by: Vishal Verma commit 9171dfcda4f26dc6ebfd8d50137c5f294c2060ee Author: Arnd Bergmann Date: Mon Jul 3 13:29:13 2023 +0200 cxl: fix CONFIG_FW_LOADER dependency When FW_LOADER is disabled, cxl fails to link: arm-linux-gnueabi-ld: drivers/cxl/core/memdev.o: in function `cxl_memdev_setup_fw_upload': memdev.c:(.text+0x90e): undefined reference to `firmware_upload_register' memdev.c:(.text+0x93c): undefined reference to `firmware_upload_unregister' In order to use the firmware_upload_register() function, both FW_LOADER and FW_UPLOAD have to be enabled, which is a bit confusing. In addition, the dependency is on the wrong symbol, as the caller is part of the cxl_core.ko module, not the cxl_mem.ko module. Fixes: 9521875bbe005 ("cxl: add a firmware update mechanism using the sysfs firmware loader") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230703112928.332321-1-arnd@kernel.org Reviewed-by: Xiao Yang Reviewed-by: Dave Jiang Signed-off-by: Vishal Verma commit 70904263512a74a3b8941dd9e6e515ca6fc57821 Author: Ross Lagerwall Date: Fri Jul 14 11:11:06 2023 +0100 blk-mq: Fix stall due to recursive flush plug We have seen rare IO stalls as follows: * blk_mq_plug_issue_direct() is entered with an mq_list containing two requests. * For the first request, it sets last == false and enters the driver's queue_rq callback. * The driver queue_rq callback indirectly calls schedule() which calls blk_flush_plug(). This may happen if the driver has the BLK_MQ_F_BLOCKING flag set and is allowed to sleep in ->queue_rq. * blk_flush_plug() handles the remaining request in the mq_list. mq_list is now empty. * The original call to queue_rq resumes (with last == false). * The loop in blk_mq_plug_issue_direct() terminates because there are no remaining requests in mq_list. The IO is now stalled because the last request submitted to the driver had last == false and there was no subsequent call to commit_rqs(). Fix this by returning early in blk_mq_flush_plug_list() if rq_count is 0 which it will be in the recursive case, rather than checking if the mq_list is empty. At the same time, adjust one of the callers to skip the mq_list empty check as it is not necessary. Fixes: dc5fc361d891 ("block: attempt direct issue of plug list") Signed-off-by: Ross Lagerwall Reviewed-by: Bart Van Assche Link: https://lore.kernel.org/r/20230714101106.3635611-1-ross.lagerwall@citrix.com Signed-off-by: Jens Axboe commit 569f8b501b177f21121d483a96491716ab8905f4 Author: John Hubbard Date: Mon Jul 10 17:56:29 2023 -0700 selftests/arm64: fix build failure during the "emit_tests" step The build failure reported in [1] occurred because commit <9fc96c7c19df> ("selftests: error out if kernel header files are not yet built") added a new "kernel_header_files" dependency to "all", and that triggered another, pre-existing problem. Specifically, the arm64 selftests override the emit_tests target, and that override improperly declares itself to depend upon the "all" target. This is a problem because the "emit_tests" target in lib.mk was not intended to be overridden. emit_tests is a very simple, sequential build target that was originally invoked from the "install" target, which in turn, depends upon "all". That approach worked for years. But with 9fc96c7c19df in place, emit_tests failed, because it does not set up all of the elaborate things that "install" does. And that caused the new "kernel_header_files" target (which depends upon $(KBUILD_OUTPUT) being correct) to fail. Some detail: The "all" target is .PHONY. Therefore, each target that depends on "all" will cause it to be invoked again, and because dependencies are managed quite loosely in the selftests Makefiles, many things will run, even "all" is invoked several times in immediate succession. So this is not a "real" failure, as far as build steps go: everything gets built, but "all" reports a problem when invoked a second time from a bad environment. To fix this, simply remove the unnecessary "all" dependency from the overridden emit_tests target. The dependency is still effectively honored, because again, invocation is via "install", which also depends upon "all". An alternative approach would be to harden the emit_tests target so that it can depend upon "all", but that's a lot more complicated and hard to get right, and doesn't seem worth it, especially given that emit_tests should probably not be overridden at all. [1] https://lore.kernel.org/20230710-kselftest-fix-arm64-v1-1-48e872844f25@kernel.org Fixes: 9fc96c7c19df ("selftests: error out if kernel header files are not yet built") Reported-by: Mark Brown Signed-off-by: John Hubbard Tested-by: Mark Brown Signed-off-by: Shuah Khan commit c77896b143d3c9c3e84c4ed0662b807ccbd8730b Author: John Hubbard Date: Wed Jul 12 12:35:14 2023 -0700 selftests/riscv: fix potential build failure during the "emit_tests" step The riscv selftests (which were modeled after the arm64 selftests) are improperly declaring the "emit_tests" target to depend upon the "all" target. This approach, when combined with commit 9fc96c7c19df ("selftests: error out if kernel header files are not yet built"), has caused build failures [1] on arm64, and is likely to cause similar failures for riscv. To fix this, simply remove the unnecessary "all" dependency from the emit_tests target. The dependency is still effectively honored, because again, invocation is via "install", which also depends upon "all". An alternative approach would be to harden the emit_tests target so that it can depend upon "all", but that's a lot more complicated and hard to get right, and doesn't seem worth it, especially given that emit_tests should probably not be overridden at all. [1] https://lore.kernel.org/20230710-kselftest-fix-arm64-v1-1-48e872844f25@kernel.org Fixes: 9fc96c7c19df ("selftests: error out if kernel header files are not yet built") Signed-off-by: John Hubbard Tested-by: Alexandre Ghiti Signed-off-by: Shuah Khan commit 2772d7df3c93f15e5b2119bd9e14724db6a21a04 Merge: bde7f150276bf ab2dbc7accedc Author: Linus Torvalds Date: Fri Jul 14 11:14:07 2023 -0700 Merge tag 'riscv-for-linus-6.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Palmer Dabbelt: - fix a formatting error in the hwprobe documentation - fix a spurious warning in the RISC-V PMU driver - fix memory detection on rv32 (problem does not manifest on any known system) - avoid parsing legacy parsing of I in ACPI ISA strings * tag 'riscv-for-linus-6.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: RISC-V: Don't include Zicsr or Zifencei in I from ACPI riscv: mm: fix truncation warning on RV32 perf: RISC-V: Remove PERF_HES_STOPPED flag checking in riscv_pmu_start() Documentation: RISC-V: hwprobe: Fix a formatting error commit bde7f150276bf2a04f92d39beaf34eb40c42c9cc Merge: 3a97a2993e7e7 d121758da6df6 Author: Linus Torvalds Date: Fri Jul 14 11:07:04 2023 -0700 Merge tag 'pm-6.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix hibernation (after recent changes), frequency QoS and the sparc cpufreq driver. Specifics: - Unbreak the /sys/power/resume interface after recent changes (Azat Khuzhin). - Allow PM_QOS_DEFAULT_VALUE to be used with frequency QoS (Chungkai Yang). - Remove __init from cpufreq callbacks in the sparc driver, because they may be called after initialization too (Viresh Kumar)" * tag 'pm-6.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: sparc: Don't mark cpufreq callbacks with __init PM: QoS: Restore support for default value on frequency QoS PM: hibernate: Fix writing maj:min to /sys/power/resume commit d121758da6df6829cb505ef0143cf42d28bd865d Merge: bfb5ef2219b7b c9e4bf607d8c4 3a8395b565b5b Author: Rafael J. Wysocki Date: Fri Jul 14 19:13:21 2023 +0200 Merge branches 'pm-sleep' and 'pm-qos' Merge a PM QoS fix and a hibernation fix for 6.5-rc2. - Unbreak the /sys/power/resume interface after recent changes (Azat Khuzhin). - Allow PM_QOS_DEFAULT_VALUE to be used with frequency QoS (Chungkai Yang). * pm-sleep: PM: hibernate: Fix writing maj:min to /sys/power/resume * pm-qos: PM: QoS: Restore support for default value on frequency QoS commit 676b7c5ecab36274442887ceadd6dee8248a244f Author: David Xu Date: Thu Jul 13 21:35:28 2023 +0800 platform/x86: serial-multi-instantiate: Auto detect IRQ resource for CSC3551 The current code assumes that the CSC3551(multiple cs35l41) always have its interrupt pin connected to GPIO thus the IRQ can be acquired with acpi_dev_gpio_irq_get. However on some newer laptop models this is no longer the case as they have the CSC3551's interrupt pin connected to APIC. This causes smi_i2c_probe to fail on these machines. To support these machines, a new macro IRQ_RESOURCE_AUTO was introduced for cs35l41 smi_node, and smi_get_irq function was modified so it tries to get GPIO irq resource first and if failed, tries to get APIC irq resource for cs35l41. This patch affects only the cs35l41's probing and brings no negative influence on machines that indeed have the cs35l41's interrupt pin connected to GPIO. Signed-off-by: David Xu Link: https://lore.kernel.org/r/SY4P282MB18350CD8288687B87FFD2243E037A@SY4P282MB1835.AUSP282.PROD.OUTLOOK.COM Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit b3e7b3a6ee92ab927f750a6b19615ce88ece808f Author: Michal Swiatkowski Date: Thu Jul 6 08:25:51 2023 +0200 ice: prevent NULL pointer deref during reload Calling ethtool during reload can lead to call trace, because VSI isn't configured for some time, but netdev is alive. To fix it add rtnl lock for VSI deconfig and config. Set ::num_q_vectors to 0 after freeing and add a check for ::tx/rx_rings in ring related ethtool ops. Add proper unroll of filters in ice_start_eth(). Reproduction: $watch -n 0.1 -d 'ethtool -g enp24s0f0np0' $devlink dev reload pci/0000:18:00.0 action driver_reinit Call trace before fix: [66303.926205] BUG: kernel NULL pointer dereference, address: 0000000000000000 [66303.926259] #PF: supervisor read access in kernel mode [66303.926286] #PF: error_code(0x0000) - not-present page [66303.926311] PGD 0 P4D 0 [66303.926332] Oops: 0000 [#1] PREEMPT SMP PTI [66303.926358] CPU: 4 PID: 933821 Comm: ethtool Kdump: loaded Tainted: G OE 6.4.0-rc5+ #1 [66303.926400] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.00.01.0014.070920180847 07/09/2018 [66303.926446] RIP: 0010:ice_get_ringparam+0x22/0x50 [ice] [66303.926649] Code: 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 48 8b 87 c0 09 00 00 c7 46 04 e0 1f 00 00 c7 46 10 e0 1f 00 00 48 8b 50 20 <48> 8b 12 0f b7 52 3a 89 56 14 48 8b 40 28 48 8b 00 0f b7 40 58 48 [66303.926722] RSP: 0018:ffffad40472f39c8 EFLAGS: 00010246 [66303.926749] RAX: ffff98a8ada05828 RBX: ffff98a8c46dd060 RCX: ffffad40472f3b48 [66303.926781] RDX: 0000000000000000 RSI: ffff98a8c46dd068 RDI: ffff98a8b23c4000 [66303.926811] RBP: ffffad40472f3b48 R08: 00000000000337b0 R09: 0000000000000000 [66303.926843] R10: 0000000000000001 R11: 0000000000000100 R12: ffff98a8b23c4000 [66303.926874] R13: ffff98a8c46dd060 R14: 000000000000000f R15: ffffad40472f3a50 [66303.926906] FS: 00007f6397966740(0000) GS:ffff98b390900000(0000) knlGS:0000000000000000 [66303.926941] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [66303.926967] CR2: 0000000000000000 CR3: 000000011ac20002 CR4: 00000000007706e0 [66303.926999] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [66303.927029] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [66303.927060] PKRU: 55555554 [66303.927075] Call Trace: [66303.927094] [66303.927111] ? __die+0x23/0x70 [66303.927140] ? page_fault_oops+0x171/0x4e0 [66303.927176] ? exc_page_fault+0x7f/0x180 [66303.927209] ? asm_exc_page_fault+0x26/0x30 [66303.927244] ? ice_get_ringparam+0x22/0x50 [ice] [66303.927433] rings_prepare_data+0x62/0x80 [66303.927469] ethnl_default_doit+0xe2/0x350 [66303.927501] genl_family_rcv_msg_doit.isra.0+0xe3/0x140 [66303.927538] genl_rcv_msg+0x1b1/0x2c0 [66303.927561] ? __pfx_ethnl_default_doit+0x10/0x10 [66303.927590] ? __pfx_genl_rcv_msg+0x10/0x10 [66303.927615] netlink_rcv_skb+0x58/0x110 [66303.927644] genl_rcv+0x28/0x40 [66303.927665] netlink_unicast+0x19e/0x290 [66303.927691] netlink_sendmsg+0x254/0x4d0 [66303.927717] sock_sendmsg+0x93/0xa0 [66303.927743] __sys_sendto+0x126/0x170 [66303.927780] __x64_sys_sendto+0x24/0x30 [66303.928593] do_syscall_64+0x5d/0x90 [66303.929370] ? __count_memcg_events+0x60/0xa0 [66303.930146] ? count_memcg_events.constprop.0+0x1a/0x30 [66303.930920] ? handle_mm_fault+0x9e/0x350 [66303.931688] ? do_user_addr_fault+0x258/0x740 [66303.932452] ? exc_page_fault+0x7f/0x180 [66303.933193] entry_SYSCALL_64_after_hwframe+0x72/0xdc Fixes: 5b246e533d01 ("ice: split probe into smaller functions") Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Reviewed-by: Simon Horman Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 24a3298ac9e6bd8de838ab79f7868207170d556d Author: Petr Oros Date: Mon Jun 19 12:58:13 2023 +0200 ice: Unregister netdev and devlink_port only once Since commit 6624e780a577fc ("ice: split ice_vsi_setup into smaller functions") ice_vsi_release does things twice. There is unregister netdev which is unregistered in ice_deinit_eth also. It also unregisters the devlink_port twice which is also unregistered in ice_deinit_eth(). This double deregistration is hidden because devl_port_unregister ignores the return value of xa_erase. [ 68.642167] Call Trace: [ 68.650385] ice_devlink_destroy_pf_port+0xe/0x20 [ice] [ 68.655656] ice_vsi_release+0x445/0x690 [ice] [ 68.660147] ice_deinit+0x99/0x280 [ice] [ 68.664117] ice_remove+0x1b6/0x5c0 [ice] [ 171.103841] Call Trace: [ 171.109607] ice_devlink_destroy_pf_port+0xf/0x20 [ice] [ 171.114841] ice_remove+0x158/0x270 [ice] [ 171.118854] pci_device_remove+0x3b/0xc0 [ 171.122779] device_release_driver_internal+0xc7/0x170 [ 171.127912] driver_detach+0x54/0x8c [ 171.131491] bus_remove_driver+0x77/0xd1 [ 171.135406] pci_unregister_driver+0x2d/0xb0 [ 171.139670] ice_module_exit+0xc/0x55f [ice] Fixes: 6624e780a577 ("ice: split ice_vsi_setup into smaller functions") Signed-off-by: Petr Oros Reviewed-by: Maciej Fijalkowski Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 69cba9d3c1284e0838ae408830a02c4a063104bc Author: Shyam Prasad N Date: Fri Jul 14 08:56:33 2023 +0000 cifs: fix mid leak during reconnection after timeout threshold When the number of responses with status of STATUS_IO_TIMEOUT exceeds a specified threshold (NUM_STATUS_IO_TIMEOUT), we reconnect the connection. But we do not return the mid, or the credits returned for the mid, or reduce the number of in-flight requests. This bug could result in the server->in_flight count to go bad, and also cause a leak in the mids. This change moves the check to a few lines below where the response is decrypted, even of the response is read from the transform header. This way, the code for returning the mids can be reused. Also, the cifs_reconnect was reconnecting just the transport connection before. In case of multi-channel, this may not be what we want to do after several timeouts. Changed that to reconnect the session and the tree too. Also renamed NUM_STATUS_IO_TIMEOUT to a more appropriate name MAX_STATUS_IO_TIMEOUT. Fixes: 8e670f77c4a5 ("Handle STATUS_IO_TIMEOUT gracefully") Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit f13be0ad5344b46bb89323ea5576a2417c6d1e55 Author: Ryan Roberts Date: Thu Jul 13 14:54:33 2023 +0100 selftests/mm: give scripts execute permission When run under run_vmtests.sh, test scripts were failing to run with "permission denied" due to the scripts not being executable. It is also annoying not to be able to directly invoke run_vmtests.sh, which is solved by giving also it the execute permission. Link: https://lkml.kernel.org/r/20230713135440.3651409-3-ryan.roberts@arm.com Signed-off-by: Ryan Roberts Cc: SeongJae Park Cc: David Hildenbrand Cc: Florent Revest Cc: Jérôme Glisse Cc: John Hubbard Cc: Liam R. Howlett Cc: Mark Brown Cc: Shuah Khan Signed-off-by: Andrew Morton commit c071b34f62ddbf8435491ebb0e21eba9dc29f901 Author: Shyam Prasad N Date: Fri Jul 14 08:56:34 2023 +0000 cifs: is_network_name_deleted should return a bool Currently, is_network_name_deleted and it's implementations do not return anything if the network name did get deleted. So the function doesn't fully achieve what it advertizes. Changed the function to return a bool instead. It will now return true if the error returned is STATUS_NETWORK_NAME_DELETED and the share (tree id) was found to be connected. It returns false otherwise. Signed-off-by: Shyam Prasad N Acked-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 73274c33d961f4aa0f968f763e2c9f4210b4f4a3 Author: Dan Carpenter Date: Tue Jul 11 11:21:13 2023 +0300 accel/qaic: Fix a leak in map_user_pages() If get_user_pages_fast() allocates some pages but not as many as we wanted, then the current code leaks those pages. Call put_page() on the pages before returning. Fixes: 129776ac2e38 ("accel/qaic: Add control path") Signed-off-by: Dan Carpenter Reviewed-by: Pranjal Ramajor Asha Kanojiya Reviewed-by: Jeffrey Hugo Reviewed-by: Dafna Hirschfeld Cc: stable@vger.kernel.org # 6.4.x Signed-off-by: Jeffrey Hugo Link: https://patchwork.freedesktop.org/patch/msgid/ZK0Q+ZuONTsBG+1T@moroto commit 47d87f71d00b7091b43a56f608f7151b33e5772e Author: Dan Carpenter Date: Tue Jul 11 11:21:00 2023 +0300 accel/qaic: Add consistent integer overflow checks The encode_dma() function has integer overflow checks. The encode_passthrough(), encode_activate() and encode_status() functions did not. I added integer overflow checking everywhere. I also updated the integer overflow checking in encode_dma() to use size_add() so everything is consistent. Fixes: 129776ac2e38 ("accel/qaic: Add control path") Signed-off-by: Dan Carpenter Reviewed-by: Pranjal Ramajor Asha Kanojiya Reviewed-by: Jeffrey Hugo Cc: stable@vger.kernel.org # 6.4.x [jhugo: tweak if in encode_dma() to match existing style] Signed-off-by: Jeffrey Hugo Link: https://patchwork.freedesktop.org/patch/msgid/ZK0Q7IsPkj6WSCcL@moroto commit 3a97a2993e7e7392292323fefc46d79bf9633e44 Merge: ddbd91617f6d0 38d88d5e97c90 Author: Linus Torvalds Date: Fri Jul 14 09:10:28 2023 -0700 Merge tag 'drm-fixes-2023-07-14-1' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "There were a bunch of fixes lined up for 2 weeks, so we have quite a few scattered fixes, mostly amdgpu and i915, but ttm has a bunch and nouveau makes an appearance. So a bit busier than usual for rc2, but nothing seems out of the ordinary. fbdev: - dma: Fix documented default preferred_bpp value ttm: - fix warning that we shouldn't mix && and || - never consider pinned BOs for eviction&swap - Don't leak a resource on eviction error - Don't leak a resource on swapout move error - fix bulk_move corruption when adding a entry client: - Send hotplug event after registering a client dma-buf: - keep the signaling time of merged fences v3 - fix an error pointer vs NULL bug sched: - wait for all deps in kill jobs - call set fence parent from scheduled i915: - Don't preserve dpll_hw_state for slave crtc in Bigjoiner - Consider OA buffer boundary when zeroing out reports - Remove dead code from gen8_pte_encode - Fix one wrong caching mode enum usage amdgpu: - SMU i2c locking fix - Fix a possible deadlock in process restoration for ROCm apps - Disable PCIe lane/speed switching on Intel platforms (the platforms don't support it) nouveau: - disp: fix HDMI on gt215+ - disp/g94: enable HDMI - acr: Abort loading ACR if no firmware was found - bring back blit subchannel for pre nv50 GPUs - Fix drm_dp_remove_payload() invocation ivpu: - Fix VPU register access in irq disable - Clear specific interrupt status bits on C0 bridge: - dw_hdmi: fix connector access for scdc - ti-sn65dsi86: Fix auxiliary bus lifetime panel: - simple: Add connector_type for innolux_at043tn24 - simple: Add Powertip PH800480T013 drm_display_mode flags" * tag 'drm-fixes-2023-07-14-1' of git://anongit.freedesktop.org/drm/drm: (32 commits) drm/nouveau: bring back blit subchannel for pre nv50 GPUs drm/nouveau/acr: Abort loading ACR if no firmware was found drm/amd: Align SMU11 SMU_MSG_OverridePcieParameters implementation with SMU13 drm/amd: Move helper for dynamic speed switch check out of smu13 drm/amd/pm: conditionally disable pcie lane/speed switching for SMU13 drm/amd/pm: share the code around SMU13 pcie parameters update drm/amdgpu: avoid restore process run into dead loop. drm/amd/pm: fix smu i2c data read risk drm/nouveau/disp/g94: enable HDMI drm/nouveau/disp: fix HDMI on gt215+ drm/client: Send hotplug event after registering a client drm/i915: Fix one wrong caching mode enum usage drm/i915: Remove dead code from gen8_pte_encode drm/i915/perf: Consider OA buffer boundary when zeroing out reports drm/i915: Don't preserve dpll_hw_state for slave crtc in Bigjoiner drm/ttm: never consider pinned BOs for eviction&swap drm/fbdev-dma: Fix documented default preferred_bpp value dma-buf: fix an error pointer vs NULL bug accel/ivpu: Clear specific interrupt status bits on C0 accel/ivpu: Fix VPU register access in irq disable ... commit ddbd91617f6d0b2fd8d509c45348a56125df07b1 Merge: 4b810bf037e52 a282a2f10539d Author: Linus Torvalds Date: Fri Jul 14 09:05:15 2023 -0700 Merge tag 'ceph-for-6.5-rc2' of https://github.com/ceph/ceph-client Pull ceph fix from Ilya Dryomov: "A fix to prevent a potential buffer overrun in the messenger, marked for stable" * tag 'ceph-for-6.5-rc2' of https://github.com/ceph/ceph-client: libceph: harden msgr2.1 frame segment length checks commit 51b56382ed2a2b03347372272362b3baa623ed1e Author: Dan Carpenter Date: Tue Jul 11 11:20:54 2023 +0300 accel/qaic: tighten bounds checking in decode_message() Copy the bounds checking from encode_message() to decode_message(). This patch addresses the following concerns. Ensure that there is enough space for at least one header so that we don't have a negative size later. if (msg_hdr_len < sizeof(*trans_hdr)) Ensure that we have enough space to read the next header from the msg->data. if (msg_len > msg_hdr_len - sizeof(*trans_hdr)) return -EINVAL; Check that the trans_hdr->len is not below the minimum size: if (hdr_len < sizeof(*trans_hdr)) This minimum check ensures that we don't corrupt memory in decode_passthrough() when we do. memcpy(out_trans->data, in_trans->data, len - sizeof(in_trans->hdr)); And finally, use size_add() to prevent an integer overflow: if (size_add(msg_len, hdr_len) > msg_hdr_len) Fixes: 129776ac2e38 ("accel/qaic: Add control path") Signed-off-by: Dan Carpenter Reviewed-by: Pranjal Ramajor Asha Kanojiya Reviewed-by: Jeffrey Hugo Cc: stable@vger.kernel.org # 6.4.x Signed-off-by: Jeffrey Hugo Link: https://patchwork.freedesktop.org/patch/msgid/ZK0Q5nbLyDO7kJa+@moroto commit ea33cb6fc2788f9fe248d49e1c0b2553a58436ef Author: Dan Carpenter Date: Tue Jul 11 11:20:44 2023 +0300 accel/qaic: tighten bounds checking in encode_message() There are several issues in this code. The check at the start of the loop: if (user_len >= user_msg->len) { This check does not ensure that we have enough space for the trans_hdr (8 bytes). Instead the check needs to be: if (user_len > user_msg->len - sizeof(*trans_hdr)) { That subtraction is done as an unsigned long we want to avoid negatives. Add a lower bound to the start of the function. if (user_msg->len < sizeof(*trans_hdr)) There is a second integer underflow which can happen if trans_hdr->len is zero inside the encode_passthrough() function. memcpy(out_trans->data, in_trans->data, in_trans->hdr.len - sizeof(in_trans->hdr)); Instead of adding a check to encode_passthrough() it's better to check in this central place. Add that check: if (trans_hdr->len < sizeof(trans_hdr) The final concern is that the "user_len + trans_hdr->len" might have an integer overflow bug. Use size_add() to prevent that. - if (user_len + trans_hdr->len > user_msg->len) { + if (size_add(user_len, trans_hdr->len) > user_msg->len) { Fixes: 129776ac2e38 ("accel/qaic: Add control path") Signed-off-by: Dan Carpenter Reviewed-by: Pranjal Ramajor Asha Kanojiya Reviewed-by: Jeffrey Hugo Cc: stable@vger.kernel.org # 6.4.x Signed-off-by: Jeffrey Hugo Link: https://patchwork.freedesktop.org/patch/msgid/9a0cb0c1-a974-4f10-bc8d-94437983639a@moroto.mountain commit f2ae72541d52a0bf50366840fe2238aaf111f7ae Author: Hans de Goede Date: Tue Jul 11 11:59:20 2023 +0200 platform/x86/amd: pmc: Use release_mem_region() to undo request_mem_region_muxed() Muxed (mem) regions will wait in request_mem_region_muxed() if the region is busy (in use by another consumer) during the call. In order to wake-up possibly waiting other consumers of the region, it must be released by a release_mem_region() call, which will actually wake up any waiters. release_mem_region() also frees the resource created by request_mem_region_muxed(), avoiding the need for the unmatched kfree(). Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20230711095920.264308-1-hdegoede@redhat.com commit 9f87fc4d72f52b26ac3e19df5e4584227fe6740c Author: Christoph Hellwig Date: Fri Jul 14 16:30:14 2023 +0200 block: queue data commands from the flush state machine at the head We used to insert the data commands following a pre-flush to the head of the queue until commit 1e82fadfc6b ("blk-mq: do not do head insertions post-pre-flush commands"). Not doing this seems to cause hangs of such commands on NFS workloads when exported from file systems with SATA SSDs. I have no idea why this would starve these workloads, but doing a semantic revert of this patch (which looks quite different due to various other changes) fixes the hangs. Fixes: 1e82fadfc6b ("blk-mq: do not do head insertions post-pre-flush commands") Reported-by: Chuck Lever Signed-off-by: Christoph Hellwig Tested-by: Chuck Lever Link: https://lore.kernel.org/r/20230714143014.11879-1-hch@lst.de Signed-off-by: Jens Axboe commit 8b58f757cd1c712b5f081e4c26b13611298dfb07 Author: Thomas GENTY Date: Fri Jul 14 12:51:17 2023 +0200 platform/x86: touchscreen_dmi.c: small changes for Archos 101 Cesium Educ tablet Fix the axes and add home button support as suggested by Hans de Goede. Signed-off-by: Thomas GENTY Link: https://lore.kernel.org/r/20230714105117.192938-1-tomlohave@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit cc8ff2dfcb948f16267335ba5440a42abb41aee2 Author: Derek Fang Date: Wed Jul 12 14:25:53 2023 +0800 ASoC: rt5640: Fix the issue of speaker noise Remove the class-D internal register setting during initialization to be compatible with most speaker designs to avoid noise. Signed-off-by: Derek Fang Link: https://lore.kernel.org/r/20230712062553.31066-1-derek.fang@realtek.com Signed-off-by: Mark Brown commit 963293ff058cef54718fd225a542c73778257b3c Author: Arnaldo Carvalho de Melo Date: Fri Jul 14 10:36:16 2023 -0300 tools headers arm64: Sync arm64's cputype.h with the kernel sources To get the changes in: e910baa9c1efdf76 ("KVM: arm64: vgic: Add Apple M2 PRO/MAX cpus to the list of broken SEIS implementations") That makes this perf source code to be rebuilt: CC /tmp/build/perf-tools/util/arm-spe.o The changes in the above patch don't affect things that are used in arm-spe.c (things like MIDR_NEOVERSE_N1, etc). Unsure if Apple M2 has SPE (Statistical Profiling Extension) :-) That addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/arch/arm64/include/asm/cputype.h arch/arm64/include/asm/cputype.h Cc: Adrian Hunter Cc: Ali Saidi Cc: Ian Rogers Cc: Jiri Olsa Cc: Leo Yan Cc: Marc Zyngier Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/ Signed-off-by: Arnaldo Carvalho de Melo commit 28e898ffa0c6a0875319d9362e387509819c9907 Author: Arnaldo Carvalho de Melo Date: Fri Jul 14 10:18:42 2023 -0300 tools include UAPI: Sync the sound/asound.h copy with the kernel sources Picking the changes from: 01dfa8e969dbbc72 ("ALSA: ump: Add info flag bit for static blocks") e375b8a045873cf5 ("ALSA: ump: Add more attributes to UMP EP and FB info") 30fc139260d46e9b ("ALSA: ump: Add ioctls to inquiry UMP EP and Block info via control API") 127ae6f6dad2edb2 ("ALSA: rawmidi: Skip UMP devices at SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE") e3a8a5b726bdd903 ("ALSA: rawmidi: UMP support") a4bb75c4f19db711 ("ALSA: uapi: pcm: control the filling of the silence samples for drain") That harvests some new ioctls: $ tools/perf/trace/beauty/sndrv_ctl_ioctl.sh > before.ctl $ tools/perf/trace/beauty/sndrv_pcm_ioctl.sh > before.pcm $ cp include/uapi/sound/asound.h tools/include/uapi/sound/asound.h $ tools/perf/trace/beauty/sndrv_ctl_ioctl.sh > after.ctl $ tools/perf/trace/beauty/sndrv_pcm_ioctl.sh > after.pcm $ diff -u before.ctl after.ctl --- before.ctl 2023-07-14 10:17:00.319591889 -0300 +++ after.ctl 2023-07-14 10:17:24.668248373 -0300 @@ -22,6 +22,9 @@ [0x40] = "RAWMIDI_NEXT_DEVICE", [0x41] = "RAWMIDI_INFO", [0x42] = "RAWMIDI_PREFER_SUBDEVICE", + [0x43] = "UMP_NEXT_DEVICE", + [0x44] = "UMP_ENDPOINT_INFO", + [0x45] = "UMP_BLOCK_INFO", [0xd0] = "POWER", [0xd1] = "POWER_STATE", }; $ diff -u before.pcm after.pcm $ Now those will be decoded when they appear, see a system wide 'perf trace' session example here: # perf trace -e ioctl --max-events=10 0.000 ( 0.010 ms): gnome-shell/2240 ioctl(fd: 9, cmd: DRM_MODE_RMFB, arg: 0x7ffc0041d54c) = 0 2.444 ( 0.005 ms): wireplumber/2304 ioctl(fd: 47, cmd: TIOCOUTQ, arg: 0x7f16e9afea24) = 0 2.452 ( 0.002 ms): wireplumber/2304 ioctl(fd: 47, cmd: TIOCOUTQ, arg: 0x7f16e9afea24) = 0 11.348 ( 0.010 ms): gnome-shell/2240 ioctl(fd: 14, cmd: DRM_I915_IRQ_WAIT, arg: 0x7ffc0041ccf0) = 0 11.406 ( 0.037 ms): gnome-shel:cs0/2259 ioctl(fd: 14, cmd: DRM_I915_IRQ_EMIT, arg: 0x7f3cf69fdc60) = 0 11.476 ( 0.009 ms): gnome-shell/2240 ioctl(fd: 9, cmd: DRM_MODE_ADDFB2, arg: 0x7ffc0041ce50) = 0 11.497 ( 0.019 ms): gnome-shell/2240 ioctl(fd: 9, cmd: DRM_MODE_ATOMIC, arg: 0x7ffc0041cdf0) = 0 12.481 ( 0.020 ms): firefox:cs0/3651 ioctl(fd: 40, cmd: DRM_I915_IRQ_EMIT, arg: 0x7f1c365fea60) = 0 12.529 ( 0.009 ms): firefox:cs0/3651 ioctl(fd: 40, cmd: DRM_I915_IRQ_EMIT, arg: 0x7f1c365feab0) = 0 12.624 ( 0.018 ms): firefox:cs0/3651 ioctl(fd: 40, cmd: DRM_I915_IRQ_EMIT, arg: 0x7f1c365fea30) = 0 # Silencing these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/sound/asound.h include/uapi/sound/asound.h Cc: Adrian Hunter Cc: Ian Rogers Cc: Jaroslav Kysela Cc: Jiri Olsa Cc: Namhyung Kim Cc: Takashi Iwai Link: https://lore.kernel.org/lkml/ZLFOrTE2+xZBgHGe@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 7b8615935560e1db55c962efa17a5cbdab349107 Author: Arnaldo Carvalho de Melo Date: Fri Jul 14 10:00:22 2023 -0300 tools include UAPI: Sync linux/vhost.h with the kernel sources To get the changes in: 228a27cf78afc63a ("vhost: Allow worker switching while work is queueing") c1ecd8e950079774 ("vhost: allow userspace to create workers") To pick up these changes and support them: $ tools/perf/trace/beauty/vhost_virtio_ioctl.sh > before $ cp include/uapi/linux/vhost.h tools/include/uapi/linux/vhost.h $ tools/perf/trace/beauty/vhost_virtio_ioctl.sh > after $ diff -u before after --- before 2023-07-14 09:58:14.268249807 -0300 +++ after 2023-07-14 09:58:23.041493892 -0300 @@ -10,6 +10,7 @@ [0x12] = "SET_VRING_BASE", [0x13] = "SET_VRING_ENDIAN", [0x14] = "GET_VRING_ENDIAN", + [0x15] = "ATTACH_VRING_WORKER", [0x20] = "SET_VRING_KICK", [0x21] = "SET_VRING_CALL", [0x22] = "SET_VRING_ERR", @@ -31,10 +32,12 @@ [0x7C] = "VDPA_SET_GROUP_ASID", [0x7D] = "VDPA_SUSPEND", [0x7E] = "VDPA_RESUME", + [0x9] = "FREE_WORKER", }; static const char *vhost_virtio_ioctl_read_cmds[] = { [0x00] = "GET_FEATURES", [0x12] = "GET_VRING_BASE", + [0x16] = "GET_VRING_WORKER", [0x26] = "GET_BACKEND_FEATURES", [0x70] = "VDPA_GET_DEVICE_ID", [0x71] = "VDPA_GET_STATUS", @@ -44,6 +47,7 @@ [0x79] = "VDPA_GET_CONFIG_SIZE", [0x7A] = "VDPA_GET_AS_NUM", [0x7B] = "VDPA_GET_VRING_GROUP", + [0x8] = "NEW_WORKER", [0x80] = "VDPA_GET_VQS_COUNT", [0x81] = "VDPA_GET_GROUP_NUM", }; $ For instance, see how those 'cmd' ioctl arguments get translated, now ATTACH_VRING_WORKER, GET_VRING_WORKER and NEW_WORKER, will be as well: # perf trace -a -e ioctl --max-events=10 0.000 ( 0.011 ms): pipewire/2261 ioctl(fd: 60, cmd: SNDRV_PCM_HWSYNC, arg: 0x1) = 0 21.353 ( 0.014 ms): pipewire/2261 ioctl(fd: 60, cmd: SNDRV_PCM_HWSYNC, arg: 0x1) = 0 25.766 ( 0.014 ms): gnome-shell/2196 ioctl(fd: 14, cmd: DRM_I915_IRQ_WAIT, arg: 0x7ffe4a22c740) = 0 25.845 ( 0.034 ms): gnome-shel:cs0/2212 ioctl(fd: 14, cmd: DRM_I915_IRQ_EMIT, arg: 0x7fd43915dc70) = 0 25.916 ( 0.011 ms): gnome-shell/2196 ioctl(fd: 9, cmd: DRM_MODE_ADDFB2, arg: 0x7ffe4a22c8a0) = 0 25.941 ( 0.025 ms): gnome-shell/2196 ioctl(fd: 9, cmd: DRM_MODE_ATOMIC, arg: 0x7ffe4a22c840) = 0 32.915 ( 0.009 ms): gnome-shell/2196 ioctl(fd: 9, cmd: DRM_MODE_RMFB, arg: 0x7ffe4a22cf9c) = 0 42.522 ( 0.013 ms): gnome-shell/2196 ioctl(fd: 14, cmd: DRM_I915_IRQ_WAIT, arg: 0x7ffe4a22c740) = 0 42.579 ( 0.031 ms): gnome-shel:cs0/2212 ioctl(fd: 14, cmd: DRM_I915_IRQ_EMIT, arg: 0x7fd43915dc70) = 0 42.644 ( 0.010 ms): gnome-shell/2196 ioctl(fd: 9, cmd: DRM_MODE_ADDFB2, arg: 0x7ffe4a22c8a0) = 0 # Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Michael S. Tsirkin Cc: Mike Christie Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/ZLFJ%2FRsDGYiaH5nj@kernel.org/ Signed-off-by: Arnaldo Carvalho de Melo commit 0e022f5bf72f9d7b6f77466b41a87c2076aa8d03 Author: Arnaldo Carvalho de Melo Date: Fri Jul 14 09:52:36 2023 -0300 perf beauty: Update copy of linux/socket.h with the kernel sources To pick the changes in: b848b26c6672c9b9 ("net: Kill MSG_SENDPAGE_NOTLAST") 5e2ff6704a275be0 ("scm: add SO_PASSPIDFD and SCM_PIDFD") 4fe38acdac8a71f7 ("net: Block MSG_SENDPAGE_* from being passed to sendmsg() by userspace") b841b901c452d926 ("net: Declare MSG_SPLICE_PAGES internal sendmsg() flag") That don't result in any changes in the tables generated from that header. But while updating I noticed we were not handling MSG_BATCH and MSG_ZEROCOPY in the hard coded table for the msg flags table, add them. This silences this perf build warning: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/linux/socket.h include/linux/socket.h Cc: Adrian Hunter Cc: Alexander Mikhalitsyn Cc: David Howells Cc: David S. Miller Cc: Ian Rogers Cc: Jakub Kicinski Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/ZLFGuHDwUGDGXdoR@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit c20ecf7bb6153149b81a9277eda23398957656f2 Author: Dan Carpenter Date: Thu Apr 6 11:55:31 2023 +0300 iommu/sva: Fix signedness bug in iommu_sva_alloc_pasid() The ida_alloc_range() function returns negative error codes on error. On success it returns values in the min to max range (inclusive). It never returns more then INT_MAX even if "max" is higher. It never returns values in the 0 to (min - 1) range. The bug is that "min" is an unsigned int so negative error codes will be promoted to high positive values errors treated as success. Fixes: 1a14bf0fc7ed ("iommu/sva: Use GFP_KERNEL for pasid allocation") Signed-off-by: Dan Carpenter Reviewed-by: Lu Baolu Link: https://lore.kernel.org/r/6b32095d-7491-4ebb-a850-12e96209eaaf@kili.mountain Signed-off-by: Joerg Roedel commit 911476ef3c585da9fdf156fd7aaa7455455daf76 Author: Jason Gunthorpe Date: Mon Jun 26 12:13:11 2023 -0300 iommu: Fix crash during syfs iommu_groups/N/type The err_restore_domain flow was accidently inserted into the success path in commit 1000dccd5d13 ("iommu: Allow IOMMU_RESV_DIRECT to work on ARM"). It should only happen if iommu_create_device_direct_mappings() fails. This caused the domains the be wrongly changed and freed whenever the sysfs is used, resulting in an oops: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 3417 Comm: avocado Not tainted 6.4.0-rc4-next-20230602 #3 Hardware name: Dell Inc. PowerEdge R6515/07PXPY, BIOS 2.3.6 07/06/2021 RIP: 0010:__iommu_attach_device+0xc/0xa0 Code: c0 c3 cc cc cc cc 48 89 f0 c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 41 54 55 48 8b 47 08 <48> 8b 00 48 85 c0 74 74 48 89 f5 e8 64 12 49 00 41 89 c4 85 c0 74 RSP: 0018:ffffabae0220bd48 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff9ac04f70e410 RCX: 0000000000000001 RDX: ffff9ac044db20c0 RSI: ffff9ac044fa50d0 RDI: ffff9ac04f70e410 RBP: ffff9ac044fa50d0 R08: 1000000100209001 R09: 00000000000002dc R10: 0000000000000000 R11: 0000000000000000 R12: ffff9ac043d54700 R13: ffff9ac043d54700 R14: 0000000000000001 R15: 0000000000000001 FS: 00007f02e30ae000(0000) GS:ffff9afeb2440000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000012afca006 CR4: 0000000000770ee0 PKRU: 55555554 Call Trace: ? __die+0x24/0x70 ? page_fault_oops+0x82/0x150 ? __iommu_queue_command_sync+0x80/0xc0 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? __iommu_attach_device+0xc/0xa0 ? __iommu_attach_device+0x1c/0xa0 __iommu_device_set_domain+0x42/0x80 __iommu_group_set_domain_internal+0x5d/0x160 iommu_setup_default_domain+0x318/0x400 iommu_group_store_type+0xb1/0x200 kernfs_fop_write_iter+0x12f/0x1c0 vfs_write+0x2a2/0x3b0 ksys_write+0x63/0xe0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0033:0x7f02e2f14a6f Reorganize the error flow so that the success branch and error branches are clearer. Fixes: 1000dccd5d13 ("iommu: Allow IOMMU_RESV_DIRECT to work on ARM") Reported-by: Dheeraj Kumar Srivastava Tested-by: Vasant Hegde Signed-off-by: Jason Gunthorpe Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/0-v1-5bd8cc969d9e+1f1-iommu_set_def_fix_jgg@nvidia.com Signed-off-by: Joerg Roedel commit 9840036786d90cea11a90d1f30b6dc003b34ee67 Author: Yan Zhai Date: Thu Jul 13 10:28:00 2023 -0700 gso: fix dodgy bit handling for GSO_UDP_L4 Commit 1fd54773c267 ("udp: allow header check for dodgy GSO_UDP_L4 packets.") checks DODGY bit for UDP, but for packets that can be fed directly to the device after gso_segs reset, it actually falls through to fragmentation: https://lore.kernel.org/all/CAJPywTKDdjtwkLVUW6LRA2FU912qcDmQOQGt2WaDo28KzYDg+A@mail.gmail.com/ This change restores the expected behavior of GSO_UDP_L4 packets. Fixes: 1fd54773c267 ("udp: allow header check for dodgy GSO_UDP_L4 packets.") Suggested-by: Willem de Bruijn Signed-off-by: Yan Zhai Reviewed-by: Willem de Bruijn Acked-by: Jason Wang Signed-off-by: David S. Miller commit 5def5c1c15bf22934ee227af85c1716762f3829f Author: Kunihiko Hayashi Date: Fri Jun 30 09:45:33 2023 +0900 mmc: sdhci-f-sdh30: Replace with sdhci_pltfm Even if sdhci_pltfm_pmops is specified for PM, this driver doesn't apply sdhci_pltfm, so the structure is not correctly referenced in PM functions. This applies sdhci_pltfm to this driver to fix this issue. - Call sdhci_pltfm_init() instead of sdhci_alloc_host() and other functions that covered by sdhci_pltfm. - Move ops and quirks to sdhci_pltfm_data - Replace sdhci_priv() with own private function sdhci_f_sdh30_priv(). Fixes: 87a507459f49 ("mmc: sdhci: host: add new f_sdh30") Signed-off-by: Kunihiko Hayashi Acked-by: Adrian Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230630004533.26644-1-hayashi.kunihiko@socionext.com Signed-off-by: Ulf Hansson commit a822551c51f0dc063305ca16b9dd0dec7fe1f259 Author: Wang Ming Date: Thu Jul 13 20:16:03 2023 +0800 net: ethernet: Remove repeating expression Identify issues that arise by using the tests/doublebitand.cocci semantic patch. Need to remove duplicate expression in if statement. Signed-off-by: Wang Ming Reviewed-by: Jiawen Wu Signed-off-by: David S. Miller commit 4ad23d2368ccce6da74edc74e69300a4d75a2379 Author: Wang Ming Date: Thu Jul 13 17:51:06 2023 +0800 bna: Remove error checking for debugfs_create_dir() It is expected that most callers should _ignore_ the errors return by debugfs_create_dir() in bnad_debugfs_init(). Signed-off-by: Wang Ming Signed-off-by: David S. Miller commit 797311bce5c2ac90b8d65e357603cfd410d36ebb Author: Masami Hiramatsu (Google) Date: Tue Jul 11 23:16:07 2023 +0900 tracing/probes: Fix to record 0-length data_loc in fetch_store_string*() if fails Fix to record 0-length data to data_loc in fetch_store_string*() if it fails to get the string data. Currently those expect that the data_loc is updated by store_trace_args() if it returns the error code. However, that does not work correctly if the argument is an array of strings. In that case, store_trace_args() only clears the first entry of the array (which may have no error) and leaves other entries. So it should be cleared by fetch_store_string*() itself. Also, 'dyndata' and 'maxlen' in store_trace_args() should be updated only if it is used (ret > 0 and argument is a dynamic data.) Link: https://lore.kernel.org/all/168908496683.123124.4761206188794205601.stgit@devnote2/ Fixes: 40b53b771806 ("tracing: probeevent: Add array type support") Cc: stable@vger.kernel.org Reviewed-by: Steven Rostedt (Google) Signed-off-by: Masami Hiramatsu (Google) commit 1d6d537dc55d1f42d16290f00157ac387985b95b Author: Daniel Golle Date: Thu Jul 13 03:42:29 2023 +0100 net: ethernet: mtk_eth_soc: handle probe deferral Move the call to of_get_ethdev_address to mtk_add_mac which is part of the probe function and can hence itself return -EPROBE_DEFER should of_get_ethdev_address return -EPROBE_DEFER. This allows us to entirely get rid of the mtk_init function. The problem of of_get_ethdev_address returning -EPROBE_DEFER surfaced in situations in which the NVMEM provider holding the MAC address has not yet be loaded at the time mtk_eth_soc is initially probed. In this case probing of mtk_eth_soc should be deferred instead of falling back to use a random MAC address, so once the NVMEM provider becomes available probing can be repeated. Fixes: 656e705243fd ("net-next: mediatek: add support for MT7623 ethernet") Signed-off-by: Daniel Golle Signed-off-by: David S. Miller commit 56a16035bb6effb37177867cea94c13a8382f745 Author: Kuniyuki Iwashima Date: Wed Jul 12 08:44:49 2023 -0700 bridge: Add extack warning when enabling STP in netns. When we create an L2 loop on a bridge in netns, we will see packets storm even if STP is enabled. # unshare -n # ip link add br0 type bridge # ip link add veth0 type veth peer name veth1 # ip link set veth0 master br0 up # ip link set veth1 master br0 up # ip link set br0 type bridge stp_state 1 # ip link set br0 up # sleep 30 # ip -s link show br0 2: br0: mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000 link/ether b6:61:98:1c:1c:b5 brd ff:ff:ff:ff:ff:ff RX: bytes packets errors dropped missed mcast 956553768 12861249 0 0 0 12861249 <-. Keep TX: bytes packets errors dropped carrier collsns | increasing 1027834 11951 0 0 0 0 <-' rapidly This is because llc_rcv() drops all packets in non-root netns and BPDU is dropped. Let's add extack warning when enabling STP in netns. # unshare -n # ip link add br0 type bridge # ip link set br0 type bridge stp_state 1 Warning: bridge: STP does not work in non-root netns. Note this commit will be reverted later when we namespacify the whole LLC infra. Fixes: e730c15519d0 ("[NET]: Make packet reception network namespace safe") Suggested-by: Harry Coin Link: https://lore.kernel.org/netdev/0f531295-e289-022d-5add-5ceffa0df9bc@quietfountain.com/ Suggested-by: Ido Schimmel Signed-off-by: Kuniyuki Iwashima Acked-by: Nikolay Aleksandrov Reviewed-by: Ido Schimmel Signed-off-by: David S. Miller commit b685f1a58956fa36cc01123f253351b25bfacfda Author: Tanmay Patil Date: Wed Jul 12 16:36:57 2023 +0530 net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field() CPSW ALE has 75 bit ALE entries which are stored within three 32 bit words. The cpsw_ale_get_field() and cpsw_ale_set_field() functions assume that the field will be strictly contained within one word. However, this is not guaranteed to be the case and it is possible for ALE field entries to span across up to two words at the most. Fix the methods to handle getting/setting fields spanning up to two words. Fixes: db82173f23c5 ("netdev: driver: ethernet: add cpsw address lookup engine support") Signed-off-by: Tanmay Patil [s-vadapalli@ti.com: rephrased commit message and added Fixes tag] Signed-off-by: Siddharth Vadapalli Signed-off-by: David S. Miller commit 9845217d60d01d151b45842ef2017a65e8f39f5a Author: Mark Brown Date: Wed Jul 12 12:16:16 2023 +0100 net: dsa: ar9331: Use explict flags for regmap single read/write The at9331 is only able to read or write a single register at once. The driver has a custom regmap bus and chooses to tell the regmap core about this by reporting the maximum transfer sizes rather than the explicit flags that exist at the regmap level. Since there are a number of problems with the raw transfer limits and the regmap level flags are better integrated anyway convert the driver to use the flags. No functional change. Signed-off-by: Mark Brown Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 0cb1d9c845110ce638a43a1417c7df5968d1daa3 Author: Arnd Bergmann Date: Fri Jun 16 16:48:48 2023 +0200 media: verisilicon: change confusingly named relaxed register access The register abstraction has wrappers around both the normal writel() and its writel_relaxed() counterpart, but this has led to a lot of users ending up with the relaxed version. There is sometimes a need to intentionally pick the relaxed accessor for performance critical functions, but I noticed that each hantro_reg_write() call also contains a non-relaxed readl(), which is typically much more expensive than a writel, so there is little benefit here but an added risk of missing a serialization against DMA. To make this behave like other interfaces, use the normal accessor by default and only provide the relaxed version as an alternative for performance critical code. hantro_postproc.c is the only place that used both the relaxed and normal writel, but this does not seem cricital either, so change it all to the normal ones. [hverkuil: fix function prototype alignment] Signed-off-by: Arnd Bergmann Tested-by: Benjamin Gaignard Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 7ee8acd1b803502878992acd6f99e61f1e8c7a25 Author: Arnd Bergmann Date: Fri Jun 16 16:48:47 2023 +0200 media: verisilicon: fix excessive stack usage In some configurations, gcc decides not to inline the register accessor functions, which in turn leads to lots of temporary hantro_reg structures on the stack that cannot be eliminated because they escape into an uninlined function: drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c:1022:1: warning: the frame size of 1112 bytes is larger than 1024 bytes [-Wframe-larger-than=] Mark all of these as __always_inline so the compiler is able to completely eliminate the temporary structures instead, which brings the stack usage back down to just the normal local variables. Closes: https://lore.kernel.org/oe-kbuild-all/202306151506.goHEegOd-lkp@intel.com/ [hverkuil: fix function prototype alignment, wrap commit log] Reported-by: kernel test robot Fixes: 727a400686a2 ("media: verisilicon: Add Rockchip AV1 decoder") Signed-off-by: Arnd Bergmann Reviewed-by: Nicolas Dufresne Tested-by: Nathan Chancellor Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit d05dea76d4a813eb959ba0a150c45246d54e7148 Author: Yunfei Dong Date: Mon Jun 12 05:15:57 2023 +0200 media: mediatek: vcodec: fix cancel_work_sync fail with fluster test Will cause below warning then reboot when exercising the decoder with fluster on mt8192-asurada-spherion. This deinit function is called on the v4l2 release callback, even though the work might not have been initialized as that only happens if/when the codec specific 'decode' callback is called (as a result of device_run m2m callback). CPU: 5 PID: 2338 Comm: gst-launch-1.0 Tainted: G W 6.4.0-rc5-next-20230607+ #475 Hardware name: Google Spherion (rev0 - 3) (DT) pstate: 00400009 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __flush_work.isra.0+0x23c/0x258 lr : __cancel_work_timer+0x14c/0x1c8 sp : ffff8000896e3b00 x29: ffff8000896e3b00 x28: ffff57c3d4079f80 x27: 0000000000000000 x26: ffff57c3d4079f80 x25: ffffb76395b59dc8 x24: 0000000000000001 x23: ffffb763928daab8 x22: ffff57c3d4079f80 x21: 0000000000000000 x20: ffffb763955f6778 x19: ffff57c3cf06f4a0 x18: 0000000000000000 x17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000000 x14: ffff57c3c03a1f80 x13: ffffa0616a2fc000 x12: 000000003464d91d x11: 0000000000000000 x10: 0000000000001b10 x9 : ffffb763928de61c x8 : ffff57c3d407baf0 x7 : 0000000000000000 x6 : ffff57c3d4079f80 x5 : ffff57c3d4079f80 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff8000896e3bf0 x1 : 0000000000000011 x0 : 0000000000000000 Call trace: __flush_work.isra.0+0x23c/0x258 __cancel_work_timer+0x14c/0x1c8 cancel_work_sync+0x1c/0x30 vdec_msg_queue_deinit+0xac/0xc8 vdec_h264_slice_deinit+0x64/0xb8 vdec_if_deinit+0x3c/0x68 mtk_vcodec_dec_release+0x20/0x40 fops_vcodec_release+0x50/0xd8 v4l2_release+0x7c/0x100 __fput+0x80/0x270 ____fput+0x18/0x30 task_work_run+0x78/0xe0 do_notify_resume+0x29c/0x7f8 el0_svc+0xa4/0xb8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x1a8/0x1b0 ---[ end trace 0000000000000000 ]--- Fixes: 297160d411e3 ("media: mediatek: vcodec: move core context from device to each instance") Reported-by: Nícolas F. R. A. Prado Signed-off-by: Yunfei Dong Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 4aaa96b59df5fac41ba891969df6b092061ea9d7 Author: Nikolay Burykin Date: Tue Jan 10 10:09:00 2023 +0100 media: pci: cx23885: fix error handling for cx23885 ATSC boards After having been assigned to NULL value at cx23885-dvb.c:1202, pointer '0' is dereferenced at cx23885-dvb.c:2469. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Nikolay Burykin Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 92cbf865ea2e0f2997ff97815c6db182eb23df1b Author: Dmitry Antipov Date: Tue Jun 6 06:38:15 2023 +0200 media: pulse8-cec: handle possible ping error Handle (and warn about) possible error waiting for MSGCODE_PING result. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Antipov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 20de9fdaf4883deffb0138eef28e9cbbead32cfd Author: Arnd Bergmann Date: Thu Jun 1 23:37:22 2023 +0200 media: mtk_jpeg_core: avoid unused-variable warning The mtk8195_jpegenc_drvdata object was added outside of an #ifdef causing a harmless build warning. drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c:1879:32: error: 'mtk8195_jpegenc_drvdata' defined but not used [-Werror=unused-variable] 1879 | static struct mtk_jpeg_variant mtk8195_jpegenc_drvdata = { | ^~~~~~~~~~~~~~~~~~~~~~~ A follow-up patch moved it inside of an #ifdef, which caused more warnings, and a third patch ended up adding even more #ifdefs. These were all bogus, since the actual problem here is the incorrect use of of_ptr(). Since the driver (like any other modern platform driver) only works in combination with CONFIG_OF, there is no point in hiding the reference, so just remove that along with all the pointless #ifdef checks in the driver. This improves build coverage and avoids running into the same problem again when another part of the driver gets changed that relies on the #ifdef blocks to be completely matched. Fixes: 934e8bccac95 ("mtk-jpegenc: support jpegenc multi-hardware") Fixes: 4ae47770d57b ("media: mtk-jpegenc: Fix a compilation issue") Fixes: da4ede4b7fd6 ("media: mtk-jpeg: move data/code inside CONFIG_OF blocks") Signed-off-by: Arnd Bergmann Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 53ebeea50599c1ed05277d7a57e331a34e6d6a82 Author: Ming Qian Date: Tue May 30 09:16:30 2023 +0200 media: imx-jpeg: Support to assign slot for encoder/decoder imx jpeg encoder and decoder support 4 slots each, aim to support some virtualization scenarios. driver should only enable one slot one time. but due to some hardware issue, only slot 0 can be enabled in imx8q platform, and they may be fixed in imx9 platform. Signed-off-by: Ming Qian Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit dcff0b56f661b6b42e828012b464d22cc2068c38 Author: Nicolas Dufresne Date: Thu May 25 22:10:15 2023 +0200 media: amphion: Fix firmware path to match linux-firmware The path did not match the one it was submitted into linux-firmware which prevented generic distribution from having working CODEC. Fixes: 9f599f351e86 ("media: amphion: add vpu core driver") Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 517f088385e1b8015606143e6212cb30f8714070 Author: Alexander Stein Date: Tue Jan 31 11:32:44 2023 +0100 media: amphion: use dev_err_probe This simplifies the code and silences -517 error messages. Also the reason is listed in /sys/kernel/debug/devices_deferred. Signed-off-by: Alexander Stein Reviewed-by: ming_qian Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit bf4c985707d3168ebb7d87d15830de66949d979c Author: Sakari Ailus Date: Tue Jun 13 18:47:53 2023 +0200 media: staging: atomisp: select V4L2_FWNODE Select V4L2_FWNODE as the driver depends on it. Reported-by: Andy Shevchenko Fixes: aa31f6514047 ("media: atomisp: allow building the driver again") Signed-off-by: Sakari Ailus Tested-by: Andy Shevchenko Reviewed-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab commit 9c2dcfc2cf0f2e4e0a0db33bc1a626e35928c475 Author: Sakari Ailus Date: Tue May 30 12:16:39 2023 +0200 media: tc358746: Address compiler warnings Address these compiler warnings by initialising the m_best and p_best values to 0 and 1 respectively (as latter is used as a divisor): drivers/media/i2c/tc358746.c: In function 'tc358746_find_pll_settings': >> drivers/media/i2c/tc358746.c:817:13: warning: 'p_best' is used uninitialized [-Wuninitialized] 817 | u16 p_best, p; | ^~~~~~ >> drivers/media/i2c/tc358746.c:816:13: warning: 'm_best' is used uninitialized [-Wuninitialized] 816 | u16 m_best, mul; | ^~~~~~ The warnings may well be a false positive but it is difficult for a compiler to find out whether that truly is the case. Closes: https://lore.kernel.org/oe-kbuild-all/202305301627.fLT3Bkds-lkp@intel.com/ Reported-by: kernel test robot Fixes: 80a21da3605 ("media: tc358746: add Toshiba TC358746 Parallel to CSI-2 bridge driver") Signed-off-by: Sakari Ailus Reviewed-by: Marco Felsch Signed-off-by: Mauro Carvalho Chehab commit 69ea4c9d02b7947cdd612335a61cc1a02e544ccd Author: Kailang Yang Date: Thu Jul 13 15:57:13 2023 +0800 ALSA: hda/realtek - remove 3k pull low procedure This was the ALC283 depop procedure. Maybe this procedure wasn't suitable with new codec. So, let us remove it. But HP 15z-fc000 must do 3k pull low. If it reboot with plugged headset, it will have errors show don't find codec error messages. Run 3k pull low will solve issues. So, let AMD chipset will run this for workarround. Fixes: 5aec98913095 ("ALSA: hda/realtek - ALC236 headset MIC recording issue") Signed-off-by: Kailang Yang Cc: Reported-by: Joseph C. Sible Closes: https://lore.kernel.org/r/CABpewhE4REgn9RJZduuEU6Z_ijXNeQWnrxO1tg70Gkw=F8qNYg@mail.gmail.com/ Link: https://lore.kernel.org/r/4678992299664babac4403d9978e7ba7@realtek.com Signed-off-by: Takashi Iwai commit e608d16e01456f82738bd98f6f5ca9f46634369d Author: Naveen Kumar Goud Arepalli Date: Tue Jul 11 16:29:14 2023 +0530 arm64: dts: qcom: sa8775p-ride: Update L4C parameters L4c is the supply for UFS vccq, As per UFS spec range of vccq is 1.14V to 1.26V, There are stability issues when operating at marginal voltage. Hence configure the min and max vccq voltages to 1.2V. Signed-off-by: Naveen Kumar Goud Arepalli Acked-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230711105915.30581-1-quic_narepall@quicinc.com Signed-off-by: Bjorn Andersson commit 5e1627cb43ddf1b24b92eb26f8d958a3f5676ccb Author: Alan Stern Date: Wed Jul 12 10:15:10 2023 -0400 net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb The syzbot fuzzer identified a problem in the usbnet driver: usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 754 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 754 Comm: kworker/0:2 Not tainted 6.4.0-rc7-syzkaller-00014-g692b7dc87ca6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Workqueue: mld mld_ifc_work RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 2c b4 5b fb 48 8b 7c 24 18 e8 42 07 f0 fe 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 c9 fc 8a e8 5a 6f 23 fb <0f> 0b e9 58 f8 ff ff e8 fe b3 5b fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc9000463f568 EFLAGS: 00010086 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff88801eb28000 RSI: ffffffff814c03b7 RDI: 0000000000000001 RBP: ffff8881443b7190 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000003 R13: ffff88802a77cb18 R14: 0000000000000003 R15: ffff888018262500 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556a99c15a18 CR3: 0000000028c71000 CR4: 0000000000350ef0 Call Trace: usbnet_start_xmit+0xfe5/0x2190 drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4918 [inline] netdev_start_xmit include/linux/netdevice.h:4932 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x187/0x700 net/core/dev.c:3594 ... This bug is caused by the fact that usbnet trusts the bulk endpoint addresses its probe routine receives in the driver_info structure, and it does not check to see that these endpoints actually exist and have the expected type and directions. The fix is simply to add such a check. Reported-and-tested-by: syzbot+63ee658b9a100ffadbe2@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/000000000000a56e9105d0cec021@google.com/ Signed-off-by: Alan Stern CC: Oliver Neukum Link: https://lore.kernel.org/r/ea152b6d-44df-4f8a-95c6-4db51143dcc1@rowland.harvard.edu Signed-off-by: Jakub Kicinski commit 95ce158b6c93b28842b54b42ad1cb221b9844062 Author: Linus Walleij Date: Thu Jul 13 00:34:05 2023 +0200 dsa: mv88e6xxx: Do a final check before timing out I get sporadic timeouts from the driver when using the MV88E6352. Reading the status again after the loop fixes the problem: the operation is successful but goes undetected. Some added prints show things like this: [ 58.356209] mv88e6085 mdio_mux-0.1:00: Timeout while waiting for switch, addr 1b reg 0b, mask 8000, val 0000, data c000 [ 58.367487] mv88e6085 mdio_mux-0.1:00: Timeout waiting for ATU op 4000, fid 0001 (...) [ 61.826293] mv88e6085 mdio_mux-0.1:00: Timeout while waiting for switch, addr 1c reg 18, mask 8000, val 0000, data 9860 [ 61.837560] mv88e6085 mdio_mux-0.1:00: Timeout waiting for PHY command 1860 to complete The reason is probably not the commands: I think those are mostly fine with the 50+50ms timeout, but the problem appears when OpenWrt brings up several interfaces in parallel on a system with 7 populated ports: if one of them take more than 50 ms and waits one or more of the others can get stuck on the mutex for the switch and then this can easily multiply. As we sleep and wait, the function loop needs a final check after exiting the loop if we were successful. Suggested-by: Andrew Lunn Cc: Tobias Waldekranz Fixes: 35da1dfd9484 ("net: dsa: mv88e6xxx: Improve performance of busy bit polling") Signed-off-by: Linus Walleij Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230712223405.861899-1-linus.walleij@linaro.org Signed-off-by: Jakub Kicinski commit 38d88d5e97c9032ebeca092b9372209f2ca92cdf Merge: 864e029fea2b8 e701156ccc6c7 Author: Dave Airlie Date: Fri Jul 14 11:44:54 2023 +1000 Merge tag 'amd-drm-fixes-6.5-2023-07-12' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.5-2023-07-12: amdgpu: - SMU i2c locking fix - Fix a possible deadlock in process restoration for ROCm apps - Disable PCIe lane/speed switching on Intel platforms (the platforms don't support it) Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230712184009.7740-1-alexander.deucher@amd.com commit 864e029fea2b8e6583e026a6f93e8933ba626d42 Merge: b7a57386b851a 113899c2669df Author: Dave Airlie Date: Fri Jul 14 11:13:14 2023 +1000 Merge tag 'drm-intel-fixes-2023-07-13' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes - Don't preserve dpll_hw_state for slave crtc in Bigjoiner (Stanislav Lisovskiy) - Consider OA buffer boundary when zeroing out reports [perf] (Umesh Nerlige Ramappa) - Remove dead code from gen8_pte_encode (Tvrtko Ursulin) - Fix one wrong caching mode enum usage (Tvrtko Ursulin) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/ZK+nHLCltaxoxVw/@tursulin-desk commit b7a57386b851aa28547c0d389644ec77d59cbc23 Merge: 06c2afb862f9d 835a65f51790e Author: Dave Airlie Date: Fri Jul 14 10:37:18 2023 +1000 Merge tag 'drm-misc-fixes-2023-07-13' of ssh://git.freedesktop.org/git/drm/drm-misc into drm-fixes A couple of nouveau patches addressing improving HDMI support and firmware handling, a fix for TTM to skip pinned BO when evicting, and a fix for the fbdev documentation. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/nq3ke75juephbex5acfyi5t6bxv22nhmfcpfhru55haj2nv3us@gehrlmjbqgjk commit b321c31c9b7b309dcde5e8854b741c8e6a9a05f0 Author: Marc Zyngier Date: Thu Jul 13 08:06:57 2023 +0100 KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption Xiang reports that VMs occasionally fail to boot on GICv4.1 systems when running a preemptible kernel, as it is possible that a vCPU is blocked without requesting a doorbell interrupt. The issue is that any preemption that occurs between vgic_v4_put() and schedule() on the block path will mark the vPE as nonresident and *not* request a doorbell irq. This occurs because when the vcpu thread is resumed on its way to block, vcpu_load() will make the vPE resident again. Once the vcpu actually blocks, we don't request a doorbell anymore, and the vcpu won't be woken up on interrupt delivery. Fix it by tracking that we're entering WFI, and key the doorbell request on that flag. This allows us not to make the vPE resident when going through a preempt/schedule cycle, meaning we don't lose any state. Cc: stable@vger.kernel.org Fixes: 8e01d9a396e6 ("KVM: arm64: vgic-v4: Move the GICv4 residency flow to be driven by vcpu_load/put") Reported-by: Xiang Chen Suggested-by: Zenghui Yu Tested-by: Xiang Chen Co-developed-by: Oliver Upton Signed-off-by: Marc Zyngier Acked-by: Zenghui Yu Link: https://lore.kernel.org/r/20230713070657.3873244-1-maz@kernel.org Signed-off-by: Oliver Upton commit 4b810bf037e524b54669acbe4e0df54b15d87ea1 Merge: b1983d427a539 18bddc5b67038 Author: Linus Torvalds Date: Thu Jul 13 14:35:02 2023 -0700 Merge tag 'erofs-for-6.5-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: "Three patches address regressions related to post-EOF unexpected behaviors and fsdax unavailability of chunk-based regular files. The other two patches mainly get rid of kmap_atomic() and simplify z_erofs_transform_plain(). - Fix two unexpected loop cases when reading beyond EOF - Fix fsdax unavailability for chunk-based regular files - Get rid of the remaining kmap_atomic() - Minor cleanups" * tag 'erofs-for-6.5-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix fsdax unavailability for chunk-based regular files erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF erofs: avoid useless loops in z_erofs_pcluster_readmore() when reading beyond EOF erofs: simplify z_erofs_transform_plain() erofs: get rid of the remaining kmap_atomic() commit b1983d427a53911ea71ba621d4bf994ae22b1536 Merge: ebc27aaceeb9c 9d23aac8a85f6 Author: Linus Torvalds Date: Thu Jul 13 14:21:22 2023 -0700 Merge tag 'net-6.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from netfilter, wireless and ebpf. Current release - regressions: - netfilter: conntrack: gre: don't set assured flag for clash entries - wifi: iwlwifi: remove 'use_tfh' config to fix crash Previous releases - regressions: - ipv6: fix a potential refcount underflow for idev - icmp6: ifix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev() - bpf: fix max stack depth check for async callbacks - eth: mlx5e: - check for NOT_READY flag state after locking - fix page_pool page fragment tracking for XDP - eth: igc: - fix tx hang issue when QBV gate is closed - fix corner cases for TSN offload - eth: octeontx2-af: Move validation of ptp pointer before its usage - eth: ena: fix shift-out-of-bounds in exponential backoff Previous releases - always broken: - core: prevent skb corruption on frag list segmentation - sched: - cls_fw: fix improper refcount update leads to use-after-free - sch_qfq: account for stab overhead in qfq_enqueue - netfilter: - report use refcount overflow - prevent OOB access in nft_byteorder_eval - wifi: mt7921e: fix init command fail with enabled device - eth: ocelot: fix oversize frame dropping for preemptible TCs - eth: fec: recycle pages for transmitted XDP frames" * tag 'net-6.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (79 commits) selftests: tc-testing: add test for qfq with stab overhead net/sched: sch_qfq: account for stab overhead in qfq_enqueue selftests: tc-testing: add tests for qfq mtu sanity check net/sched: sch_qfq: reintroduce lmax bound check for MTU wifi: cfg80211: fix receiving mesh packets without RFC1042 header wifi: rtw89: debug: fix error code in rtw89_debug_priv_send_h2c_set() net: txgbe: fix eeprom calculation error net/sched: make psched_mtu() RTNL-less safe net: ena: fix shift-out-of-bounds in exponential backoff netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write() net/sched: flower: Ensure both minimum and maximum ports are specified MAINTAINERS: Add another mailing list for QUALCOMM ETHQOS ETHERNET DRIVER docs: netdev: update the URL of the status page wifi: iwlwifi: remove 'use_tfh' config to fix crash xdp: use trusted arguments in XDP hints kfuncs bpf: cpumap: Fix memory leak in cpu_map_update_elem wifi: airo: avoid uninitialized warning in airo_get_rate() octeontx2-pf: Add additional check for MCAM rules net: dsa: Removed unneeded of_node_put in felix_parse_ports_node net: fec: use netdev_err_once() instead of netdev_err() ... commit ebc27aaceeb9c4c988dbf321e849fcb75c6b55fa Merge: 15999328946bd d5a821896360c Author: Linus Torvalds Date: Thu Jul 13 13:44:28 2023 -0700 Merge tag 'trace-v6.5-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix some missing-prototype warnings - Fix user events struct args (did not include size of struct) When creating a user event, the "struct" keyword is to denote that the size of the field will be passed in. But the parsing failed to handle this case. - Add selftest to struct sizes for user events - Fix sample code for direct trampolines. The sample code for direct trampolines attached to handle_mm_fault(). But the prototype changed and the direct trampoline sample code was not updated. Direct trampolines needs to have the arguments correct otherwise it can fail or crash the system. - Remove unused ftrace_regs_caller_ret() prototype. - Quiet false positive of FORTIFY_SOURCE Due to backward compatibility, the structure used to save stack traces in the kernel had a fixed size of 8. This structure is exported to user space via the tracing format file. A change was made to allow more than 8 functions to be recorded, and user space now uses the size field to know how many functions are actually in the stack. But the structure still has size of 8 (even though it points into the ring buffer that has the required amount allocated to hold a full stack. This was fine until the fortifier noticed that the memcpy(&entry->caller, stack, size) was greater than the 8 functions and would complain at runtime about it. Hide this by using a pointer to the stack location on the ring buffer instead of using the address of the entry structure caller field. - Fix a deadloop in reading trace_pipe that was caused by a mismatch between ring_buffer_empty() returning false which then asked to read the data, but the read code uses rb_num_of_entries() that returned zero, and causing a infinite "retry". - Fix a warning caused by not using all pages allocated to store ftrace functions, where this can happen if the linker inserts a bunch of "NULL" entries, causing the accounting of how many pages needed to be off. - Fix histogram synthetic event crashing when the start event is removed and the end event is still using a variable from it - Fix memory leak in freeing iter->temp in tracing_release_pipe() * tag 'trace-v6.5-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix memory leak of iter->temp when reading trace_pipe tracing/histograms: Add histograms to hist_vars if they have referenced variables tracing: Stop FORTIFY_SOURCE complaining about stack trace caller ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() ring-buffer: Fix deadloop issue on reading trace_pipe tracing: arm64: Avoid missing-prototype warnings selftests/user_events: Test struct size match cases tracing/user_events: Fix struct arg size match check x86/ftrace: Remove unsued extern declaration ftrace_regs_caller_ret() arm64: ftrace: Add direct call trampoline samples support samples: ftrace: Save required argument registers in sample trampolines commit 15999328946bd778b7bbf57179ee871dd5279b04 Merge: 9350cd0190c0d 21a235bce1236 Author: Linus Torvalds Date: Thu Jul 13 13:39:36 2023 -0700 Merge tag 'for-linus-6.5-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - a cleanup of the Xen related ELF-notes - a fix for virtio handling in Xen dom0 when running Xen in a VM * tag 'for-linus-6.5-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/virtio: Fix NULL deref when a bridge of PCI root bus has no parent x86/Xen: tidy xen-head.S commit 9350cd0190c0d60915ec704112c864d858a0d31c Merge: 0099852f9d732 7c28a35e19faf Author: Linus Torvalds Date: Thu Jul 13 13:34:00 2023 -0700 Merge tag 'sh-for-v6.5-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux Pull sh fixes from John Paul Adrian Glaubitz: "The sh updates introduced multiple regressions. In particular, the change a8ac2961148e ("sh: Avoid using IRQ0 on SH3 and SH4") causes several boards to hang during boot due to incorrect IRQ numbers. Geert Uytterhoeven has contributed patches that handle the virq offset in the IRQ code for the dreamcast, highlander and r2d boards while Artur Rojek has contributed a patch which handles the virq offset for the hd64461 companion chip" * tag 'sh-for-v6.5-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux: sh: hd64461: Handle virq offset for offchip IRQ base and HD64461 IRQ sh: mach-dreamcast: Handle virq offset in cascaded IRQ demux sh: mach-highlander: Handle virq offset in cascaded IRL demux sh: mach-r2d: Handle virq offset in cascaded IRL demux commit 90b4622954d59078fa0cecad7e7baa48efd006e7 Merge: 5c17f45e91f50 b8f6446b68537 Author: Jens Axboe Date: Thu Jul 13 14:26:38 2023 -0600 Merge tag 'nvme-6.5-2023-07-13' of git://git.infradead.org/nvme into block-6.5 Pull NVMe fixes from Keith: "nvme fixes for Linux 6.5 - Don't require quirk to use duplicate namespace identifiers (Christoph, Sagi) - One more BOGUS_NID quirk (Pankaj) - IO timeout and error hanlding fixes for PCI (Keith) - Enhanced metadata format mask fix (Ankit) - Association race condition fix for fibre channel (Michael) - Correct debugfs error checks (Minjie) - Use PAGE_SECTORS_SHIFT where needed (Damien) - Reduce kernel logs for legacy nguid attribute (Keith) - Use correct dma direction when unmapping metadata (Ming)" * tag 'nvme-6.5-2023-07-13' of git://git.infradead.org/nvme: nvme-pci: fix DMA direction of unmapping integrity data nvme: don't reject probe due to duplicate IDs for single-ported PCIe devices nvme: ensure disabling pairs with unquiesce nvme-fc: fix race between error recovery and creating association nvme-fc: return non-zero status code when fails to create association nvme: fix parameter check in nvme_fault_inject_init() nvme: warn only once for legacy uuid attribute nvme: fix the NVME_ID_NS_NVM_STS_MASK definition nvmet: use PAGE_SECTORS_SHIFT nvme: add BOGUS_NID quirk for Samsung SM953 commit 97368254a08e2ca4766e7f84a45840230fe77fa3 Author: Marijn Suijten Date: Tue Jun 27 22:14:16 2023 +0200 drm/msm/dsi: Drop unused regulators from QCM2290 14nm DSI PHY config The regulator setup was likely copied from other SoCs by mistake. Just like SM6125 the DSI PHY on this platform is not getting power from a regulator but from the MX power domain. Fixes: 572e9fd6d14a ("drm/msm/dsi: Add phy configuration for QCM2290") Signed-off-by: Marijn Suijten Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/544536/ Link: https://lore.kernel.org/r/20230627-sm6125-dpu-v2-1-03e430a2078c@somainline.org Signed-off-by: Abhinav Kumar commit e8b03aef194c3c8597f4fb8e58ade1cc1f43001e Author: Minjie Du Date: Thu Jul 6 11:22:57 2023 +0800 tools: timers: fix freq average calculation Delete a duplicate assignment from this function implementation. The note means ppm is average of the two actual freq samples. But ppm have a duplicate assignment. Signed-off-by: Minjie Du Acked-by: John Stultz Signed-off-by: Shuah Khan commit e8383f5cf1b3573ce140a80bfbfd809278ab16d6 Author: Dmitry Baryshkov Date: Fri Jul 7 22:39:32 2023 +0300 drm/msm/dpu: drop enum dpu_core_perf_data_bus_id Drop the leftover of bus-client -> interconnect conversion, the enum dpu_core_perf_data_bus_id. Fixes: cb88482e2570 ("drm/msm/dpu: clean up references of DPU custom bus scaling") Reviewed-by: Konrad Dybcio Reviewed-by: Abhinav Kumar Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/546048/ Link: https://lore.kernel.org/r/20230707193942.3806526-2-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar commit ba7a94ea73120e3f72c4a9b7ed6fd5598d29c069 Author: Jonathan Marek Date: Tue Jul 4 12:01:04 2023 -0400 drm/msm/dpu: add missing flush and fetch bits for DMA4/DMA5 planes Note that with this, DMA4/DMA5 are still non-functional, but at least display *something* in modetest instead of nothing or underflow. Fixes: efcd0107727c ("drm/msm/dpu: add support for SM8550") Signed-off-by: Jonathan Marek Reviewed-by: Abhinav Kumar Tested-by: Neil Armstrong # on SM8550-QRD Patchwork: https://patchwork.freedesktop.org/patch/545548/ Link: https://lore.kernel.org/r/20230704160106.26055-1-jonathan@marek.ca Signed-off-by: Abhinav Kumar commit b33b8731566d50aae6e11bd02921452cf3a7e0e7 Author: Ricardo Cañuelo Date: Thu Jun 29 10:35:46 2023 +0200 selftests/mincore: fix skip condition for check_huge_pages test The check_huge_pages test was failing instead of skipping on qemu-armv7 because the skip condition wasn't handled properly. Add an additional check to fix it. Signed-off-by: Ricardo Cañuelo Reported-by: Naresh Kamboju Reported-by: Linux Kernel Functional Testing Reviewed-by: Muhammad Usama Anjum Tested-by: Anders Roxell Closes: https://lore.kernel.org/all/CA+G9fYuoB8Ug8PcTU-YGmemL7_eeEksXFihvxWF6OikD7sK7pA@mail.gmail.com Signed-off-by: Shuah Khan commit a85c238c5ccd64f8d4c4560702c65cb25dee791c Author: Dmitry Baryshkov Date: Wed Jul 12 15:11:39 2023 +0300 drm/msm/mdss: correct UBWC programming for SM8550 The SM8550 platform employs newer UBWC decoder, which requires slightly different programming. Fixes: a2f33995c19d ("drm/msm: mdss: add support for SM8550") Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/546934/ Link: https://lore.kernel.org/r/20230712121145.1994830-3-dmitry.baryshkov@linaro.org Signed-off-by: Abhinav Kumar commit 5c17f45e91f5035c1b317e93b3dfb01088ac2902 Author: Chengming Zhou Date: Mon Jul 10 18:55:16 2023 +0800 blk-mq: fix start_time_ns and alloc_time_ns for pre-allocated rq The iocost rely on rq start_time_ns and alloc_time_ns to tell saturation state of the block device. Most of the time request is allocated after rq_qos_throttle() and its alloc_time_ns or start_time_ns won't be affected. But for plug batched allocation introduced by the commit 47c122e35d7e ("block: pre-allocate requests if plug is started and is a batch"), we can rq_qos_throttle() after the allocation of the request. This is what the blk_mq_get_cached_request() does. In this case, the cached request alloc_time_ns or start_time_ns is much ahead if blocked in any qos ->throttle(). Fix it by setting alloc_time_ns and start_time_ns to now when the allocated request is actually used. Signed-off-by: Chengming Zhou Acked-by: Tejun Heo Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230710105516.2053478-1-chengming.zhou@linux.dev Signed-off-by: Jens Axboe commit 37540db221e1ca94d9a57632238d1a62043205b3 Author: Krzysztof Wilczyński Date: Thu Jul 13 12:18:39 2023 -0500 MAINTAINERS: Add Manivannan Sadhasivam as DesignWare PCIe driver maintainer Manivannan has been actively reviewing patches and testing changes related to the DesignWare core driver and other DWC-based PCIe drivers for a while now. Add Manivannan as a maintainer for the Synopsys DesignWare driver to make his role and contributions official. Thank you Manivannan! For all the help with DWC! Signed-off-by: Krzysztof Wilczyński Signed-off-by: Bjorn Helgaas Acked-by: Manivannan Sadhasivam commit ec7633de404e7ce704d8f79081b97bca5b616c23 Author: Arnd Bergmann Date: Wed Jun 28 11:49:18 2023 +0200 sparc: mark __arch_xchg() as __always_inline An otherwise correct change to the atomic operations uncovered an existing bug in the sparc __arch_xchg() function, which is calls __xchg_called_with_bad_pointer() when its arguments are unknown at compile time: ERROR: modpost: "__xchg_called_with_bad_pointer" [lib/atomic64_test.ko] undefined! This now happens because gcc determines that it's better to not inline the function. Avoid this by just marking the function as __always_inline to force the compiler to do the right thing here. Reported-by: Guenter Roeck Link: https://lore.kernel.org/all/c525adc9-6623-4660-8718-e0c9311563b8@roeck-us.net/ Fixes: d12157efc8e08 ("locking/atomic: make atomic*_{cmp,}xchg optional") Signed-off-by: Arnd Bergmann Acked-by: Palmer Dabbelt Acked-by: Mark Rutland Reviewed-by: Sam Ravnborg Acked-by: Guenter Roeck Acked-by: Andi Shyti Link: https://lore.kernel.org/r/20230628094938.2318171-1-arnd@kernel.org Signed-off-by: Kees Cook commit e0b7b2081233ac7fe55838ff68cbc7ca9887a91f Author: Kees Cook Date: Wed Jul 12 12:46:29 2023 -0700 MAINTAINERS: Foolishly claim maintainership of string routines Since the string API is tightly coupled with FORTIFY_SOURCE, I am offering myself up as maintainer for it. Thankfully Andy is already a reviewer and can keep me on the straight and narrow. Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230712194625.never.252-kees@kernel.org Signed-off-by: Kees Cook commit 4ed8f337dee32df71435689c19d22e4ee846e15a Author: Masami Hiramatsu (Google) Date: Tue Jul 11 23:15:57 2023 +0900 Revert "tracing: Add "(fault)" name injection to kernel probes" This reverts commit 2e9906f84fc7c99388bb7123ade167250d50f1c0. It was turned out that commit 2e9906f84fc7 ("tracing: Add "(fault)" name injection to kernel probes") did not work correctly and probe events still show just '(fault)' (instead of '"(fault)"'). Also, current '(fault)' is more explicit that it faulted. This also moves FAULT_STRING macro to trace.h so that synthetic event can keep using it, and uses it in trace_probe.c too. Link: https://lore.kernel.org/all/168908495772.123124.1250788051922100079.stgit@devnote2/ Link: https://lore.kernel.org/all/20230706230642.3793a593@rorschach.local.home/ Cc: stable@vger.kernel.org Cc: Andrew Morton Cc: Tom Zanussi Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit e38e2c6a9efc435f9de344b7c91f7697e01b47d5 Author: Masami Hiramatsu (Google) Date: Tue Jul 11 23:15:48 2023 +0900 tracing/probes: Fix to update dynamic data counter if fetcharg uses it Fix to update dynamic data counter ('dyndata') and max length ('maxlen') only if the fetcharg uses the dynamic data. Also get out arg->dynamic from unlikely(). This makes dynamic data address wrong if process_fetch_insn() returns error on !arg->dynamic case. Link: https://lore.kernel.org/all/168908494781.123124.8160245359962103684.stgit@devnote2/ Suggested-by: Steven Rostedt Link: https://lore.kernel.org/all/20230710233400.5aaf024e@gandalf.local.home/ Fixes: 9178412ddf5a ("tracing: probeevent: Return consumed bytes of dynamic area") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit b41326b5e0f82e93592c4366359917b5d67b529f Author: Masami Hiramatsu (Google) Date: Tue Jul 11 23:15:38 2023 +0900 tracing/probes: Fix not to count error code to total length Fix not to count the error code (which is minus value) to the total used length of array, because it can mess up the return code of process_fetch_insn_bottom(). Also clear the 'ret' value because it will be used for calculating next data_loc entry. Link: https://lore.kernel.org/all/168908493827.123124.2175257289106364229.stgit@devnote2/ Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/8819b154-2ba1-43c3-98a2-cbde20892023@moroto.mountain/ Fixes: 9b960a38835f ("tracing: probeevent: Unify fetch_insn processing common part") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit 66bcf65d6cf0ca6540e2341e88ee7ef02dbdda08 Author: Masami Hiramatsu (Google) Date: Tue Jul 11 23:15:29 2023 +0900 tracing/probes: Fix to avoid double count of the string length on the array If an array is specified with the ustring or symstr, the length of the strings are accumlated on both of 'ret' and 'total', which means the length is double counted. Just set the length to the 'ret' value for avoiding double counting. Link: https://lore.kernel.org/all/168908492917.123124.15076463491122036025.stgit@devnote2/ Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/8819b154-2ba1-43c3-98a2-cbde20892023@moroto.mountain/ Fixes: 88903c464321 ("tracing/probe: Add ustring type for user-space string") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit d5f28bb1ce04636b285726ee2a5afa3a514025f4 Author: Masami Hiramatsu (Google) Date: Sat Jul 8 01:38:03 2023 +0900 fprobes: Add a comment why fprobe_kprobe_handler exits if kprobe is running Add a comment the reason why fprobe_kprobe_handler() exits if any other kprobe is running. Link: https://lore.kernel.org/all/168874788299.159442.2485957441413653858.stgit@devnote2/ Suggested-by: Steven Rostedt Link: https://lore.kernel.org/all/20230706120916.3c6abf15@gandalf.local.home/ Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit b8f6446b6853768cb99e7c201bddce69ca60c15e Author: Ming Lei Date: Thu Jul 13 17:26:20 2023 +0800 nvme-pci: fix DMA direction of unmapping integrity data DMA direction should be taken in dma_unmap_page() for unmapping integrity data. Fix this DMA direction, and reported in Guangwu's test. Reported-by: Guangwu Zhang Fixes: 4aedb705437f ("nvme-pci: split metadata handling from nvme_map_data / nvme_unmap_data") Signed-off-by: Ming Lei Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit ac522fc6c3165fd0daa2f8da7e07d5f800586daa Author: Christoph Hellwig Date: Thu Jul 13 15:30:42 2023 +0200 nvme: don't reject probe due to duplicate IDs for single-ported PCIe devices While duplicate IDs are still very harmful, including the potential to easily see changing devices in /dev/disk/by-id, it turn out they are extremely common for cheap end user NVMe devices. Relax our check for them for so that it doesn't reject the probe on single-ported PCIe devices, but prints a big warning instead. In doubt we'd still like to see quirk entries to disable the potential for changing supposed stable device identifier links, but this will at least allow users how have two (or more) of these devices to use them without having to manually add a new PCI ID entry with the quirk through sysfs or by patching the kernel. Fixes: 2079f41ec6ff ("nvme: check that EUI/GUID/UUID are globally unique") Cc: stable@vger.kernel.org # 6.0+ Co-developed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Signed-off-by: Keith Busch commit d5a821896360cc8b93a15bd888fabc858c038dc0 Author: Zheng Yejian Date: Thu Jul 13 22:14:35 2023 +0800 tracing: Fix memory leak of iter->temp when reading trace_pipe kmemleak reports: unreferenced object 0xffff88814d14e200 (size 256): comm "cat", pid 336, jiffies 4294871818 (age 779.490s) hex dump (first 32 bytes): 04 00 01 03 00 00 00 00 08 00 00 00 00 00 00 00 ................ 0c d8 c8 9b ff ff ff ff 04 5a ca 9b ff ff ff ff .........Z...... backtrace: [] __kmalloc+0x4f/0x140 [] trace_find_next_entry+0xbb/0x1d0 [] trace_print_lat_context+0xaf/0x4e0 [] print_trace_line+0x3e0/0x950 [] tracing_read_pipe+0x2d9/0x5a0 [] vfs_read+0x143/0x520 [] ksys_read+0xbd/0x160 [] do_syscall_64+0x3f/0x90 [] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 when reading file 'trace_pipe', 'iter->temp' is allocated or relocated in trace_find_next_entry() but not freed before 'trace_pipe' is closed. To fix it, free 'iter->temp' in tracing_release_pipe(). Link: https://lore.kernel.org/linux-trace-kernel/20230713141435.1133021-1-zhengyejian1@huawei.com Cc: stable@vger.kernel.org Fixes: ff895103a84ab ("tracing: Save off entry when peeking at next entry") Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit 2329cc7a101af1a844fbf706c0724c0baea38365 Author: Jocelyn Falempe Date: Tue Jul 11 11:20:44 2023 +0200 drm/client: Fix memory leak in drm_client_modeset_probe When a new mode is set to modeset->mode, the previous mode should be freed. This fixes the following kmemleak report: drm_mode_duplicate+0x45/0x220 [drm] drm_client_modeset_probe+0x944/0xf50 [drm] __drm_fb_helper_initial_config_and_unlock+0xb4/0x2c0 [drm_kms_helper] drm_fbdev_client_hotplug+0x2bc/0x4d0 [drm_kms_helper] drm_client_register+0x169/0x240 [drm] ast_pci_probe+0x142/0x190 [ast] local_pci_probe+0xdc/0x180 work_for_cpu_fn+0x4e/0xa0 process_one_work+0x8b7/0x1540 worker_thread+0x70a/0xed0 kthread+0x29f/0x340 ret_from_fork+0x1f/0x30 cc: Reported-by: Zhang Yi Signed-off-by: Jocelyn Falempe Reviewed-by: Javier Martinez Canillas Reviewed-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230711092203.68157-3-jfalempe@redhat.com commit c2a88e8bdf5f6239948d75283d0ae7e0c7945b03 Author: Jocelyn Falempe Date: Tue Jul 11 11:20:43 2023 +0200 drm/client: Fix memory leak in drm_client_target_cloned dmt_mode is allocated and never freed in this function. It was found with the ast driver, but most drivers using generic fbdev setup are probably affected. This fixes the following kmemleak report: backtrace: [<00000000b391296d>] drm_mode_duplicate+0x45/0x220 [drm] [<00000000e45bb5b3>] drm_client_target_cloned.constprop.0+0x27b/0x480 [drm] [<00000000ed2d3a37>] drm_client_modeset_probe+0x6bd/0xf50 [drm] [<0000000010e5cc9d>] __drm_fb_helper_initial_config_and_unlock+0xb4/0x2c0 [drm_kms_helper] [<00000000909f82ca>] drm_fbdev_client_hotplug+0x2bc/0x4d0 [drm_kms_helper] [<00000000063a69aa>] drm_client_register+0x169/0x240 [drm] [<00000000a8c61525>] ast_pci_probe+0x142/0x190 [ast] [<00000000987f19bb>] local_pci_probe+0xdc/0x180 [<000000004fca231b>] work_for_cpu_fn+0x4e/0xa0 [<0000000000b85301>] process_one_work+0x8b7/0x1540 [<000000003375b17c>] worker_thread+0x70a/0xed0 [<00000000b0d43cd9>] kthread+0x29f/0x340 [<000000008d770833>] ret_from_fork+0x1f/0x30 unreferenced object 0xff11000333089a00 (size 128): cc: Fixes: 1d42bbc8f7f9 ("drm/fbdev: fix cloning on fbcon") Reported-by: Zhang Yi Signed-off-by: Jocelyn Falempe Reviewed-by: Javier Martinez Canillas Reviewed-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230711092203.68157-2-jfalempe@redhat.com commit d42334578eba1390859012ebb91e1e556d51db49 Author: Namjae Jeon Date: Thu Jul 13 21:59:37 2023 +0900 exfat: check if filename entries exceeds max filename length exfat_extract_uni_name copies characters from a given file name entry into the 'uniname' variable. This variable is actually defined on the stack of the exfat_readdir() function. According to the definition of the 'exfat_uni_name' type, the file name should be limited 255 characters (+ null teminator space), but the exfat_get_uniname_from_ext_entry() function can write more characters because there is no check if filename entries exceeds max filename length. This patch add the check not to copy filename characters when exceeding max filename length. Cc: stable@vger.kernel.org Cc: Yuezhang Mo Reported-by: Maxim Suhanov Reviewed-by: Sungjong Seo Signed-off-by: Namjae Jeon commit d088d6b648f47fc63e0f1d429c6eaddb426623a4 Author: Sudeep Holla Date: Thu Jul 6 09:55:34 2023 +0100 arm64: dts: arm: Remove the dangling vexpress-v2m-rs1.dtsi symlink Commit 724ba6751532 ("ARM: dts: Move .dts files to vendor sub-directories") moved all arm vendor specific DTS into the sub-directory and updated vexpress-v2f-1xv7-ca53x2.dts accordingly to include vexpress-v2m-rs1.dtsi from the right path. However the symlink was left dangling which is harmless and causes no issue for the build. Just remove the dangling symlink now that it is noticed and reported. Fixes: 724ba6751532 ("ARM: dts: Move .dts files to vendor sub-directories") Cc: Liviu Dudau Cc: Lorenzo Pieralisi Cc: Rob Herring Reported-by: Avram Lubkin Reported-by: Darren Kenny Acked-by: Liviu Dudau Link: https://lore.kernel.org/r/20230706085534.300828-1-sudeep.holla@arm.com Signed-off-by: Sudeep Holla commit a282a2f10539dce2aa619e71e1817570d557fc97 Author: Ilya Dryomov Date: Mon Jul 10 20:39:29 2023 +0200 libceph: harden msgr2.1 frame segment length checks ceph_frame_desc::fd_lens is an int array. decode_preamble() thus effectively casts u32 -> int but the checks for segment lengths are written as if on unsigned values. While reading in HELLO or one of the AUTH frames (before authentication is completed), arithmetic in head_onwire_len() can get duped by negative ctrl_len and produce head_len which is less than CEPH_PREAMBLE_LEN but still positive. This would lead to a buffer overrun in prepare_read_control() as the preamble gets copied to the newly allocated buffer of size head_len. Cc: stable@vger.kernel.org Fixes: cd1a677cad99 ("libceph, ceph: implement msgr2.1 protocol (crc and secure modes)") Reported-by: Thelford Williams Signed-off-by: Ilya Dryomov Reviewed-by: Xiubo Li commit d44263222134b5635932974c6177a5cba65a07e8 Author: Sergei Antonov Date: Tue Jun 27 15:05:49 2023 +0300 mmc: moxart: read scr register without changing byte order Conversion from big-endian to native is done in a common function mmc_app_send_scr(). Converting in moxart_transfer_pio() is extra. Double conversion on a LE system returns an incorrect SCR value, leads to errors: mmc0: unrecognised SCR structure version 8 Fixes: 1b66e94e6b99 ("mmc: moxart: Add MOXA ART SD/MMC driver") Signed-off-by: Sergei Antonov Cc: Jonas Jensen Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230627120549.2400325-1-saproj@gmail.com Signed-off-by: Ulf Hansson commit 55b87b74996383230586f4f9f801ae304c70e649 Author: Marc Zyngier Date: Mon Jul 3 14:04:16 2023 +0100 arm64: Fix HFGxTR_EL2 field naming The HFGxTR_EL2 fields do not always follow the naming described in the spec, nor do they match the name of the register they trap in the rest of the kernel. It is a bit sad that they were written by hand despite the availability of a machine readable version... Fixes: cc077e7facbe ("arm64/sysreg: Convert HFG[RW]TR_EL2 to automatic generation") Signed-off-by: Marc Zyngier Cc: Mark Brown Cc: Will Deacon Cc: Catalin Marinas Cc: Mark Rutland Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20230703130416.1495307-1-maz@kernel.org Signed-off-by: Will Deacon commit 9d23aac8a85f69239e585c8656c6fdb21be65695 Merge: b0b0ab6f01318 137f6219da599 Author: Paolo Abeni Date: Thu Jul 13 11:12:01 2023 +0200 Merge branch 'net-sched-fixes-for-sch_qfq' Pedro Tammela says: ==================== net/sched: fixes for sch_qfq Patch 1 fixes a regression introduced in 6.4 where the MTU size could be bigger than 'lmax'. Patch 3 fixes an issue where the code doesn't account for qdisc_pkt_len() returning a size bigger then 'lmax'. Patches 2 and 4 are selftests for the issues above. ==================== Link: https://lore.kernel.org/r/20230711210103.597831-1-pctammela@mojatatu.com Signed-off-by: Paolo Abeni commit 137f6219da59903f480a9032b01225e9062f7ae0 Author: Pedro Tammela Date: Tue Jul 11 18:01:03 2023 -0300 selftests: tc-testing: add test for qfq with stab overhead A packet with stab overhead greater than QFQ_MAX_LMAX should be dropped by the QFQ qdisc as it can't handle such lengths. Signed-off-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Reviewed-by: Simon Horman Tested-by: Zhengchao Shao Signed-off-by: Paolo Abeni commit 3e337087c3b5805fe0b8a46ba622a962880b5d64 Author: Pedro Tammela Date: Tue Jul 11 18:01:02 2023 -0300 net/sched: sch_qfq: account for stab overhead in qfq_enqueue Lion says: ------- In the QFQ scheduler a similar issue to CVE-2023-31436 persists. Consider the following code in net/sched/sch_qfq.c: static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) { unsigned int len = qdisc_pkt_len(skb), gso_segs; // ... if (unlikely(cl->agg->lmax < len)) { pr_debug("qfq: increasing maxpkt from %u to %u for class %u", cl->agg->lmax, len, cl->common.classid); err = qfq_change_agg(sch, cl, cl->agg->class_weight, len); if (err) { cl->qstats.drops++; return qdisc_drop(skb, sch, to_free); } // ... } Similarly to CVE-2023-31436, "lmax" is increased without any bounds checks according to the packet length "len". Usually this would not impose a problem because packet sizes are naturally limited. This is however not the actual packet length, rather the "qdisc_pkt_len(skb)" which might apply size transformations according to "struct qdisc_size_table" as created by "qdisc_get_stab()" in net/sched/sch_api.c if the TCA_STAB option was set when modifying the qdisc. A user may choose virtually any size using such a table. As a result the same issue as in CVE-2023-31436 can occur, allowing heap out-of-bounds read / writes in the kmalloc-8192 cache. ------- We can create the issue with the following commands: tc qdisc add dev $DEV root handle 1: stab mtu 2048 tsize 512 mpu 0 \ overhead 999999999 linklayer ethernet qfq tc class add dev $DEV parent 1: classid 1:1 htb rate 6mbit burst 15k tc filter add dev $DEV parent 1: matchall classid 1:1 ping -I $DEV 1.1.1.2 This is caused by incorrectly assuming that qdisc_pkt_len() returns a length within the QFQ_MIN_LMAX < len < QFQ_MAX_LMAX. Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost") Reported-by: Lion Reviewed-by: Eric Dumazet Signed-off-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit c5a06fdc618d1d262fa0db3483f096936961588c Author: Pedro Tammela Date: Tue Jul 11 18:01:01 2023 -0300 selftests: tc-testing: add tests for qfq mtu sanity check QFQ only supports a certain bound of MTU size so make sure we check for this requirement in the tests. Acked-by: Jamal Hadi Salim Signed-off-by: Pedro Tammela Reviewed-by: Simon Horman Tested-by: Zhengchao Shao Signed-off-by: Paolo Abeni commit 158810b261d02fc7dd92ca9c392d8f8a211a2401 Author: Pedro Tammela Date: Tue Jul 11 18:01:00 2023 -0300 net/sched: sch_qfq: reintroduce lmax bound check for MTU 25369891fcef deletes a check for the case where no 'lmax' is specified which 3037933448f6 previously fixed as 'lmax' could be set to the device's MTU without any bound checking for QFQ_LMAX_MIN and QFQ_LMAX_MAX. Therefore, reintroduce the check. Fixes: 25369891fcef ("net/sched: sch_qfq: refactor parsing of netlink parameters") Acked-by: Jamal Hadi Salim Reviewed-by: Eric Dumazet Signed-off-by: Pedro Tammela Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit 7c28a35e19fafa1d3b367bcd3ec4021427a9397b Author: Artur Rojek Date: Tue Jul 11 01:31:32 2023 +0200 sh: hd64461: Handle virq offset for offchip IRQ base and HD64461 IRQ A recent change to start counting SuperH IRQ #s from 16 breaks support for the Hitachi HD64461 companion chip. Move the offchip IRQ base and HD64461 IRQ # by 16 in order to accommodate for the new virq numbering rules. Fixes: a8ac2961148e ("sh: Avoid using IRQ0 on SH3 and SH4") Signed-off-by: Artur Rojek Reviewed-by: Geert Uytterhoeven Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20230710233132.69734-1-contact@artur-rojek.eu Signed-off-by: John Paul Adrian Glaubitz commit 3d20f7a6eb76afdf9d4ad9cb864c2e2da9c38e1f Author: Geert Uytterhoeven Date: Sun Jul 9 15:10:43 2023 +0200 sh: mach-dreamcast: Handle virq offset in cascaded IRQ demux Take into account the virq offset when translating cascaded interrupts. Fixes: a8ac2961148e8c72 ("sh: Avoid using IRQ0 on SH3 and SH4") Signed-off-by: Geert Uytterhoeven Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/7d0cb246c9f1cd24bb1f637ec5cb67e799a4c3b8.1688908227.git.geert+renesas@glider.be Signed-off-by: John Paul Adrian Glaubitz commit a2601b8d8f077368c6d113b4d496559415c6d495 Author: Geert Uytterhoeven Date: Sun Jul 9 15:10:23 2023 +0200 sh: mach-highlander: Handle virq offset in cascaded IRL demux Take into account the virq offset when translating cascaded IRL interrupts. Fixes: a8ac2961148e8c72 ("sh: Avoid using IRQ0 on SH3 and SH4") Signed-off-by: Geert Uytterhoeven Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/4fcb0d08a2b372431c41e04312742dc9e41e1be4.1688908186.git.geert+renesas@glider.be Signed-off-by: John Paul Adrian Glaubitz commit ab8aa4f0956d2e0fb8344deadb823ef743581795 Author: Geert Uytterhoeven Date: Sun Jul 9 13:15:49 2023 +0200 sh: mach-r2d: Handle virq offset in cascaded IRL demux When booting rts7751r2dplus_defconfig on QEMU, the system hangs due to an interrupt storm on IRQ 20. IRQ 20 aka event 0x280 is a cascaded IRL interrupt, which maps to IRQ_VOYAGER, the interrupt used by the Silicon Motion SM501 multimedia companion chip. As rts7751r2d_irq_demux() does not take into account the new virq offset, the interrupt is no longer translated, leading to an unhandled interrupt. Fix this by taking into account the virq offset when translating cascaded IRL interrupts. Fixes: a8ac2961148e8c72 ("sh: Avoid using IRQ0 on SH3 and SH4") Reported-by: Guenter Roeck Closes: https://lore.kernel.org/r/fbfea3ad-d327-4ad5-ac9c-648c7ca3fe1f@roeck-us.net Signed-off-by: Geert Uytterhoeven Reviewed-by: John Paul Adrian Glaubitz Tested-by: John Paul Adrian Glaubitz Tested-by: Guenter Roeck Link: https://lore.kernel.org/r/2c99d5df41c40691f6c407b7b6a040d406bc81ac.1688901306.git.geert+renesas@glider.be Signed-off-by: John Paul Adrian Glaubitz commit 645e583d2689a1dd2163da28a7789b4d9febf316 Author: Colin Ian King Date: Wed Jul 12 15:01:22 2023 +0100 selftests: ALSA: Fix fclose on an already fclosed file pointer In the case where a sysfs file cannot be opened the error return path fcloses file pointer fpl, however, fpl has already been closed in the previous stanza. Fix the double fclose by removing it. Fixes: 10b98a4db11a ("selftests: ALSA: Add test for the 'pcmtest' driver") Signed-off-by: Colin Ian King Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20230712140122.457206-1-colin.i.king@gmail.com Signed-off-by: Takashi Iwai commit 7891d0a5ce6f627132d3068ba925cf86f29008b1 Author: Dan Carpenter Date: Tue Jun 27 08:42:10 2023 +0300 soundwire: amd: Fix a check for errors in probe() This code has two problems: 1) The devm_ioremap() function returns NULL, not error pointers. 2) It's checking the wrong variable. ->mmio instead of ->acp_mmio. Fixes: d8f48fbdfd9a ("soundwire: amd: Add support for AMD Manager driver") Suggested-by: "Mukunda,Vijendar" Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/9863b2bf-0de2-4bf8-8f09-fe24dc5c63ff@moroto.mountain Signed-off-by: Vinod Koul commit bf99f6be2d20146942bce6f9e90a0ceef12cbc1e Author: Paulo Alcantara Date: Tue Jul 11 14:15:10 2023 -0300 smb: client: fix missed ses refcounting Use new cifs_smb_ses_inc_refcount() helper to get an active reference of @ses and @ses->dfs_root_ses (if set). This will prevent @ses->dfs_root_ses of being put in the next call to cifs_put_smb_ses() and thus potentially causing an use-after-free bug. Fixes: 8e3554150d6c ("cifs: fix sharing of DFS connections") Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit f1f047bd7ce0d73788e04ac02268060a565f7ecb Author: Gustavo A. R. Silva Date: Tue Jul 11 17:12:31 2023 -0600 smb: client: Fix -Wstringop-overflow issues pSMB->hdr.Protocol is an array of size 4 bytes, hence when the compiler analyzes this line of code parm_data = ((char *) &pSMB->hdr.Protocol) + offset; it legitimately complains about the fact that offset points outside the bounds of the array. Notice that the compiler gives priority to the object as an array, rather than merely the address of one more byte in a structure to wich offset should be added (which seems to be the actual intention of the original implementation). Fix this by explicitly instructing the compiler to treat the code as a sequence of bytes in struct smb_com_transaction2_spi_req, and not as an array accessed through pointer notation. Notice that ((char *)pSMB) + sizeof(pSMB->hdr.smb_buf_length) points to the same address as ((char *) &pSMB->hdr.Protocol), therefore this results in no differences in binary output. Fixes the following -Wstringop-overflow warnings when built s390 architecture with defconfig (GCC 13): CC [M] fs/smb/client/cifssmb.o In function 'cifs_init_ace', inlined from 'posix_acl_to_cifs' at fs/smb/client/cifssmb.c:3046:3, inlined from 'cifs_do_set_acl' at fs/smb/client/cifssmb.c:3191:15: fs/smb/client/cifssmb.c:2987:31: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 2987 | cifs_ace->cifs_e_perm = local_ace->e_perm; | ~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~ In file included from fs/smb/client/cifssmb.c:27: fs/smb/client/cifspdu.h: In function 'cifs_do_set_acl': fs/smb/client/cifspdu.h:384:14: note: at offset [7, 11] into destination object 'Protocol' of size 4 384 | __u8 Protocol[4]; | ^~~~~~~~ In function 'cifs_init_ace', inlined from 'posix_acl_to_cifs' at fs/smb/client/cifssmb.c:3046:3, inlined from 'cifs_do_set_acl' at fs/smb/client/cifssmb.c:3191:15: fs/smb/client/cifssmb.c:2988:30: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 2988 | cifs_ace->cifs_e_tag = local_ace->e_tag; | ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~ fs/smb/client/cifspdu.h: In function 'cifs_do_set_acl': fs/smb/client/cifspdu.h:384:14: note: at offset [6, 10] into destination object 'Protocol' of size 4 384 | __u8 Protocol[4]; | ^~~~~~~~ This helps with the ongoing efforts to globally enable -Wstringop-overflow. Link: https://github.com/KSPP/linux/issues/310 Fixes: dc1af4c4b472 ("cifs: implement set acl method") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: Steve French commit b0b0ab6f013185f25ad0fcd9111802d92d1631dc Merge: fec3ebb5ed299 2e06c57d66d3f Author: Jakub Kicinski Date: Wed Jul 12 18:13:57 2023 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2023-07-12 We've added 5 non-merge commits during the last 7 day(s) which contain a total of 7 files changed, 93 insertions(+), 28 deletions(-). The main changes are: 1) Fix max stack depth check for async callbacks, from Kumar. 2) Fix inconsistent JIT image generation, from Björn. 3) Use trusted arguments in XDP hints kfuncs, from Larysa. 4) Fix memory leak in cpu_map_update_elem, from Pu. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: xdp: use trusted arguments in XDP hints kfuncs bpf: cpumap: Fix memory leak in cpu_map_update_elem riscv, bpf: Fix inconsistent JIT image generation selftests/bpf: Add selftest for check_stack_max_depth bug bpf: Fix max stack depth check for async callbacks ==================== Link: https://lore.kernel.org/r/20230712223045.40182-1-alexei.starovoitov@gmail.com Signed-off-by: Jakub Kicinski commit fec3ebb5ed299ac3a998f011c380f2ded47f4866 Author: Felix Fietkau Date: Tue Jul 11 13:50:52 2023 +0200 wifi: cfg80211: fix receiving mesh packets without RFC1042 header Fix ethernet header length field after stripping the mesh header Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/CT5GNZSK28AI.2K6M69OXM9RW5@syracuse/ Fixes: 986e43b19ae9 ("wifi: mac80211: fix receiving A-MSDU frames on mesh interfaces") Reported-and-tested-by: Nicolas Escande Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20230711115052.68430-1-nbd@nbd.name Signed-off-by: Jakub Kicinski commit 4f4626cd049576af1276c7568d5b44eb3f7bb1b1 Author: Zhang Shurong Date: Thu Jul 6 10:45:00 2023 +0800 wifi: rtw89: debug: fix error code in rtw89_debug_priv_send_h2c_set() If there is a failure during rtw89_fw_h2c_raw() rtw89_debug_priv_send_h2c should return negative error code instead of a positive value count. Fix this bug by returning correct error code. Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver") Signed-off-by: Zhang Shurong Acked-by: Ping-Ke Shih Link: https://lore.kernel.org/r/tencent_AD09A61BC4DA92AD1EB0790F5C850E544D07@qq.com Signed-off-by: Jakub Kicinski commit aa846677a9fb19a0f2c58154c140398aa92a87ba Author: Jiawen Wu Date: Tue Jul 11 14:34:14 2023 +0800 net: txgbe: fix eeprom calculation error For some device types like TXGBE_ID_XAUI, *checksum computed in txgbe_calc_eeprom_checksum() is larger than TXGBE_EEPROM_SUM. Remove the limit on the size of *checksum. Fixes: 049fe5365324 ("net: txgbe: Add operations to interact with firmware") Fixes: 5e2ea7801fac ("net: txgbe: Fix unsigned comparison to zero in txgbe_calc_eeprom_checksum()") Signed-off-by: Jiawen Wu Link: https://lore.kernel.org/r/20230711063414.3311-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit 0099852f9d7322890636503146f303b41cd8663e Merge: eb26cbb1a754c dceaafd668812 Author: Linus Torvalds Date: Wed Jul 12 16:28:53 2023 -0700 Merge tag 'for-linus' of https://github.com/openrisc/linux Pull OpenRISC fix from Stafford Horne: - During the 6.4 cycle my fpu support work broke ABI compatibility in the sigcontext struct. This was noticed by musl libc developers after the release. This fix restores the ABI. * tag 'for-linus' of https://github.com/openrisc/linux: openrisc: Union fpcsr and oldmask in sigcontext to unbreak userspace ABI commit 6018b585e8c6fa7d85d4b38d9ce49a5b67be7078 Author: Mohamed Khalfella Date: Wed Jul 12 22:30:21 2023 +0000 tracing/histograms: Add histograms to hist_vars if they have referenced variables Hist triggers can have referenced variables without having direct variables fields. This can be the case if referenced variables are added for trigger actions. In this case the newly added references will not have field variables. Not taking such referenced variables into consideration can result in a bug where it would be possible to remove hist trigger with variables being refenced. This will result in a bug that is easily reproducable like so $ cd /sys/kernel/tracing $ echo 'synthetic_sys_enter char[] comm; long id' >> synthetic_events $ echo 'hist:keys=common_pid.execname,id.syscall:vals=hitcount:comm=common_pid.execname' >> events/raw_syscalls/sys_enter/trigger $ echo 'hist:keys=common_pid.execname,id.syscall:onmatch(raw_syscalls.sys_enter).synthetic_sys_enter($comm, id)' >> events/raw_syscalls/sys_enter/trigger $ echo '!hist:keys=common_pid.execname,id.syscall:vals=hitcount:comm=common_pid.execname' >> events/raw_syscalls/sys_enter/trigger [ 100.263533] ================================================================== [ 100.264634] BUG: KASAN: slab-use-after-free in resolve_var_refs+0xc7/0x180 [ 100.265520] Read of size 8 at addr ffff88810375d0f0 by task bash/439 [ 100.266320] [ 100.266533] CPU: 2 PID: 439 Comm: bash Not tainted 6.5.0-rc1 #4 [ 100.267277] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-20220807_005459-localhost 04/01/2014 [ 100.268561] Call Trace: [ 100.268902] [ 100.269189] dump_stack_lvl+0x4c/0x70 [ 100.269680] print_report+0xc5/0x600 [ 100.270165] ? resolve_var_refs+0xc7/0x180 [ 100.270697] ? kasan_complete_mode_report_info+0x80/0x1f0 [ 100.271389] ? resolve_var_refs+0xc7/0x180 [ 100.271913] kasan_report+0xbd/0x100 [ 100.272380] ? resolve_var_refs+0xc7/0x180 [ 100.272920] __asan_load8+0x71/0xa0 [ 100.273377] resolve_var_refs+0xc7/0x180 [ 100.273888] event_hist_trigger+0x749/0x860 [ 100.274505] ? kasan_save_stack+0x2a/0x50 [ 100.275024] ? kasan_set_track+0x29/0x40 [ 100.275536] ? __pfx_event_hist_trigger+0x10/0x10 [ 100.276138] ? ksys_write+0xd1/0x170 [ 100.276607] ? do_syscall_64+0x3c/0x90 [ 100.277099] ? entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 100.277771] ? destroy_hist_data+0x446/0x470 [ 100.278324] ? event_hist_trigger_parse+0xa6c/0x3860 [ 100.278962] ? __pfx_event_hist_trigger_parse+0x10/0x10 [ 100.279627] ? __kasan_check_write+0x18/0x20 [ 100.280177] ? mutex_unlock+0x85/0xd0 [ 100.280660] ? __pfx_mutex_unlock+0x10/0x10 [ 100.281200] ? kfree+0x7b/0x120 [ 100.281619] ? ____kasan_slab_free+0x15d/0x1d0 [ 100.282197] ? event_trigger_write+0xac/0x100 [ 100.282764] ? __kasan_slab_free+0x16/0x20 [ 100.283293] ? __kmem_cache_free+0x153/0x2f0 [ 100.283844] ? sched_mm_cid_remote_clear+0xb1/0x250 [ 100.284550] ? __pfx_sched_mm_cid_remote_clear+0x10/0x10 [ 100.285221] ? event_trigger_write+0xbc/0x100 [ 100.285781] ? __kasan_check_read+0x15/0x20 [ 100.286321] ? __bitmap_weight+0x66/0xa0 [ 100.286833] ? _find_next_bit+0x46/0xe0 [ 100.287334] ? task_mm_cid_work+0x37f/0x450 [ 100.287872] event_triggers_call+0x84/0x150 [ 100.288408] trace_event_buffer_commit+0x339/0x430 [ 100.289073] ? ring_buffer_event_data+0x3f/0x60 [ 100.292189] trace_event_raw_event_sys_enter+0x8b/0xe0 [ 100.295434] syscall_trace_enter.constprop.0+0x18f/0x1b0 [ 100.298653] syscall_enter_from_user_mode+0x32/0x40 [ 100.301808] do_syscall_64+0x1a/0x90 [ 100.304748] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 100.307775] RIP: 0033:0x7f686c75c1cb [ 100.310617] Code: 73 01 c3 48 8b 0d 65 3c 10 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 21 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 35 3c 10 00 f7 d8 64 89 01 48 [ 100.317847] RSP: 002b:00007ffc60137a38 EFLAGS: 00000246 ORIG_RAX: 0000000000000021 [ 100.321200] RAX: ffffffffffffffda RBX: 000055f566469ea0 RCX: 00007f686c75c1cb [ 100.324631] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 000000000000000a [ 100.328104] RBP: 00007ffc60137ac0 R08: 00007f686c818460 R09: 000000000000000a [ 100.331509] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000009 [ 100.334992] R13: 0000000000000007 R14: 000000000000000a R15: 0000000000000007 [ 100.338381] We hit the bug because when second hist trigger has was created has_hist_vars() returned false because hist trigger did not have variables. As a result of that save_hist_vars() was not called to add the trigger to trace_array->hist_vars. Later on when we attempted to remove the first histogram find_any_var_ref() failed to detect it is being used because it did not find the second trigger in hist_vars list. With this change we wait until trigger actions are created so we can take into consideration if hist trigger has variable references. Also, now we check the return value of save_hist_vars() and fail trigger creation if save_hist_vars() fails. Link: https://lore.kernel.org/linux-trace-kernel/20230712223021.636335-1-mkhalfella@purestorage.com Cc: stable@vger.kernel.org Fixes: 067fe038e70f6 ("tracing: Add variable reference handling to hist triggers") Signed-off-by: Mohamed Khalfella Signed-off-by: Steven Rostedt (Google) commit 150e33e62c1fa4af5aaab02776b6c3812711d478 Author: Pedro Tammela Date: Mon Jul 10 23:16:34 2023 -0300 net/sched: make psched_mtu() RTNL-less safe Eric Dumazet says[1]: ------- Speaking of psched_mtu(), I see that net/sched/sch_pie.c is using it without holding RTNL, so dev->mtu can be changed underneath. KCSAN could issue a warning. ------- Annotate dev->mtu with READ_ONCE() so KCSAN don't issue a warning. [1] https://lore.kernel.org/all/CANn89iJoJO5VtaJ-2=_d2aOQhb0Xw8iBT_Cxqp2HyuS-zj6azw@mail.gmail.com/ v1 -> v2: Fix commit message Fixes: d4b36210c2e6 ("net: pkt_sched: PIE AQM scheme") Suggested-by: Eric Dumazet Signed-off-by: Pedro Tammela Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230711021634.561598-1-pctammela@mojatatu.com Signed-off-by: Jakub Kicinski commit 1e9cb763e9bacf0c932aa948f50dcfca6f519a26 Author: Krister Johansen Date: Mon Jul 10 18:36:21 2023 -0700 net: ena: fix shift-out-of-bounds in exponential backoff The ENA adapters on our instances occasionally reset. Once recently logged a UBSAN failure to console in the process: UBSAN: shift-out-of-bounds in build/linux/drivers/net/ethernet/amazon/ena/ena_com.c:540:13 shift exponent 32 is too large for 32-bit type 'unsigned int' CPU: 28 PID: 70012 Comm: kworker/u72:2 Kdump: loaded not tainted 5.15.117 Hardware name: Amazon EC2 c5d.9xlarge/, BIOS 1.0 10/16/2017 Workqueue: ena ena_fw_reset_device [ena] Call Trace: dump_stack_lvl+0x4a/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x36 __ubsan_handle_shift_out_of_bounds.cold+0x61/0x10e ? __const_udelay+0x43/0x50 ena_delay_exponential_backoff_us.cold+0x16/0x1e [ena] wait_for_reset_state+0x54/0xa0 [ena] ena_com_dev_reset+0xc8/0x110 [ena] ena_down+0x3fe/0x480 [ena] ena_destroy_device+0xeb/0xf0 [ena] ena_fw_reset_device+0x30/0x50 [ena] process_one_work+0x22b/0x3d0 worker_thread+0x4d/0x3f0 ? process_one_work+0x3d0/0x3d0 kthread+0x12a/0x150 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 Apparently, the reset delays are getting so large they can trigger a UBSAN panic. Looking at the code, the current timeout is capped at 5000us. Using a base value of 100us, the current code will overflow after (1<<29). Even at values before 32, this function wraps around, perhaps unintentionally. Cap the value of the exponent used for this backoff at (1<<16) which is larger than currently necessary, but large enough to support bigger values in the future. Cc: stable@vger.kernel.org Fixes: 4bb7f4cf60e3 ("net: ena: reduce driver load time") Signed-off-by: Krister Johansen Reviewed-by: Leon Romanovsky Reviewed-by: Shay Agroskin Link: https://lore.kernel.org/r/20230711013621.GE1926@templeofstupid.com Signed-off-by: Jakub Kicinski commit 8cc32a9bbf2934d90762d9de0187adcb5ad46a11 Author: Yonghong Song Date: Wed Jun 28 11:19:26 2023 -0700 kallsyms: strip LTO-only suffixes from promoted global functions Commit 6eb4bd92c1ce ("kallsyms: strip LTO suffixes from static functions") stripped all function/variable suffixes started with '.' regardless of whether those suffixes are generated at LTO mode or not. In fact, as far as I know, in LTO mode, when a static function/variable is promoted to the global scope, '.llvm.<...>' suffix is added. The existing mechanism breaks live patch for a LTO kernel even if no .llvm.<...> symbols are involved. For example, for the following kernel symbols: $ grep bpf_verifier_vlog /proc/kallsyms ffffffff81549f60 t bpf_verifier_vlog ffffffff8268b430 d bpf_verifier_vlog._entry ffffffff8282a958 d bpf_verifier_vlog._entry_ptr ffffffff82e12a1f d bpf_verifier_vlog.__already_done 'bpf_verifier_vlog' is a static function. '_entry', '_entry_ptr' and '__already_done' are static variables used inside 'bpf_verifier_vlog', so llvm promotes them to file-level static with prefix 'bpf_verifier_vlog.'. Note that the func-level to file-level static function promotion also happens without LTO. Given a symbol name 'bpf_verifier_vlog', with LTO kernel, current mechanism will return 4 symbols to live patch subsystem which current live patching subsystem cannot handle it. With non-LTO kernel, only one symbol is returned. In [1], we have a lengthy discussion, the suggestion is to separate two cases: (1). new symbols with suffix which are generated regardless of whether LTO is enabled or not, and (2). new symbols with suffix generated only when LTO is enabled. The cleanup_symbol_name() should only remove suffixes for case (2). Case (1) should not be changed so it can work uniformly with or without LTO. This patch removed LTO-only suffix '.llvm.<...>' so live patching and tracing should work the same way for non-LTO kernel. The cleanup_symbol_name() in scripts/kallsyms.c is also changed to have the same filtering pattern so both kernel and kallsyms tool have the same expectation on the order of symbols. [1] https://lore.kernel.org/live-patching/20230615170048.2382735-1-song@kernel.org/T/#u Fixes: 6eb4bd92c1ce ("kallsyms: strip LTO suffixes from static functions") Reported-by: Song Liu Signed-off-by: Yonghong Song Reviewed-by: Zhen Lei Reviewed-by: Nick Desaulniers Acked-by: Song Liu Link: https://lore.kernel.org/r/20230628181926.4102448-1-yhs@fb.com Signed-off-by: Kees Cook commit dcf89d111199562fa5f31a1bb76f17bc4831f6da Author: Mostafa Saleh Date: Thu Jul 6 15:22:40 2023 +0000 KVM: arm64: Add missing BTI instructions Some bti instructions were missing from commit b53d4a272349 ("KVM: arm64: Use BTI for nvhe") 1) kvm_host_psci_cpu_entry kvm_host_psci_cpu_entry is called from __kvm_hyp_init_cpu through "br" instruction as __kvm_hyp_init_cpu resides in idmap section while kvm_host_psci_cpu_entry is in hyp .text so the offset is larger than 128MB range covered by "b". Which means that this function should start with "bti j" instruction. LLVM which is the only compiler supporting BTI for Linux, adds "bti j" for jump tables or by when taking the address of the block [1]. Same behaviour is observed with GCC. As kvm_host_psci_cpu_entry is a C function, this must be done in assembly. Another solution is to use X16/X17 with "br", as according to ARM ARM DDI0487I.a RLJHCL/IGMGRS, PACIASP has an implicit branch target identification instruction that is compatible with PSTATE.BTYPE 0b01 which includes "br X16/X17" And the kvm_host_psci_cpu_entry has PACIASP as it is an external function. Although, using explicit "bti" makes it more clear than relying on which register is used. A third solution is to clear SCTLR_EL2.BT, which would make PACIASP compatible PSTATE.BTYPE 0b11 ("br" to other registers). However this deviates from the kernel behaviour (in bti_enable()). 2) Spectre vector table "br" instructions are generated at runtime for the vector table (__bp_harden_hyp_vecs). These branches would land on vectors in __kvm_hyp_vector at offset 8. As all the macros are defined with valid_vect/invalid_vect, it is sufficient to add "bti j" at the correct offset. [1] https://reviews.llvm.org/D52867 Fixes: b53d4a272349 ("KVM: arm64: Use BTI for nvhe") Signed-off-by: Mostafa Saleh Reported-by: Sudeep Holla Acked-by: Marc Zyngier Tested-by: Sudeep Holla Link: https://lore.kernel.org/r/20230706152240.685684-1-smostafa@google.com Signed-off-by: Oliver Upton commit 04e601f2a71c804422a91df813e19fda5f4b845e Merge: 283c5ce7da0a6 bfc374a145ae1 Author: Linus Walleij Date: Thu Jul 13 00:05:52 2023 +0200 Merge tag 'renesas-pinctrl-fixes-for-v6.5-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into fixes pinctrl: renesas: Fixes for v6.5 - Fix handling of non-unique pin control configuration subnode names on the RZ/V2M and RZ/G2L SoC families. Signed-off-by: Linus Walleij commit 283c5ce7da0a676f46539094d40067ad17c4f294 Author: Mario Limonciello Date: Wed Jul 5 08:30:05 2023 -0500 pinctrl: amd: Unify debounce handling into amd_pinconf_set() Debounce handling is done in two different entry points in the driver. Unify this to make sure that it's always handled the same. Tested-by: Jan Visser Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20230705133005.577-5-mario.limonciello@amd.com Signed-off-by: Linus Walleij commit 3f62312d04d4c68aace9cd06fc135e09573325f3 Author: Mario Limonciello Date: Wed Jul 5 08:30:04 2023 -0500 pinctrl: amd: Drop pull up select configuration pinctrl-amd currently tries to program bit 19 of all GPIOs to select either a 4kΩ or 8hΩ pull up, but this isn't what bit 19 does. Bit 19 is marked as reserved, even in the latest platforms documentation. Drop this programming functionality. Tested-by: Jan Visser Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20230705133005.577-4-mario.limonciello@amd.com Signed-off-by: Linus Walleij commit 635a750d958e158e17af0f524bedc484b27fbb93 Author: Mario Limonciello Date: Wed Jul 5 08:30:03 2023 -0500 pinctrl: amd: Use amd_pinconf_set() for all config options On ASUS TUF A16 it is reported that the ITE5570 ACPI device connected to GPIO 7 is causing an interrupt storm. This issue doesn't happen on Windows. Comparing the GPIO register configuration between Windows and Linux bit 20 has been configured as a pull up on Windows, but not on Linux. Checking GPIO declaration from the firmware it is clear it *should* have been a pull up on Linux as well. ``` GpioInt (Level, ActiveLow, Exclusive, PullUp, 0x0000, "\\_SB.GPIO", 0x00, ResourceConsumer, ,) { // Pin list 0x0007 } ``` On Linux amd_gpio_set_config() is currently only used for programming the debounce. Actually the GPIO core calls it with all the arguments that are supported by a GPIO, pinctrl-amd just responds `-ENOTSUPP`. To solve this issue expand amd_gpio_set_config() to support the other arguments amd_pinconf_set() supports, namely `PIN_CONFIG_BIAS_PULL_DOWN`, `PIN_CONFIG_BIAS_PULL_UP`, and `PIN_CONFIG_DRIVE_STRENGTH`. Reported-by: Nik P Reported-by: Nathan Schulte Reported-by: Friedrich Vock Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217336 Reported-by: dridri85@gmail.com Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217493 Link: https://lore.kernel.org/linux-input/20230530154058.17594-1-friedrich.vock@gmx.de/ Tested-by: Jan Visser Fixes: 2956b5d94a76 ("pinctrl / gpio: Introduce .set_config() callback for GPIO chips") Signed-off-by: Mario Limonciello Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230705133005.577-3-mario.limonciello@amd.com Signed-off-by: Linus Walleij commit 0d5ace1a07f7e846d0f6d972af60d05515599d0b Author: Mario Limonciello Date: Wed Jul 5 08:30:02 2023 -0500 pinctrl: amd: Only use special debounce behavior for GPIO 0 It's uncommon to use debounce on any other pin, but technically we should only set debounce to 0 when working off GPIO0. Cc: stable@vger.kernel.org Tested-by: Jan Visser Fixes: 968ab9261627 ("pinctrl: amd: Detect internal GPIO0 debounce handling") Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20230705133005.577-2-mario.limonciello@amd.com Signed-off-by: Linus Walleij commit bec3c25c247c4f88a33d79675a09e1644c9a3114 Author: Steven Rostedt (Google) Date: Wed Jul 12 10:52:35 2023 -0400 tracing: Stop FORTIFY_SOURCE complaining about stack trace caller The stack_trace event is an event created by the tracing subsystem to store stack traces. It originally just contained a hard coded array of 8 words to hold the stack, and a "size" to know how many entries are there. This is exported to user space as: name: kernel_stack ID: 4 format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:int size; offset:8; size:4; signed:1; field:unsigned long caller[8]; offset:16; size:64; signed:0; print fmt: "\t=> %ps\n\t=> %ps\n\t=> %ps\n" "\t=> %ps\n\t=> %ps\n\t=> %ps\n" "\t=> %ps\n\t=> %ps\n",i (void *)REC->caller[0], (void *)REC->caller[1], (void *)REC->caller[2], (void *)REC->caller[3], (void *)REC->caller[4], (void *)REC->caller[5], (void *)REC->caller[6], (void *)REC->caller[7] Where the user space tracers could parse the stack. The library was updated for this specific event to only look at the size, and not the array. But some older users still look at the array (note, the older code still checks to make sure the array fits inside the event that it read. That is, if only 4 words were saved, the parser would not read the fifth word because it will see that it was outside of the event size). This event was changed a while ago to be more dynamic, and would save a full stack even if it was greater than 8 words. It does this by simply allocating more ring buffer to hold the extra words. Then it copies in the stack via: memcpy(&entry->caller, fstack->calls, size); As the entry is struct stack_entry, that is created by a macro to both create the structure and export this to user space, it still had the caller field of entry defined as: unsigned long caller[8]. When the stack is greater than 8, the FORTIFY_SOURCE code notices that the amount being copied is greater than the source array and complains about it. It has no idea that the source is pointing to the ring buffer with the required allocation. To hide this from the FORTIFY_SOURCE logic, pointer arithmetic is used: ptr = ring_buffer_event_data(event); entry = ptr; ptr += offsetof(typeof(*entry), caller); memcpy(ptr, fstack->calls, size); Link: https://lore.kernel.org/all/20230612160748.4082850-1-svens@linux.ibm.com/ Link: https://lore.kernel.org/linux-trace-kernel/20230712105235.5fc441aa@gandalf.local.home Cc: Masami Hiramatsu Cc: Mark Rutland Reported-by: Sven Schnelle Tested-by: Sven Schnelle Signed-off-by: Steven Rostedt (Google) commit 26efd79c4624294e553aeaa3439c646729bad084 Author: Zheng Yejian Date: Wed Jul 12 14:04:52 2023 +0800 ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() As comments in ftrace_process_locs(), there may be NULL pointers in mcount_loc section: > Some architecture linkers will pad between > the different mcount_loc sections of different > object files to satisfy alignments. > Skip any NULL pointers. After commit 20e5227e9f55 ("ftrace: allow NULL pointers in mcount_loc"), NULL pointers will be accounted when allocating ftrace pages but skipped before adding into ftrace pages, this may result in some pages not being used. Then after commit 706c81f87f84 ("ftrace: Remove extra helper functions"), warning may occur at: WARN_ON(pg->next); To fix it, only warn for case that no pointers skipped but pages not used up, then free those unused pages after releasing ftrace_lock. Link: https://lore.kernel.org/linux-trace-kernel/20230712060452.3175675-1-zhengyejian1@huawei.com Cc: stable@vger.kernel.org Fixes: 706c81f87f84 ("ftrace: Remove extra helper functions") Suggested-by: Steven Rostedt Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit 835a65f51790e1f72b1ab106ec89db9ac15b47d6 Author: Karol Herbst Date: Fri May 26 11:10:52 2023 +0200 drm/nouveau: bring back blit subchannel for pre nv50 GPUs 1ba6113a90a0 removed a lot of the kernel GPU channel, but method 0x128 was important as otherwise the GPU spams us with `CACHE_ERROR` messages. We use the blit subchannel inside our vblank handling, so we should keep at least this part. v2: Only do it for NV11+ GPUs Closes: https://gitlab.freedesktop.org/drm/nouveau/-/issues/201 Fixes: 4a16dd9d18a0 ("drm/nouveau/kms: switch to drm fbdev helpers") Signed-off-by: Karol Herbst Reviewed-by: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/20230526091052.2169044-1-kherbst@redhat.com commit 938a06c8b7913455073506c33ae3bff029c3c4ef Author: Karol Herbst Date: Mon May 22 22:18:38 2023 +0200 drm/nouveau/acr: Abort loading ACR if no firmware was found This fixes a NULL pointer access inside nvkm_acr_oneinit in case necessary firmware files couldn't be loaded. Closes: https://gitlab.freedesktop.org/drm/nouveau/-/issues/212 Fixes: 4b569ded09fd ("drm/nouveau/acr/ga102: initial support") Signed-off-by: Karol Herbst Reviewed-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230522201838.1496622-1-kherbst@redhat.com commit df6556adf27b7372cfcd97e1c0afb0d516c8279f Author: Oliver Upton Date: Tue Jun 27 23:54:05 2023 +0000 KVM: arm64: Correctly handle page aging notifiers for unaligned memslot Userspace is allowed to select any PAGE_SIZE aligned hva to back guest memory. This is even the case with hugepages, although it is a rather suboptimal configuration as PTE level mappings are used at stage-2. The arm64 page aging handlers have an assumption that the specified range is exactly one page/block of memory, which in the aforementioned case is not necessarily true. All together this leads to the WARN() in kvm_age_gfn() firing. However, the WARN is only part of the issue as the table walkers visit at most a single leaf PTE. For hugepage-backed memory in a memslot that isn't hugepage-aligned, page aging entirely misses accesses to the hugepage beyond the first page in the memslot. Add a new walker dedicated to handling page aging MMU notifiers capable of walking a range of PTEs. Convert kvm(_test)_age_gfn() over to the new walker and drop the WARN that caught the issue in the first place. The implementation of this walker was inspired by the test_clear_young() implementation by Yu Zhao [*], but repurposed to address a bug in the existing aging implementation. Cc: stable@vger.kernel.org # v5.15 Fixes: 056aad67f836 ("kvm: arm/arm64: Rework gpa callback handlers") Link: https://lore.kernel.org/kvmarm/20230526234435.662652-6-yuzhao@google.com/ Co-developed-by: Yu Zhao Signed-off-by: Yu Zhao Reported-by: Reiji Watanabe Reviewed-by: Marc Zyngier Reviewed-by: Shaoqin Huang Link: https://lore.kernel.org/r/20230627235405.4069823-1-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit f72207a5c0dbaaf6921cf9a6c0d2fd0bc249ea78 Author: Dan Carpenter Date: Tue Jul 11 11:52:26 2023 +0300 netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write() The simple_write_to_buffer() function is designed to handle partial writes. It returns negatives on error, otherwise it returns the number of bytes that were able to be copied. This code doesn't check the return properly. We only know that the first byte is written, the rest of the buffer might be uninitialized. There is no need to use the simple_write_to_buffer() function. Partial writes are prohibited by the "if (*ppos != 0)" check at the start of the function. Just use memdup_user() and copy the whole buffer. Fixes: d3cbb907ae57 ("netdevsim: add ACL trap reporting cookie as a metadata") Signed-off-by: Dan Carpenter Reviewed-by: Pavan Chebbi Reviewed-by: Ido Schimmel Link: https://lore.kernel.org/r/7c1f950b-3a7d-4252-82a6-876e53078ef7@moroto.mountain Signed-off-by: Jakub Kicinski commit eb26cbb1a754ccde5d4d74527dad5ba051808fad Merge: 9a3236ce48406 6b293a8c91bca Author: Linus Torvalds Date: Wed Jul 12 12:16:47 2023 -0700 Merge tag 'platform-drivers-x86-v6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Hans de Goede: "Misc small fixes and hw-id additions" * tag 'platform-drivers-x86-v6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: touchscreen_dmi: Add info for the Archos 101 Cesium Educ tablet platform/x86: dell-ddv: Fix mangled list in documentation platform/x86: dell-ddv: Improve error handling platform/x86/amd: pmf: Add new ACPI ID AMDI0103 platform/x86/amd: pmc: Add new ACPI ID AMDI000A platform/x86/amd: pmc: Apply nvme quirk to HP 15s-eq2xxx platform/x86: Move s2idle quirk from thinkpad-acpi to amd-pmc platform/x86: int3472/discrete: set variable skl_int3472_regulator_second_sensor storage-class-specifier to static platform/x86/intel/tpmi: Prevent overflow for cap_offset platform/x86: wmi: Replace open coded guid_parse_and_compare() platform/x86: wmi: Break possible infinite loop when parsing GUID commit 5b10c18d1bf9238d842db6c8e86cc0066185c391 Author: Ian Rogers Date: Tue Jul 11 23:52:50 2023 -0700 perf parse-events: Avoid SEGV if PMU lookup fails for legacy cache terms libfuzzer found the following command could SEGV: $ perf stat -e cpu/L2,L2/ true This is because the L2 term rewrites the perf_event_attr type to PERF_TYPE_HW_CACHE which then fails the PMU lookup for the second legacy cache term. The new failure is consistent with repeated hardware terms: $ perf stat -e cpu/L2,L2/ true event syntax error: 'cpu/L2,L2/' \___ Failed to find PMU for type 3 Initial error: event syntax error: 'cpu/L2,L2/' \___ Failed to find PMU for type 3 Run 'perf list' for a list of valid events Usage: perf stat [] [] -e, --event event selector. use 'perf list' to list available events $ perf stat -e cpu/cycles,cycles/ true event syntax error: 'cpu/cycles,cycles/' \___ Failed to find PMU for type 0 Initial error: event syntax error: 'cpu/cycles,cycles/' \___ Failed to find PMU for type 0 Run 'perf list' for a list of valid events Usage: perf stat [] [] -e, --event event selector. use 'perf list' to list available events Committer testing: Before: $ perf stat -e cpu/L2,L2/ true Segmentation fault (core dumped) $ After: $ perf stat -e cpu/L2,L2/ true event syntax error: 'cpu/L2,L2/' \___ Failed to find PMU for type 3 Initial error: event syntax error: 'cpu/L2,L2/' \___ Failed to find PMU for type 3 Run 'perf list' for a list of valid events Usage: perf stat [] [] -e, --event event selector. use 'perf list' to list available events $ Fixes: 6fd1e5191591f9d5 ("perf parse-events: Support PMUs for legacy cache events") Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Xing Zhengjun Link: https://lore.kernel.org/r/20230712065250.1450306-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 9a3236ce48406c3190dfa06137636525001b32f5 Merge: 1d7546042f8fd 195b9cb5b288f Author: Linus Torvalds Date: Wed Jul 12 12:01:16 2023 -0700 Merge tag 'probes-fixes-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fixes from Masami Hiramatsu: - Fix fprobe's rethook release issues: - Release rethook after ftrace_ops is unregistered so that the rethook is not accessed after free. - Stop rethook before ftrace_ops is unregistered so that the rethook is NOT used after exiting unregister_fprobe() - Fix eprobe cleanup logic. If it attaches to multiple events and failes to enable one of them, rollback all enabled events correctly. - Fix fprobe to unlock ftrace recursion lock correctly when it missed by another running kprobe. - Cleanup kprobe to remove unnecessary NULL. - Cleanup kprobe to remove unnecessary 0 initializations. * tag 'probes-fixes-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: fprobe: Ensure running fprobe_exit_handler() finished before calling rethook_free() kernel: kprobes: Remove unnecessary ‘0’ values kprobes: Remove unnecessary ‘NULL’ values from correct_ret_addr fprobe: add unlock to match a succeeded ftrace_test_recursion_trylock kernel/trace: Fix cleanup logic of enable_trace_eprobe fprobe: Release rethook after the ftrace_ops is unregistered commit 1d7546042f8fdc4bc39ab91ec966203e2d64f8bd Merge: 3f01e9fed8454 8785436617640 Author: Linus Torvalds Date: Wed Jul 12 11:56:22 2023 -0700 Merge tag 'for-linus-2023071101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Benjamin Tissoires: - AMD SFH shift-out-of-bounds fix (Basavaraj Natikar) - avoid struct memcpy overrun warning in the hid-hyperv module (Arnd Bergmann) - a quick HID kselftests script fix for our CI to be happy (Benjamin Tissoires) - various fixes and additions of device IDs * tag 'for-linus-2023071101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: amd_sfh: Fix for shift-out-of-bounds HID: amd_sfh: Rename the float32 variable HID: input: fix mapping for camera access keys HID: logitech-hidpp: Add wired USB id for Logitech G502 Lightspeed HID: nvidia-shield: Pack inner/related declarations in HOSTCMD reports HID: hyperv: avoid struct memcpy overrun warning selftests: hid: fix vmtests.sh not running make headers commit f673b4f5bd13365c8bee2f38c9794b635c73a302 Author: Bart Van Assche Date: Wed Jul 12 10:33:43 2023 -0700 block/mq-deadline: Fix a bug in deadline_from_pos() A bug was introduced in deadline_from_pos() while implementing the suggestion to use round_down() in the following code: pos -= bdev_offset_from_zone_start(rq->q->disk->part0, pos); This patch makes deadline_from_pos() use round_down() such that 'pos' is rounded down. Reported-by: Shin'ichiro Kawasaki Closes: https://lore.kernel.org/all/5zthzi3lppvcdp4nemum6qck4gpqbdhvgy4k3qwguhgzxc4quj@amulvgycq67h/ Cc: Christoph Hellwig Cc: Damien Le Moal Fixes: 0effb390c4ba ("block: mq-deadline: Handle requeued requests correctly") Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20230712173344.2994513-1-bvanassche@acm.org Signed-off-by: Jens Axboe commit ab2dbc7accedc2e98eb7d8b8878d337e3b36c95d Author: Palmer Dabbelt Date: Tue Jul 11 15:46:00 2023 -0700 RISC-V: Don't include Zicsr or Zifencei in I from ACPI ACPI ISA strings are based on a specification after Zicsr and Zifencei were split out of I, so we shouldn't be treating them as part of I. We haven't release an ACPI-based kernel yet, so we don't need to worry about compatibility with the old ISA strings. Fixes: 07edc32779e3 ("RISC-V: always report presence of extensions formerly part of the base ISA") Reviewed-by: Conor Dooley Reviewed-by: Sunil V L Link: https://lore.kernel.org/r/20230711224600.10879-1-palmer@rivosinc.com Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit f84d41b2a083b990cbdf70f3b24b6b108b9678ad Author: Srinivas Kandagatla Date: Thu May 25 14:38:09 2023 +0100 soundwire: qcom: update status correctly with mask SoundWire device status can be incorrectly updated without proper mask, fix this by adding a mask before updating the status. Fixes: c7d49c76d1d5 ("soundwire: qcom: add support to new interrupts") Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230525133812.30841-2-srinivas.kandagatla@linaro.org Signed-off-by: Vinod Koul commit c40d6b3249b11d60e09d81530588f56233d9aa44 Author: Johan Hovold Date: Wed Jul 5 14:30:11 2023 +0200 soundwire: fix enumeration completion The soundwire subsystem uses two completion structures that allow drivers to wait for soundwire device to become enumerated on the bus and initialised by their drivers, respectively. The code implementing the signalling is currently broken as it does not signal all current and future waiters and also uses the wrong reinitialisation function, which can potentially lead to memory corruption if there are still waiters on the queue. Not signalling future waiters specifically breaks sound card probe deferrals as codec drivers can not tell that the soundwire device is already attached when being reprobed. Some codec runtime PM implementations suffer from similar problems as waiting for enumeration during resume can also timeout despite the device already having been enumerated. Fixes: fb9469e54fa7 ("soundwire: bus: fix race condition with enumeration_complete signaling") Fixes: a90def068127 ("soundwire: bus: fix race condition with initialization_complete signaling") Cc: stable@vger.kernel.org # 5.7 Cc: Pierre-Louis Bossart Cc: Rander Wang Signed-off-by: Johan Hovold Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20230705123018.30903-2-johan+linaro@kernel.org Signed-off-by: Vinod Koul commit 8932089b566c24ea19b57e37704c492678de1420 Author: Adrien Thierry Date: Thu Jun 29 10:45:40 2023 -0400 phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code The return value from qcom_snps_hsphy_suspend/resume is not used. Make sure qcom_snps_hsphy_runtime_suspend/resume return this value as well. Signed-off-by: Adrien Thierry Link: https://lore.kernel.org/r/20230629144542.14906-4-athierry@redhat.com Signed-off-by: Vinod Koul commit 8a0eb8f9b9a002291a3934acfd913660b905249e Author: Adrien Thierry Date: Thu Jun 29 10:45:39 2023 -0400 phy: qcom-snps-femto-v2: properly enable ref clock The driver is not enabling the ref clock, which thus gets disabled by the clk_disable_unused() initcall. This leads to the dwc3 controller failing to initialize if probed after clk_disable_unused() is called, for instance when the driver is built as a module. To fix this, switch to the clk_bulk API to handle both cfg_ahb and ref clocks at the proper places. Note that the cfg_ahb clock is currently not used by any device tree instantiation of the PHY. Work needs to be done separately to fix this. Link: https://lore.kernel.org/linux-arm-msm/ZEqvy+khHeTkC2hf@fedora/ Fixes: 51e8114f80d0 ("phy: qcom-snps: Add SNPS USB PHY driver for QCOM based SOCs") Signed-off-by: Adrien Thierry Link: https://lore.kernel.org/r/20230629144542.14906-3-athierry@redhat.com Signed-off-by: Vinod Koul commit 45d89a344eb46db9dce851c28e14f5e3c635c251 Author: Adrien Thierry Date: Thu Jun 29 10:45:38 2023 -0400 phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend In the dwc3 core, both system and runtime suspend end up calling dwc3_suspend_common(). From there, what happens for the PHYs depends on the USB mode and whether the controller is entering system or runtime suspend. HOST mode: (1) system suspend on a non-wakeup-capable controller The [1] if branch is taken. dwc3_core_exit() is called, which ends up calling phy_power_off() and phy_exit(). Those two functions decrease the PM runtime count at some point, so they will trigger the PHY runtime sleep (assuming the count is right). (2) runtime suspend / system suspend on a wakeup-capable controller The [1] branch is not taken. dwc3_suspend_common() calls phy_pm_runtime_put_sync(). Assuming the ref count is right, the PHY runtime suspend op is called. DEVICE mode: dwc3_core_exit() is called on both runtime and system sleep unless the controller is already runtime suspended. OTG mode: (1) system suspend : dwc3_core_exit() is called (2) runtime suspend : do nothing In host mode, the code seems to make a distinction between 1) runtime sleep / system sleep for wakeup-capable controller, and 2) system sleep for non-wakeup-capable controller, where phy_power_off() and phy_exit() are only called for the latter. This suggests the PHY is not supposed to be in a fully powered-off state for runtime sleep and system sleep for wakeup-capable controller. Moreover, downstream, cfg_ahb_clk only gets disabled for system suspend. The clocks are disabled by phy->set_suspend() [2] which is only called in the system sleep path through dwc3_core_exit() [3]. With that in mind, don't disable the clocks during the femto PHY runtime suspend callback. The clocks will only be disabled during system suspend for non-wakeup-capable controllers, through dwc3_core_exit(). [1] https://elixir.bootlin.com/linux/v6.4/source/drivers/usb/dwc3/core.c#L1988 [2] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/LV.AU.1.2.1.r2-05300-gen3meta.0/drivers/usb/phy/phy-msm-snps-hs.c#L524 [3] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/LV.AU.1.2.1.r2-05300-gen3meta.0/drivers/usb/dwc3/core.c#L1915 Signed-off-by: Adrien Thierry Link: https://lore.kernel.org/r/20230629144542.14906-2-athierry@redhat.com Signed-off-by: Vinod Koul commit 95bd315f0a5ed7d7afe771776272c5b3cdb29bc8 Author: Guillaume Ranquet Date: Tue May 30 10:43:07 2023 +0200 phy: mediatek: hdmi: mt8195: fix prediv bad upper limit test The pll prediv calculus searchs for the smallest prediv that gets the ns_hdmipll_ck in the range of 5 GHz to 12 GHz. A typo in the upper bound test was testing for 5Ghz to 1Ghz Fixes: 45810d486bb44 ("phy: mediatek: add support for phy-mtk-hdmi-mt8195") Signed-off-by: Guillaume Ranquet Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230529-hdmi_phy_fix-v1-1-bf65f53af533@baylibre.com Signed-off-by: Vinod Koul commit 5782017cc4d0c8f3425d55b893675bb8a20c33e9 Author: Dan Carpenter Date: Tue Jul 11 09:13:25 2023 +0300 phy: phy-mtk-dp: Fix an error code in probe() Negative -EINVAL was intended instead of positive EINVAL. Fixes: 6a23afad443a ("phy: phy-mtk-dp: Add driver for DP phy") Signed-off-by: Dan Carpenter Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/3c699e00-2883-40d9-92c3-0da1dc38fdd4@moroto.mountain Signed-off-by: Vinod Koul commit a68b48afc050a9456ed4ed19d8755e0f925b44e6 Author: Minjie Du Date: Wed Jul 5 19:39:12 2023 +0800 dmaengine: xilinx: xdma: Fix Judgment of the return value Fix: make IS_ERR() judge the devm_ioremap_resource() function return. Fixes: 17ce252266c7 ("dmaengine: xilinx: xdma: Add xilinx xdma driver") Signed-off-by: Minjie Du Acked-by: Michal Simek Link: https://lore.kernel.org/r/20230705113912.16247-1-duminjie@vivo.com Signed-off-by: Vinod Koul commit b1e213a9e31c20206f111ec664afcf31cbfe0dbb Author: Baoquan He Date: Fri Jul 7 21:58:45 2023 +0800 idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM On s390 systems (aka mainframes), it has classic channel devices for networking and permanent storage that are currently even more common than PCI devices. Hence it could have a fully functional s390 kernel with CONFIG_PCI=n, then the relevant iomem mapping functions [including ioremap(), devm_ioremap(), etc.] are not available. Here let FSL_EDMA and INTEL_IDMA64 depend on HAS_IOMEM so that it won't be built to cause below compiling error if PCI is unset. -------- ERROR: modpost: "devm_platform_ioremap_resource" [drivers/dma/fsl-edma.ko] undefined! ERROR: modpost: "devm_platform_ioremap_resource" [drivers/dma/idma64.ko] undefined! -------- Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306211329.ticOJCSv-lkp@intel.com/ Signed-off-by: Baoquan He Cc: Vinod Koul Cc: dmaengine@vger.kernel.org Link: https://lore.kernel.org/r/20230707135852.24292-2-bhe@redhat.com Signed-off-by: Vinod Koul commit 71a5bb153be104d9175636e95166fd5e37466649 Author: Keith Busch Date: Wed Jul 12 08:36:47 2023 -0700 nvme: ensure disabling pairs with unquiesce If any error handling that disables the controller fails to queue the reset work, like if the state changed to disconnected inbetween, then the failed teardown needs to unquiesce the queues since it's no longer paired with reset_work. Just make sure that the controller can be put into a resetting state prior to starting the disable so that no other handling can change the queue states while recovery is happening. Reported-by: Ming Lei Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit ee6fdc5055e916b1dd497f11260d4901c4c1e55e Author: Michael Liang Date: Fri Jul 7 15:21:57 2023 -0600 nvme-fc: fix race between error recovery and creating association There is a small race window between nvme-fc association creation and error recovery. Fix this race condition by protecting accessing to controller state and ASSOC_FAILED flag under nvme-fc controller lock. Signed-off-by: Michael Liang Reviewed-by: Caleb Sander Reviewed-by: James Smart Signed-off-by: Keith Busch commit 60e445bdfccbb90c1bc13a92e128e50ba4357b3c Author: Michael Liang Date: Fri Jul 7 15:21:56 2023 -0600 nvme-fc: return non-zero status code when fails to create association Return non-zero status code(-EIO) when needed, so re-connecting or deleting controller will be triggered properly. Signed-off-by: Michael Liang Reviewed-by: Caleb Sander Reviewed-by: James Smart Signed-off-by: Keith Busch commit e701156ccc6c7a5f104a968dda74cd6434178712 Author: Mario Limonciello Date: Fri Jul 7 21:26:09 2023 -0500 drm/amd: Align SMU11 SMU_MSG_OverridePcieParameters implementation with SMU13 SMU13 overrides dynamic PCIe lane width and dynamic speed by when on certain hosts. commit 38e4ced80479 ("drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs") worked around this issue by setting up certain SKUs to set up certain limits, but the same fundamental problem with those hosts affects all SMU11 implmentations as well, so align the SMU11 and SMU13 driver handling. Signed-off-by: Mario Limonciello Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 7e42907f3a7b4ce3a2d1757f6d78336984daf8f5 Author: Zheng Yejian Date: Sun Jul 9 06:51:44 2023 +0800 ring-buffer: Fix deadloop issue on reading trace_pipe Soft lockup occurs when reading file 'trace_pipe': watchdog: BUG: soft lockup - CPU#6 stuck for 22s! [cat:4488] [...] RIP: 0010:ring_buffer_empty_cpu+0xed/0x170 RSP: 0018:ffff88810dd6fc48 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000246 RCX: ffffffff93d1aaeb RDX: ffff88810a280040 RSI: 0000000000000008 RDI: ffff88811164b218 RBP: ffff88811164b218 R08: 0000000000000000 R09: ffff88815156600f R10: ffffed102a2acc01 R11: 0000000000000001 R12: 0000000051651901 R13: 0000000000000000 R14: ffff888115e49500 R15: 0000000000000000 [...] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8d853c2000 CR3: 000000010dcd8000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __find_next_entry+0x1a8/0x4b0 ? peek_next_entry+0x250/0x250 ? down_write+0xa5/0x120 ? down_write_killable+0x130/0x130 trace_find_next_entry_inc+0x3b/0x1d0 tracing_read_pipe+0x423/0xae0 ? tracing_splice_read_pipe+0xcb0/0xcb0 vfs_read+0x16b/0x490 ksys_read+0x105/0x210 ? __ia32_sys_pwrite64+0x200/0x200 ? switch_fpu_return+0x108/0x220 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x61/0xc6 Through the vmcore, I found it's because in tracing_read_pipe(), ring_buffer_empty_cpu() found some buffer is not empty but then it cannot read anything due to "rb_num_of_entries() == 0" always true, Then it infinitely loop the procedure due to user buffer not been filled, see following code path: tracing_read_pipe() { ... ... waitagain: tracing_wait_pipe() // 1. find non-empty buffer here trace_find_next_entry_inc() // 2. loop here try to find an entry __find_next_entry() ring_buffer_empty_cpu(); // 3. find non-empty buffer peek_next_entry() // 4. but peek always return NULL ring_buffer_peek() rb_buffer_peek() rb_get_reader_page() // 5. because rb_num_of_entries() == 0 always true here // then return NULL // 6. user buffer not been filled so goto 'waitgain' // and eventually leads to an deadloop in kernel!!! } By some analyzing, I found that when resetting ringbuffer, the 'entries' of its pages are not all cleared (see rb_reset_cpu()). Then when reducing the ringbuffer, and if some reduced pages exist dirty 'entries' data, they will be added into 'cpu_buffer->overrun' (see rb_remove_pages()), which cause wrong 'overrun' count and eventually cause the deadloop issue. To fix it, we need to clear every pages in rb_reset_cpu(). Link: https://lore.kernel.org/linux-trace-kernel/20230708225144.3785600-1-zhengyejian1@huawei.com Cc: stable@vger.kernel.org Fixes: a5fb833172eca ("ring-buffer: Fix uninitialized read_stamp") Signed-off-by: Zheng Yejian Signed-off-by: Steven Rostedt (Google) commit 188623076d0f1a500583d392b6187056bf7cc71a Author: Mario Limonciello Date: Fri Jul 7 21:26:08 2023 -0500 drm/amd: Move helper for dynamic speed switch check out of smu13 This helper is used for checking if the connected host supports the feature, it can be moved into generic code to be used by other smu implementations as well. Signed-off-by: Mario Limonciello Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 31c7a3b378a136adc63296a2ff17645896fcf303 Author: Mario Limonciello Date: Fri Jul 7 14:31:35 2023 -0500 drm/amd/pm: conditionally disable pcie lane/speed switching for SMU13 Intel platforms such as Sapphire Rapids and Raptor Lake don't support dynamic pcie lane or speed switching. This limitation seems to carry over from one generation to another. To be safer, disable dynamic pcie lane width and speed switching when running on an Intel platform. Link: https://edc.intel.com/content/www/us/en/design/products/platforms/details/raptor-lake-s/13th-generation-core-processors-datasheet-volume-1-of-2/005/pci-express-support/ Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2663 Co-developed-by: Evan Quan Signed-off-by: Evan Quan Signed-off-by: Mario Limonciello Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit dcb489bae65d92cfd26da22c7a0d6665b06ecc63 Author: Evan Quan Date: Fri Jul 7 14:31:34 2023 -0500 drm/amd/pm: share the code around SMU13 pcie parameters update So that SMU13.0.0 and SMU13.0.7 do not need to have one copy each. Signed-off-by: Evan Quan Signed-off-by: Mario Limonciello Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.1.x commit 8a774fe912ff09e39c2d3a3589c729330113f388 Author: gaba Date: Thu Mar 2 19:03:56 2023 -0500 drm/amdgpu: avoid restore process run into dead loop. In restore process worker, pinned BO cause update PTE fail, then the function re-schedule the restore_work. This will generate dead loop. Signed-off-by: gaba Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit d934e537c14bfe1227ced6341472571f354383e8 Author: Yang Wang Date: Tue Jun 20 17:05:25 2023 +0800 drm/amd/pm: fix smu i2c data read risk the smu driver_table is used for all types of smu tables data transcation (e.g: PPtable, Metrics, i2c, Ecc..). it is necessary to hold this lock to avoiding data tampering during the i2c read operation. Signed-off-by: Yang Wang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 7d8b31b73c79835572611ed1eed649e4d2e14245 Author: Arnd Bergmann Date: Wed May 17 14:51:48 2023 +0200 tracing: arm64: Avoid missing-prototype warnings These are all tracing W=1 warnings in arm64 allmodconfig about missing prototypes: kernel/trace/trace_kprobe_selftest.c:7:5: error: no previous prototype for 'kprobe_trace_selftest_target' [-Werror=missing-pro totypes] kernel/trace/ftrace.c:329:5: error: no previous prototype for '__register_ftrace_function' [-Werror=missing-prototypes] kernel/trace/ftrace.c:372:5: error: no previous prototype for '__unregister_ftrace_function' [-Werror=missing-prototypes] kernel/trace/ftrace.c:4130:15: error: no previous prototype for 'arch_ftrace_match_adjust' [-Werror=missing-prototypes] kernel/trace/fgraph.c:243:15: error: no previous prototype for 'ftrace_return_to_handler' [-Werror=missing-prototypes] kernel/trace/fgraph.c:358:6: error: no previous prototype for 'ftrace_graph_sleep_time_control' [-Werror=missing-prototypes] arch/arm64/kernel/ftrace.c:460:6: error: no previous prototype for 'prepare_ftrace_return' [-Werror=missing-prototypes] arch/arm64/kernel/ptrace.c:2172:5: error: no previous prototype for 'syscall_trace_enter' [-Werror=missing-prototypes] arch/arm64/kernel/ptrace.c:2195:6: error: no previous prototype for 'syscall_trace_exit' [-Werror=missing-prototypes] Move the declarations to an appropriate header where they can be seen by the caller and callee, and make sure the headers are included where needed. Link: https://lore.kernel.org/linux-trace-kernel/20230517125215.930689-1-arnd@kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Will Deacon Cc: Kees Cook Cc: Florent Revest Signed-off-by: Arnd Bergmann Acked-by: Catalin Marinas [ Fixed ftrace_return_to_handler() to handle CONFIG_HAVE_FUNCTION_GRAPH_RETVAL case ] Signed-off-by: Steven Rostedt (Google) commit 769e637276c294c2254f698e6a57eda771deb3f7 Author: Beau Belgrave Date: Thu Jun 29 23:50:49 2023 +0000 selftests/user_events: Test struct size match cases The self tests for user_events currently does not ensure that the edge case for struct types work properly with size differences. Add cases for mis-matching struct names and sizes to ensure they work properly. Link: https://lkml.kernel.org/r/20230629235049.581-3-beaub@linux.microsoft.com Cc: Shuah Khan Cc: linux-kselftest@vger.kernel.org Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit 733ba346d941d37e0814bac37b6a5c188ac3c9b2 Author: Minjie Du Date: Wed Jul 12 19:18:37 2023 +0800 nvme: fix parameter check in nvme_fault_inject_init() Make IS_ERR() judge the debugfs_create_dir() function return. Signed-off-by: Minjie Du Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit b718ae835bd5de891ff6fefa290940b7613d2b07 Author: Keith Busch Date: Wed Jul 12 07:54:59 2023 -0700 nvme: warn only once for legacy uuid attribute Report the legacy fallback behavior for uuid attributes just once instead of logging repeated warnings for the same condition every time the attribute is read. The old behavior is too spamy on the kernel logs. Cc: Johannes Thumshirn Reported-by: Breno Leitao Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit c177872cb056e0b499af4717d8d1977017fd53df Author: Karol Herbst Date: Fri Jun 30 18:06:45 2023 +0200 drm/nouveau/disp/g94: enable HDMI Cc: Ben Skeggs Cc: Lyude Paul Fixes: f530bc60a30b ("drm/nouveau/disp: move HDMI config into acquire + infoframe methods") Signed-off-by: Karol Herbst Reviewed-by: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/20230630160645.3984596-1-kherbst@redhat.com Signed-off-by: Karol Herbst commit d94303699921bda8141ad33554ae55b615ddd149 Author: Karol Herbst Date: Wed Jun 28 23:22:46 2023 +0200 drm/nouveau/disp: fix HDMI on gt215+ Cc: Ben Skeggs Cc: Lyude Paul Fixes: f530bc60a30b ("drm/nouveau/disp: move HDMI config into acquire + infoframe methods") Signed-off-by: Karol Herbst Reviewed-by: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/20230628212248.3798605-1-kherbst@redhat.com Signed-off-by: Karol Herbst commit 30ebf2ce70888d8fdd1986e8e6d509dd2d227985 Author: Randy Dunlap Date: Mon Jul 10 21:29:13 2023 -0700 kconfig: gconfig: correct program name in help text Change "gkc" to "gconfig" in 3 places since it is called "gconfig" and not "gkc". Add a period at the end of one sentence. Signed-off-by: Randy Dunlap Signed-off-by: Masahiro Yamada commit 390ef8c0a37751434d084a8226a1ad9c90ae5772 Author: Randy Dunlap Date: Mon Jul 10 21:28:59 2023 -0700 kconfig: gconfig: drop the Show Debug Info help text The Show Debug Info option was removed eons ago. Now finish the job by removing the help text for it also. Fixes: 7b5d87215b38 ("gconfig: remove show_debug option") Signed-off-by: Randy Dunlap Signed-off-by: Masahiro Yamada commit b690e266dae2f85f4dfea21fa6a05e3500a51054 Author: Jisheng Zhang Date: Mon Jul 10 01:10:36 2023 +0800 riscv: mm: fix truncation warning on RV32 lkp reports below sparse warning when building for RV32: arch/riscv/mm/init.c:1204:48: sparse: warning: cast truncates bits from constant value (100000000 becomes 0) IMO, the reason we didn't see this truncates bug in real world is "0" means MEMBLOCK_ALLOC_ACCESSIBLE in memblock and there's no RV32 HW with more than 4GB memory. Fix it anyway to make sparse happy. Fixes: decf89f86ecd ("riscv: try to allocate crashkern region from 32bit addressible memory") Signed-off-by: Jisheng Zhang Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306080034.SLiCiOMn-lkp@intel.com/ Link: https://lore.kernel.org/r/20230709171036.1906-1-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit 66843b14fb71825fdd73ab12f6594f2243b402be Author: Eric Lin Date: Mon Jul 10 15:43:28 2023 +0000 perf: RISC-V: Remove PERF_HES_STOPPED flag checking in riscv_pmu_start() Since commit 096b52fd2bb4 ("perf: RISC-V: throttle perf events") the perf_sample_event_took() function was added to report time spent in overflow interrupts. If the interrupt takes too long, the perf framework will lower the sysctl_perf_event_sample_rate and max_samples_per_tick. When hwc->interrupts is larger than max_samples_per_tick, the hwc->interrupts will be set to MAX_INTERRUPTS, and events will be throttled within the __perf_event_account_interrupt() function. However, the RISC-V PMU driver doesn't call riscv_pmu_stop() to update the PERF_HES_STOPPED flag after perf_event_overflow() in pmu_sbi_ovf_handler() function to avoid throttling. When the perf framework unthrottled the event in the timer interrupt handler, it triggers riscv_pmu_start() function and causes a WARN_ON_ONCE() warning, as shown below: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 240 at drivers/perf/riscv_pmu.c:184 riscv_pmu_start+0x7c/0x8e Modules linked in: CPU: 0 PID: 240 Comm: ls Not tainted 6.4-rc4-g19d0788e9ef2 #1 Hardware name: SiFive (DT) epc : riscv_pmu_start+0x7c/0x8e ra : riscv_pmu_start+0x28/0x8e epc : ffffffff80aef864 ra : ffffffff80aef810 sp : ffff8f80004db6f0 gp : ffffffff81c83750 tp : ffffaf80069f9bc0 t0 : ffff8f80004db6c0 t1 : 0000000000000000 t2 : 000000000000001f s0 : ffff8f80004db720 s1 : ffffaf8008ca1068 a0 : 0000ffffffffffff a1 : 0000000000000000 a2 : 0000000000000001 a3 : 0000000000000870 a4 : 0000000000000000 a5 : 0000000000000000 a6 : 0000000000000840 a7 : 0000000000000030 s2 : 0000000000000000 s3 : ffffaf8005165800 s4 : ffffaf800424da00 s5 : ffffffffffffffff s6 : ffffffff81cc7590 s7 : 0000000000000000 s8 : 0000000000000006 s9 : 0000000000000001 s10: ffffaf807efbc340 s11: ffffaf807efbbf00 t3 : ffffaf8006a16028 t4 : 00000000dbfbb796 t5 : 0000000700000000 t6 : ffffaf8005269870 status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000003 [] riscv_pmu_start+0x7c/0x8e [] perf_adjust_freq_unthr_context+0x15e/0x174 [] perf_event_task_tick+0x88/0x9c [] scheduler_tick+0xfe/0x27c [] update_process_times+0x9a/0xba [] tick_sched_handle+0x32/0x66 [] tick_sched_timer+0x64/0xb0 [] __hrtimer_run_queues+0x156/0x2f4 [] hrtimer_interrupt+0xe2/0x1fe [] riscv_timer_interrupt+0x38/0x42 [] handle_percpu_devid_irq+0x90/0x1d2 [] generic_handle_domain_irq+0x28/0x36 After referring other PMU drivers like Arm, Loongarch, Csky, and Mips, they don't call *_pmu_stop() to update with PERF_HES_STOPPED flag after perf_event_overflow() function nor do they add PERF_HES_STOPPED flag checking in *_pmu_start() which don't cause this warning. Thus, it's recommended to remove this unnecessary check in riscv_pmu_start() function to prevent this warning. Signed-off-by: Eric Lin Link: https://lore.kernel.org/r/20230710154328.19574-1-eric.lin@sifive.com Fixes: 096b52fd2bb4 ("perf: RISC-V: throttle perf events") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt commit 0266a2f791294e0b4ba36f4a1d89b8615ea3cac0 Author: Wang Ming Date: Tue Jul 4 15:40:47 2023 +0800 ksmbd: Fix unsigned expression compared with zero The return value of the ksmbd_vfs_getcasexattr() is signed. However, the return value is being assigned to an unsigned variable and subsequently recasted, causing warnings. Use a signed type. Signed-off-by: Wang Ming Acked-by: Tom Talpey Acked-by: Namjae Jeon Signed-off-by: Steve French commit d64b1ee12a168030fbb3e0aebf7bce49e9a07589 Author: Dan Carpenter Date: Thu Jun 29 09:07:37 2023 +0300 RDMA/mlx4: Make check for invalid flags stricter This code is trying to ensure that only the flags specified in the list are allowed. The problem is that ucmd->rx_hash_fields_mask is a u64 and the flags are an enum which is treated as a u32 in this context. That means the test doesn't check whether the highest 32 bits are zero. Fixes: 4d02ebd9bbbd ("IB/mlx4: Fix RSS hash fields restrictions") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/233ed975-982d-422a-b498-410f71d8a101@moroto.mountain Signed-off-by: Leon Romanovsky commit 54ccc8758ef4d29de9e8fdb711c852abbdd4103a Author: Jonas Gorski Date: Sat Jul 8 21:53:09 2023 +0200 mailmap: add entry for Jonas Gorski The openwrt.org email address is long defunct, but still pop ups from time to time when asking get_maintainer.pl. So add an entry to my currently used address. Signed-off-by: Jonas Gorski Link: https://lore.kernel.org/r/20230708195309.72767-2-jonas.gorski@gmail.com Signed-off-by: Mark Brown commit 2bbc72ffc4de803f6265119963aa7aac6559960f Author: Jonas Gorski Date: Sat Jul 8 21:53:08 2023 +0200 MAINTAINERS: add myself for spi-bcm63xx I noticed the driver is unclaimed. Since I was the last one doing substantial work on it, add me as the maintainer. As it is only found in legacy products, mark it as "Odd Fixes" instead of "Maintained". Signed-off-by: Jonas Gorski Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20230708195309.72767-1-jonas.gorski@gmail.com Signed-off-by: Mark Brown commit 9ec3c5517e22a12d2ff1b71e844f7913641460c6 Author: Jaewon Kim Date: Tue Jul 11 17:20:20 2023 +0900 spi: s3c64xx: clear loopback bit after loopback test When SPI loopback transfer is performed, S3C64XX_SPI_MODE_SELF_LOOPBACK bit still remained. It works as loopback even if the next transfer is not spi loopback mode. If not SPI_LOOP, needs to clear S3C64XX_SPI_MODE_SELF_LOOPBACK bit. Signed-off-by: Jaewon Kim Fixes: ffb7bcd3b27e ("spi: s3c64xx: support loopback mode") Reviewed-by: Chanho Park Link: https://lore.kernel.org/r/20230711082020.138165-1-jaewon02.kim@samsung.com Signed-off-by: Mark Brown commit 7e6b04f9238eab0f684fafd158c1f32ea65b9eaa Author: Arseniy Krasnov Date: Wed Jul 5 09:52:10 2023 +0300 mtd: rawnand: meson: fix OOB available bytes for ECC It is incorrect to calculate number of OOB bytes for ECC engine using some "already known" ECC step size (1024 bytes here). Number of such bytes for ECC engine must be whole OOB except 2 bytes for bad block marker, while proper ECC step size and strength will be selected by ECC logic. Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller") Cc: Signed-off-by: Arseniy Krasnov Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230705065211.293500-1-AVKrasnov@sberdevices.ru commit d8403b9eeee66d5dd81ecb9445800b108c267ce3 Author: Roger Quadros Date: Sun Jun 25 00:10:21 2023 +0530 mtd: rawnand: omap_elm: Fix incorrect type in assignment Once the ECC word endianness is converted to BE32, we force cast it to u32 so we can use elm_write_reg() which in turn uses writel(). Fixes below sparse warnings: drivers/mtd/nand/raw/omap_elm.c:180:37: sparse: expected unsigned int [usertype] val drivers/mtd/nand/raw/omap_elm.c:180:37: sparse: got restricted __be32 [usertype] drivers/mtd/nand/raw/omap_elm.c:185:37: sparse: expected unsigned int [usertype] val drivers/mtd/nand/raw/omap_elm.c:185:37: sparse: got restricted __be32 [usertype] drivers/mtd/nand/raw/omap_elm.c:190:37: sparse: expected unsigned int [usertype] val drivers/mtd/nand/raw/omap_elm.c:190:37: sparse: got restricted __be32 [usertype] >> drivers/mtd/nand/raw/omap_elm.c:200:40: sparse: sparse: restricted __be32 degrades to integer drivers/mtd/nand/raw/omap_elm.c:206:39: sparse: sparse: restricted __be32 degrades to integer drivers/mtd/nand/raw/omap_elm.c:210:37: sparse: expected unsigned int [assigned] [usertype] val drivers/mtd/nand/raw/omap_elm.c:210:37: sparse: got restricted __be32 [usertype] drivers/mtd/nand/raw/omap_elm.c:213:37: sparse: expected unsigned int [assigned] [usertype] val drivers/mtd/nand/raw/omap_elm.c:213:37: sparse: got restricted __be32 [usertype] drivers/mtd/nand/raw/omap_elm.c:216:37: sparse: expected unsigned int [assigned] [usertype] val drivers/mtd/nand/raw/omap_elm.c:216:37: sparse: got restricted __be32 [usertype] drivers/mtd/nand/raw/omap_elm.c:219:37: sparse: expected unsigned int [assigned] [usertype] val drivers/mtd/nand/raw/omap_elm.c:219:37: sparse: got restricted __be32 [usertype] drivers/mtd/nand/raw/omap_elm.c:222:37: sparse: expected unsigned int [assigned] [usertype] val drivers/mtd/nand/raw/omap_elm.c:222:37: sparse: got restricted __be32 [usertype] drivers/mtd/nand/raw/omap_elm.c:225:37: sparse: expected unsigned int [assigned] [usertype] val drivers/mtd/nand/raw/omap_elm.c:225:37: sparse: got restricted __be32 [usertype] drivers/mtd/nand/raw/omap_elm.c:228:39: sparse: sparse: restricted __be32 degrades to integer Fixes: bf22433575ef ("mtd: devices: elm: Add support for ELM error correction") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306212211.WDXokuWh-lkp@intel.com/ Signed-off-by: Roger Quadros Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230624184021.7740-1-rogerq@kernel.org commit f5a05060670a4d8d6523afc7963eb559c2e3615f Author: Olivier Maignial Date: Fri Jun 23 17:33:37 2023 +0200 mtd: spinand: winbond: Fix ecc_get_status Reading ECC status is failing. w25n02kv_ecc_get_status() is using on-stack buffer for SPINAND_GET_FEATURE_OP() output. It is not suitable for DMA needs of spi-mem. Fix this by using the spi-mem operations dedicated buffer spinand->scratchbuf. See spinand->scratchbuf: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/linux/mtd/spinand.h?h=v6.3#n418 spi_mem_check_op(): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/spi/spi-mem.c?h=v6.3#n199 Fixes: 6154c7a58348 ("mtd: spinand: winbond: add Winbond W25N02KV flash support") Cc: stable@vger.kernel.org Signed-off-by: Olivier Maignial Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/DB4P250MB1032EDB9E36B764A33769039FE23A@DB4P250MB1032.EURP250.PROD.OUTLOOK.COM commit 8544cda94dae6be3f1359539079c68bb731428b1 Author: Olivier Maignial Date: Fri Jun 23 17:33:36 2023 +0200 mtd: spinand: toshiba: Fix ecc_get_status Reading ECC status is failing. tx58cxgxsxraix_ecc_get_status() is using on-stack buffer for SPINAND_GET_FEATURE_OP() output. It is not suitable for DMA needs of spi-mem. Fix this by using the spi-mem operations dedicated buffer spinand->scratchbuf. See spinand->scratchbuf: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/linux/mtd/spinand.h?h=v6.3#n418 spi_mem_check_op(): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/spi/spi-mem.c?h=v6.3#n199 Fixes: 10949af1681d ("mtd: spinand: Add initial support for Toshiba TC58CVG2S0H") Cc: stable@vger.kernel.org Signed-off-by: Olivier Maignial Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/DB4P250MB1032553D05FBE36DEE0D311EFE23A@DB4P250MB1032.EURP250.PROD.OUTLOOK.COM commit 963b54df82b6d6206d7def273390bf3f7af558e1 Author: Isaac J. Manjarres Date: Tue Jul 11 12:30:58 2023 -0700 regmap-irq: Fix out-of-bounds access when allocating config buffers When allocating the 2D array for handling IRQ type registers in regmap_add_irq_chip_fwnode(), the intent is to allocate a matrix with num_config_bases rows and num_config_regs columns. This is currently handled by allocating a buffer to hold a pointer for each row (i.e. num_config_bases). After that, the logic attempts to allocate the memory required to hold the register configuration for each row. However, instead of doing this allocation for each row (i.e. num_config_bases allocations), the logic erroneously does this allocation num_config_regs number of times. This scenario can lead to out-of-bounds accesses when num_config_regs is greater than num_config_bases. Fix this by updating the terminating condition of the loop that allocates the memory for holding the register configuration to allocate memory only for each row in the matrix. Amit Pundir reported a crash that was occurring on his db845c device due to memory corruption (see "Closes" tag for Amit's report). The KASAN report below helped narrow it down to this issue: [ 14.033877][ T1] ================================================================== [ 14.042507][ T1] BUG: KASAN: invalid-access in regmap_add_irq_chip_fwnode+0x594/0x1364 [ 14.050796][ T1] Write of size 8 at addr 06ffff8081021850 by task init/1 [ 14.242004][ T1] The buggy address belongs to the object at ffffff8081021850 [ 14.242004][ T1] which belongs to the cache kmalloc-8 of size 8 [ 14.255669][ T1] The buggy address is located 0 bytes inside of [ 14.255669][ T1] 8-byte region [ffffff8081021850, ffffff8081021858) Fixes: faa87ce9196d ("regmap-irq: Introduce config registers for irq types") Reported-by: Amit Pundir Closes: https://lore.kernel.org/all/CAMi1Hd04mu6JojT3y6wyN2YeVkPR5R3qnkKJ8iR8if_YByCn4w@mail.gmail.com/ Tested-by: John Stultz Tested-by: Amit Pundir # tested on Dragonboard 845c Cc: stable@vger.kernel.org # v6.0+ Cc: Aidan MacDonald Cc: Saravana Kannan Cc: Catalin Marinas Signed-off-by: "Isaac J. Manjarres" Link: https://lore.kernel.org/r/20230711193059.2480971-1-isaacmanjarres@google.com Signed-off-by: Mark Brown commit bfb5ef2219b7b28a6e328860438eb55027807289 Author: Viresh Kumar Date: Wed Jul 12 09:28:43 2023 +0530 cpufreq: sparc: Don't mark cpufreq callbacks with __init These callbacks can be called again by the cpufreq core after the driver is initialized and must be kept around. We currently get section mismatch build warnings. Don't mark them with __init. Fixes: dcfce7c2cee4 ("cpufreq: sparc: Don't allocate cpufreq_driver dynamically") Reported-by: Geert Uytterhoeven Signed-off-by: Viresh Kumar Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap # build-tested Signed-off-by: Rafael J. Wysocki commit d3f87278bcb80bd7f9519669d928b43320363d4f Author: Ido Schimmel Date: Tue Jul 11 10:08:09 2023 +0300 net/sched: flower: Ensure both minimum and maximum ports are specified The kernel does not currently validate that both the minimum and maximum ports of a port range are specified. This can lead user space to think that a filter matching on a port range was successfully added, when in fact it was not. For example, with a patched (buggy) iproute2 that only sends the minimum port, the following commands do not return an error: # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp src_port 100-200 action pass # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp dst_port 100-200 action pass # tc filter show dev swp1 ingress filter protocol ip pref 1 flower chain 0 filter protocol ip pref 1 flower chain 0 handle 0x1 eth_type ipv4 ip_proto udp not_in_hw action order 1: gact action pass random type none pass val 0 index 1 ref 1 bind 1 filter protocol ip pref 1 flower chain 0 handle 0x2 eth_type ipv4 ip_proto udp not_in_hw action order 1: gact action pass random type none pass val 0 index 2 ref 1 bind 1 Fix by returning an error unless both ports are specified: # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp src_port 100-200 action pass Error: Both min and max source ports must be specified. We have an error talking to the kernel # tc filter add dev swp1 ingress pref 1 proto ip flower ip_proto udp dst_port 100-200 action pass Error: Both min and max destination ports must be specified. We have an error talking to the kernel Fixes: 5c72299fba9d ("net: sched: cls_flower: Classify packets using port ranges") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller commit b6c9ebde5a967f40fdc462b0c27eff7e31fe6c28 Merge: e522c1bd0ab4f 0bcc62858d6ba Author: David S. Miller Date: Wed Jul 12 10:07:24 2023 +0100 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== igc: Fix corner cases for TSN offload Florian Kauer says: The igc driver supports several different offloading capabilities relevant in the TSN context. Recent patches in this area introduced regressions for certain corner cases that are fixed in this series. Each of the patches (except the first one) addresses a different regression that can be separately reproduced. Still, they have overlapping code changes so they should not be separately applied. Especially #4 and #6 address the same observation, but both need to be applied to avoid TX hang occurrences in the scenario described in the patches. ==================== Signed-off-by: Florian Kauer Reviewed-by: Kurt Kanzenbach Acked-by: Vinicius Costa Gomes Reviewed-by: Muhammad Husaini Zulkifli Signed-off-by: Tony Nguyen Signed-off-by: David S. Miller commit e522c1bd0ab4f645885a3eef4e1dd920cc9ac3b6 Author: Andrew Halaney Date: Mon Jul 10 14:50:57 2023 -0500 MAINTAINERS: Add another mailing list for QUALCOMM ETHQOS ETHERNET DRIVER linux-arm-msm is the list most people subscribe to in order to receive updates about Qualcomm related drivers. Make sure changes for the Qualcomm ethernet driver make it there. Signed-off-by: Andrew Halaney Acked-by: Vinod Koul Link: https://lore.kernel.org/r/20230710195240.197047-1-ahalaney@redhat.com Signed-off-by: Jakub Kicinski commit cf28792facaa9c1c4f5a246d6a364761f7835870 Author: Jakub Kicinski Date: Mon Jul 10 10:46:36 2023 -0700 docs: netdev: update the URL of the status page Move the status page from vger to the same server as mailbot. Link: https://lore.kernel.org/r/20230710174636.1174684-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 12a89f0177092dbc2a1cb1d05a9790adbcea2309 Author: Johannes Berg Date: Mon Jul 10 16:50:39 2023 +0200 wifi: iwlwifi: remove 'use_tfh' config to fix crash This is equivalent to 'gen2', and it was always confusing to have two identical config entries. The split config patch actually had been originally developed after removing 'use_tfh" and didn't add the use_tfh in the new configs as they'd later been copied to the new files. Thus the easiest way to fix the init crash here now is to just remove use_tfh (which is erroneously unset in most of the configs now) and use 'gen2' in the code instead. There's possibly still an unwind error in iwl_txq_gen2_init() as it crashes if TXQ 0 fails to initialize, but we can deal with it later since the original failure is due to the use_tfh confusion. Tested-by: Xi Ruoyao Reported-and-tested-by: Niklāvs Koļesņikovs Reported-and-tested-by: Jeff Chua Reported-and-tested-by: Zhang Rui Link: https://bugzilla.kernel.org/show_bug.cgi?id=217622 Link: https://lore.kernel.org/all/9274d9bd3d080a457649ff5addcc1726f08ef5b2.camel@xry111.site/ Link: https://lore.kernel.org/all/CAAJw_Zug6VCS5ZqTWaFSr9sd85k%3DtyPm9DEE%2BmV%3DAKoECZM%2BsQ@mail.gmail.com/ Fixes: 19898ce9cf8a ("wifi: iwlwifi: split 22000.c into multiple files") Signed-off-by: Johannes Berg Link: https://lore.kernel.org/r/20230710145038.84186-2-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 2e06c57d66d3f6c26faa5f5b479fb3add34ce85a Author: Larysa Zaremba Date: Tue Jul 11 12:59:26 2023 +0200 xdp: use trusted arguments in XDP hints kfuncs Currently, verifier does not reject XDP programs that pass NULL pointer to hints functions. At the same time, this case is not handled in any driver implementation (including veth). For example, changing bpf_xdp_metadata_rx_timestamp(ctx, ×tamp); to bpf_xdp_metadata_rx_timestamp(ctx, NULL); in xdp_metadata test successfully crashes the system. Add KF_TRUSTED_ARGS flag to hints kfunc definitions, so driver code does not have to worry about getting invalid pointers. Fixes: 3d76a4d3d4e5 ("bpf: XDP metadata RX kfuncs") Reported-by: Stanislav Fomichev Closes: https://lore.kernel.org/bpf/ZKWo0BbpLfkZHbyE@google.com/ Signed-off-by: Larysa Zaremba Acked-by: Jesper Dangaard Brouer Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/20230711105930.29170-1-larysa.zaremba@intel.com Signed-off-by: Alexei Starovoitov commit 4369016497319a9635702da010d02af1ebb1849d Author: Pu Lehui Date: Tue Jul 11 19:58:48 2023 +0800 bpf: cpumap: Fix memory leak in cpu_map_update_elem Syzkaller reported a memory leak as follows: BUG: memory leak unreferenced object 0xff110001198ef748 (size 192): comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s) hex dump (first 32 bytes): 00 00 00 00 4a 19 00 00 80 ad e3 e4 fe ff c0 00 ....J........... 00 b2 d3 0c 01 00 11 ff 28 f5 8e 19 01 00 11 ff ........(....... backtrace: [] __cpu_map_entry_alloc+0xf7/0xb00 [] cpu_map_update_elem+0x2fe/0x3d0 [] bpf_map_update_value.isra.0+0x2bd/0x520 [] map_update_elem+0x4cb/0x720 [] __se_sys_bpf+0x8c3/0xb90 [] do_syscall_64+0x30/0x40 [] entry_SYSCALL_64_after_hwframe+0x61/0xc6 BUG: memory leak unreferenced object 0xff110001198ef528 (size 192): comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] __cpu_map_entry_alloc+0x260/0xb00 [] cpu_map_update_elem+0x2fe/0x3d0 [] bpf_map_update_value.isra.0+0x2bd/0x520 [] map_update_elem+0x4cb/0x720 [] __se_sys_bpf+0x8c3/0xb90 [] do_syscall_64+0x30/0x40 [] entry_SYSCALL_64_after_hwframe+0x61/0xc6 BUG: memory leak unreferenced object 0xff1100010fd93d68 (size 8): comm "syz-executor.3", pid 17672, jiffies 4298118891 (age 9.906s) hex dump (first 8 bytes): 00 00 00 00 00 00 00 00 ........ backtrace: [] kvmalloc_node+0x11e/0x170 [] __cpu_map_entry_alloc+0x2f0/0xb00 [] cpu_map_update_elem+0x2fe/0x3d0 [] bpf_map_update_value.isra.0+0x2bd/0x520 [] map_update_elem+0x4cb/0x720 [] __se_sys_bpf+0x8c3/0xb90 [] do_syscall_64+0x30/0x40 [] entry_SYSCALL_64_after_hwframe+0x61/0xc6 In the cpu_map_update_elem flow, when kthread_stop is called before calling the threadfn of rcpu->kthread, since the KTHREAD_SHOULD_STOP bit of kthread has been set by kthread_stop, the threadfn of rcpu->kthread will never be executed, and rcpu->refcnt will never be 0, which will lead to the allocated rcpu, rcpu->queue and rcpu->queue->queue cannot be released. Calling kthread_stop before executing kthread's threadfn will return -EINTR. We can complete the release of memory resources in this state. Fixes: 6710e1126934 ("bpf: introduce new bpf cpu map type BPF_MAP_TYPE_CPUMAP") Signed-off-by: Pu Lehui Acked-by: Jesper Dangaard Brouer Acked-by: Hou Tao Link: https://lore.kernel.org/r/20230711115848.2701559-1-pulehui@huaweicloud.com Signed-off-by: Alexei Starovoitov commit 9373771aaed17f5c2c38485f785568abe3a9f8c1 Author: Randy Dunlap Date: Sun Jul 9 06:31:54 2023 -0700 wifi: airo: avoid uninitialized warning in airo_get_rate() Quieten a gcc (11.3.0) build error or warning by checking the function call status and returning -EBUSY if the function call failed. This is similar to what several other wireless drivers do for the SIOCGIWRATE ioctl call when there is a locking problem. drivers/net/wireless/cisco/airo.c: error: 'status_rid.currentXmitRate' is used uninitialized [-Werror=uninitialized] Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Randy Dunlap Reported-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/39abf2c7-24a-f167-91da-ed4c5435d1c4@linux-m68k.org Link: https://lore.kernel.org/r/20230709133154.26206-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit 0bb8f49cd2cc8cb32ac51189ff9fcbe7ec3d9d65 Author: Rob Herring Date: Mon Jul 10 11:40:07 2023 -0600 of: Preserve "of-display" device name for compatibility Since commit 241d2fb56a18 ("of: Make OF framebuffer device names unique"), as spotted by Frédéric Bonnard, the historical "of-display" device is gone: the updated logic creates "of-display.0" instead, then as many "of-display.N" as required. This means that offb no longer finds the expected device, which prevents the Debian Installer from setting up its interface, at least on ppc64el. Fix this by keeping "of-display" for the first device and "of-display.N" for subsequent devices. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217328 Link: https://bugs.debian.org/1033058 Fixes: 241d2fb56a18 ("of: Make OF framebuffer device names unique") Cc: stable@vger.kernel.org Cc: Cyril Brulebois Cc: Thomas Zimmermann Cc: Helge Deller Acked-by: Helge Deller Acked-by: Thomas Zimmermann Reviewed-by: Michal Suchánek Link: https://lore.kernel.org/r/20230710174007.2291013-1-robh@kernel.org Signed-off-by: Rob Herring commit b2ec116aad38aa9c8b67fad4314e50823adf6949 Author: Geert Uytterhoeven Date: Tue Jul 11 12:38:20 2023 +0200 workqueue: Fix cpu_intensive_thresh_us name in help text There exists no parameter called "cpu_intensive_threshold_us". The actual parameter name is "cpu_intensive_thresh_us". Fixes: 6363845005202148 ("workqueue: Report work funcs that trigger automatic CPU_INTENSIVE mechanism") Signed-off-by: Geert Uytterhoeven Reviewed-by: Randy Dunlap Signed-off-by: Tejun Heo commit 5fc52248559802f0f1ac10b3c8729a1568216715 Author: Petr Pavlu Date: Tue Jul 11 14:50:54 2023 +0200 vmlinux.lds.h: Remove a reference to no longer used sections .text..refcount Sections .text..refcount were previously used to hold an error path code for fast refcount overflow protection on x86, see commit 7a46ec0e2f48 ("locking/refcounts, x86/asm: Implement fast refcount overflow protection") and commit 564c9cc84e2a ("locking/refcounts, x86/asm: Use unique .text section for refcount exceptions"). The code was replaced and removed in commit fb041bb7c0a9 ("locking/refcount: Consolidate implementations of refcount_t") and no sections .text..refcount are present since then. Remove then a relic referencing these sections from TEXT_TEXT to avoid confusing people, like me. This is a non-functional change. Signed-off-by: Petr Pavlu Link: https://lore.kernel.org/r/20230711125054.9000-1-petr.pavlu@suse.com Signed-off-by: Kees Cook commit db66795f61354c373ecdadbdae1ed253a96c47cb Author: Dinh Nguyen Date: Tue Jul 11 15:44:30 2023 -0500 arm64: dts: stratix10: fix incorrect I2C property for SCL signal The correct dts property for the SCL falling time is "i2c-scl-falling-time-ns". Fixes: c8da1d15b8a4 ("arm64: dts: stratix10: i2c clock running out of spec") Cc: stable@vger.kernel.org Signed-off-by: Dinh Nguyen commit 4b96679170c63be361d1b0fdeb81bb0ef207dbcb Author: Ian Rogers Date: Fri Jul 7 16:09:26 2023 -0700 libsubcmd: Avoid SEGV/use-after-free when commands aren't excluded The array shortening may perform unnecessary array copies. Before commit 657a3efee43a ("lib subcmd: Avoid memory leak in exclude_cmds") this was benign, but afterwards this could lead to a SEGV. Fixes: 657a3efee43a29d1 ("lib subcmd: Avoid memory leak in exclude_cmds") Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Chenyuan Mi Cc: Ian Rogers Link: https://lore.kernel.org/r/20230707230926.841086-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo commit 970dee09b230895fe2230d2b32ad05a2826818c6 Author: Marc Zyngier Date: Mon Jul 3 17:35:48 2023 +0100 KVM: arm64: Disable preemption in kvm_arch_hardware_enable() Since 0bf50497f03b ("KVM: Drop kvm_count_lock and instead protect kvm_usage_count with kvm_lock"), hotplugging back a CPU whilst a guest is running results in a number of ugly splats as most of this code expects to run with preemption disabled, which isn't the case anymore. While the context is preemptable, it isn't migratable, which should be enough. But we have plenty of preemptible() checks all over the place, and our per-CPU accessors also disable preemption. Since this affects released versions, let's do the easy fix first, disabling preemption in kvm_arch_hardware_enable(). We can always revisit this with a more invasive fix in the future. Fixes: 0bf50497f03b ("KVM: Drop kvm_count_lock and instead protect kvm_usage_count with kvm_lock") Reported-by: Kristina Martsenko Tested-by: Kristina Martsenko Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/aeab7562-2d39-e78e-93b1-4711f8cc3fa5@arm.com Cc: stable@vger.kernel.org # v6.3, v6.4 Link: https://lore.kernel.org/r/20230703163548.1498943-1-maz@kernel.org Signed-off-by: Oliver Upton commit fa729bc7c9c8c17a2481358c841ef8ca920485d3 Author: Sudeep Holla Date: Tue Jul 4 20:32:43 2023 +0100 KVM: arm64: Handle kvm_arm_init failure correctly in finalize_pkvm Currently there is no synchronisation between finalize_pkvm() and kvm_arm_init() initcalls. The finalize_pkvm() proceeds happily even if kvm_arm_init() fails resulting in the following warning on all the CPUs and eventually a HYP panic: | kvm [1]: IPA Size Limit: 48 bits | kvm [1]: Failed to init hyp memory protection | kvm [1]: error initializing Hyp mode: -22 | | | | WARNING: CPU: 0 PID: 0 at arch/arm64/kvm/pkvm.c:226 _kvm_host_prot_finalize+0x30/0x50 | Modules linked in: | CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0 #237 | Hardware name: FVP Base RevC (DT) | pstate: 634020c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) | pc : _kvm_host_prot_finalize+0x30/0x50 | lr : __flush_smp_call_function_queue+0xd8/0x230 | | Call trace: | _kvm_host_prot_finalize+0x3c/0x50 | on_each_cpu_cond_mask+0x3c/0x6c | pkvm_drop_host_privileges+0x4c/0x78 | finalize_pkvm+0x3c/0x5c | do_one_initcall+0xcc/0x240 | do_initcall_level+0x8c/0xac | do_initcalls+0x54/0x94 | do_basic_setup+0x1c/0x28 | kernel_init_freeable+0x100/0x16c | kernel_init+0x20/0x1a0 | ret_from_fork+0x10/0x20 | Failed to finalize Hyp protection: -22 | dtb=fvp-base-revc.dtb | kvm [95]: nVHE hyp BUG at: arch/arm64/kvm/hyp/nvhe/mem_protect.c:540! | kvm [95]: nVHE call trace: | kvm [95]: [] __kvm_nvhe_hyp_panic+0xac/0xf8 | kvm [95]: [] __kvm_nvhe_handle_host_mem_abort+0x1a0/0x2ac | kvm [95]: [] __kvm_nvhe_handle_trap+0x4c/0x160 | kvm [95]: [] __kvm_nvhe___skip_pauth_save+0x4/0x4 | kvm [95]: ---[ end nVHE call trace ]--- | kvm [95]: Hyp Offset: 0xfffe8db00ffa0000 | Kernel panic - not syncing: HYP panic: | PS:a34023c9 PC:0000f250710b973c ESR:00000000f2000800 | FAR:ffff000800cb00d0 HPFAR:000000000880cb00 PAR:0000000000000000 | VCPU:0000000000000000 | CPU: 3 PID: 95 Comm: kworker/u16:2 Tainted: G W 6.4.0 #237 | Hardware name: FVP Base RevC (DT) | Workqueue: rpciod rpc_async_schedule | Call trace: | dump_backtrace+0xec/0x108 | show_stack+0x18/0x2c | dump_stack_lvl+0x50/0x68 | dump_stack+0x18/0x24 | panic+0x138/0x33c | nvhe_hyp_panic_handler+0x100/0x184 | new_slab+0x23c/0x54c | ___slab_alloc+0x3e4/0x770 | kmem_cache_alloc_node+0x1f0/0x278 | __alloc_skb+0xdc/0x294 | tcp_stream_alloc_skb+0x2c/0xf0 | tcp_sendmsg_locked+0x3d0/0xda4 | tcp_sendmsg+0x38/0x5c | inet_sendmsg+0x44/0x60 | sock_sendmsg+0x1c/0x34 | xprt_sock_sendmsg+0xdc/0x274 | xs_tcp_send_request+0x1ac/0x28c | xprt_transmit+0xcc/0x300 | call_transmit+0x78/0x90 | __rpc_execute+0x114/0x3d8 | rpc_async_schedule+0x28/0x48 | process_one_work+0x1d8/0x314 | worker_thread+0x248/0x474 | kthread+0xfc/0x184 | ret_from_fork+0x10/0x20 | SMP: stopping secondary CPUs | Kernel Offset: 0x57c5cb460000 from 0xffff800080000000 | PHYS_OFFSET: 0x80000000 | CPU features: 0x00000000,1035b7a3,ccfe773f | Memory Limit: none | ---[ end Kernel panic - not syncing: HYP panic: | PS:a34023c9 PC:0000f250710b973c ESR:00000000f2000800 | FAR:ffff000800cb00d0 HPFAR:000000000880cb00 PAR:0000000000000000 | VCPU:0000000000000000 ]--- Fix it by checking for the successfull initialisation of kvm_arm_init() in finalize_pkvm() before proceeding any futher. Fixes: 87727ba2bb05 ("KVM: arm64: Ensure CPU PMU probes before pKVM host de-privilege") Cc: Will Deacon Cc: Marc Zyngier Cc: Oliver Upton Cc: James Morse Cc: Suzuki K Poulose Cc: Zenghui Yu Signed-off-by: Sudeep Holla Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20230704193243.3300506-1-sudeep.holla@arm.com Signed-off-by: Oliver Upton commit fe769e6c1f80f542d6f4e7f7c8c6bf20c1307f99 Author: Marc Zyngier Date: Tue Jun 27 15:05:57 2023 +0100 KVM: arm64: timers: Use CNTHCTL_EL2 when setting non-CNTKCTL_EL1 bits It recently appeared that, when running VHE, there is a notable difference between using CNTKCTL_EL1 and CNTHCTL_EL2, despite what the architecture documents: - When accessed from EL2, bits [19:18] and [16:10] of CNTKCTL_EL1 have the same assignment as CNTHCTL_EL2 - When accessed from EL1, bits [19:18] and [16:10] are RES0 It is all OK, until you factor in NV, where the EL2 guest runs at EL1. In this configuration, CNTKCTL_EL11 doesn't trap, nor ends up in the VNCR page. This means that any write from the guest affecting CNTHCTL_EL2 using CNTKCTL_EL1 ends up losing some state. Not good. The fix it obvious: don't use CNTKCTL_EL1 if you want to change bits that are not part of the EL1 definition of CNTKCTL_EL1, and use CNTHCTL_EL2 instead. This doesn't change anything for a bare-metal OS, and fixes it when running under NV. The NV hypervisor will itself have to work harder to merge the two accessors. Note that there is a pending update to the architecture to address this issue by making the affected bits UNKNOWN when CNTKCTL_EL1 is used from EL2 with VHE enabled. Fixes: c605ee245097 ("KVM: arm64: timers: Allow physical offset without CNTPOFF_EL2") Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org # v6.4 Reviewed-by: Eric Auger Link: https://lore.kernel.org/r/20230627140557.544885-1-maz@kernel.org Signed-off-by: Oliver Upton commit 3a8395b565b5b4f019b3dc182be4c4541eb35ac8 Author: Chungkai Yang Date: Wed Jul 5 16:59:07 2023 +0800 PM: QoS: Restore support for default value on frequency QoS Commit 8d36694245f2 ("PM: QoS: Add check to make sure CPU freq is non-negative") makes sure CPU freq is non-negative to avoid negative value converting to unsigned data type. However, when the value is PM_QOS_DEFAULT_VALUE, pm_qos_update_target specifically uses c->default_value which is set to FREQ_QOS_MIN/MAX_DEFAULT_VALUE when cpufreq_policy_alloc is executed, for this case handling. Adding check for PM_QOS_DEFAULT_VALUE to let default setting work will fix this problem. Fixes: 8d36694245f2 ("PM: QoS: Add check to make sure CPU freq is non-negative") Link: https://lore.kernel.org/lkml/20230626035144.19717-1-Chung-kai.Yang@mediatek.com/ Link: https://lore.kernel.org/lkml/20230627071727.16646-1-Chung-kai.Yang@mediatek.com/ Link: https://lore.kernel.org/lkml/CAJZ5v0gxNOWhC58PHeUhW_tgf6d1fGJVZ1x91zkDdht11yUv-A@mail.gmail.com/ Signed-off-by: Chungkai Yang Cc: 6.0+ # 6.0+ Signed-off-by: Rafael J. Wysocki commit c9e4bf607d8c431452ef362c00e62ce999bbae93 Author: Azat Khuzhin Date: Tue Jul 11 13:48:12 2023 +0200 PM: hibernate: Fix writing maj:min to /sys/power/resume resume_store() first calls lookup_bdev() and after tries to handle maj:min, but it does not reset the error before, hence if you will write maj:min you will get ENOENT: # echo 259:2 >| /sys/power/resume bash: echo: write error: No such file or directory This also should fix hiberation via systemd, since it uses this way. Fixes: 1e8c813b083c4 ("PM: hibernate: don't use early_lookup_bdev in resume_store") Signed-off-by: Azat Khuzhin Reviewed-by: Christoph Hellwig [ rjw: Subject edits ] Signed-off-by: Rafael J. Wysocki commit d6e724d3ef0b37aa425267921100c89e378eb4a9 Author: Palmer Dabbelt Date: Mon Jul 10 12:33:30 2023 -0700 Documentation: RISC-V: hwprobe: Fix a formatting error I'm not sure what I was trying to do with the ':'s, but they're just rendered to HTML which looks odd. This makes "fence.i" look like "mvendorid" and such, which is seems reasonable to me. Reviewed-by: Evan Green Link: https://lore.kernel.org/r/20230710193329.2742-1-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit 18bddc5b67038722cb88fcf51fbf41a0277092cb Author: Xin Yin Date: Tue Jul 11 14:21:30 2023 +0800 erofs: fix fsdax unavailability for chunk-based regular files DAX can be used to share page cache between VMs, reducing guest memory overhead. And chunk based data format is widely used for VM and container image. So enable dax support for it, make erofs better used for VM scenarios. Fixes: c5aa903a59db ("erofs: support reading chunk-based uncompressed files") Signed-off-by: Xin Yin Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230711062130.7860-1-yinxin.x@bytedance.com Signed-off-by: Gao Xiang commit 8191213a5835b0317c5e4d0d337ae1ae00c75253 Author: Chunhai Guo Date: Mon Jul 10 17:34:10 2023 +0800 erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF z_erofs_do_read_page() may loop infinitely due to the inappropriate truncation in the below statement. Since the offset is 64 bits and min_t() truncates the result to 32 bits. The solution is to replace unsigned int with a 64-bit type, such as erofs_off_t. cur = end - min_t(unsigned int, offset + end - map->m_la, end); - For example: - offset = 0x400160000 - end = 0x370 - map->m_la = 0x160370 - offset + end - map->m_la = 0x400000000 - offset + end - map->m_la = 0x00000000 (truncated as unsigned int) - Expected result: - cur = 0 - Actual result: - cur = 0x370 Signed-off-by: Chunhai Guo Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support") Reviewed-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230710093410.44071-1-guochunhai@vivo.com Signed-off-by: Gao Xiang commit 936aa701d82d397c2d1afcd18ce2c739471d978d Author: Chunhai Guo Date: Mon Jul 10 12:25:31 2023 +0800 erofs: avoid useless loops in z_erofs_pcluster_readmore() when reading beyond EOF z_erofs_pcluster_readmore() may take a long time to loop when the page offset is large enough, which is unnecessary should be prevented. For example, when the following case is encountered, it will loop 4691368 times, taking about 27 seconds: - offset = 19217289215 - inode_size = 1442672 Signed-off-by: Chunhai Guo Fixes: 386292919c25 ("erofs: introduce readmore decompression strategy") Reviewed-by: Gao Xiang Reviewed-by: Yue Hu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230710042531.28761-1-guochunhai@vivo.com Signed-off-by: Gao Xiang commit c5539762f32e97c5e16215fa1336e32095b8b0fd Author: Gao Xiang Date: Wed Jun 28 00:12:40 2023 +0800 erofs: simplify z_erofs_transform_plain() Use memcpy_to_page() instead of open-coding them. In addition, add a missing flush_dcache_page() even though almost all modern architectures clear `PG_dcache_clean` flag for new file cache pages so that it doesn't change anything in practice. Signed-off-by: Gao Xiang Reviewed-by: Yue Hu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230627161240.331-2-hsiangkao@linux.alibaba.com Signed-off-by: Gao Xiang commit 123ec246ebe323d468c5ca996700ea4739d20ddf Author: Gao Xiang Date: Wed Jun 28 00:12:39 2023 +0800 erofs: get rid of the remaining kmap_atomic() It's unnecessary to use kmap_atomic() compared with kmap_local_page(). In addition, kmap_atomic() is deprecated now. Signed-off-by: Gao Xiang Reviewed-by: Yue Hu Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20230627161240.331-1-hsiangkao@linux.alibaba.com Signed-off-by: Gao Xiang commit f4d1a8e011909fee24643f84bd1196e1366c26f2 Author: Michael Kelley Date: Fri Jul 7 21:01:26 2023 -0700 scsi: storvsc: Handle SRB status value 0x30 In response to a disk I/O request, Hyper-V has been observed to return SRB status value 0x30. This indicates the request was not processed by Hyper-V because low memory conditions on the host caused an internal error. The 0x30 status is not recognized by storvsc, so the I/O operation is not flagged as an error. The request is treated as if it completed normally but with zero data transferred, causing a flood of retries. Add a definition for this SRB status value and handle it like other error statuses from the Hyper-V host. Signed-off-by: Michael Kelley Link: https://lore.kernel.org/r/1688788886-94279-1-git-send-email-mikelley@microsoft.com Signed-off-by: Martin K. Petersen commit ad07149f34dbb3e0f4e25e19ef80bdd3216ba1cf Author: Arnaldo Carvalho de Melo Date: Tue Jul 11 13:23:02 2023 -0300 tools headers UAPI: Sync linux/prctl.h with the kernel sources To pick the changes in: 1fd96a3e9d5d4feb ("riscv: Add prctl controls for userspace vector management") That adds some RISC-V specific prctl options: $ tools/perf/trace/beauty/prctl_option.sh > before $ cp include/uapi/linux/prctl.h tools/include/uapi/linux/prctl.h $ tools/perf/trace/beauty/prctl_option.sh > after $ diff -u before after --- before 2023-07-11 13:22:01.928705942 -0300 +++ after 2023-07-11 13:22:36.342645970 -0300 @@ -63,6 +63,8 @@ [66] = "GET_MDWE", [67] = "SET_MEMORY_MERGE", [68] = "GET_MEMORY_MERGE", + [69] = "RISCV_V_SET_CONTROL", + [70] = "RISCV_V_GET_CONTROL", }; static const char *prctl_set_mm_options[] = { [1] = "START_CODE", $ That now will be used to decode the syscall option and also to compose filters, for instance: [root@five ~]# perf trace -e syscalls:sys_enter_prctl --filter option==SET_NAME 0.000 Isolated Servi/3474327 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23f13b7aee) 0.032 DOM Worker/3474327 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23deb25670) 7.920 :3474328/3474328 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24fbb10) 7.935 StreamT~s #374/3474328 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24fb970) 8.400 Isolated Servi/3474329 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24bab10) 8.418 StreamT~s #374/3474329 syscalls:sys_enter_prctl(option: SET_NAME, arg2: 0x7f23e24ba970) ^C[root@five ~]# This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/prctl.h include/uapi/linux/prctl.h Cc: Adrian Hunter Cc: Andy Chiu Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Palmer Dabbelt Link: https://lore.kernel.org/lkml/ZK2DhOB6JJKu2A7M@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit a87834d19aa2bf455e2fd9309ef4754eccd8459a Author: Thomas Richter Date: Tue Jul 11 15:53:38 2023 +0200 perf build: Fix broken feature check for libtracefs due to external lib changes The perf build process auto-detects features and packages already installed for its build. This is done in directory tools/build/feature. This directory contains small sample programs. When they successfully compile the necessary prereqs in form of libraries and header files are present. Such a check is also done for libtracefs. And this check fails: Output before: # rm -f test-libtracefs.bin; make test-libtracefs.bin gcc -MD -Wall -Werror -o test-libtracefs.bin test-libtracefs.c \ > test-libtracefs.make.output 2>&1 -ltracefs make: *** [Makefile:211: test-libtracefs.bin] Error 1 # cat test-libtracefs.make.output In file included from test-libtracefs.c:2: /usr/include/tracefs/tracefs.h:11:10: fatal error: \ event-parse.h: No such file or directory 11 | #include | ^~~~~~~~~~~~~~~ compilation terminated. # The root cause of this compile error is commit 880885d9c22e ("libtracefs: Remove "traceevent/" from referencing libtraceevent headers") in the libtracefs project hosted here: https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git/ That mentioned patch removes the traceevent/ directory name from the include statement, causing the file not to be included even when the libtraceevent-devel package is installed. This package contains the file referred to in tracefs/tracefs.h: # rpm -ql libtraceevent-devel /usr/include/traceevent /usr/include/traceevent/event-parse.h <----- here /usr/include/traceevent/event-utils.h /usr/include/traceevent/kbuffer.h /usr/include/traceevent/trace-seq.h /usr/lib64/libtraceevent.so /usr/lib64/pkgconfig/libtraceevent.pc # With this patch the compile succeeds. Output after: # rm -f test-libtracefs.bin; make test-libtracefs.bin gcc -MD -Wall -Werror -o test-libtracefs.bin test-libtracefs.c \ > test-libtracefs.make.output 2>&1 -I/usr/include/traceevent -ltracefs # Committer testing: $ make -k BUILD_BPF_SKEL=1 CORESIGHT=1 O=/tmp/build/perf-tools -C tools/perf install-bin Before: $ cat /tmp/build/perf-tools/feature/test-libtracefs.make.output In file included from test-libtracefs.c:2: /usr/include/tracefs/tracefs.h:11:10: fatal error: event-parse.h: No such file or directory 11 | #include | ^~~~~~~~~~~~~~~ compilation terminated. $ $ grep -i tracefs /tmp/build/perf-tools/FEATURE-DUMP feature-libtracefs=0 $ After: $ cat /tmp/build/perf-tools/feature/test-libtracefs.make.output $ $ grep -i tracefs /tmp/build/perf-tools/FEATURE-DUMP feature-libtracefs=1 $ Signed-off-by: Thomas Richter Tested-by: Arnaldo Carvalho de Melo Cc: Heiko Carstens Cc: Jiri Olsa Cc: Steven Rostedt (VMware) Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Vasily Gorbik Link: https://lore.kernel.org/r/20230711135338.397473-1-tmricht@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo commit e96277a570cda96f1363a051b6a1a321f2ec2d35 Merge: 06c2afb862f9d a97ccaa4f0439 Author: Martin K. Petersen Date: Tue Jul 11 12:15:15 2023 -0400 Merge branch '6.5/scsi-staging' into 6.5/scsi-fixes Pull in the currently staged SCSI fixes for 6.5. Signed-off-by: Martin K. Petersen commit 920b91d92702784f34b7c70b86ca051ba1c94430 Author: Arnaldo Carvalho de Melo Date: Tue Jul 11 12:51:37 2023 -0300 tools include UAPI: Sync linux/mount.h copy with the kernel sources To pick the changes from: 6ac392815628f317 ("fs: allow to mount beneath top mount") That, after a fix to the move_mount_flags.sh script, harvests the new MOVE_MOUNT_BENEATH move_mount flag: $ tools/perf/trace/beauty/move_mount_flags.sh > before $ cp include/uapi/linux/mount.h tools/include/uapi/linux/mount.h $ tools/perf/trace/beauty/move_mount_flags.sh > after $ $ diff -u before after --- before 2023-07-11 12:38:49.244886707 -0300 +++ after 2023-07-11 12:51:15.125255940 -0300 @@ -6,4 +6,5 @@ [ilog2(0x00000020) + 1] = "T_AUTOMOUNTS", [ilog2(0x00000040) + 1] = "T_EMPTY_PATH", [ilog2(0x00000100) + 1] = "SET_GROUP", + [ilog2(0x00000200) + 1] = "BENEATH", }; $ That will then be properly decoded when used in tools like: # perf trace -e move_mount This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/mount.h include/uapi/linux/mount.h Cc: Christian Brauner Cc: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/ZK17kifP%2FiYl+Hcc@kernel.org/ Signed-off-by: Arnaldo Carvalho de Melo commit 225bbf44bffd30dfde7449c9e74b3ea238397113 Author: Arnaldo Carvalho de Melo Date: Tue Jul 11 12:33:30 2023 -0300 tools headers UAPI: Sync linux/kvm.h with the kernel sources To pick the changes in: 89d01306e34d6ace ("RISC-V: KVM: Implement device interface for AIA irqchip") 22725266bdf95bdd ("KVM: Fix comment for KVM_ENABLE_CAP") 2f440b72e852be42 ("KVM: arm64: Add KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE") That just rebuilds perf, as these patches don't add any new KVM ioctl to be harvested for the the 'perf trace' ioctl syscall argument beautifiers. This addresses this perf build warning: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h Cc: Adrian Hunter Cc: Anup Patel Cc: Binbin Wu Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Oliver Upton Cc: Ricardo Koller Cc: Sean Christopherson Link: https://lore.kernel.org/lkml/ZK12+virXMIXMysy@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 0657b20c5a76c938612f8409735a8830d257866e Author: Filipe Manana Date: Wed Jun 28 17:13:37 2023 +0100 btrfs: fix use-after-free of new block group that became unused If a task creates a new block group and that block group becomes unused before we finish its creation, at btrfs_create_pending_block_groups(), then when btrfs_mark_bg_unused() is called against the block group, we assume that the block group is currently in the list of block groups to reclaim, and we move it out of the list of new block groups and into the list of unused block groups. This has two consequences: 1) We move it out of the list of new block groups associated to the current transaction. So the block group creation is not finished and if we attempt to delete the bg because it's unused, we will not find the block group item in the extent tree (or the new block group tree), its device extent items in the device tree etc, resulting in the deletion to fail due to the missing items; 2) We don't increment the reference count on the block group when we move it to the list of unused block groups, because we assumed the block group was on the list of block groups to reclaim, and in that case it already has the correct reference count. However the block group was on the list of new block groups, in which case no extra reference was taken because it's local to the current task. This later results in doing an extra reference count decrement when removing the block group from the unused list, eventually leading the reference count to 0. This second case was caught when running generic/297 from fstests, which produced the following assertion failure and stack trace: [589.559] assertion failed: refcount_read(&block_group->refs) == 1, in fs/btrfs/block-group.c:4299 [589.559] ------------[ cut here ]------------ [589.559] kernel BUG at fs/btrfs/block-group.c:4299! [589.560] invalid opcode: 0000 [#1] PREEMPT SMP PTI [589.560] CPU: 8 PID: 2819134 Comm: umount Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1 [589.560] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [589.560] RIP: 0010:btrfs_free_block_groups+0x449/0x4a0 [btrfs] [589.561] Code: 68 62 da c0 (...) [589.561] RSP: 0018:ffffa55a8c3b3d98 EFLAGS: 00010246 [589.561] RAX: 0000000000000058 RBX: ffff8f030d7f2000 RCX: 0000000000000000 [589.562] RDX: 0000000000000000 RSI: ffffffff953f0878 RDI: 00000000ffffffff [589.562] RBP: ffff8f030d7f2088 R08: 0000000000000000 R09: ffffa55a8c3b3c50 [589.562] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8f05850b4c00 [589.562] R13: ffff8f030d7f2090 R14: ffff8f05850b4cd8 R15: dead000000000100 [589.563] FS: 00007f497fd2e840(0000) GS:ffff8f09dfc00000(0000) knlGS:0000000000000000 [589.563] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [589.563] CR2: 00007f497ff8ec10 CR3: 0000000271472006 CR4: 0000000000370ee0 [589.563] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [589.564] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [589.564] Call Trace: [589.564] [589.565] ? __die_body+0x1b/0x60 [589.565] ? die+0x39/0x60 [589.565] ? do_trap+0xeb/0x110 [589.565] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs] [589.566] ? do_error_trap+0x6a/0x90 [589.566] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs] [589.566] ? exc_invalid_op+0x4e/0x70 [589.566] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs] [589.567] ? asm_exc_invalid_op+0x16/0x20 [589.567] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs] [589.567] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs] [589.567] close_ctree+0x35d/0x560 [btrfs] [589.568] ? fsnotify_sb_delete+0x13e/0x1d0 [589.568] ? dispose_list+0x3a/0x50 [589.568] ? evict_inodes+0x151/0x1a0 [589.568] generic_shutdown_super+0x73/0x1a0 [589.569] kill_anon_super+0x14/0x30 [589.569] btrfs_kill_super+0x12/0x20 [btrfs] [589.569] deactivate_locked_super+0x2e/0x70 [589.569] cleanup_mnt+0x104/0x160 [589.570] task_work_run+0x56/0x90 [589.570] exit_to_user_mode_prepare+0x160/0x170 [589.570] syscall_exit_to_user_mode+0x22/0x50 [589.570] ? __x64_sys_umount+0x12/0x20 [589.571] do_syscall_64+0x48/0x90 [589.571] entry_SYSCALL_64_after_hwframe+0x72/0xdc [589.571] RIP: 0033:0x7f497ff0a567 [589.571] Code: af 98 0e (...) [589.572] RSP: 002b:00007ffc98347358 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [589.572] RAX: 0000000000000000 RBX: 00007f49800b8264 RCX: 00007f497ff0a567 [589.572] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000557f558abfa0 [589.573] RBP: 0000557f558a6ba0 R08: 0000000000000000 R09: 00007ffc98346100 [589.573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [589.573] R13: 0000557f558abfa0 R14: 0000557f558a6cb0 R15: 0000557f558a6dd0 [589.573] [589.574] Modules linked in: dm_snapshot dm_thin_pool (...) [589.576] ---[ end trace 0000000000000000 ]--- Fix this by adding a runtime flag to the block group to tell that the block group is still in the list of new block groups, and therefore it should not be moved to the list of unused block groups, at btrfs_mark_bg_unused(), until the flag is cleared, when we finish the creation of the block group at btrfs_create_pending_block_groups(). Fixes: a9f189716cf1 ("btrfs: move out now unused BG from the reclaim list") CC: stable@vger.kernel.org # 5.15+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 4e7de35eb7d1a1d4f2dda15f39fbedd4798a0b8d Author: Christoph Hellwig Date: Tue Jun 27 08:13:23 2023 +0200 btrfs: be a bit more careful when setting mirror_num_ret in btrfs_map_block The mirror_num_ret is allowed to be NULL, although it has to be set when smap is set. Unfortunately that is not a well enough specifiable invariant for static type checkers, so add a NULL check to make sure they are fine. Fixes: 03793cbbc80f ("btrfs: add fast path for single device io in __btrfs_map_block") Reported-by: Dan Carpenter Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Reviewed-by: David Sterba Signed-off-by: David Sterba commit b19c98f237cd76981aaded52c258ce93f7daa8cb Author: Josef Bacik Date: Fri Jun 23 01:05:41 2023 -0400 btrfs: fix race between balance and cancel/pause Syzbot reported a panic that looks like this: assertion failed: fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE_PAUSED, in fs/btrfs/ioctl.c:465 ------------[ cut here ]------------ kernel BUG at fs/btrfs/messages.c:259! RIP: 0010:btrfs_assertfail+0x2c/0x30 fs/btrfs/messages.c:259 Call Trace: btrfs_exclop_balance fs/btrfs/ioctl.c:465 [inline] btrfs_ioctl_balance fs/btrfs/ioctl.c:3564 [inline] btrfs_ioctl+0x531e/0x5b30 fs/btrfs/ioctl.c:4632 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The reproducer is running a balance and a cancel or pause in parallel. The way balance finishes is a bit wonky, if we were paused we need to save the balance_ctl in the fs_info, but clear it otherwise and cleanup. However we rely on the return values being specific errors, or having a cancel request or no pause request. If balance completes and returns 0, but we have a pause or cancel request we won't do the appropriate cleanup, and then the next time we try to start a balance we'll trip this ASSERT. The error handling is just wrong here, we always want to clean up, unless we got -ECANCELLED and we set the appropriate pause flag in the exclusive op. With this patch the reproducer ran for an hour without tripping, previously it would trip in less than a few minutes. Reported-by: syzbot+c0f3acf145cb465426d5@syzkaller.appspotmail.com CC: stable@vger.kernel.org # 6.1+ Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit 48fa42c94547d80586db4eae8c1f5d0592f18ebd Author: Arnaldo Carvalho de Melo Date: Tue Jul 11 12:23:53 2023 -0300 tools headers uapi: Sync linux/fcntl.h with the kernel sources To get the changes in: 96b2b072ee62be8a ("exportfs: allow exporting non-decodeable file handles to userspace") That don't add anything that is handled by existing hard coded tables or table generation scripts. This silences this perf build warning: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/fcntl.h include/uapi/linux/fcntl.h Cc: Adrian Hunter Cc: Amir Goldstein Cc: Ian Rogers Cc: Jan Kara Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/lkml/ZK11P5AwRBUxxutI@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 8d40f74ebf217d3b9e9b7481721e6236b857cc55 Author: Sandipan Das Date: Thu Jul 6 12:04:40 2023 +0530 perf vendor events amd: Fix large metrics There are cases where a metric requires more events than the number of available counters. E.g. AMD Zen, Zen 2 and Zen 3 processors have four data fabric counters but the "nps1_die_to_dram" metric has eight events. By default, the constituent events are placed in a group and since the events cannot be scheduled at the same time, the metric is not computed. The "all metrics" test also fails because of this. Use the NO_GROUP_EVENTS constraint for such metrics which anyway expect the user to run perf with "--metric-no-group". E.g. $ sudo perf test -v 101 Before: 101: perf all metrics test : --- start --- test child forked, pid 37131 Testing branch_misprediction_ratio Testing all_remote_links_outbound Testing nps1_die_to_dram Metric 'nps1_die_to_dram' not printed in: Error: Invalid event (dram_channel_data_controller_4) in per-thread mode, enable system wide with '-a'. Testing macro_ops_dispatched Testing all_l2_cache_accesses Testing all_l2_cache_hits Testing all_l2_cache_misses Testing ic_fetch_miss_ratio Testing l2_cache_accesses_from_l2_hwpf Testing l2_cache_misses_from_l2_hwpf Testing op_cache_fetch_miss_ratio Testing l3_read_miss_latency Testing l1_itlb_misses test child finished with -1 ---- end ---- perf all metrics test: FAILED! After: 101: perf all metrics test : --- start --- test child forked, pid 43766 Testing branch_misprediction_ratio Testing all_remote_links_outbound Testing nps1_die_to_dram Testing macro_ops_dispatched Testing all_l2_cache_accesses Testing all_l2_cache_hits Testing all_l2_cache_misses Testing ic_fetch_miss_ratio Testing l2_cache_accesses_from_l2_hwpf Testing l2_cache_misses_from_l2_hwpf Testing op_cache_fetch_miss_ratio Testing l3_read_miss_latency Testing l1_itlb_misses test child finished with 0 ---- end ---- perf all metrics test: Ok Reported-by: Ayush Jain Suggested-by: Ian Rogers Signed-off-by: Sandipan Das Acked-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ananth Narayan Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Santosh Shukla Link: https://lore.kernel.org/r/20230706063440.54189-1-sandipan.das@amd.com Signed-off-by: Arnaldo Carvalho de Melo commit 1feece2780ac2f8de45177fe53979726cee4b3d1 Author: James Clark Date: Fri Jul 7 16:45:46 2023 +0100 perf build: Fix library not found error when using CSLIBS -L only specifies the search path for libraries directly provided in the link line with -l. Because -lopencsd isn't specified, it's only linked because it's a dependency of -lopencsd_c_api. Dependencies like this are resolved using the default system search paths or -rpath-link=... rather than -L. This means that compilation only works if OpenCSD is installed to the system rather than provided with the CSLIBS (-L) option. This could be fixed by adding -Wl,-rpath-link=$(CSLIBS) but that is less conventional than just adding -lopencsd to the link line so that it uses -L. -lopencsd seems to have been removed in commit ed17b1914978eddb ("perf tools: Drop requirement for libstdc++.so for libopencsd check") because it was thought that there was a chance compilation would work even if it didn't exist, but I think that only applies to libstdc++ so there is no harm to add it back. libopencsd.so and libopencsd_c_api.so would always exist together. Testing ======= The following scenarios now all work: * Cross build with OpenCSD installed * Cross build using CSLIBS=... * Native build with OpenCSD installed * Native build using CSLIBS=... * Static cross build with OpenCSD installed * Static cross build with CSLIBS=... Committer testing: ⬢[acme@toolbox perf-tools]$ alias m alias m='make -k BUILD_BPF_SKEL=1 CORESIGHT=1 O=/tmp/build/perf-tools -C tools/perf install-bin && git status && perf test python ; perf record -o /dev/null sleep 0.01 ; perf stat --null sleep 0.01' ⬢[acme@toolbox perf-tools]$ ldd ~/bin/perf | grep csd libopencsd_c_api.so.1 => /lib64/libopencsd_c_api.so.1 (0x00007fd49c44e000) libopencsd.so.1 => /lib64/libopencsd.so.1 (0x00007fd49bd56000) ⬢[acme@toolbox perf-tools]$ cat /etc/redhat-release Fedora release 36 (Thirty Six) ⬢[acme@toolbox perf-tools]$ Fixes: ed17b1914978eddb ("perf tools: Drop requirement for libstdc++.so for libopencsd check") Reported-by: Radhey Shyam Pandey Signed-off-by: James Clark Tested-by: Arnaldo Carvalho de Melo Tested-by: Radhey Shyam Pandey Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Uwe Kleine-König Cc: coresight@lists.linaro.org Closes: https://lore.kernel.org/linux-arm-kernel/56905d7a-a91e-883a-b707-9d5f686ba5f1@arm.com/ Link: https://lore.kernel.org/all/36cc4dc6-bf4b-1093-1c0a-876e368af183@kleine-koenig.org/ Link: https://lore.kernel.org/r/20230707154546.456720-1-james.clark@arm.com Signed-off-by: Arnaldo Carvalho de Melo commit 9350a917913321c69edbfdfd204e0d2855cddd06 Author: Arnaldo Carvalho de Melo Date: Tue Jul 11 10:11:12 2023 -0300 tools headers UAPI: Sync files changed by new cachestat syscall with the kernel sources To pick the changes in these csets: cf264e1329fb0307 ("cachestat: implement cachestat syscall") That add support for this new syscall in tools such as 'perf trace'. For instance, this is now possible: # perf trace -e cachestat ^C[root@five ~]# # perf trace -v -e cachestat Using CPUID AuthenticAMD-25-21-0 event qualifier tracepoint filter: (common_pid != 3163687 && common_pid != 3147) && (id == 451) mmap size 528384B ^C[root@five ~] # perf trace -v -e *stat* --max-events=10 Using CPUID AuthenticAMD-25-21-0 event qualifier tracepoint filter: (common_pid != 3163713 && common_pid != 3147) && (id == 4 || id == 5 || id == 6 || id == 136 || id == 137 || id == 138 || id == 262 || id == 332 || id == 451) mmap size 528384B 0.000 ( 0.009 ms): Cache2 I/O/4544 statfs(pathname: 0x45635288, buf: 0x7f8745725b60) = 0 0.012 ( 0.003 ms): Cache2 I/O/4544 newfstatat(dfd: CWD, filename: 0x45635288, statbuf: 0x7f874569d250) = 0 0.036 ( 0.002 ms): Cache2 I/O/4544 newfstatat(dfd: 138, filename: 0x541b7093, statbuf: 0x7f87457256f0, flag: 4096) = 0 0.372 ( 0.006 ms): Cache2 I/O/4544 statfs(pathname: 0x45635288, buf: 0x7f8745725b10) = 0 0.379 ( 0.003 ms): Cache2 I/O/4544 newfstatat(dfd: CWD, filename: 0x45635288, statbuf: 0x7f874569d250) = 0 0.390 ( 0.002 ms): Cache2 I/O/4544 newfstatat(dfd: 138, filename: 0x541b7093, statbuf: 0x7f87457256a0, flag: 4096) = 0 0.609 ( 0.005 ms): Cache2 I/O/4544 statfs(pathname: 0x45635288, buf: 0x7f8745725b60) = 0 0.615 ( 0.003 ms): Cache2 I/O/4544 newfstatat(dfd: CWD, filename: 0x45635288, statbuf: 0x7f874569d250) = 0 0.625 ( 0.002 ms): Cache2 I/O/4544 newfstatat(dfd: 138, filename: 0x541b7093, statbuf: 0x7f87457256f0, flag: 4096) = 0 0.826 ( 0.005 ms): Cache2 I/O/4544 statfs(pathname: 0x45635288, buf: 0x7f8745725b10) = 0 # That is the filter expression attached to the raw_syscalls:sys_{enter,exit} tracepoints. $ find tools/perf/arch/ -name "syscall*tbl" | xargs grep -w sys_cachestat tools/perf/arch/mips/entry/syscalls/syscall_n64.tbl:451 n64 cachestat sys_cachestat tools/perf/arch/powerpc/entry/syscalls/syscall.tbl:451 common cachestat sys_cachestat tools/perf/arch/s390/entry/syscalls/syscall.tbl:451 common cachestat sys_cachestat sys_cachestat tools/perf/arch/x86/entry/syscalls/syscall_64.tbl:451 common cachestat sys_cachestat $ $ grep -w cachestat /tmp/build/perf-tools/arch/x86/include/generated/asm/syscalls_64.c [451] = "cachestat", $ This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/asm-generic/unistd.h include/uapi/asm-generic/unistd.h diff -u tools/include/uapi/linux/mman.h include/uapi/linux/mman.h diff -u tools/perf/arch/x86/entry/syscalls/syscall_64.tbl arch/x86/entry/syscalls/syscall_64.tbl diff -u tools/perf/arch/powerpc/entry/syscalls/syscall.tbl arch/powerpc/kernel/syscalls/syscall.tbl diff -u tools/perf/arch/s390/entry/syscalls/syscall.tbl arch/s390/kernel/syscalls/syscall.tbl diff -u tools/perf/arch/mips/entry/syscalls/syscall_n64.tbl arch/mips/kernel/syscalls/syscall_n64.tbl Cc: Adrian Hunter Cc: Andrew Morton Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nhat Pham Link: https://lore.kernel.org/lkml/ZK1pVBJpbjujJNJW@kernel.org Signed-off-by: Arnaldo Carvalho de Melo commit 142256d2f41af6f7a9dbbe7db49eecc70858b1f7 Author: Arnaldo Carvalho de Melo Date: Tue Jul 11 09:53:10 2023 -0300 tools headers UAPI: Sync drm/i915_drm.h with the kernel sources 81b1b599dfd71c95 ("drm/i915: Allow user to set cache at BO creation") 98d2722a85c4ad5f ("drm/i915/huc: differentiate the 2 steps of the MTL HuC auth flow") bc4be0a38b63b6d4 ("drm/i915/pmu: Prepare for multi-tile non-engine counters") d1da138f245d4fb4 ("drm/i915/uapi/pxp: Add a GET_PARAM for PXP") That adds some ioctls but use the __I915_PMU_OTHER() macro, not supported yet in the tools/perf/trace/beauty/drm_ioctl.sh conversion script. This silences this perf build warning: Warning: Kernel ABI header differences: diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Cc: Adrian Hunter Cc: Alan Previn Cc: Andi Shyti Cc: Daniele Ceraolo Spurio Cc: Fei Yang Cc: Ian Rogers Cc: Jiri Olsa Cc: Namhyung Kim Cc: Radhakrishna Sripada Cc: Tvrtko Ursulin Cc: Umesh Nerlige Ramappa Link: https://lore.kernel.org/lkml/ZK1R%2FIyWcUKYQbQV@kernel.org/ Signed-off-by: Arnaldo Carvalho de Melo commit c66e1c68c13b872505f25ab641c44b77313ee7fe Author: Georg Müller Date: Wed Jun 28 10:45:51 2023 +0200 perf probe: Read DWARF files from the correct CU After switching from dwarf_decl_file() to die_get_decl_file(), it is not possible to add probes for certain functions: $ perf probe -x /usr/lib/systemd/systemd-logind match_unit_removed A function DIE doesn't have decl_line. Maybe broken DWARF? A function DIE doesn't have decl_line. Maybe broken DWARF? Probe point 'match_unit_removed' not found. Error: Failed to add events. The problem is that die_get_decl_file() uses the wrong CU to search for the file. elfutils commit e1db5cdc9f has some good explanation for this: dwarf_decl_file uses dwarf_attr_integrate to get the DW_AT_decl_file attribute. This means the attribute might come from a different DIE in a different CU. If so, we need to use the CU associated with the attribute, not the original DIE, to resolve the file name. This patch uses the same source of information as elfutils: use attribute DW_AT_decl_file and use this CU to search for the file. Fixes: dc9a5d2ccd5c823c ("perf probe: Fix to get declared file name from clang DWARF5") Signed-off-by: Georg Müller Acked-by: Masami Hiramatsu (Google) Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: regressions@lists.linux.dev Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230628084551.1860532-6-georgmueller@gmx.net Signed-off-by: Arnaldo Carvalho de Melo commit 56cbeacf143530576905623ac72ae0964f3293a6 Author: Georg Müller Date: Wed Jun 28 10:45:50 2023 +0200 perf probe: Add test for regression introduced by switch to die_get_decl_file() This patch adds a test to validate that 'perf probe' works for binaries where DWARF info is split into multiple CUs Signed-off-by: Georg Müller Acked-by: Masami Hiramatsu (Google) Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Cc: regressions@lists.linux.dev Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230628084551.1860532-5-georgmueller@gmx.net Signed-off-by: Arnaldo Carvalho de Melo commit 3cb11fe244d516f757c1022cfa971528d525fe65 Author: Neil Armstrong Date: Fri Jun 23 14:50:45 2023 +0200 interconnect: qcom: sa8775p: add enable_mask for bcm nodes Set the proper enable_mask the ACV node requiring such value to be used instead of a bandwidth when voting. The masks was copied from the downstream implementation at [1]. [1] https://git.codelinaro.org/clo/la/kernel/msm-5.15/-/blob/kernel.lnx.5.15.r32-rel/drivers/interconnect/qcom/lemans.c Signed-off-by: Neil Armstrong Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230619-topic-sm8550-upstream-interconnect-mask-vote-v2-4-709474b151cc@linaro.org Fixes: 3655a63f9661 ("interconnect: qcom: add a driver for sa8775p") Signed-off-by: Georgi Djakov commit 0dc82bd9e4627065dbc6ac8468296aa18f13c840 Author: Neil Armstrong Date: Fri Jun 23 14:50:44 2023 +0200 interconnect: qcom: sm8550: add enable_mask for bcm nodes Set the proper enable_mask to nodes requiring such value to be used instead of a bandwidth when voting. The masks were copied from the downstream implementation at [1]. [1] https://git.codelinaro.org/clo/la/kernel/msm-5.15/-/blob/kernel.lnx.5.15.r1-rel/drivers/interconnect/qcom/kalama.c Reviewed-by: Konrad Dybcio Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20230619-topic-sm8550-upstream-interconnect-mask-vote-v2-3-709474b151cc@linaro.org Fixes: e6f0d6a30f73 ("interconnect: qcom: Add SM8550 interconnect provider driver") Signed-off-by: Georgi Djakov commit be02db24cf840bc0fdfbecc78ad803619dd143e6 Author: Neil Armstrong Date: Fri Jun 23 14:50:43 2023 +0200 interconnect: qcom: sm8450: add enable_mask for bcm nodes Set the proper enable_mask to nodes requiring such value to be used instead of a bandwidth when voting. The masks were copied from the downstream implementation at [1]. [1] https://git.codelinaro.org/clo/la/kernel/msm-5.10/-/blob/KERNEL.PLATFORM.1.0.r2-05600-WAIPIOLE.0/drivers/interconnect/qcom/waipio.c Signed-off-by: Neil Armstrong Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230619-topic-sm8550-upstream-interconnect-mask-vote-v2-2-709474b151cc@linaro.org Fixes: fafc114a468e ("interconnect: qcom: Add SM8450 interconnect provider driver") Signed-off-by: Georgi Djakov commit d8630f050d3fd2079f8617dd6c00c6509109c755 Author: Mike Tipton Date: Fri Jun 23 14:50:42 2023 +0200 interconnect: qcom: Add support for mask-based BCMs Some BCMs aren't directly associated with the data path (i.e. ACV) and therefore don't communicate using BW. Instead, they are simply enabled/disabled with a simple bit mask. Add support for these. Origin commit retrieved from: https://git.codelinaro.org/clo/la/kernel/msm-5.15/-/commit/2d1573e0206998151b342e6b52a4c0f7234d7e36 Signed-off-by: Mike Tipton [narmstrong: removed copyright change from original commit] Signed-off-by: Neil Armstrong Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230619-topic-sm8550-upstream-interconnect-mask-vote-v2-1-709474b151cc@linaro.org Fixes: fafc114a468e ("interconnect: qcom: Add SM8450 interconnect provider driver") Signed-off-by: Georgi Djakov commit daf60d6cca26e50d65dac374db92e58de745ad26 Author: gaoming Date: Wed Jul 5 15:15:15 2023 +0800 exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree The call stack shown below is a scenario in the Linux 4.19 kernel. Allocating memory failed where exfat fs use kmalloc_array due to system memory fragmentation, while the u-disk was inserted without recognition. Devices such as u-disk using the exfat file system are pluggable and may be insert into the system at any time. However, long-term running systems cannot guarantee the continuity of physical memory. Therefore, it's necessary to address this issue. Binder:2632_6: page allocation failure: order:4, mode:0x6040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null) Call trace: [242178.097582] dump_backtrace+0x0/0x4 [242178.097589] dump_stack+0xf4/0x134 [242178.097598] warn_alloc+0xd8/0x144 [242178.097603] __alloc_pages_nodemask+0x1364/0x1384 [242178.097608] kmalloc_order+0x2c/0x510 [242178.097612] kmalloc_order_trace+0x40/0x16c [242178.097618] __kmalloc+0x360/0x408 [242178.097624] load_alloc_bitmap+0x160/0x284 [242178.097628] exfat_fill_super+0xa3c/0xe7c [242178.097635] mount_bdev+0x2e8/0x3a0 [242178.097638] exfat_fs_mount+0x40/0x50 [242178.097643] mount_fs+0x138/0x2e8 [242178.097649] vfs_kern_mount+0x90/0x270 [242178.097655] do_mount+0x798/0x173c [242178.097659] ksys_mount+0x114/0x1ac [242178.097665] __arm64_sys_mount+0x24/0x34 [242178.097671] el0_svc_common+0xb8/0x1b8 [242178.097676] el0_svc_handler+0x74/0x90 [242178.097681] el0_svc+0x8/0x340 By analyzing the exfat code,we found that continuous physical memory is not required here,so kvmalloc_array is used can solve this problem. Cc: stable@vger.kernel.org Signed-off-by: gaoming Signed-off-by: Namjae Jeon commit 27655b9bb9f0d9c32b8de8bec649b676898c52d5 Author: Thomas Zimmermann Date: Mon Jul 10 11:10:17 2023 +0200 drm/client: Send hotplug event after registering a client Generate a hotplug event after registering a client to allow the client to configure its display. Remove the hotplug calls from the existing clients for fbdev emulation. This change fixes a concurrency bug between registering a client and receiving events from the DRM core. The bug is present in the fbdev emulation of all drivers. The fbdev emulation currently generates a hotplug event before registering the client to the device. For each new output, the DRM core sends an additional hotplug event to each registered client. If the DRM core detects first output between sending the artificial hotplug and registering the device, the output's hotplug event gets lost. If this is the first output, the fbdev console display remains dark. This has been observed with amdgpu and fbdev-generic. Fix this by adding hotplug generation directly to the client's register helper drm_client_register(). Registering the client and receiving events are serialized by struct drm_device.clientlist_mutex. So an output is either configured by the initial hotplug event, or the client has already been registered. The bug was originally added in commit 6e3f17ee73f7 ("drm/fb-helper: generic: Call drm_client_add() after setup is done"), in which adding a client and receiving a hotplug event switched order. It was hidden, as most hardware and drivers have at least on static output configured. Other drivers didn't use the internal DRM client or still had struct drm_mode_config_funcs.output_poll_changed set. That callback handled hotplug events as well. After not setting the callback in amdgpu in commit 0e3172bac3f4 ("drm/amdgpu: Don't set struct drm_driver.output_poll_changed"), amdgpu did not show a framebuffer console if output events got lost. The bug got copy-pasted from fbdev-generic into the other fbdev emulation. Reported-by: Moritz Duge Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2649 Fixes: 6e3f17ee73f7 ("drm/fb-helper: generic: Call drm_client_add() after setup is done") Fixes: 8ab59da26bc0 ("drm/fb-helper: Move generic fbdev emulation into separate source file") Fixes: b79fe9abd58b ("drm/fbdev-dma: Implement fbdev emulation for GEM DMA helpers") Fixes: 63c381552f69 ("drm/armada: Implement fbdev emulation as in-kernel client") Fixes: 49953b70e7d3 ("drm/exynos: Implement fbdev emulation as in-kernel client") Fixes: 8f1aaccb04b7 ("drm/gma500: Implement client-based fbdev emulation") Fixes: 940b869c2f2f ("drm/msm: Implement fbdev emulation as in-kernel client") Fixes: 9e69bcd88e45 ("drm/omapdrm: Implement fbdev emulation as in-kernel client") Fixes: e317a69fe891 ("drm/radeon: Implement client-based fbdev emulation") Fixes: 71ec16f45ef8 ("drm/tegra: Implement fbdev emulation as in-kernel client") Fixes: 0e3172bac3f4 ("drm/amdgpu: Don't set struct drm_driver.output_poll_changed") Signed-off-by: Thomas Zimmermann Tested-by: Moritz Duge Tested-by: Torsten Krah Tested-by: Paul Schyska Cc: Daniel Vetter Cc: David Airlie Cc: Noralf Trønnes Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Javier Martinez Canillas Cc: Russell King Cc: Inki Dae Cc: Seung-Woo Kim Cc: Kyungmin Park Cc: Krzysztof Kozlowski Cc: Patrik Jakobsson Cc: Rob Clark Cc: Abhinav Kumar Cc: Dmitry Baryshkov Cc: Tomi Valkeinen Cc: Alex Deucher Cc: "Christian König" Cc: "Pan, Xinhui" Cc: Thierry Reding Cc: Mikko Perttunen Cc: dri-devel@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org Cc: linux-samsung-soc@vger.kernel.org Cc: linux-arm-msm@vger.kernel.org Cc: freedreno@lists.freedesktop.org Cc: amd-gfx@lists.freedesktop.org Cc: linux-tegra@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: # v5.2+ Reviewed-by: Javier Martinez Canillas Reviewed-by: Dmitry Baryshkov # msm Link: https://patchwork.freedesktop.org/patch/msgid/20230710091029.27503-1-tzimmermann@suse.de commit 8278ee2a2646b9acf747317895e47a640ba933c9 Author: Suman Ghosh Date: Mon Jul 10 16:00:27 2023 +0530 octeontx2-pf: Add additional check for MCAM rules Due to hardware limitation, MCAM drop rule with ether_type == 802.1Q and vlan_id == 0 is not supported. Hence rejecting such rules. Fixes: dce677da57c0 ("octeontx2-pf: Add vlan-etype to ntuple filters") Signed-off-by: Suman Ghosh Link: https://lore.kernel.org/r/20230710103027.2244139-1-sumang@marvell.com Signed-off-by: Paolo Abeni commit 6b293a8c91bca52726448d03216e65da509e9bb7 Author: Thomas GENTY Date: Fri Jul 7 16:14:25 2023 +0200 platform/x86: touchscreen_dmi: Add info for the Archos 101 Cesium Educ tablet Add info for the Archos 101 Cesium Educ tablet It was tested using gslx680_ts_acpi module PR at https://github.com/onitake/gsl-firmware/pull/210 for the firmware Signed-off-by: Thomas GENTY Link: https://lore.kernel.org/r/20230707141425.21473-1-tomlohave@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit d0050c2ef53f87561d8345cccf49927ade91cca6 Author: Armin Wolf Date: Fri Jul 7 03:03:33 2023 +0200 platform/x86: dell-ddv: Fix mangled list in documentation Add missing empty line necessary for sphinx to recognize the list. Also reword the first entry a little bit. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20230707010333.12954-2-W_Armin@gmx.de Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 8c4893837554687addae919998b0f3de23a514dc Author: Armin Wolf Date: Fri Jul 7 03:03:32 2023 +0200 platform/x86: dell-ddv: Improve error handling If for some reason a external function returns -ENODEV, no error message is being displayed because the driver assumes that -ENODEV can only be returned internally if no sensors, etc where found. Fix this by explicitly returning 0 in such a case since missing hardware is no error. Also remove the now obsolete check for -ENODEV. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20230707010333.12954-1-W_Armin@gmx.de Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 5d3acd9d7a44ad9902e98e57013f028d5f4fc86c Author: Shyam Sundar S K Date: Tue Jul 11 15:39:03 2023 +0530 platform/x86/amd: pmf: Add new ACPI ID AMDI0103 Add new ACPI ID AMDI0103 used by upcoming AMD platform to the PMF supported list of devices. Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20230711100903.384151-1-Shyam-sundar.S-k@amd.com Signed-off-by: Hans de Goede commit 822507ca6affc8930a3919f326c79062354e8283 Author: Shyam Sundar S K Date: Tue Jul 11 15:33:44 2023 +0530 platform/x86/amd: pmc: Add new ACPI ID AMDI000A Add new ACPI ID AMDI000A used by upcoming AMD platform to the pmc supported list of devices Signed-off-by: Shyam Sundar S K Link: https://lore.kernel.org/r/20230711100344.383948-1-Shyam-sundar.S-k@amd.com Signed-off-by: Hans de Goede commit 6e2acbfe59b83043bc7ae1bb39fac4fc9dcd5a18 Author: Dmitry Rokosov Date: Wed Jul 5 00:54:04 2023 +0300 clk: meson: change usleep_range() to udelay() for atomic context The function meson_clk_pll_enable() can be invoked under the enable_lock spinlock from the clk core logic, which risks a kernel panic during the usleep_range() call: BUG: scheduling while atomic: kworker/u4:2/36/0x00000002 Modules linked in: g_ffs usb_f_fs libcomposite CPU: 1 PID: 36 Comm: kworker/u4:2 Not tainted 6.4.0-rc5 #273 Workqueue: events_unbound async_run_entry_fn Call trace: dump_backtrace+0x9c/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x48/0x60 dump_stack+0x18/0x28 __schedule_bug+0x58/0x78 __schedule+0x828/0xa88 schedule+0x64/0xd8 schedule_hrtimeout_range_clock+0xd0/0x208 schedule_hrtimeout_range+0x1c/0x30 usleep_range_state+0x6c/0xa8 meson_clk_pll_enable+0x1f4/0x310 clk_core_enable+0x78/0x200 clk_core_enable+0x58/0x200 clk_core_enable+0x58/0x200 clk_core_enable+0x58/0x200 clk_enable+0x34/0x60 So it is required to use the udelay() function instead of usleep_range() for the atomic context safety. Fixes: b6ec400aa153 ("clk: meson: introduce new pll power-on sequence for A1 SoC family") Reported-by: Jan Dakinevich Signed-off-by: Dmitry Rokosov Link: https://lore.kernel.org/r/20230704215404.11533-1-ddrokosov@sberdevices.ru Signed-off-by: Jerome Brunet commit d194803325150c53ad228aedb6f6a82ac9ea6360 Author: Mario Limonciello Date: Mon Jul 10 13:39:34 2023 -0500 platform/x86/amd: pmc: Apply nvme quirk to HP 15s-eq2xxx HP 15s-eq2xxx is an older Lucienne laptop that has a problem resuming from s2idle when IOMMU is enabled. The symptoms very closely resemble that of the Lenovo issues with NVME resume. Lucienne was released in a similar timeframe as the Renoir / Cezanne Lenovo laptops and they may have similar BIOS code. Applying the same quirk to this system allows the system to work with IOMMU enabled and s2idle resume to work. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2684 Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20230710183934.17315-3-mario.limonciello@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit e8ef8dd28c4c4b86cd3010ff42c79582f766862e Author: Mario Limonciello Date: Mon Jul 10 13:39:33 2023 -0500 platform/x86: Move s2idle quirk from thinkpad-acpi to amd-pmc It turns out that some-non Lenovo systems can benefit from the quirk introduced for Lenovo systems in commit 455cd867b85b5 ("platform/x86: thinkpad_acpi: Add a s2idle resume quirk for a number of laptops"). So move this quirk into running from the amd-pmc driver instead. No intended functional changes. Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20230710183934.17315-2-mario.limonciello@amd.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 6018a266279b1a75143c7c0804dd08a5fc4c3e0b Author: Zhengchao Shao Date: Mon Jul 10 17:40:53 2023 +0800 ip_vti: fix potential slab-use-after-free in decode_session6 When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ip_vti device sends IPv6 packets. As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets. Fixes: f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") Signed-off-by: Zhengchao Shao Signed-off-by: Steffen Klassert commit 9fd41f1ba638938c9a1195d09bc6fa3be2712f25 Author: Zhengchao Shao Date: Mon Jul 10 17:40:52 2023 +0800 ip6_vti: fix slab-use-after-free in decode_session6 When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ipv6_vti device sends IPv6 packets. The stack information is as follows: BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff88802e08edc2 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130 decode_session6+0x103f/0x1890 __xfrm_decode_session+0x54/0xb0 vti6_tnl_xmit+0x3e6/0x1ee0 dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0 __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550 ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890 ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580 expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120 sysvec_apic_timer_interrupt+0x97/0xc0 Allocated by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x7f/0x90 kmem_cache_alloc_node+0x1cd/0x410 kmalloc_reserve+0x165/0x270 __alloc_skb+0x129/0x330 netlink_sendmsg+0x9b1/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x40 ____kasan_slab_free+0x160/0x1c0 slab_free_freelist_hook+0x11b/0x220 kmem_cache_free+0xf0/0x490 skb_free_head+0x17f/0x1b0 skb_release_data+0x59c/0x850 consume_skb+0xd2/0x170 netlink_unicast+0x54f/0x7f0 netlink_sendmsg+0x926/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff88802e08ed00 which belongs to the cache skbuff_small_head of size 640 The buggy address is located 194 bytes inside of freed 640-byte region [ffff88802e08ed00, ffff88802e08ef80) As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets. Fixes: f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") Signed-off-by: Zhengchao Shao Signed-off-by: Steffen Klassert commit 53223f2ed1ef5c90dad814daaaefea4e68a933c8 Author: Zhengchao Shao Date: Mon Jul 10 17:40:51 2023 +0800 xfrm: fix slab-use-after-free in decode_session6 When the xfrm device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when the xfrm device sends IPv6 packets. The stack information is as follows: BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff8881111458ef by task swapper/3/0 CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.4.0-next-20230707 #409 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130 decode_session6+0x103f/0x1890 __xfrm_decode_session+0x54/0xb0 xfrmi_xmit+0x173/0x1ca0 dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0 __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550 ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890 ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580 expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120 sysvec_apic_timer_interrupt+0x97/0xc0 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:intel_idle_hlt+0x23/0x30 Code: 1f 84 00 00 00 00 00 f3 0f 1e fa 41 54 41 89 d4 0f 1f 44 00 00 66 90 0f 1f 44 00 00 0f 00 2d c4 9f ab 00 0f 1f 44 00 00 fb f4 44 89 e0 41 5c c3 66 0f 1f 44 00 00 f3 0f 1e fa 41 54 41 89 d4 RSP: 0018:ffffc90000197d78 EFLAGS: 00000246 RAX: 00000000000a83c3 RBX: ffffe8ffffd09c50 RCX: ffffffff8a22d8e5 RDX: 0000000000000001 RSI: ffffffff8d3f8080 RDI: ffffe8ffffd09c50 RBP: ffffffff8d3f8080 R08: 0000000000000001 R09: ffffed1026ba6d9d R10: ffff888135d36ceb R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff8d3f8100 R14: 0000000000000001 R15: 0000000000000000 cpuidle_enter_state+0xd3/0x6f0 cpuidle_enter+0x4e/0xa0 do_idle+0x2fe/0x3c0 cpu_startup_entry+0x18/0x20 start_secondary+0x200/0x290 secondary_startup_64_no_verify+0x167/0x16b Allocated by task 939: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x7f/0x90 kmem_cache_alloc_node+0x1cd/0x410 kmalloc_reserve+0x165/0x270 __alloc_skb+0x129/0x330 inet6_ifa_notify+0x118/0x230 __ipv6_ifa_notify+0x177/0xbe0 addrconf_dad_completed+0x133/0xe00 addrconf_dad_work+0x764/0x1390 process_one_work+0xa32/0x16f0 worker_thread+0x67d/0x10c0 kthread+0x344/0x440 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff888111145800 which belongs to the cache skbuff_small_head of size 640 The buggy address is located 239 bytes inside of freed 640-byte region [ffff888111145800, ffff888111145a80) As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets. Fixes: f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") Signed-off-by: Zhengchao Shao Signed-off-by: Steffen Klassert commit 04499f28b40bfc24f20b0e2331008bb90a54a6cf Author: Lu Hongfei Date: Mon Jul 10 11:18:59 2023 +0800 net: dsa: Removed unneeded of_node_put in felix_parse_ports_node Remove unnecessary of_node_put from the continue path to prevent child node from being released twice, which could avoid resource leak or other unexpected issues. Signed-off-by: Lu Hongfei Reviewed-by: Vladimir Oltean Fixes: de879a016a94 ("net: dsa: felix: add functionality when not all ports are supported") Link: https://lore.kernel.org/r/20230710031859.36784-1-luhongfei@vivo.com Signed-off-by: Paolo Abeni commit 113899c2669dff148b2a5bea4780123811aecc13 Author: Tvrtko Ursulin Date: Fri Jul 7 13:55:03 2023 +0100 drm/i915: Fix one wrong caching mode enum usage Commit a4d86249c773 ("drm/i915/gt: Provide a utility to create a scratch buffer") mistakenly passed in uapi I915_CACHING_CACHED as argument to i915_gem_object_set_cache_coherency(), which actually takes internal enum i915_cache_level. No functional issue since the value matches I915_CACHE_LLC (1 == 1), which is the intended caching mode, but lets clean it up nevertheless. Signed-off-by: Tvrtko Ursulin Fixes: a4d86249c773 ("drm/i915/gt: Provide a utility to create a scratch buffer") Cc: Daniele Ceraolo Spurio Reviewed-by: Tejas Upadhyay Link: https://patchwork.freedesktop.org/patch/msgid/20230707125503.3965817-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit 49c60b2f0867ac36fd54d513882a48431aeccae7) Signed-off-by: Tvrtko Ursulin commit 6bf0961a008ac74b085f1690fba8520ac3b253ee Author: Tvrtko Ursulin Date: Fri Jul 7 13:46:44 2023 +0100 drm/i915: Remove dead code from gen8_pte_encode Commit 9275277d5324 ("drm/i915: use pat_index instead of cache_level") added a dedicated gen12_pte_encode but forgot to remove the Gen12 specific bit from gen8_pte_encode. Signed-off-by: Tvrtko Ursulin Fixes: 9275277d5324 ("drm/i915: use pat_index instead of cache_level") Cc: Fei Yang Cc: Andi Shyti Cc: Matt Roper Reviewed-by: Rodrigo Vivi Reviewed-by: Fei Yang Link: https://patchwork.freedesktop.org/patch/msgid/20230707124644.3965281-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit 08509377dd82ead98429785509f6b52a4b5f09f5) Signed-off-by: Tvrtko Ursulin commit dde4c3d477d834212947f38519407df404acde4a Author: Umesh Nerlige Ramappa Date: Fri Jun 16 10:34:02 2023 -0700 drm/i915/perf: Consider OA buffer boundary when zeroing out reports For reports that are not powers of 2, reports at the end of the OA buffer may get split across the buffer boundary. When zeroing out such reports, take the split into consideration. v2: Use OA_BUFFER_SIZE (Ashutosh) Fixes: 09a36015d9a0 ("drm/i915/perf: Clear out entire reports after reading if not power of 2 size") Signed-off-by: Umesh Nerlige Ramappa Reviewed-by: Ashutosh Dixit Signed-off-by: Ashutosh Dixit Link: https://patchwork.freedesktop.org/patch/msgid/20230616173402.699776-1-umesh.nerlige.ramappa@intel.com (cherry picked from commit 40b1588a750240cbe8a83117aa785d778749a77c) Signed-off-by: Tvrtko Ursulin commit 5c413188c68da0e4bffc93de1c80257e20741e69 Author: Stanislav Lisovskiy Date: Wed Jun 28 17:10:17 2023 +0300 drm/i915: Don't preserve dpll_hw_state for slave crtc in Bigjoiner If we are using Bigjoiner dpll_hw_state is supposed to be exactly same as for master crtc, so no need to save it's state for slave crtc. Signed-off-by: Stanislav Lisovskiy Fixes: 0ff0e219d9b8 ("drm/i915: Compute clocks earlier") Reviewed-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230628141017.18937-1-stanislav.lisovskiy@intel.com (cherry picked from commit cbaf758809952c95ec00e796695049babb08bb60) Signed-off-by: Tvrtko Ursulin commit 535d0ae39185a266536a1e97ff9a8956d7fbb9df Author: Ingo Molnar Date: Tue Jul 11 10:10:40 2023 +0200 x86/cfi: Only define poison_cfi() if CONFIG_X86_KERNEL_IBT=y poison_cfi() was introduced in: 9831c6253ace ("x86/cfi: Extend ENDBR sealing to kCFI") ... but it's only ever used under CONFIG_X86_KERNEL_IBT=y, and if that option is disabled, we get: arch/x86/kernel/alternative.c:1243:13: error: ‘poison_cfi’ defined but not used [-Werror=unused-function] Guard the definition with CONFIG_X86_KERNEL_IBT. Cc: Peter Zijlstra (Intel) Cc: Kees Cook Cc: Sami Tolvanen Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar commit 6fe5c68ee6a1aae0ef291a56001e7888de547fa2 Author: Lorenzo Pieralisi Date: Tue Jul 4 17:50:34 2023 +0200 irqchip/gic-v3: Workaround for GIC-700 erratum 2941627 GIC700 erratum 2941627 may cause GIC-700 missing SPIs wake requests when SPIs are deactivated while targeting a sleeping CPU - ie a CPU for which the redistributor: GICR_WAKER.ProcessorSleep == 1 This runtime situation can happen if an SPI that has been activated on a core is retargeted to a different core, it becomes pending and the target core subsequently enters a power state quiescing the respective redistributor. When this situation is hit, the de-activation carried out on the core that activated the SPI (through either ICC_EOIR1_EL1 or ICC_DIR_EL1 register writes) does not trigger a wake requests for the sleeping GIC redistributor even if the SPI is pending. Work around the erratum by de-activating the SPI using the redistributor GICD_ICACTIVER register if the runtime conditions require it (ie the IRQ was retargeted between activation and de-activation). Signed-off-by: Lorenzo Pieralisi Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230704155034.148262-1-lpieralisi@kernel.org commit c0dbbdf56f13c960aa6bedf61302f57411ae4865 Merge: 9d0aba98316d0 84a1094719879 Author: Paolo Abeni Date: Tue Jul 11 10:00:52 2023 +0200 Merge branch 'net-fec-fix-some-issues-of-ndo_xdp_xmit' Wei Fang says: ==================== net: fec: fix some issues of ndo_xdp_xmit() We encountered some issues when testing the ndo_xdp_xmit() interface of the fec driver on i.MX8MP and i.MX93 platforms. These issues are easy to reproduce, and the specific reproduction steps are as follows. step1: The ethernet port of a board (board A) is connected to the EQOS port of i.MX8MP/i.MX93, and the FEC port of i.MX8MP/i.MX93 is connected to another ethernet port, such as a switch port. step2: Board A uses the pktgen_sample03_burst_single_flow.sh to generate and send packets to i.MX8MP/i.MX93. The command is shown below. ./pktgen_sample03_burst_single_flow.sh -i eth0 -d 192.168.6.8 -m \ 56:bf:0d:68:b0:9e -s 1500 step3: i.MX8MP/i.MX93 use the xdp_redirect bfp program to redirect the XDP frames from EQOS port to FEC port. The command is shown below. ./xdp_redirect eth1 eth0 After a few moments, the warning or error logs will be printed in the console, for more details, please refer to the commit message of each patch. ==================== Link: https://lore.kernel.org/r/20230706081012.2278063-1-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 84a10947198792d038527af9c3994782ecb37c82 Author: Wei Fang Date: Thu Jul 6 16:10:12 2023 +0800 net: fec: use netdev_err_once() instead of netdev_err() In the case of heavy XDP traffic to be transmitted, the console will print the error log continuously if there are lack of enough BDs to accommodate the frames. The log looks like below. [ 160.013112] fec 30be0000.ethernet eth0: NOT enough BD for SG! [ 160.023116] fec 30be0000.ethernet eth0: NOT enough BD for SG! [ 160.028926] fec 30be0000.ethernet eth0: NOT enough BD for SG! [ 160.038946] fec 30be0000.ethernet eth0: NOT enough BD for SG! [ 160.044758] fec 30be0000.ethernet eth0: NOT enough BD for SG! Not only will this log be replicated and redundant, it will also degrade XDP performance. So we use netdev_err_once() instead of netdev_err() now. Fixes: 6d6b39f180b8 ("net: fec: add initial XDP support") Signed-off-by: Wei Fang Signed-off-by: Paolo Abeni commit 56b3c6ba53d0e9649ea5e4089b39cadde13aaef8 Author: Wei Fang Date: Thu Jul 6 16:10:11 2023 +0800 net: fec: increase the size of tx ring and update tx_wake_threshold When the XDP feature is enabled and with heavy XDP frames to be transmitted, there is a considerable probability that available tx BDs are insufficient. This will lead to some XDP frames to be discarded and the "NOT enough BD for SG!" error log will appear in the console (as shown below). [ 160.013112] fec 30be0000.ethernet eth0: NOT enough BD for SG! [ 160.023116] fec 30be0000.ethernet eth0: NOT enough BD for SG! [ 160.028926] fec 30be0000.ethernet eth0: NOT enough BD for SG! [ 160.038946] fec 30be0000.ethernet eth0: NOT enough BD for SG! [ 160.044758] fec 30be0000.ethernet eth0: NOT enough BD for SG! In the case of heavy XDP traffic, sometimes the speed of recycling tx BDs may be slower than the speed of sending XDP frames. There may be several specific reasons, such as the interrupt is not responsed in time, the efficiency of the NAPI callback function is too low due to all the queues (tx queues and rx queues) share the same NAPI, and so on. After trying various methods, I think that increase the size of tx BD ring is simple and effective. Maybe the best resolution is that allocate NAPI for each queue to improve the efficiency of the NAPI callback, but this change is a bit big and I didn't try this method. Perheps this method will be implemented in a future patch. This patch also updates the tx_wake_threshold of tx ring which is related to the size of tx ring in the previous logic. Otherwise, the tx_wake_threshold will be too high (403 BDs), which is more likely to impact the slow path in the case of heavy XDP traffic, because XDP path and slow path share the tx BD rings. According to Jakub's suggestion, the tx_wake_threshold is at least equal to tx_stop_threshold + 2 * MAX_SKB_FRAGS, if a queue of hundreds of entries is overflowing, we should be able to apply a hysteresis of a few tens of entries. Fixes: 6d6b39f180b8 ("net: fec: add initial XDP support") Signed-off-by: Wei Fang Signed-off-by: Paolo Abeni commit 20f797399035a8052dbd7297fdbe094079a9482e Author: Wei Fang Date: Thu Jul 6 16:10:10 2023 +0800 net: fec: recycle pages for transmitted XDP frames Once the XDP frames have been successfully transmitted through the ndo_xdp_xmit() interface, it's the driver responsibility to free the frames so that the page_pool can recycle the pages and reuse them. However, this action is not implemented in the fec driver. This leads to a user-visible problem that the console will print the following warning log. [ 157.568851] page_pool_release_retry() stalled pool shutdown 1389 inflight 60 sec [ 217.983446] page_pool_release_retry() stalled pool shutdown 1389 inflight 120 sec [ 278.399006] page_pool_release_retry() stalled pool shutdown 1389 inflight 181 sec [ 338.812885] page_pool_release_retry() stalled pool shutdown 1389 inflight 241 sec [ 399.226946] page_pool_release_retry() stalled pool shutdown 1389 inflight 302 sec Therefore, to solve this issue, we free XDP frames via xdp_return_frame() while cleaning the tx BD ring. Fixes: 6d6b39f180b8 ("net: fec: add initial XDP support") Signed-off-by: Wei Fang Signed-off-by: Paolo Abeni commit be7ecbe7ec7df7320db4b810fef438bf67144011 Author: Wei Fang Date: Thu Jul 6 16:10:09 2023 +0800 net: fec: dynamically set the NETDEV_XDP_ACT_NDO_XMIT feature of XDP When a XDP program is installed or uninstalled, fec_restart() will be invoked to reset MAC and buffer descriptor rings. It's reasonable not to transmit any packet during the process of reset. However, the NETDEV_XDP_ACT_NDO_XMIT bit of xdp_features is enabled by default, that is to say, it's possible that the fec_enet_xdp_xmit() will be invoked even if the process of reset is not finished. In this case, the redirected XDP frames might be dropped and available transmit BDs may be incorrectly deemed insufficient. So this patch disable the NETDEV_XDP_ACT_NDO_XMIT feature by default and dynamically configure this feature when the bpf program is installed or uninstalled. Fixes: e4ac7cc6e5a4 ("net: fec: turn on XDP features") Signed-off-by: Wei Fang Signed-off-by: Paolo Abeni commit 2f98e686ef59b5d19af5847d755798e2031bee3a Merge: a2848d08742c8 06c2afb862f9d Author: Maxime Ripard Date: Tue Jul 11 09:23:20 2023 +0200 Merge v6.5-rc1 into drm-misc-fixes Boris needs 6.5-rc1 in drm-misc-fixes to prevent a conflict. Signed-off-by: Maxime Ripard commit c56fb2aab23505bb7160d06097c8de100b82b851 Author: Björn Töpel Date: Mon Jul 10 09:41:31 2023 +0200 riscv, bpf: Fix inconsistent JIT image generation In order to generate the prologue and epilogue, the BPF JIT needs to know which registers that are clobbered. Therefore, the during pre-final passes, the prologue is generated after the body of the program body-prologue-epilogue. Then, in the final pass, a proper prologue-body-epilogue JITted image is generated. This scheme has worked most of the time. However, for some large programs with many jumps, e.g. the test_kmod.sh BPF selftest with hardening enabled (blinding constants), this has shown to be incorrect. For the final pass, when the proper prologue-body-epilogue is generated, the image has not converged. This will lead to that the final image will have incorrect jump offsets. The following is an excerpt from an incorrect image: | ... | 3b8: 00c50663 beq a0,a2,3c4 <.text+0x3c4> | 3bc: 0020e317 auipc t1,0x20e | 3c0: 49630067 jalr zero,1174(t1) # 20e852 <.text+0x20e852> | ... | 20e84c: 8796 c.mv a5,t0 | 20e84e: 6422 c.ldsp s0,8(sp) # Epilogue start | 20e850: 6141 c.addi16sp sp,16 | 20e852: 853e c.mv a0,a5 # Incorrect jump target | 20e854: 8082 c.jr ra The image has shrunk, and the epilogue offset is incorrect in the final pass. Correct the problem by always generating proper prologue-body-epilogue outputs, which means that the first pass will only generate the body to track what registers that are touched. Fixes: 2353ecc6f91f ("bpf, riscv: add BPF JIT for RV64G") Signed-off-by: Björn Töpel Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20230710074131.19596-1-bjorn@kernel.org commit 53a90ae81a33437ff6ae907c75fd8a9902df2480 Author: Yangtao Li Date: Mon Jul 10 21:20:01 2023 +0800 fbdev: imxfb: remove unneeded labels These labels are now redundant and don't do anything, let's remove them. Signed-off-by: Yangtao Li Signed-off-by: Helge Deller commit 78dd4f415567a94fa134214f82b7966cbefde05c Author: Yangtao Li Date: Mon Jul 10 21:20:00 2023 +0800 fbdev: imxfb: Convert to devm_platform_ioremap_resource() Use devm_platform_ioremap_resource() to simplify code. Signed-off-by: Yangtao Li Signed-off-by: Helge Deller commit 55dd7378ba94afe389e7edec23510bad80d344ca Author: Yangtao Li Date: Mon Jul 10 21:19:59 2023 +0800 fbdev: imxfb: Convert to devm_kmalloc_array() No need for manual kfree in the error path and the remove function. Signed-off-by: Yangtao Li Signed-off-by: Helge Deller commit 45fcc058a75bf5d65cf4c32da44a252fbe873cd4 Author: Yangtao Li Date: Mon Jul 10 21:19:58 2023 +0800 fbdev: imxfb: Removed unneeded release_mem_region Remove unnecessary release_mem_region from the error path to prevent mem region from being released twice, which could avoid resource leak or other unexpected issues. Fixes: b083c22d5114 ("video: fbdev: imxfb: Convert request_mem_region + ioremap to devm_ioremap_resource") Signed-off-by: Yangtao Li Signed-off-by: Helge Deller commit 86a101023e7d4413f89d0a0a77693af952529260 Author: Martin Kaiser Date: Wed Jun 28 15:26:52 2023 +0200 fbdev: imxfb: switch to DEFINE_SIMPLE_DEV_PM_OPS SIMPLE_DEV_PM_OPS is deprecated, replace it with DEFINE_SIMPLE_DEV_PM_OPS and use pm_sleep_ptr for setting the driver's pm routines. We can now remove the __maybe_unused qualifier in the suspend and resume functions. Signed-off-by: Martin Kaiser Signed-off-by: Helge Deller commit 4e47382fbca916d7db95cbf9e2d7ca2e9d1ca3fe Author: Martin Kaiser Date: Wed Jun 28 15:24:37 2023 +0200 fbdev: imxfb: warn about invalid left/right margin Warn about invalid var->left_margin or var->right_margin. Their values are read from the device tree. We store var->left_margin-3 and var->right_margin-1 in register fields. These fields should be >= 0. Fixes: 7e8549bcee00 ("imxfb: Fix margin settings") Signed-off-by: Martin Kaiser Signed-off-by: Helge Deller commit a160e9414d8a1747225206558b24d7df513b3c8d Author: Max Filippov Date: Mon Jul 10 15:13:27 2023 -0700 xtensa: fix unaligned and load/store configuration interaction Unaligned exception handler is needed in configurations with hardware support for unaligned access when the load/store exception handler is enabled because such configurations would still raise an exception on unaligned access through the instruction bus. Fixes: f29cf77609cc ("xtensa: add load/store exception handler") Signed-off-by: Max Filippov commit bc8d5916541fa19ca5bc598eb51a5f78eb891a36 Author: Max Filippov Date: Mon Jul 3 11:01:42 2023 -0700 xtensa: ISS: fix call to split_if_spec split_if_spec expects a NULL-pointer as an end marker for the argument list, but tuntap_probe never supplied that terminating NULL. As a result incorrectly formatted interface specification string may cause a crash because of the random memory access. Fix that by adding NULL terminator to the split_if_spec argument list. Cc: stable@vger.kernel.org Fixes: 7282bee78798 ("[PATCH] xtensa: Architecture support for Tensilica Xtensa Part 8") Signed-off-by: Max Filippov commit c44e783e0b4539cb8296da9229202a9f9e6a3c8d Author: Max Filippov Date: Mon Jul 3 09:57:25 2023 -0700 xtensa: ISS: add comment about etherdev freeing iss_net_configure explicitly frees etherdev in all error return paths except one where register_netdevice fails. In that remaining error return path the etherdev is freed by the iss_net_pdev_release callback triggered by the platform_device_unregister call. Add a comment stating that. Signed-off-by: Max Filippov commit 3c55097c553c49deab60ac62c83ef17565004a97 Author: Zhang Yi Date: Tue Jun 6 21:59:28 2023 +0800 jbd2: remove __journal_try_to_free_buffer() __journal_try_to_free_buffer() has only one caller and it's logic is much simple now, so just remove it and open code in jbd2_journal_try_to_free_buffers(). Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230606135928.434610-7-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 46f881b5b1758dc4a35fba4a643c10717d0cf427 Author: Zhang Yi Date: Tue Jun 6 21:59:27 2023 +0800 jbd2: fix a race when checking checkpoint buffer busy Before removing checkpoint buffer from the t_checkpoint_list, we have to check both BH_Dirty and BH_Lock bits together to distinguish buffers have not been or were being written back. But __cp_buffer_busy() checks them separately, it first check lock state and then check dirty, the window between these two checks could be raced by writing back procedure, which locks buffer and clears buffer dirty before I/O completes. So it cannot guarantee checkpointing buffers been written back to disk if some error happens later. Finally, it may clean checkpoint transactions and lead to inconsistent filesystem. jbd2_journal_forget() and __journal_try_to_free_buffer() also have the same problem (journal_unmap_buffer() escape from this issue since it's running under the buffer lock), so fix them through introducing a new helper to try holding the buffer lock and remove really clean buffer. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217490 Cc: stable@vger.kernel.org Suggested-by: Jan Kara Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230606135928.434610-6-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit e34c8dd238d0c9368b746480f313055f5bab5040 Author: Zhihao Cheng Date: Tue Jun 6 21:59:26 2023 +0800 jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint Following process, jbd2_journal_commit_transaction // there are several dirty buffer heads in transaction->t_checkpoint_list P1 wb_workfn jbd2_log_do_checkpoint if (buffer_locked(bh)) // false __block_write_full_page trylock_buffer(bh) test_clear_buffer_dirty(bh) if (!buffer_dirty(bh)) __jbd2_journal_remove_checkpoint(jh) if (buffer_write_io_error(bh)) // false >> bh IO error occurs << jbd2_cleanup_journal_tail __jbd2_update_log_tail jbd2_write_superblock // The bh won't be replayed in next mount. , which could corrupt the ext4 image, fetch a reproducer in [Link]. Since writeback process clears buffer dirty after locking buffer head, we can fix it by try locking buffer and check dirtiness while buffer is locked, the buffer head can be removed if it is neither dirty nor locked. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217490 Fixes: 470decc613ab ("[PATCH] jbd2: initial copy of files from jbd") Signed-off-by: Zhihao Cheng Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230606135928.434610-5-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit b98dba273a0e47dbfade89c9af73c5b012a4eabb Author: Zhang Yi Date: Tue Jun 6 21:59:25 2023 +0800 jbd2: remove journal_clean_one_cp_list() journal_clean_one_cp_list() and journal_shrink_one_cp_list() are almost the same, so merge them into journal_shrink_one_cp_list(), remove the nr_to_scan parameter, always scan and try to free the whole checkpoint list. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230606135928.434610-4-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit be22255360f80d3af789daad00025171a65424a5 Author: Zhang Yi Date: Tue Jun 6 21:59:24 2023 +0800 jbd2: remove t_checkpoint_io_list Since t_checkpoint_io_list was stop using in jbd2_log_do_checkpoint() now, it's time to remove the whole t_checkpoint_io_list logic. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230606135928.434610-3-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit c2d6fd9d6f35079f1669f0100f05b46708c74b7f Author: Zhang Yi Date: Tue Jun 6 21:59:23 2023 +0800 jbd2: recheck chechpointing non-dirty buffer There is a long-standing metadata corruption issue that happens from time to time, but it's very difficult to reproduce and analyse, benefit from the JBD2_CYCLE_RECORD option, we found out that the problem is the checkpointing process miss to write out some buffers which are raced by another do_get_write_access(). Looks below for detail. jbd2_log_do_checkpoint() //transaction X //buffer A is dirty and not belones to any transaction __buffer_relink_io() //move it to the IO list __flush_batch() write_dirty_buffer() do_get_write_access() clear_buffer_dirty __jbd2_journal_file_buffer() //add buffer A to a new transaction Y lock_buffer(bh) //doesn't write out __jbd2_journal_remove_checkpoint() //finish checkpoint except buffer A //filesystem corrupt if the new transaction Y isn't fully write out. Due to the t_checkpoint_list walking loop in jbd2_log_do_checkpoint() have already handles waiting for buffers under IO and re-added new transaction to complete commit, and it also removing cleaned buffers, this makes sure the list will eventually get empty. So it's fine to leave buffers on the t_checkpoint_list while flushing out and completely stop using the t_checkpoint_io_list. Cc: stable@vger.kernel.org Suggested-by: Jan Kara Signed-off-by: Zhang Yi Tested-by: Zhihao Cheng Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230606135928.434610-2-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit d0a3022f30629a208e5944022caeca3568add9e7 Author: Beau Belgrave Date: Thu Jun 29 23:50:48 2023 +0000 tracing/user_events: Fix struct arg size match check When users register an event the name of the event and it's argument are checked to ensure they match if the event already exists. Normally all arguments are in the form of "type name", except for when the type starts with "struct ". In those cases, the size of the struct is passed in addition to the name, IE: "struct my_struct a 20" for an argument that is of type "struct my_struct" with a field name of "a" and has the size of 20 bytes. The current code does not honor the above case properly when comparing a match. This causes the event register to fail even when the same string was used for events that contain a struct argument within them. The example above "struct my_struct a 20" generates a match string of "struct my_struct a" omitting the size field. Add the struct size of the existing field when generating a comparison string for a struct field to ensure proper match checking. Link: https://lkml.kernel.org/r/20230629235049.581-2-beaub@linux.microsoft.com Cc: stable@vger.kernel.org Fixes: e6f89a149872 ("tracing/user_events: Ensure user provided strings are safely formatted") Signed-off-by: Beau Belgrave Signed-off-by: Steven Rostedt (Google) commit b599b06544d87b0c7dcb7d3571c3473ab5abce72 Author: YueHaibing Date: Fri Jun 23 17:16:40 2023 +0800 x86/ftrace: Remove unsued extern declaration ftrace_regs_caller_ret() This is now unused, so can remove it. Link: https://lore.kernel.org/linux-trace-kernel/20230623091640.21952-1-yuehaibing@huawei.com Cc: Cc: Cc: Cc: Cc: Cc: Cc: Cc: Signed-off-by: YueHaibing Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 195b9cb5b288fec1c871ef89f78cc9a7461aad3a Author: Masami Hiramatsu (Google) Date: Fri Jul 7 23:03:19 2023 +0900 fprobe: Ensure running fprobe_exit_handler() finished before calling rethook_free() Ensure running fprobe_exit_handler() has finished before calling rethook_free() in the unregister_fprobe() so that caller can free the fprobe right after unregister_fprobe(). unregister_fprobe() ensured that all running fprobe_entry/exit_handler() have finished by calling unregister_ftrace_function() which synchronizes RCU. But commit 5f81018753df ("fprobe: Release rethook after the ftrace_ops is unregistered") changed to call rethook_free() after unregister_ftrace_function(). So call rethook_stop() to make rethook disabled before unregister_ftrace_function() and ensure it again. Here is the possible code flow that can call the exit handler after unregister_fprobe(). ------ CPU1 CPU2 call unregister_fprobe(fp) ... __fprobe_handler() rethook_hook() on probed function unregister_ftrace_function() return from probed function rethook hooks find rh->handler == fprobe_exit_handler call fprobe_exit_handler() rethook_free(): set rh->handler = NULL; return from unreigster_fprobe; call fp->exit_handler() <- (*) ------ (*) At this point, the exit handler is called after returning from unregister_fprobe(). This fixes it as following; ------ CPU1 CPU2 call unregister_fprobe() ... rethook_stop(): set rh->handler = NULL; __fprobe_handler() rethook_hook() on probed function unregister_ftrace_function() return from probed function rethook hooks find rh->handler == NULL return from rethook rethook_free() return from unreigster_fprobe; ------ Link: https://lore.kernel.org/all/168873859949.156157.13039240432299335849.stgit@devnote2/ Fixes: 5f81018753df ("fprobe: Release rethook after the ftrace_ops is unregistered") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit 8c3526fb86060cb53a1f4ca6cc44eb036afcf43e Author: Florent Revest Date: Thu Apr 27 16:07:00 2023 +0200 arm64: ftrace: Add direct call trampoline samples support The ftrace samples need per-architecture trampoline implementations to save and restore argument registers around the calls to my_direct_func* and to restore polluted registers (eg: x30). These samples also include which, on arm64, is not necessary and redefines previously defined macros (resulting in warnings) so these includes are guarded by !CONFIG_ARM64. Link: https://lkml.kernel.org/r/20230427140700.625241-3-revest@chromium.org Reviewed-by: Mark Rutland Tested-by: Mark Rutland Acked-by: Catalin Marinas Signed-off-by: Florent Revest Signed-off-by: Steven Rostedt (Google) commit 8564c315876ab86fcaf8e7f558d6a84cb2ce5590 Author: Florent Revest Date: Thu Apr 27 16:06:59 2023 +0200 samples: ftrace: Save required argument registers in sample trampolines The ftrace-direct-too sample traces the handle_mm_fault function whose signature changed since the introduction of the sample. Since: commit bce617edecad ("mm: do page fault accounting in handle_mm_fault") handle_mm_fault now has 4 arguments. Therefore, the sample trampoline should save 4 argument registers. s390 saves all argument registers already so it does not need a change but x86_64 needs an extra push and pop. This also evolves the signature of the tracing function to make it mirror the signature of the traced function. Link: https://lkml.kernel.org/r/20230427140700.625241-2-revest@chromium.org Cc: stable@vger.kernel.org Fixes: bce617edecad ("mm: do page fault accounting in handle_mm_fault") Reviewed-by: Steven Rostedt (Google) Reviewed-by: Mark Rutland Acked-by: Catalin Marinas Signed-off-by: Florent Revest Signed-off-by: Steven Rostedt (Google) commit dceaafd668812115037fc13a1893d068b7b880f5 Author: Stafford Horne Date: Wed Jun 28 17:54:40 2023 +0100 openrisc: Union fpcsr and oldmask in sigcontext to unbreak userspace ABI With commit 27267655c531 ("openrisc: Support floating point user api") I added an entry to the struct sigcontext which caused an unwanted change to the userspace ABI. To fix this we use the previously unused oldmask field space for the floating point fpcsr state. We do this with a union to restore the ABI back to the pre kernel v6.4 ABI and keep API compatibility. This does mean if there is some code somewhere that is setting oldmask in an OpenRISC specific userspace sighandler it would end up setting the floating point register status, but I think it's unlikely as oldmask was never functional before. Fixes: 27267655c531 ("openrisc: Support floating point user api") Reported-by: Szabolcs Nagy Closes: https://lore.kernel.org/openrisc/20230626213840.GA1236108@port70.net/ Signed-off-by: Stafford Horne commit 3f01e9fed8454dcd89727016c3e5b2fbb8f8e50c Merge: 419caed6cc77f 2500df55a615f Author: Linus Torvalds Date: Mon Jul 10 10:04:26 2023 -0700 Merge tag 'linux-watchdog-6.5-rc2' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog update from Wim Van Sebroeck: - Add Loongson-1 watchdog dt-bindings * tag 'linux-watchdog-6.5-rc2' of git://www.linux-watchdog.org/linux-watchdog: dt-bindings: watchdog: Add Loongson-1 watchdog commit 419caed6cc77f19148faefe13515f8685ede219b Merge: 06c2afb862f9d 0b7ec177b5898 Author: Linus Torvalds Date: Mon Jul 10 09:53:11 2023 -0700 Merge tag 'v6.5-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "Fix a couple of regressions in af_alg and incorrect return values in crypto/asymmetric_keys/public_key" * tag 'v6.5-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: algif_hash - Fix race between MORE and non-MORE sends KEYS: asymmetric: Fix error codes crypto: af_alg - Fix merging of written data into spliced pages commit dc8cbb65dc17b0daebca84375d35ce54ff730762 Author: Jens Axboe Date: Mon Jul 10 10:23:05 2023 -0600 block: remove dead struc request->completion_data field It's no longer used. While in there, also update the comment as to why it can coexist with the rb_node. Signed-off-by: Jens Axboe commit b938e6603660652dc3db66d3c915fbfed3bce21d Author: Ankit Kumar Date: Fri Jun 23 18:08:05 2023 +0530 nvme: fix the NVME_ID_NS_NVM_STS_MASK definition As per NVMe command set specification 1.0c Storage tag size is 7 bits. Fixes: 4020aad85c67 ("nvme: add support for enhanced metadata") Signed-off-by: Ankit Kumar Reviewed-by: Kanchan Joshi Signed-off-by: Keith Busch commit 0bcc62858d6ba62cbade957d69745e6adeed5f3d Author: Florian Kauer Date: Wed Jun 14 16:07:14 2023 +0200 igc: Fix inserting of empty frame for launchtime The insertion of an empty frame was introduced with commit db0b124f02ba ("igc: Enhance Qbv scheduling by using first flag bit") in order to ensure that the current cycle has at least one packet if there is some packet to be scheduled for the next cycle. However, the current implementation does not properly check if a packet is already scheduled for the current cycle. Currently, an empty packet is always inserted if and only if txtime >= end_of_cycle && txtime > last_tx_cycle but since last_tx_cycle is always either the end of the current cycle (end_of_cycle) or the end of a previous cycle, the second part (txtime > last_tx_cycle) is always true unless txtime == last_tx_cycle. What actually needs to be checked here is if the last_tx_cycle was already written within the current cycle, so an empty frame should only be inserted if and only if txtime >= end_of_cycle && end_of_cycle > last_tx_cycle. This patch does not only avoid an unnecessary insertion, but it can actually be harmful to insert an empty packet if packets are already scheduled in the current cycle, because it can lead to a situation where the empty packet is actually processed as the first packet in the upcoming cycle shifting the packet with the first_flag even one cycle into the future, finally leading to a TX hang. The TX hang can be reproduced on a i225 with: sudo tc qdisc replace dev enp1s0 parent root handle 100 taprio \ num_tc 1 \ map 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 \ queues 1@0 \ base-time 0 \ sched-entry S 01 300000 \ flags 0x1 \ txtime-delay 500000 \ clockid CLOCK_TAI sudo tc qdisc replace dev enp1s0 parent 100:1 etf \ clockid CLOCK_TAI \ delta 500000 \ offload \ skip_sock_check and traffic generator sudo trafgen -i traffic.cfg -o enp1s0 --cpp -n0 -q -t1400ns with traffic.cfg #define ETH_P_IP 0x0800 { /* Ethernet Header */ 0x30, 0x1f, 0x9a, 0xd0, 0xf0, 0x0e, # MAC Dest - adapt as needed 0x24, 0x5e, 0xbe, 0x57, 0x2e, 0x36, # MAC Src - adapt as needed const16(ETH_P_IP), /* IPv4 Header */ 0b01000101, 0, # IPv4 version, IHL, TOS const16(1028), # IPv4 total length (UDP length + 20 bytes (IP header)) const16(2), # IPv4 ident 0b01000000, 0, # IPv4 flags, fragmentation off 64, # IPv4 TTL 17, # Protocol UDP csumip(14, 33), # IPv4 checksum /* UDP Header */ 10, 0, 48, 1, # IP Src - adapt as needed 10, 0, 48, 10, # IP Dest - adapt as needed const16(5555), # UDP Src Port const16(6666), # UDP Dest Port const16(1008), # UDP length (UDP header 8 bytes + payload length) csumudp(14, 34), # UDP checksum /* Payload */ fill('W', 1000), } and the observed message with that is for example igc 0000:01:00.0 enp1s0: Detected Tx Unit Hang Tx Queue <0> TDH <32> TDT <3c> next_to_use <3c> next_to_clean <32> buffer_info[next_to_clean] time_stamp next_to_watch <00000000632a1828> jiffies desc.status <1048000> Fixes: db0b124f02ba ("igc: Enhance Qbv scheduling by using first flag bit") Signed-off-by: Florian Kauer Reviewed-by: Kurt Kanzenbach Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit c1bca9ac0bcb355be11354c2e68bc7bf31f5ac5a Author: Florian Kauer Date: Wed Jun 14 16:07:13 2023 +0200 igc: Fix launchtime before start of cycle It is possible (verified on a running system) that frames are processed by igc_tx_launchtime with a txtime before the start of the cycle (baset_est). However, the result of txtime - baset_est is written into a u32, leading to a wrap around to a positive number. The following launchtime > 0 check will only branch to executing launchtime = 0 if launchtime is already 0. Fix it by using a s32 before checking launchtime > 0. Fixes: db0b124f02ba ("igc: Enhance Qbv scheduling by using first flag bit") Signed-off-by: Florian Kauer Reviewed-by: Kurt Kanzenbach Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit 8b86f10ab64eca0287ea8f7c94e9ad8b2e101c01 Author: Florian Kauer Date: Wed Jun 14 16:07:12 2023 +0200 igc: No strict mode in pure launchtime/CBS offload The flags IGC_TXQCTL_STRICT_CYCLE and IGC_TXQCTL_STRICT_END prevent the packet transmission over slot and cycle boundaries. This is important for taprio offload where the slots and cycles correspond to the slots and cycles configured for the network. However, the Qbv offload feature of the i225 is also used for enabling TX launchtime / ETF offload. In that case, however, the cycle has no meaning for the network and is only used internally to adapt the base time register after a second has passed. Enabling strict mode in this case would unnecessarily prevent the transmission of certain packets (i.e. at the boundary of a second) and thus interferes with the ETF qdisc that promises transmission at a certain point in time. Similar to ETF, this also applies to CBS offload that also should not be influenced by strict mode unless taprio offload would be enabled at the same time. This fully reverts commit d8f45be01dd9 ("igc: Use strict cycles for Qbv scheduling") but its commit message only describes what was already implemented before that commit. The difference to a plain revert of that commit is that it now copes with the base_time = 0 case that was fixed with commit e17090eb2494 ("igc: allow BaseTime 0 enrollment for Qbv") In particular, enabling strict mode leads to TX hang situations under high traffic if taprio is applied WITHOUT taprio offload but WITH ETF offload, e.g. as in sudo tc qdisc replace dev enp1s0 parent root handle 100 taprio \ num_tc 1 \ map 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 \ queues 1@0 \ base-time 0 \ sched-entry S 01 300000 \ flags 0x1 \ txtime-delay 500000 \ clockid CLOCK_TAI sudo tc qdisc replace dev enp1s0 parent 100:1 etf \ clockid CLOCK_TAI \ delta 500000 \ offload \ skip_sock_check and traffic generator sudo trafgen -i traffic.cfg -o enp1s0 --cpp -n0 -q -t1400ns with traffic.cfg #define ETH_P_IP 0x0800 { /* Ethernet Header */ 0x30, 0x1f, 0x9a, 0xd0, 0xf0, 0x0e, # MAC Dest - adapt as needed 0x24, 0x5e, 0xbe, 0x57, 0x2e, 0x36, # MAC Src - adapt as needed const16(ETH_P_IP), /* IPv4 Header */ 0b01000101, 0, # IPv4 version, IHL, TOS const16(1028), # IPv4 total length (UDP length + 20 bytes (IP header)) const16(2), # IPv4 ident 0b01000000, 0, # IPv4 flags, fragmentation off 64, # IPv4 TTL 17, # Protocol UDP csumip(14, 33), # IPv4 checksum /* UDP Header */ 10, 0, 48, 1, # IP Src - adapt as needed 10, 0, 48, 10, # IP Dest - adapt as needed const16(5555), # UDP Src Port const16(6666), # UDP Dest Port const16(1008), # UDP length (UDP header 8 bytes + payload length) csumudp(14, 34), # UDP checksum /* Payload */ fill('W', 1000), } and the observed message with that is for example igc 0000:01:00.0 enp1s0: Detected Tx Unit Hang Tx Queue <0> TDH TDT next_to_use next_to_clean buffer_info[next_to_clean] time_stamp next_to_watch <00000000245a4efb> jiffies desc.status <1048000> Fixes: d8f45be01dd9 ("igc: Use strict cycles for Qbv scheduling") Signed-off-by: Florian Kauer Reviewed-by: Kurt Kanzenbach Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit ed9492dfef8738ca68879f5690dda5a04f1897dc Author: Li zeming Date: Wed Jul 12 02:53:53 2023 +0800 kernel: kprobes: Remove unnecessary ‘0’ values it is assigned first, so it does not need to initialize the assignment. Link: https://lore.kernel.org/all/20230711185353.3218-1-zeming@nfschina.com/ Signed-off-by: Li zeming Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) commit e1164787f22b51010cfdc6a5e41b744435836b79 Author: Li zeming Date: Wed Jul 5 03:43:59 2023 +0800 kprobes: Remove unnecessary ‘NULL’ values from correct_ret_addr The 'correct_ret_addr' pointer is always set in the later code, no need to initialize it at definition time. Link: https://lore.kernel.org/all/20230704194359.3124-1-zeming@nfschina.com/ Signed-off-by: Li zeming Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) commit 5f0c584daf7464f04114c65dd07269ee2bfedc13 Author: Ze Gao Date: Mon Jul 3 17:23:36 2023 +0800 fprobe: add unlock to match a succeeded ftrace_test_recursion_trylock Unlock ftrace recursion lock when fprobe_kprobe_handler() is failed because of some running kprobe. Link: https://lore.kernel.org/all/20230703092336.268371-1-zegao@tencent.com/ Fixes: 3cc4e2c5fbae ("fprobe: make fprobe_kprobe_handler recursion free") Reported-by: Yafang Closes: https://lore.kernel.org/linux-trace-kernel/CALOAHbC6UpfFOOibdDiC7xFc5YFUgZnk3MZ=3Ny6we=AcrNbew@mail.gmail.com/ Signed-off-by: Ze Gao Acked-by: Masami Hiramatsu (Google) Acked-by: Yafang Shao Reviewed-by: Steven Rostedt (Google) Signed-off-by: Masami Hiramatsu (Google) commit 9bcf156f5897e91e21be54960b46774f0682afad Author: Damien Le Moal Date: Fri Jul 7 09:32:22 2023 +0900 nvmet: use PAGE_SECTORS_SHIFT Replace occurences of the pattern "PAGE_SHIFT - 9" in the passthru and loop targets with PAGE_SECTORS_SHIFT. Signed-off-by: Damien Le Moal Reviewed-by: Chaitanya Kulkarni Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit cf0a624dc706c306294c14e6b3e7694702f25191 Author: Tzvetomir Stoyanov (VMware) Date: Mon Jul 3 07:28:53 2023 +0300 kernel/trace: Fix cleanup logic of enable_trace_eprobe The enable_trace_eprobe() function enables all event probes, attached to given trace probe. If an error occurs in enabling one of the event probes, all others should be roll backed. There is a bug in that roll back logic - instead of all event probes, only the failed one is disabled. Link: https://lore.kernel.org/all/20230703042853.1427493-1-tz.stoyanov@gmail.com/ Reported-by: Dan Carpenter Fixes: 7491e2c44278 ("tracing: Add a probe that attaches to trace events") Signed-off-by: Tzvetomir Stoyanov (VMware) Acked-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) Signed-off-by: Masami Hiramatsu (Google) commit e5bb0988a5b622f58cc53dbdc044562229284d23 Author: Pankaj Raghav Date: Tue Jul 4 09:36:56 2023 +0200 nvme: add BOGUS_NID quirk for Samsung SM953 Add the quirk as SM953 is reporting bogus namespace ID. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217593 Reported-by: Clemens Springsguth Tested-by: Clemens Springsguth Signed-off-by: Pankaj Raghav Signed-off-by: Keith Busch commit e5d88c53d03f8df864776431175d08c053645f50 Author: Florian Kauer Date: Wed Jun 14 16:07:11 2023 +0200 igc: Handle already enabled taprio offload for basetime 0 Since commit e17090eb2494 ("igc: allow BaseTime 0 enrollment for Qbv") it is possible to enable taprio offload with a basetime of 0. However, the check if taprio offload is already enabled (and thus -EALREADY should be returned for igc_save_qbv_schedule) still relied on adapter->base_time > 0. This can be reproduced as follows: # TAPRIO offload (flags == 0x2) and base-time = 0 sudo tc qdisc replace dev enp1s0 parent root handle 100 stab overhead 24 taprio \ num_tc 1 \ map 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 \ queues 1@0 \ base-time 0 \ sched-entry S 01 300000 \ flags 0x2 # The second call should fail with "Error: Device failed to setup taprio offload." # But that only happens if base-time was != 0 sudo tc qdisc replace dev enp1s0 parent root handle 100 stab overhead 24 taprio \ num_tc 1 \ map 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 \ queues 1@0 \ base-time 0 \ sched-entry S 01 300000 \ flags 0x2 Fixes: e17090eb2494 ("igc: allow BaseTime 0 enrollment for Qbv") Signed-off-by: Florian Kauer Reviewed-by: Kurt Kanzenbach Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit 82ff5f29b7377d614f0c01fd74b5d0cb225f0adc Author: Florian Kauer Date: Wed Jun 14 16:07:10 2023 +0200 igc: Do not enable taprio offload for invalid arguments Only set adapter->taprio_offload_enable after validating the arguments. Otherwise, it stays set even if the offload was not enabled. Since the subsequent code does not get executed in case of invalid arguments, it will not be read at first. However, by activating and then deactivating another offload (e.g. ETF/TX launchtime offload), taprio_offload_enable is read and erroneously keeps the offload feature of the NIC enabled. This can be reproduced as follows: # TAPRIO offload (flags == 0x2) and negative base-time leading to expected -ERANGE sudo tc qdisc replace dev enp1s0 parent root handle 100 stab overhead 24 taprio \ num_tc 1 \ map 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 \ queues 1@0 \ base-time -1000 \ sched-entry S 01 300000 \ flags 0x2 # IGC_TQAVCTRL is 0x0 as expected (iomem=relaxed for reading register) sudo pcimem /sys/bus/pci/devices/0000:01:00.0/resource0 0x3570 w*1 # Activate ETF offload sudo tc qdisc replace dev enp1s0 parent root handle 6666 mqprio \ num_tc 3 \ map 2 2 1 0 2 2 2 2 2 2 2 2 2 2 2 2 \ queues 1@0 1@1 2@2 \ hw 0 sudo tc qdisc add dev enp1s0 parent 6666:1 etf \ clockid CLOCK_TAI \ delta 500000 \ offload # IGC_TQAVCTRL is 0x9 as expected sudo pcimem /sys/bus/pci/devices/0000:01:00.0/resource0 0x3570 w*1 # Deactivate ETF offload again sudo tc qdisc delete dev enp1s0 parent 6666:1 # IGC_TQAVCTRL should now be 0x0 again, but is observed as 0x9 sudo pcimem /sys/bus/pci/devices/0000:01:00.0/resource0 0x3570 w*1 Fixes: e17090eb2494 ("igc: allow BaseTime 0 enrollment for Qbv") Signed-off-by: Florian Kauer Reviewed-by: Kurt Kanzenbach Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit 8046063df887bee35c002224267ba46f41be7cf6 Author: Florian Kauer Date: Wed Jun 14 16:07:09 2023 +0200 igc: Rename qbv_enable to taprio_offload_enable In the current implementation the flags adapter->qbv_enable and IGC_FLAG_TSN_QBV_ENABLED have a similar name, but do not have the same meaning. The first one is used only to indicate taprio offload (i.e. when igc_save_qbv_schedule was called), while the second one corresponds to the Qbv mode of the hardware. However, the second one is also used to support the TX launchtime feature, i.e. ETF qdisc offload. This leads to situations where adapter->qbv_enable is false, but the flag IGC_FLAG_TSN_QBV_ENABLED is set. This is prone to confusion. The rename should reduce this confusion. Since it is a pure rename, it has no impact on functionality. Fixes: e17090eb2494 ("igc: allow BaseTime 0 enrollment for Qbv") Signed-off-by: Florian Kauer Reviewed-by: Kurt Kanzenbach Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit df9d70c18616760c6504b97fec66b6379c172dbb Author: Bharath SM Date: Fri Jul 7 15:29:01 2023 +0000 cifs: if deferred close is disabled then close files immediately If defer close timeout value is set to 0, then there is no need to include files in the deferred close list and utilize the delayed worker for closing. Instead, we can close them immediately. Signed-off-by: Bharath SM Reviewed-by: Shyam Prasad N Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 7e08baf6a89c8758050a3593aedc949f44fe3413 Author: Baoquan He Date: Fri Jul 7 21:58:52 2023 +0800 of: make OF_EARLY_FLATTREE depend on HAS_IOMEM On s390 systems (aka mainframes), it has classic channel devices for networking and permanent storage that are currently even more common than PCI devices. Hence it could have a fully functional s390 kernel with CONFIG_PCI=n, then the relevant iomem mapping functions [including ioremap(), devm_ioremap(), etc.] are not available. In LKP error report at below on s390: ------ ld: kernel/dma/coherent.o: in function `dma_init_coherent_memory': coherent.c:(.text+0x102): undefined reference to `memremap' ld: coherent.c:(.text+0x226): undefined reference to `memunmap' ld: kernel/dma/coherent.o: in function `dma_declare_coherent_memory': coherent.c:(.text+0x8b8): undefined reference to `memunmap' ld: kernel/dma/coherent.o: in function `dma_release_coherent_memory': coherent.c:(.text+0x9aa): undefined reference to `memunmap' ------ In the config file, several Kconfig options are: ------ '# CONFIG_PCI is not set' CONFIG_OF_EARLY_FLATTREE=y CONFIG_DMA_DECLARE_COHERENT=y ------ So, enabling OF_EARLY_FLATTREE will select DMA_DECLARE_COHERENT and cause above building errors even though they are not needed because CONFIG_PCI is disabled. Here let OF_EARLY_FLATTREE depend on HAS_IOMEM so that it won't be built to cause compiling error if PCI is unset. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306211329.ticOJCSv-lkp@intel.com/ Signed-off-by: Baoquan He Cc: Rob Herring Cc: Frank Rowand Cc: devicetree@vger.kernel.org Link: https://lore.kernel.org/r/20230707135852.24292-9-bhe@redhat.com Signed-off-by: Rob Herring commit f99a75f11f46a24dabb33e90893eebf61dca0566 Author: Krzysztof Kozlowski Date: Sun Jul 2 20:52:42 2023 +0200 arm64: dts: rockchip: minor whitespace cleanup around '=' The DTS code coding style expects exactly one space before and after '=' sign. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230702185242.44421-1-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner commit 2bd1d2dd808c60532283e9cf05110bf1bf2f9079 Author: Christopher Obbard Date: Wed Jul 5 15:42:55 2023 +0100 arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+ There is some instablity with some eMMC modules on ROCK Pi 4 SBCs running in HS400 mode. This ends up resulting in some block errors after a while or after a "heavy" operation utilising the eMMC (e.g. resizing a filesystem). An example of these errors is as follows: [ 289.171014] mmc1: running CQE recovery [ 290.048972] mmc1: running CQE recovery [ 290.054834] mmc1: running CQE recovery [ 290.060817] mmc1: running CQE recovery [ 290.061337] blk_update_request: I/O error, dev mmcblk1, sector 1411072 op 0x1:(WRITE) flags 0x800 phys_seg 36 prio class 0 [ 290.061370] EXT4-fs warning (device mmcblk1p1): ext4_end_bio:348: I/O error 10 writing to inode 29547 starting block 176466) [ 290.061484] Buffer I/O error on device mmcblk1p1, logical block 172288 [ 290.061531] Buffer I/O error on device mmcblk1p1, logical block 172289 [ 290.061551] Buffer I/O error on device mmcblk1p1, logical block 172290 [ 290.061574] Buffer I/O error on device mmcblk1p1, logical block 172291 [ 290.061592] Buffer I/O error on device mmcblk1p1, logical block 172292 [ 290.061615] Buffer I/O error on device mmcblk1p1, logical block 172293 [ 290.061632] Buffer I/O error on device mmcblk1p1, logical block 172294 [ 290.061654] Buffer I/O error on device mmcblk1p1, logical block 172295 [ 290.061673] Buffer I/O error on device mmcblk1p1, logical block 172296 [ 290.061695] Buffer I/O error on device mmcblk1p1, logical block 172297 Disabling the Command Queue seems to stop the CQE recovery from running, but doesn't seem to improve the I/O errors. Until this can be investigated further, disable HS400 mode on the ROCK Pi 4 SBCs to at least stop I/O errors from occurring. Fixes: 246450344dad ("arm64: dts: rockchip: rk3399: Radxa ROCK 4C+") Signed-off-by: Christopher Obbard Link: https://lore.kernel.org/r/20230705144255.115299-3-chris.obbard@collabora.com Signed-off-by: Heiko Stuebner commit cee572756aa2cb46e959e9797ad4b730b78a050b Author: Christopher Obbard Date: Wed Jul 5 15:42:54 2023 +0100 arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4 There is some instablity with some eMMC modules on ROCK Pi 4 SBCs running in HS400 mode. This ends up resulting in some block errors after a while or after a "heavy" operation utilising the eMMC (e.g. resizing a filesystem). An example of these errors is as follows: [ 289.171014] mmc1: running CQE recovery [ 290.048972] mmc1: running CQE recovery [ 290.054834] mmc1: running CQE recovery [ 290.060817] mmc1: running CQE recovery [ 290.061337] blk_update_request: I/O error, dev mmcblk1, sector 1411072 op 0x1:(WRITE) flags 0x800 phys_seg 36 prio class 0 [ 290.061370] EXT4-fs warning (device mmcblk1p1): ext4_end_bio:348: I/O error 10 writing to inode 29547 starting block 176466) [ 290.061484] Buffer I/O error on device mmcblk1p1, logical block 172288 [ 290.061531] Buffer I/O error on device mmcblk1p1, logical block 172289 [ 290.061551] Buffer I/O error on device mmcblk1p1, logical block 172290 [ 290.061574] Buffer I/O error on device mmcblk1p1, logical block 172291 [ 290.061592] Buffer I/O error on device mmcblk1p1, logical block 172292 [ 290.061615] Buffer I/O error on device mmcblk1p1, logical block 172293 [ 290.061632] Buffer I/O error on device mmcblk1p1, logical block 172294 [ 290.061654] Buffer I/O error on device mmcblk1p1, logical block 172295 [ 290.061673] Buffer I/O error on device mmcblk1p1, logical block 172296 [ 290.061695] Buffer I/O error on device mmcblk1p1, logical block 172297 Disabling the Command Queue seems to stop the CQE recovery from running, but doesn't seem to improve the I/O errors. Until this can be investigated further, disable HS400 mode on the ROCK Pi 4 SBCs to at least stop I/O errors from occurring. While we are here, set the eMMC maximum clock frequency to 1.5MHz to follow the ROCK 4C+. Fixes: 1b5715c602fd ("arm64: dts: rockchip: add ROCK Pi 4 DTS support") Signed-off-by: Christopher Obbard Tested-By: Folker Schwesinger Link: https://lore.kernel.org/r/20230705144255.115299-2-chris.obbard@collabora.com Signed-off-by: Heiko Stuebner commit 5ce6971e5279c569defc2f2ac800692049bbaa90 Author: Krzysztof Kozlowski Date: Wed Jul 5 16:58:59 2023 +0200 arm64: dts: rockchip: add missing space before { on indiedroid nova Add missing whitespace between node name/label and opening {. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230705145859.293260-1-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner commit 2d6f7e3938a7aba154c8e8afaddc8b7f1e0a1b56 Author: Krzysztof Kozlowski Date: Fri Jul 7 08:33:35 2023 +0200 arm64: dts: rockchip: correct wifi interrupt flag in Box Demo GPIO_ACTIVE_x flags are not correct in the context of interrupt flags. These are simple defines so they could be used in DTS but they will not have the same meaning: GPIO_ACTIVE_HIGH = 0 = IRQ_TYPE_NONE. Correct the interrupt flags, assuming the author of the code wanted same logical behavior behind the name "ACTIVE_xxx", this is: ACTIVE_HIGH => IRQ_TYPE_LEVEL_HIGH Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230707063335.13317-3-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner commit cfa12c32b96fd5b12f77d880d6a1ddd2a502756e Author: Krzysztof Kozlowski Date: Fri Jul 7 08:33:34 2023 +0200 arm64: dts: rockchip: correct wifi interrupt flag in Rock Pi 4B GPIO_ACTIVE_x flags are not correct in the context of interrupt flags. These are simple defines so they could be used in DTS but they will not have the same meaning: GPIO_ACTIVE_HIGH = 0 = IRQ_TYPE_NONE. Correct the interrupt flags, assuming the author of the code wanted same logical behavior behind the name "ACTIVE_xxx", this is: ACTIVE_HIGH => IRQ_TYPE_LEVEL_HIGH Signed-off-by: Krzysztof Kozlowski Tested-by: Christopher Obbard Link: https://lore.kernel.org/r/20230707063335.13317-2-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner commit 8183bb7e291b7818f49ea39687c2fafa01a46e27 Author: Krzysztof Kozlowski Date: Fri Jul 7 08:33:33 2023 +0200 arm64: dts: rockchip: correct wifi interrupt flag in eaidk-610 GPIO_ACTIVE_x flags are not correct in the context of interrupt flags. These are simple defines so they could be used in DTS but they will not have the same meaning: GPIO_ACTIVE_HIGH = 0 = IRQ_TYPE_NONE. Correct the interrupt flags, assuming the author of the code wanted same logical behavior behind the name "ACTIVE_xxx", this is: ACTIVE_HIGH => IRQ_TYPE_LEVEL_HIGH Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230707063335.13317-1-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner commit 9ecedaf6f82acf9e0d68932da2a72aefcf0b7176 Author: Tom Rix Date: Sun Jul 2 09:44:19 2023 -0400 platform/x86: int3472/discrete: set variable skl_int3472_regulator_second_sensor storage-class-specifier to static smatch reports drivers/platform/x86/intel/int3472/clk_and_regulator.c:263:28: warning: symbol 'skl_int3472_regulator_second_sensor' was not declared. Should it be static? This variable is only used in its defining file, so it should be static. Signed-off-by: Tom Rix Link: https://lore.kernel.org/r/20230702134419.3438361-1-trix@redhat.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 5b2a4a4394ce96fb01a282dd58e263d02218db03 Author: Srinivas Pandruvada Date: Thu Jun 22 12:57:17 2023 -0700 platform/x86/intel/tpmi: Prevent overflow for cap_offset cap_offset is a u16 field, so multiplying with TPMI_CAP_OFFSET_UNIT (which is equal to 1024) to covert to bytes will cause overflow. This will be a problem once more TPMI features are added. This field is not used except for calculating pfs->vsec_offset. So, leave cap_offset field unchanged and multiply with TPMI_CAP_OFFSET_UNIT while calculating pfs->vsec_offset. Signed-off-by: Srinivas Pandruvada Link: https://lore.kernel.org/r/20230622195717.3125088-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 95f41d87810083d8b3dedcce46a4e356cf4a9673 Author: Christophe JAILLET Date: Tue Apr 25 08:47:27 2023 +0200 fs/9p: Fix a datatype used with V9FS_DIRECT_IO The commit in Fixes has introduced some "enum p9_session_flags" values larger than a char. Such values are stored in "v9fs_session_info->flags" which is a char only. Turn it into an int so that the "enum p9_session_flags" values can fit in it. Fixes: 6deffc8924b5 ("fs/9p: Add new mount modes") Signed-off-by: Christophe JAILLET Reviewed-by: Dominique Martinet Reviewed-by: Christian Schoenebeck Signed-off-by: Eric Van Hensbergen commit 6bf06f14bf33d668ee0eb85b6c414d85a0f8e1a5 Author: Andy Shevchenko Date: Wed Jun 21 18:11:55 2023 +0300 platform/x86: wmi: Replace open coded guid_parse_and_compare() Even though we have no issues in the code, let's replace the open coded guid_parse_and_compare(). Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230621151155.78279-2-andriy.shevchenko@linux.intel.com Tested-by: Armin Wolf Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit 028e6e204ace1f080cfeacd72c50397eb8ae8883 Author: Andy Shevchenko Date: Wed Jun 21 18:11:54 2023 +0300 platform/x86: wmi: Break possible infinite loop when parsing GUID The while-loop may break on one of the two conditions, either ID string is empty or GUID matches. The second one, may never be reached if the parsed string is not correct GUID. In such a case the loop will never advance to check the next ID. Break possible infinite loop by factoring out guid_parse_and_compare() helper which may be moved to the generic header for everyone later on and preventing from similar mistake in the future. Interestingly that firstly it appeared when WMI was turned into a bus driver, but later when duplicated GUIDs were checked, the while-loop has been replaced by for-loop and hence no mistake made again. Fixes: a48e23385fcf ("platform/x86: wmi: add context pointer field to struct wmi_device_id") Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver") Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230621151155.78279-1-andriy.shevchenko@linux.intel.com Tested-by: Armin Wolf Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede commit a2848d08742c8e8494675892c02c0d22acbe3cf8 Author: Christian König Date: Fri Jul 7 11:25:00 2023 +0200 drm/ttm: never consider pinned BOs for eviction&swap There is a small window where we have already incremented the pin count but not yet moved the bo from the lru to the pinned list. Signed-off-by: Christian König Reported-by: Pelloux-Prayer, Pierre-Eric Tested-by: Pelloux-Prayer, Pierre-Eric Acked-by: Alex Deucher Cc: stable@vger.kernel.org Link: https://patchwork.freedesktop.org/patch/msgid/20230707120826.3701-1-christian.koenig@amd.com commit 4d08b19629495b29601991d09d07865694c25199 Author: Cristian Ciocaltea Date: Fri Jul 7 19:22:17 2023 +0300 arm64: dts: rockchip: Drop invalid regulator-init-microvolt property The 'regulator-init-microvolt' property is not currently supported by any driver, it was simply carried on from downstream kernels. The problem is also indicated by the following dtbs_check warning: rk3588-rock-5b.dtb: pmic@0: regulators:dcdc-reg4: Unevaluated properties are not allowed ('regulator-init-microvolt' was unexpected) Remove the invalid property from all affected DTS files. Signed-off-by: Cristian Ciocaltea Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: David Heidelberg Link: https://lore.kernel.org/r/20230707162217.675390-1-cristian.ciocaltea@collabora.com Signed-off-by: Heiko Stuebner commit d1478aea649e739a0a0e4890cd8b049ae5d08c13 Author: Thierry Reding Date: Thu Jun 29 18:01:32 2023 +0200 memory: tegra: Add dummy implementation on Tegra194 With the introduction of commit 9365bf006f53 ("PCI: tegra194: Add interconnect support in Tegra234"), the PCI driver on Tegra194 and later requires an interconnect provider. However, a provider is currently only exposed on Tegra234 and this causes PCI on Tegra194 to defer probe indefinitely. Fix this by adding a dummy implementation on Tegra194. This allows nodes to be provided to interconnect consumers, but doesn't do any bandwidth accounting or frequency scaling. Fixes: 9365bf006f53 ("PCI: tegra194: Add interconnect support in Tegra234") Reported-by: Jon Hunter Signed-off-by: Thierry Reding Reviewed-by: Sumit Gupta Tested-by: Sumit Gupta Link: https://lore.kernel.org/r/20230629160132.768940-1-thierry.reding@gmail.com Signed-off-by: Krzysztof Kozlowski commit 57010b8ece2821a1fdfdba2197d14a022f3769db Author: Herbert Xu Date: Tue Jul 4 08:53:49 2023 +0800 xfrm: Silence warnings triggerable by bad packets After the elimination of inner modes, a couple of warnings that were previously unreachable can now be triggered by malformed inbound packets. Fix this by: 1. Moving the setting of skb->protocol into the decap functions. 2. Returning -EINVAL when unexpected protocol is seen. Reported-by: Maciej Żenczykowski Fixes: 5f24f41e8ea6 ("xfrm: Remove inner/outer modes from input path") Signed-off-by: Herbert Xu Reviewed-by: Maciej Żenczykowski Signed-off-by: Steffen Klassert commit 5158814cbb37bbb38344b3ecddc24ba2ed0365f2 Author: Jonas Gorski Date: Thu Jun 29 09:14:52 2023 +0200 spi: bcm63xx: fix max prepend length The command word is defined as following: /* Command */ #define SPI_CMD_COMMAND_SHIFT 0 #define SPI_CMD_DEVICE_ID_SHIFT 4 #define SPI_CMD_PREPEND_BYTE_CNT_SHIFT 8 #define SPI_CMD_ONE_BYTE_SHIFT 11 #define SPI_CMD_ONE_WIRE_SHIFT 12 If the prepend byte count field starts at bit 8, and the next defined bit is SPI_CMD_ONE_BYTE at bit 11, it can be at most 3 bits wide, and thus the max value is 7, not 15. Fixes: b17de076062a ("spi/bcm63xx: work around inability to keep CS up") Signed-off-by: Jonas Gorski Link: https://lore.kernel.org/r/20230629071453.62024-1-jonas.gorski@gmail.com Signed-off-by: Mark Brown commit c09168c9392ac9250d87d71fc5ca3156f7456ea4 Author: Ryan Wanner Date: Fri Jun 30 09:17:00 2023 -0700 MAINTAINERS: Add myself as a maintainer for Microchip SPI Tudor is not with Microchip anymore. I have worked lately with Microchip SPI drivers replacing Tudor with myself as this maintainer. Signed-off-by: Ryan Wanner Acked-by: Nicolas Ferre Acked-by: Tudor Ambarus Link: https://lore.kernel.org/r/20230630161700.448747-1-Ryan.Wanner@microchip.com Signed-off-by: Mark Brown commit bfc374a145ae133613e05b9b89be561f169cb58d Author: Biju Das Date: Tue Jul 4 12:18:58 2023 +0100 pinctrl: renesas: rzg2l: Handle non-unique subnode names Currently, sd1 and sd0 have unique subnode names 'sd1_mux' and 'sd0_mux'. If we change these to non-unique subnode names such as 'mux' this can lead to the below conflict as the RZ/G2L pin control driver considers only the names of the subnodes. pinctrl-rzg2l 11030000.pinctrl: pin P47_0 already requested by 11c00000.mmc; cannot claim for 11c10000.mmc pinctrl-rzg2l 11030000.pinctrl: pin-376 (11c10000.mmc) status -22 pinctrl-rzg2l 11030000.pinctrl: could not request pin 376 (P47_0) from group mux on device pinctrl-rzg2l renesas_sdhi_internal_dmac 11c10000.mmc: Error applying setting, reverse things back Fix this by constructing unique names from the node names of both the pin control configuration node and its child node, where appropriate. Based on the work done by Geert for the RZ/V2M pinctrl driver. Fixes: c4c4637eb57f ("pinctrl: renesas: Add RZ/G2L pin and gpio controller driver") Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230704111858.215278-1-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit f46a0b47cc0829acd050213194c5a77351e619b2 Author: Geert Uytterhoeven Date: Mon Jul 3 17:07:06 2023 +0200 pinctrl: renesas: rzv2m: Handle non-unique subnode names The eMMC and SDHI pin control configuration nodes in DT have subnodes with the same names ("data" and "ctrl"). As the RZ/V2M pin control driver considers only the names of the subnodes, this leads to conflicts: pinctrl-rzv2m b6250000.pinctrl: pin P8_2 already requested by 85000000.mmc; cannot claim for 85020000.mmc pinctrl-rzv2m b6250000.pinctrl: pin-130 (85020000.mmc) status -22 renesas_sdhi_internal_dmac 85020000.mmc: Error applying setting, reverse things back Fix this by constructing unique names from the node names of both the pin control configuration node and its child node, where appropriate. Reported by: Fabrizio Castro Fixes: 92a9b825257614af ("pinctrl: renesas: Add RZ/V2M pin and gpio controller driver") Signed-off-by: Geert Uytterhoeven Tested-by: Fabrizio Castro Link: https://lore.kernel.org/r/607bd6ab4905b0b1b119a06ef953fa1184505777.1688396717.git.geert+renesas@glider.be commit 87854366176403438d01f368b09de3ec2234e0f5 Author: Basavaraj Natikar Date: Fri Jul 7 12:27:22 2023 +0530 HID: amd_sfh: Fix for shift-out-of-bounds Shift operation of 'exp' and 'shift' variables exceeds the maximum number of shift values in the u32 range leading to UBSAN shift-out-of-bounds. ... [ 6.120512] UBSAN: shift-out-of-bounds in drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c:149:50 [ 6.120598] shift exponent 104 is too large for 64-bit type 'long unsigned int' [ 6.120659] CPU: 4 PID: 96 Comm: kworker/4:1 Not tainted 6.4.0amd_1-next-20230519-dirty #10 [ 6.120665] Hardware name: AMD Birman-PHX/Birman-PHX, BIOS SFH_with_HPD_SEN.FD 04/05/2023 [ 6.120667] Workqueue: events amd_sfh_work_buffer [amd_sfh] [ 6.120687] Call Trace: [ 6.120690] [ 6.120694] dump_stack_lvl+0x48/0x70 [ 6.120704] dump_stack+0x10/0x20 [ 6.120707] ubsan_epilogue+0x9/0x40 [ 6.120716] __ubsan_handle_shift_out_of_bounds+0x10f/0x170 [ 6.120720] ? psi_group_change+0x25f/0x4b0 [ 6.120729] float_to_int.cold+0x18/0xba [amd_sfh] [ 6.120739] get_input_rep+0x57/0x340 [amd_sfh] [ 6.120748] ? __schedule+0xba7/0x1b60 [ 6.120756] ? __pfx_get_input_rep+0x10/0x10 [amd_sfh] [ 6.120764] amd_sfh_work_buffer+0x91/0x180 [amd_sfh] [ 6.120772] process_one_work+0x229/0x430 [ 6.120780] worker_thread+0x4a/0x3c0 [ 6.120784] ? __pfx_worker_thread+0x10/0x10 [ 6.120788] kthread+0xf7/0x130 [ 6.120792] ? __pfx_kthread+0x10/0x10 [ 6.120795] ret_from_fork+0x29/0x50 [ 6.120804] ... Fix this by adding the condition to validate shift ranges. Fixes: 93ce5e0231d7 ("HID: amd_sfh: Implement SFH1.1 functionality") Cc: stable@vger.kernel.org Tested-by: Kai-Heng Feng Signed-off-by: Basavaraj Natikar Signed-off-by: Akshata MukundShetty Link: https://lore.kernel.org/r/20230707065722.9036-3-Basavaraj.Natikar@amd.com Signed-off-by: Benjamin Tissoires commit c1685a862a4bea863537f06abaa37a123aef493c Author: Basavaraj Natikar Date: Fri Jul 7 12:27:21 2023 +0530 HID: amd_sfh: Rename the float32 variable As float32 is also used in other places as a data type, it is necessary to rename the float32 variable in order to avoid confusion. Cc: stable@vger.kernel.org Tested-by: Kai-Heng Feng Signed-off-by: Basavaraj Natikar Signed-off-by: Akshata MukundShetty Link: https://lore.kernel.org/r/20230707065722.9036-2-Basavaraj.Natikar@amd.com Signed-off-by: Benjamin Tissoires commit aff037078ecaecf34a7c2afab1341815f90fba5e Author: Suren Baghdasaryan Date: Thu Jun 29 17:56:12 2023 -0700 sched/psi: use kernfs polling functions for PSI trigger polling Destroying psi trigger in cgroup_file_release causes UAF issues when a cgroup is removed from under a polling process. This is happening because cgroup removal causes a call to cgroup_file_release while the actual file is still alive. Destroying the trigger at this point would also destroy its waitqueue head and if there is still a polling process on that file accessing the waitqueue, it will step on the freed pointer: do_select vfs_poll do_rmdir cgroup_rmdir kernfs_drain_open_files cgroup_file_release cgroup_pressure_release psi_trigger_destroy wake_up_pollfree(&t->event_wait) // vfs_poll is unblocked synchronize_rcu kfree(t) poll_freewait -> UAF access to the trigger's waitqueue head Patch [1] fixed this issue for epoll() case using wake_up_pollfree(), however the same issue exists for synchronous poll() case. The root cause of this issue is that the lifecycles of the psi trigger's waitqueue and of the file associated with the trigger are different. Fix this by using kernfs_generic_poll function when polling on cgroup-specific psi triggers. It internally uses kernfs_open_node->poll waitqueue head with its lifecycle tied to the file's lifecycle. This also renders the fix in [1] obsolete, so revert it. [1] commit c2dbe32d5db5 ("sched/psi: Fix use-after-free in ep_remove_wait_queue()") Fixes: 0e94682b73bf ("psi: introduce psi monitor") Closes: https://lore.kernel.org/all/20230613062306.101831-1-lujialin4@huawei.com/ Reported-by: Lu Jialin Signed-off-by: Suren Baghdasaryan Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20230630005612.1014540-1-surenb@google.com commit ae2ad293d6be143ad223f5f947cca07bcbe42595 Author: Miaohe Lin Date: Tue Jun 20 16:07:47 2023 +0800 sched/fair: Use recent_used_cpu to test p->cpus_ptr When checking whether a recently used CPU can be a potential idle candidate, recent_used_cpu should be used to test p->cpus_ptr as p->recent_used_cpu is not equal to recent_used_cpu and candidate decision is made based on recent_used_cpu here. Fixes: 89aafd67f28c ("sched/fair: Use prev instead of new target as recent_used_cpu") Signed-off-by: Miaohe Lin Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Phil Auld Acked-by: Mel Gorman Link: https://lore.kernel.org/r/20230620080747.359122-1-linmiaohe@huawei.com commit 719a937b7003933de1298ffa4b881dd6a234e244 Author: Peter Zijlstra Date: Fri Jun 16 14:43:55 2023 +0200 iov_iter: Mark copy_iovec_from_user() noclone Extend commit 50f9a76ef127 ("iov_iter: Mark copy_compat_iovec_from_user() noinline") to also cover copy_iovec_from_user(). Different compiler versions cause the same problem on different functions. lib/iov_iter.o: warning: objtool: .altinstr_replacement+0x1f: redundant UACCESS disable lib/iov_iter.o: warning: objtool: iovec_from_user+0x84: call to copy_iovec_from_user.part.0() with UACCESS enabled lib/iov_iter.o: warning: objtool: __import_iovec+0x143: call to copy_iovec_from_user.part.0() with UACCESS enabled Fixes: 50f9a76ef127 ("iov_iter: Mark copy_compat_iovec_from_user() noinline") Signed-off-by: Peter Zijlstra (Intel) Tested-by: Borislav Petkov (AMD) Link: https://lkml.kernel.org/r/20230616124354.GD4253@hirez.programming.kicks-ass.net commit 9f71fbcde2820f2af4658313e808cf1e579190a4 Author: Michal Kubecek Date: Thu Jun 29 12:05:05 2023 +0200 objtool: initialize all of struct elf Function elf_open_read() only zero initializes the initial part of allocated struct elf; num_relocs member was recently added outside the zeroed part so that it was left uninitialized, resulting in build failures on some systems. The partial initialization is a relic of times when struct elf had large hash tables embedded. This is no longer the case so remove the trap and initialize the whole structure instead. Fixes: eb0481bbc4ce ("objtool: Fix reloc_hash size") Signed-off-by: Michal Kubecek Signed-off-by: Peter Zijlstra (Intel) Acked-by: Josh Poimboeuf Link: https://lore.kernel.org/r/20230629102051.42E8360467@lion.mk-sys.cz commit 04505bbbbb15da950ea0239e328a76a3ad2376e0 Author: Peter Zijlstra Date: Thu Jun 15 21:35:48 2023 +0200 x86/fineibt: Poison ENDBR at +0 Alyssa noticed that when building the kernel with CFI_CLANG+IBT and booting on IBT enabled hardware to obtain FineIBT, the indirect functions look like: __cfi_foo: endbr64 subl $hash, %r10d jz 1f ud2 nop 1: foo: endbr64 This is because the compiler generates code for kCFI+IBT. In that case the caller does the hash check and will jump to +0, so there must be an ENDBR there. The compiler doesn't know about FineIBT at all; also it is possible to actually use kCFI+IBT when booting with 'cfi=kcfi' on IBT enabled hardware. Having this second ENDBR however makes it possible to elide the CFI check. Therefore, we should poison this second ENDBR when switching to FineIBT mode. Fixes: 931ab63664f0 ("x86/ibt: Implement FineIBT") Reported-by: "Milburn, Alyssa" Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kees Cook Reviewed-by: Sami Tolvanen Link: https://lore.kernel.org/r/20230615193722.194131053@infradead.org commit 3aec4ecb3d1f313a8ab985df7cab07c4af81f478 Author: Brian Gerst Date: Fri Jun 23 18:55:29 2023 -0400 x86: Rewrite ret_from_fork() in C When kCFI is enabled, special handling is needed for the indirect call to the kernel thread function. Rewrite the ret_from_fork() function in C so that the compiler can properly handle the indirect call. Suggested-by: Peter Zijlstra (Intel) Signed-off-by: Brian Gerst Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kees Cook Reviewed-by: Sami Tolvanen Link: https://lkml.kernel.org/r/20230623225529.34590-3-brgerst@gmail.com commit 81f755d561f365f544795fad92f05a085ea4f292 Author: Brian Gerst Date: Fri Jun 23 18:55:28 2023 -0400 x86/32: Remove schedule_tail_wrapper() The unwinder expects a return address at the very top of the kernel stack just below pt_regs and before any stack frame is created. Instead of calling a wrapper, set up a return address as if ret_from_fork() was called from the syscall entry code. Signed-off-by: Brian Gerst Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kees Cook Reviewed-by: Sami Tolvanen Link: https://lkml.kernel.org/r/20230623225529.34590-2-brgerst@gmail.com commit 9831c6253ace48051189f6d18a15f658f94babc2 Author: Peter Zijlstra Date: Wed Jun 21 22:17:12 2023 +0200 x86/cfi: Extend ENDBR sealing to kCFI Kees noted that IBT sealing could be extended to kCFI. Fundamentally it is the list of functions that do not have their address taken and are thus never called indirectly. It doesn't matter that objtool uses IBT infrastructure to determine this list, once we have it it can also be used to clobber kCFI hashes and avoid kCFI indirect calls. Suggested-by: Kees Cook Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kees Cook Reviewed-by: Sami Tolvanen Link: https://lkml.kernel.org/r/20230622144321.494426891%40infradead.org commit be0fffa5ca894a971a31c5e28aa77b633a97d1dc Author: Peter Zijlstra Date: Thu Jun 22 15:36:50 2023 +0200 x86/alternative: Rename apply_ibt_endbr() The current name doesn't reflect what it does very well. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kees Cook Reviewed-by: Sami Tolvanen Link: https://lkml.kernel.org/r/20230622144321.427441595%40infradead.org commit 0479a42d4c15bd554f54d89d12bf68218e3e70da Author: Peter Zijlstra Date: Thu Jun 22 16:27:13 2023 +0200 x86/cfi: Extend {JMP,CAKK}_NOSPEC comment With the introduction of kCFI these helpers are no longer equivalent to C indirect calls and should be used with care. Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kees Cook Reviewed-by: Sami Tolvanen Link: https://lkml.kernel.org/r/20230622144321.360957723%40infradead.org commit 27c68c216ee1f1b086e789a64486e6511e380b8a Author: Namhyung Kim Date: Tue Jul 4 11:15:15 2023 -0700 perf/x86: Fix lockdep warning in for_each_sibling_event() on SPR On SPR, the load latency event needs an auxiliary event in the same group to work properly. There's a check in intel_pmu_hw_config() for this to iterate sibling events and find a mem-loads-aux event. The for_each_sibling_event() has a lockdep assert to make sure if it disabled hardirq or hold leader->ctx->mutex. This works well if the given event has a separate leader event since perf_try_init_event() grabs the leader->ctx->mutex to protect the sibling list. But it can cause a problem when the event itself is a leader since the event is not initialized yet and there's no ctx for the event. Actually I got a lockdep warning when I run the below command on SPR, but I guess it could be a NULL pointer dereference. $ perf record -d -e cpu/mem-loads/uP true The code path to the warning is: sys_perf_event_open() perf_event_alloc() perf_init_event() perf_try_init_event() x86_pmu_event_init() hsw_hw_config() intel_pmu_hw_config() for_each_sibling_event() lockdep_assert_event_ctx() We don't need for_each_sibling_event() when it's a standalone event. Let's return the error code directly. Fixes: f3c0eba28704 ("perf: Add a few assertions") Reported-by: Greg Thelen Signed-off-by: Namhyung Kim Signed-off-by: Peter Zijlstra (Intel) Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20230704181516.3293665-1-namhyung@kernel.org commit 9d0aba98316d00f9c0a4506fc15f5ed9241bc1fd Author: Junfeng Guo Date: Sat Jul 8 11:14:51 2023 +0800 gve: unify driver name usage Current codebase contained the usage of two different names for this driver (i.e., `gvnic` and `gve`), which is quite unfriendly for users to use, especially when trying to bind or unbind the driver manually. The corresponding kernel module is registered with the name of `gve`. It's more reasonable to align the name of the driver with the module. Fixes: 893ce44df565 ("gve: Add basic driver framework for Compute Engine Virtual NIC") Cc: csully@google.com Signed-off-by: Junfeng Guo Signed-off-by: David S. Miller commit 989b52cdc84955c2a35bc18f53e3a83edfa6f404 Author: Azeem Shaikh Date: Mon Jul 10 03:07:11 2023 +0000 net: sched: Replace strlcpy with strscpy strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). Direct replacement is safe here since return value of -errno is used to check for truncation instead of sizeof(dest). [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh Reviewed-by: Pavan Chebbi Signed-off-by: David S. Miller commit 87355b7c3da9bfd81935caba0ab763355147f7b0 Author: Jiasheng Jiang Date: Mon Jul 10 09:39:07 2023 +0800 net: dsa: qca8k: Add check for skb_copy Add check for the return value of skb_copy in order to avoid NULL pointer dereference. Fixes: 2cd548566384 ("net: dsa: qca8k: add support for phy read/write with mgmt Ethernet") Signed-off-by: Jiasheng Jiang Reviewed-by: Pavan Chebbi Signed-off-by: David S. Miller commit 35bc3efb3157cc5a9c3b5853591c4dcef40f6029 Author: Uwe Kleine-König Date: Fri Jul 7 09:50:58 2023 +0200 ALSA: pcmtest: Don't use static storage to track per device data While there is probably only ever a single instance of such a pcmtst device, it's still bad style to use a static variable to store per device data. Make use of platform_get_drvdata() and platform_set_drvdata() which fixes a data corruption if there should be two or more such devices (or this driver is used as a template for another driver). Signed-off-by: Uwe Kleine-König Acked-by: Ivan Orlov Link: https://lore.kernel.org/r/20230707075058.3402832-2-u.kleine-koenig@pengutronix.de Signed-off-by: Takashi Iwai commit cb2bffdea267efad8d03eb680890e5fa2e93411c Author: Uwe Kleine-König Date: Fri Jul 7 09:50:57 2023 +0200 ALSA: pcmtest: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is ignored (apart from emitting a warning) and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Eventually after all drivers are converted, .remove_new() is renamed to .remove(). Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Signed-off-by: Uwe Kleine-König Acked-by: Ivan Orlov Link: https://lore.kernel.org/r/20230707075058.3402832-1-u.kleine-koenig@pengutronix.de Signed-off-by: Takashi Iwai commit 798f1df86e5709b7b6aedf493cc04c7fedbf544a Author: Dmitry Baryshkov Date: Tue Jun 13 16:12:24 2023 +0300 arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict The commit 3a786086c6f8 ("arm64: dts: qcom: Add missing "-thermal" suffix for thermal zones") renamed the thermal zone in the pm8150l.dtsi file to comply with the schema. However this resulted in a clash with the RB5 board file, which already contained the pm8150l-thermal zone for the on-board sensor. This resulted in the board file definition overriding the thermal zone defined in the PMIC include file (and thus the on-die PMIC temp alarm was not probing at all). Rename the thermal zone in qcom/qrb5165-rb5.dts to remove this override. Fixes: 3a786086c6f8 ("arm64: dts: qcom: Add missing "-thermal" suffix for thermal zones") Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230613131224.666668-1-dmitry.baryshkov@linaro.org Signed-off-by: Bjorn Andersson commit 4d29db2043610dd70be00a61f26fd64256a2a6c5 Author: Krzysztof Kozlowski Date: Mon Jun 26 16:59:59 2023 +0200 arm64: dts: qcom: sm8350: fix BAM DMA crash and reboot SM8350 HDK and MTP boards were silently dying and rebooting during BAM DMA probe, probably during reading BAM_REVISION register: [ 1.574304] vreg_bob: Setting 3008000-3960000uV [ 1.576918] bam-dFormat: Log Type - Time(microsec) - Message - Optional Info Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic S - QC_IMAGE_VERSION_STRING=BOOT.MXF.1.0-00637.1-LAHAINA-1 S - IMAGE_VARIANT_STRING=SocLahainaLAA S - OEM_IMAGE_VERSION_STRING=crm-ubuntu77 S - Boot Interface: UFS It seems that BAM DMA is not yet operational, thus mark it as failed and disable also QCE because it won't work without BAM DMA. Fixes: f1040a7fe8f0 ("arm64: dts: qcom: sm8350: Add Crypto Engine support") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230626145959.646747-1-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit 9ea2c3fba5c5b78a13bfc51d0999ff0be58baae8 Author: Krzysztof Kozlowski Date: Sat Jun 17 22:41:18 2023 +0200 arm64: dts: qcom: sc8180x: Fix OSM L3 compatible Since commit c70edc067739 ("dt-bindings: interconnect: Add sm8350, sc8280xp and generic OSM L3 compatibles") OSM L3 compatible should have generic fallback: sc8180x-primus.dtb: interconnect@18321000: compatible: 'oneOf' conditional failed, one must be fixed: Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230617204118.61959-3-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit 6d526ee4bfe1b86af4d53bde20e1dbcdc1ee69f7 Author: Krzysztof Kozlowski Date: Sat Jun 17 22:41:17 2023 +0200 arm64: dts: qcom: sm8250: Fix EPSS L3 interconnect cells Qualcomm EPSS L3 Interconnect does not take path (third) argument. This was introduced by commit b5a12438325b ("arm64: dts: qcom: sm8250: Use 2 interconnect cells") which probably wanted to use 2 cells only for RPMh interconnects. sm8250-hdk.dtb: interconnect@18590000: #interconnect-cells:0:0: 1 was expected Fixes: b5a12438325b ("arm64: dts: qcom: sm8250: Use 2 interconnect cells") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230617204118.61959-2-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit 8713c5e16698a5bda7f50e5c81799c419e0e2cb3 Author: Krzysztof Kozlowski Date: Sat Jun 17 22:41:16 2023 +0200 arm64: dts: qcom: sm8150: Fix OSM L3 interconnect cells Qualcomm Operating State Manager (OSM) L3 Interconnect does not take path (third) argument. This was introduced by commit 97c289026c62 ("arm64: dts: qcom: sm8150: Use 2 interconnect cells") which probably wanted to use 2 cells only for RPMh interconnects. sm8150-microsoft-surface-duo.dtb: interconnect@18321000: #interconnect-cells:0:0: 1 was expected Fixes: 97c289026c62 ("arm64: dts: qcom: sm8150: Use 2 interconnect cells") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230617204118.61959-1-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit cf53564b11cef5cdfafc548b172345c9aa753f89 Author: Aneesh Kumar K.V Date: Thu Jul 6 07:54:05 2023 +0530 powerpc/mm/book3s64/hash/4k: Add pmd_same callback for 4K page size With commit 0d940a9b270b ("mm/pgtable: allow pte_offset_map[_lock]() to fail") the kernel is now using pmd_same to compare pmd values that are pointing to a level 4 page table page. Move the functions out of #ifdef CONFIG_TRANSPARENT_HUGEPAGE and add a variant that can work with both 4K and 64K page size. kernel BUG at arch/powerpc/include/asm/book3s/64/hash-4k.h:141! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries ..... NIP [c00000000048aee0] __pte_offset_map_lock+0xf0/0x164 LR [c00000000048ae78] __pte_offset_map_lock+0x88/0x164 Call Trace: 0xc0003f000009a340 (unreliable) __handle_mm_fault+0x1340/0x1980 handle_mm_fault+0xbc/0x380 __get_user_pages+0x320/0x550 get_user_pages_remote+0x13c/0x520 get_arg_page+0x80/0x1d0 copy_string_kernel+0xc8/0x250 kernel_execve+0x11c/0x270 run_init_process+0xe4/0x10c kernel_init+0xbc/0x1a0 ret_from_kernel_user_thread+0x14/0x1c Reported-by: Michael Ellerman Signed-off-by: "Aneesh Kumar K.V" Acked-by: Hugh Dickins Signed-off-by: Michael Ellerman Link: https://msgid.link/20230706022405.798157-1-aneesh.kumar@linux.ibm.com commit cf65b12c17b4910d099d78f6ed6919ec040ecdbc Author: Michael Ellerman Date: Thu Jun 22 21:24:51 2023 +1000 powerpc/64e: Fix obtool warnings in exceptions-64e.S Since commit aec0ba7472a7 ("powerpc/64: Use -mprofile-kernel for big endian ELFv2 kernels"), this file is checked by objtool. Fix warnings such as: arch/powerpc/kernel/idle_64e.o: warning: objtool: .text+0x20: unannotated intra-function call arch/powerpc/kernel/exceptions-64e.o: warning: objtool: .text+0x218: unannotated intra-function call Signed-off-by: Michael Ellerman Link: https://msgid.link/20230622112451.735268-1-mpe@ellerman.id.au commit 5bcedc5931e7bd6928a2d8207078d4cb476b3b55 Author: Michael Ellerman Date: Wed May 17 17:49:45 2023 +1000 powerpc/security: Fix Speculation_Store_Bypass reporting on Power10 Nageswara reported that /proc/self/status was showing "vulnerable" for the Speculation_Store_Bypass feature on Power10, eg: $ grep Speculation_Store_Bypass: /proc/self/status Speculation_Store_Bypass: vulnerable But at the same time the sysfs files, and lscpu, were showing "Not affected". This turns out to simply be a bug in the reporting of the Speculation_Store_Bypass, aka. PR_SPEC_STORE_BYPASS, case. When SEC_FTR_STF_BARRIER was added, so that firmware could communicate the vulnerability was not present, the code in ssb_prctl_get() was not updated to check the new flag. So add the check for SEC_FTR_STF_BARRIER being disabled. Rather than adding the new check to the existing if block and expanding the comment to cover both cases, rewrite the three cases to be separate so they can be commented separately for clarity. Fixes: 84ed26fd00c5 ("powerpc/security: Add a security feature for STF barrier") Cc: stable@vger.kernel.org # v5.14+ Reported-by: Nageswara R Sastry Tested-by: Nageswara R Sastry Reviewed-by: Russell Currey Signed-off-by: Michael Ellerman Link: https://msgid.link/20230517074945.53188-1-mpe@ellerman.id.au commit 8bbe9fee5848371d4af101be445303cac8d880c5 Author: Michael Ellerman Date: Wed May 17 22:30:33 2023 +1000 powerpc/64s: Fix native_hpte_remove() to be irq-safe Lockdep warns that the use of the hpte_lock in native_hpte_remove() is not safe against an IRQ coming in: ================================ WARNING: inconsistent lock state 6.4.0-rc2-g0c54f4d30ecc #1 Not tainted -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. qemu-system-ppc/93865 [HC0[0]:SC0[0]:HE1:SE1] takes: c0000000021f5180 (hpte_lock){+.?.}-{0:0}, at: native_lock_hpte+0x8/0xd0 {IN-SOFTIRQ-W} state was registered at: lock_acquire+0x134/0x3f0 native_lock_hpte+0x44/0xd0 native_hpte_insert+0xd4/0x2a0 __hash_page_64K+0x218/0x4f0 hash_page_mm+0x464/0x840 do_hash_fault+0x11c/0x260 data_access_common_virt+0x210/0x220 __ip_select_ident+0x140/0x150 ... net_rx_action+0x3bc/0x440 __do_softirq+0x180/0x534 ... sys_sendmmsg+0x34/0x50 system_call_exception+0x128/0x320 system_call_common+0x160/0x2e4 ... Possible unsafe locking scenario: CPU0 ---- lock(hpte_lock); lock(hpte_lock); *** DEADLOCK *** ... Call Trace: dump_stack_lvl+0x98/0xe0 (unreliable) print_usage_bug.part.0+0x250/0x278 mark_lock+0xc9c/0xd30 __lock_acquire+0x440/0x1ca0 lock_acquire+0x134/0x3f0 native_lock_hpte+0x44/0xd0 native_hpte_remove+0xb0/0x190 kvmppc_mmu_map_page+0x650/0x698 [kvm_pr] kvmppc_handle_pagefault+0x534/0x6e8 [kvm_pr] kvmppc_handle_exit_pr+0x6d8/0xe90 [kvm_pr] after_sprg3_load+0x80/0x90 [kvm_pr] kvmppc_vcpu_run_pr+0x108/0x270 [kvm_pr] kvmppc_vcpu_run+0x34/0x48 [kvm] kvm_arch_vcpu_ioctl_run+0x340/0x470 [kvm] kvm_vcpu_ioctl+0x338/0x8b8 [kvm] sys_ioctl+0x7c4/0x13e0 system_call_exception+0x128/0x320 system_call_common+0x160/0x2e4 I suspect kvm_pr is the only caller that doesn't already have IRQs disabled, which is why this hasn't been reported previously. Fix it by disabling IRQs in native_hpte_remove(). Fixes: 35159b5717fa ("powerpc/64s: make HPTE lock and native_tlbie_lock irq-safe") Cc: stable@vger.kernel.org # v6.1+ Signed-off-by: Michael Ellerman Link: https://msgid.link/20230517123033.18430-1-mpe@ellerman.id.au commit c65b21f8aeac86768d387a86dfcbec5980480b6a Author: Rob Herring Date: Fri Jul 7 16:17:25 2023 -0600 ASoC: dt-bindings: audio-graph-card2: Drop incomplete example The example in audio-graph-card2 binding is incomplete, uses undocumented compatibles strings, and doesn't follow typical .dts formatting. Rather than try to fix with what would probably be a lengthy example, just drop the example. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20230707221725.1071292-1-robh@kernel.org Signed-off-by: Mark Brown commit a1ff5802da3806e916de100130a7850b3f80c377 Author: Rohit kumar Date: Fri Jul 7 13:13:36 2023 +0530 ASoC: dt-bindings: Update maintainer email id Updated my mail id to latest quicinc id. Acked-by: Krzysztof Kozlowski Signed-off-by: Rohit kumar Link: https://lore.kernel.org/r/20230707074337.3120530-1-quic_rohkumar@quicinc.com Signed-off-by: Mark Brown commit cd710900ed2b96b1fbc26d711d562581afc385e2 Author: Mario Limonciello Date: Fri Jul 7 21:52:08 2023 -0500 ASoC: amd: ps: Fix extraneous error messages On Pink Sardine machines that don't have SdW controllers in use, the property `mipi-sdw-manager-list` won't exist. There is no point in showing an error to a user when this situation is encountered. Furthermore if the machine doesn't have a DMIC connected to the ACP, there may be no platform devices created either. Downgrade the associated message to debug. Fixes: d1351c30ac8a6 ("ASoC: amd: ps: create platform devices based on acp config") Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20230708025208.54272-1-mario.limonciello@amd.com Signed-off-by: Mark Brown commit 86867aca7330e4fbcfa2a117e20b48bbb6c758a9 Author: Fabio Estevam Date: Thu Jul 6 19:18:27 2023 -0300 ASoC: fsl_sai: Revert "ASoC: fsl_sai: Enable MCTL_MCLK_EN bit for master mode" This reverts commit ff87d619ac180444db297f043962a5c325ded47b. Andreas reports that on an i.MX8MP-based system where MCLK needs to be used as an input, the MCLK pin is actually an output, despite not having the 'fsl,sai-mclk-direction-output' property present in the devicetree. This is caused by commit ff87d619ac18 ("ASoC: fsl_sai: Enable MCTL_MCLK_EN bit for master mode") that sets FSL_SAI_MCTL_MCLK_EN unconditionally for imx8mm/8mn/8mp/93, causing the MCLK to always be configured as output. FSL_SAI_MCTL_MCLK_EN corresponds to the MOE (MCLK Output Enable) bit of register MCR and the drivers sets it when the 'fsl,sai-mclk-direction-output' devicetree property is present. Revert the commit to allow SAI to use MCLK as input as well. Cc: stable@vger.kernel.org Fixes: ff87d619ac18 ("ASoC: fsl_sai: Enable MCTL_MCLK_EN bit for master mode") Reported-by: Andreas Henriksson Signed-off-by: Fabio Estevam Acked-by: Shengjiu Wang Link: https://lore.kernel.org/r/20230706221827.1938990-1-festevam@gmail.com Signed-off-by: Mark Brown commit 06c2afb862f9da8dc5efa4b6076a0e48c3fbaaa5 Author: Linus Torvalds Date: Sun Jul 9 13:53:13 2023 -0700 Linux 6.5-rc1 commit c192ac7357683f78c2e6d6e75adfcc29deb8c4ae Author: Linus Torvalds Date: Sun Jul 9 10:29:53 2023 -0700 MAINTAINERS 2: Electric Boogaloo We just sorted the entries and fields last release, so just out of a perverse sense of curiosity, I decided to see if we can keep things ordered for even just one release. The answer is "No. No we cannot". I suggest that all kernel developers will need weekly training sessions, involving a lot of Big Bird and Sesame Street. And at the yearly maintainer summit, we will all sing the alphabet song together. I doubt I will keep doing this. At some point "perverse sense of curiosity" turns into just a cold dark place filled with sadness and despair. Repeats: 80e62bc8487b ("MAINTAINERS: re-sort all entries and fields") Signed-off-by: Linus Torvalds commit f71f64210d698f603ab119740d1656f7bdfd3171 Merge: a9943ad3dddb0 8ac04063354a0 Author: Linus Torvalds Date: Sun Jul 9 10:24:22 2023 -0700 Merge tag 'dma-mapping-6.5-2023-07-09' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fixes from Christoph Hellwig: - swiotlb area sizing fixes (Petr Tesarik) * tag 'dma-mapping-6.5-2023-07-09' of git://git.infradead.org/users/hch/dma-mapping: swiotlb: reduce the number of areas to match actual memory pool size swiotlb: always set the number of areas before allocating the pool commit a9943ad3dddb04763e73649ade8ed726a17b5ec3 Merge: 51e3d7c27446c 67a4e1a3bf7c6 Author: Linus Torvalds Date: Sun Jul 9 10:16:04 2023 -0700 Merge tag 'irq_urgent_for_v6.5_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq update from Borislav Petkov: - Optimize IRQ domain's name assignment * tag 'irq_urgent_for_v6.5_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqdomain: Use return value of strreplace() commit 51e3d7c27446c3af97e8a467ecc99bc2936d885c Merge: e3da8db055318 fe3e0a13e597c Author: Linus Torvalds Date: Sun Jul 9 10:13:32 2023 -0700 Merge tag 'x86_urgent_for_v6.5_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fpu fix from Borislav Petkov: - Do FPU AP initialization on Xen PV too which got missed by the recent boot reordering work * tag 'x86_urgent_for_v6.5_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/xen: Fix secondary processors' FPU initialization commit e3da8db05531829cf64f922491be6f052acc5fba Merge: 74099e20348e8 b1472a60a5846 Author: Linus Torvalds Date: Sun Jul 9 10:08:38 2023 -0700 Merge tag 'x86-core-2023-07-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Thomas Gleixner: "A single fix for the mechanism to park CPUs with an INIT IPI. On shutdown or kexec, the kernel tries to park the non-boot CPUs with an INIT IPI. But the same code path is also used by the crash utility. If the CPU which panics is not the boot CPU then it sends an INIT IPI to the boot CPU which resets the machine. Prevent this by validating that the CPU which runs the stop mechanism is the boot CPU. If not, leave the other CPUs in HLT" * tag 'x86-core-2023-07-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/smp: Don't send INIT to boot CPU commit 74099e20348e84e62b5ea6ef270f91db48bc1352 Merge: 76487845fd23b 3a6dbb691782e Author: Linus Torvalds Date: Sun Jul 9 10:02:49 2023 -0700 Merge tag 'mips_6.5_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Thomas Bogendoerfer: - fixes for KVM - fix for loongson build and cpu probing - DT fixes * tag 'mips_6.5_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: kvm: Fix build error with KVM_MIPS_DEBUG_COP0_COUNTERS enabled MIPS: dts: add missing space before { MIPS: Loongson: Fix build error when make modules_install MIPS: KVM: Fix NULL pointer dereference MIPS: Loongson: Fix cpu_probe_loongson() again commit 76487845fd23bc2346244fbf7c1a6eb1ed845d28 Merge: 4770353b660ab ed04a91f718e6 Author: Linus Torvalds Date: Sun Jul 9 09:50:42 2023 -0700 Merge tag 'xfs-6.5-merge-6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fix from Darrick Wong: "Nothing exciting here, just getting rid of a gcc warning that I got tired of seeing when I turn on gcov" * tag 'xfs-6.5-merge-6' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix uninit warning in xfs_growfs_data commit 4770353b660abc8b1a5d2afc233b6061d48e7d80 Merge: cff0687396887 d14de8067e3f9 Author: Linus Torvalds Date: Sun Jul 9 09:45:32 2023 -0700 Merge tag '6.5-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6 Pull more smb client updates from Steve French: - fix potential use after free in unmount - minor cleanup - add worker to cleanup stale directory leases * tag '6.5-rc-smb3-client-fixes-part2' of git://git.samba.org/sfrench/cifs-2.6: cifs: Add a laundromat thread for cached directories smb: client: remove redundant pointer 'server' cifs: fix session state transition to avoid use-after-free issue commit cff068739688791cf7a8f427b7ca6230d798914a Merge: 1c7873e336457 bff6efc54bd0e Author: Linus Torvalds Date: Sun Jul 9 09:35:51 2023 -0700 Merge tag 'ntb-6.5' of https://github.com/jonmason/ntb Pull NTB updates from Jon Mason: "Fixes for pci_clean_master, error handling in driver inits, and various other issues/bugs" * tag 'ntb-6.5' of https://github.com/jonmason/ntb: ntb: hw: amd: Fix debugfs_create_dir error checking ntb.rst: Fix copy and paste error ntb_netdev: Fix module_init problem ntb: intel: Remove redundant pci_clear_master ntb: epf: Remove redundant pci_clear_master ntb_hw_amd: Remove redundant pci_clear_master ntb: idt: drop redundant pci_enable_pcie_error_reporting() MAINTAINERS: git://github -> https://github.com for jonmason NTB: EPF: fix possible memory leak in pci_vntb_probe() NTB: ntb_tool: Add check for devm_kcalloc NTB: ntb_transport: fix possible memory leak while device_register() fails ntb: intel: Fix error handling in intel_ntb_pci_driver_init() NTB: amd: Fix error handling in amd_ntb_pci_driver_init() ntb: idt: Fix error handling in idt_pci_driver_init() commit e3ea6467f623b80906ff0c93b58755ab903ce12f Author: Dmitry Torokhov Date: Tue Jun 27 15:09:01 2023 -0700 HID: input: fix mapping for camera access keys Commit 9f4211bf7f81 ("HID: add mapping for camera access keys") added mapping for the camera access keys, but unfortunately used wrong usage codes for them. HUTRR72[1] specifies that camera access controls use 0x76, 0x077 and 0x78 usages in the consumer control page. Previously mapped 0xd5, 0xd6 and 0xd7 usages are actually defined in HUTRR64[2] as game recording controls. [1] https://www.usb.org/sites/default/files/hutrr72_-_usages_to_control_camera_access_0.pdf [2] https://www.usb.org/sites/default/files/hutrr64b_-_game_recording_controllers_0.pdf Fixes: 9f4211bf7f81 ("HID: add mapping for camera access keys") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov Link: https://lore.kernel.org/r/ZJtd/fMXRUgq20TW@google.com Signed-off-by: Benjamin Tissoires commit a343a7682acc56182d4b54777c358f5ec6d274e7 Author: Stuart Hayhurst Date: Fri Jun 30 12:38:20 2023 +0100 HID: logitech-hidpp: Add wired USB id for Logitech G502 Lightspeed Previously, support for the G502 had been attempted in commit '27fc32fd9417 ("HID: logitech-hidpp: add USB PID for a few more supported mice")' This caused some issues and was reverted by 'addf3382c47c ("Revert "HID: logitech-hidpp: add USB PID for a few more supported mice"")'. Since then, a new version of this mouse has been released (Lightpseed Wireless), and works correctly. This device has support for battery reporting with the driver Signed-off-by: Stuart Hayhurst Reviewed-by: Bastien Nocera Link: https://lore.kernel.org/r/20230630113818.13005-1-stuart.a.hayhurst@gmail.com Signed-off-by: Benjamin Tissoires commit 8bcf314b92ed923019206e0dbf198980f15a70e0 Author: Rahul Rameshbabu Date: Tue Jul 4 23:04:14 2023 -0700 HID: nvidia-shield: Pack inner/related declarations in HOSTCMD reports Match alignment information in composite type declarations used by packed HOSTCMD report structures. Compiler packing attribute is not recursive for inner declarations. Mismatched alignment information can cause undefined behavior in code generated for accessing composite type members. struct pointers passed to thunderstrike_parse_board_info_payload and thunderstrike_parse_haptics_payload are an example of this being potentially problematic since alignment information from the packed HOSTCMD report is lost. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202307041500.6bKn7nCl-lkp@intel.com/ Link: https://github.com/llvm/llvm-project/issues/55520#issuecomment-1128617570 Link: https://gcc.gnu.org/onlinedocs/gcc-13.1.0/gcc/Common-Type-Attributes.html#index-packed-type-attribute Signed-off-by: Rahul Rameshbabu Link: https://lore.kernel.org/r/20230705060414.581468-1-rrameshbabu@nvidia.com Signed-off-by: Benjamin Tissoires commit 5f151364b1da6bd217632fd4ee8cc24eaf66a497 Author: Arnd Bergmann Date: Wed Jul 5 16:02:24 2023 +0200 HID: hyperv: avoid struct memcpy overrun warning A previous patch addressed the fortified memcpy warning for most builds, but I still see this one with gcc-9: In file included from include/linux/string.h:254, from drivers/hid/hid-hyperv.c:8: In function 'fortify_memcpy_chk', inlined from 'mousevsc_on_receive' at drivers/hid/hid-hyperv.c:272:3: include/linux/fortify-string.h:583:4: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] 583 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ My guess is that the WARN_ON() itself is what confuses gcc, so it no longer sees that there is a correct range check. Rework the code in a way that helps readability and avoids the warning. Fixes: 542f25a94471 ("HID: hyperv: Replace one-element array with flexible-array member") Signed-off-by: Arnd Bergmann Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20230705140242.844167-1-arnd@kernel.org Signed-off-by: Benjamin Tissoires commit 73c4d1b307aeb713e80ab03f90c7df9d417dc0f0 Author: Simon Horman Date: Sat Jul 8 15:06:25 2023 +0100 net: lan743x: select FIXED_PHY The blamed commit introduces usage of fixed_phy_register() but not a corresponding dependency on FIXED_PHY. This can result in a build failure. s390-linux-ld: drivers/net/ethernet/microchip/lan743x_main.o: in function `lan743x_phy_open': drivers/net/ethernet/microchip/lan743x_main.c:1514: undefined reference to `fixed_phy_register' Fixes: 624864fbff92 ("net: lan743x: add fixed phy support for LAN7431 device") Cc: stable@vger.kernel.org Reported-by: Randy Dunlap Closes: https://lore.kernel.org/netdev/725bf1c5-b252-7d19-7582-a6809716c7d6@infradead.org/ Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap # build-tested Signed-off-by: Simon Horman Signed-off-by: David S. Miller commit 06a0716949c22e2aefb648526580671197151acc Author: Ziyang Xuan Date: Sat Jul 8 14:59:10 2023 +0800 ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer(), reference idev depends on whether rs_timer is not pending. Then modify rs_timer timeout. There is a time gap in [1], during which if the pending rs_timer becomes not pending. It will miss to hold idev, but the rs_timer is activated. Thus rs_timer callback function addrconf_rs_timer() will be executed and put idev later without holding idev. A refcount underflow issue for idev can be caused by this. if (!timer_pending(&idev->rs_timer)) in6_dev_hold(idev); <--------------[1] mod_timer(&idev->rs_timer, jiffies + when); To fix the issue, hold idev if mod_timer() return 0. Fixes: b7b1bfce0bb6 ("ipv6: split duplicate address detection and router solicitation timer") Suggested-by: Eric Dumazet Signed-off-by: Ziyang Xuan Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit f9abdcc617dad5f14bbc2ebe96ee99f3e6de0c4e Author: Benjamin Tissoires Date: Sun Jul 9 12:06:56 2023 +0200 selftests: hid: fix vmtests.sh not running make headers According to commit 01d6c48a828b ("Documentation: kselftest: "make headers" is a prerequisite"), running the kselftests requires to run "make headers" first. Do that in "vmtest.sh" as well to fix the HID CI. Link: https://lore.kernel.org/r/20230709-fix-selftests-v1-1-57d0878114cc@kernel.org Signed-off-by: Benjamin Tissoires commit 1c7873e3364570ec89343ff4877e0f27a7b21a61 Author: Hugh Dickins Date: Sat Jul 8 16:04:00 2023 -0700 mm: lock newly mapped VMA with corrected ordering Lockdep is certainly right to complain about (&vma->vm_lock->lock){++++}-{3:3}, at: vma_start_write+0x2d/0x3f but task is already holding lock: (&mapping->i_mmap_rwsem){+.+.}-{3:3}, at: mmap_region+0x4dc/0x6db Invert those to the usual ordering. Fixes: 33313a747e81 ("mm: lock newly mapped VMA which can be modified after it becomes visible") Cc: stable@vger.kernel.org Signed-off-by: Hugh Dickins Tested-by: Suren Baghdasaryan Signed-off-by: Linus Torvalds commit 946c6b59c56dc6e7d8364a8959cb36bf6d10bc37 Merge: fb49c455323ff 8ba388c06bc80 Author: Linus Torvalds Date: Sat Jul 8 14:30:25 2023 -0700 Merge tag 'mm-hotfixes-stable-2023-07-08-10-43' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull hotfixes from Andrew Morton: "16 hotfixes. Six are cc:stable and the remainder address post-6.4 issues" The merge undoes the disabling of the CONFIG_PER_VMA_LOCK feature, since it was all hopefully fixed in mainline. * tag 'mm-hotfixes-stable-2023-07-08-10-43' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: lib: dhry: fix sleeping allocations inside non-preemptable section kasan, slub: fix HW_TAGS zeroing with slub_debug kasan: fix type cast in memory_is_poisoned_n mailmap: add entries for Heiko Stuebner mailmap: update manpage link bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page MAINTAINERS: add linux-next info mailmap: add Markus Schneider-Pargmann writeback: account the number of pages written back mm: call arch_swap_restore() from do_swap_page() squashfs: fix cache race with migration mm/hugetlb.c: fix a bug within a BUG(): inconsistent pte comparison docs: update ocfs2-devel mailing list address MAINTAINERS: update ocfs2-devel mailing list address mm: disable CONFIG_PER_VMA_LOCK until its fixed fork: lock VMAs of the parent process when forking commit fb49c455323ff8319a123dd312be9082c49a23a5 Author: Suren Baghdasaryan Date: Sat Jul 8 12:12:12 2023 -0700 fork: lock VMAs of the parent process when forking When forking a child process, the parent write-protects anonymous pages and COW-shares them with the child being forked using copy_present_pte(). We must not take any concurrent page faults on the source vma's as they are being processed, as we expect both the vma and the pte's behind it to be stable. For example, the anon_vma_fork() expects the parents vma->anon_vma to not change during the vma copy. A concurrent page fault on a page newly marked read-only by the page copy might trigger wp_page_copy() and a anon_vma_prepare(vma) on the source vma, defeating the anon_vma_clone() that wasn't done because the parent vma originally didn't have an anon_vma, but we now might end up copying a pte entry for a page that has one. Before the per-vma lock based changes, the mmap_lock guaranteed exclusion with concurrent page faults. But now we need to do a vma_start_write() to make sure no concurrent faults happen on this vma while it is being processed. This fix can potentially regress some fork-heavy workloads. Kernel build time did not show noticeable regression on a 56-core machine while a stress test mapping 10000 VMAs and forking 5000 times in a tight loop shows ~5% regression. If such fork time regression is unacceptable, disabling CONFIG_PER_VMA_LOCK should restore its performance. Further optimizations are possible if this regression proves to be problematic. Suggested-by: David Hildenbrand Reported-by: Jiri Slaby Closes: https://lore.kernel.org/all/dbdef34c-3a07-5951-e1ae-e9c6e3cdf51b@kernel.org/ Reported-by: Holger Hoffstätte Closes: https://lore.kernel.org/all/b198d649-f4bf-b971-31d0-e8433ec2a34c@applied-asynchrony.com/ Reported-by: Jacob Young Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217624 Fixes: 0bff0aaea03e ("x86/mm: try VMA lock-based page fault handling first") Cc: stable@vger.kernel.org Signed-off-by: Suren Baghdasaryan Signed-off-by: Linus Torvalds commit 33313a747e81af9f31d0d45de78c9397fa3655eb Author: Suren Baghdasaryan Date: Sat Jul 8 12:12:11 2023 -0700 mm: lock newly mapped VMA which can be modified after it becomes visible mmap_region adds a newly created VMA into VMA tree and might modify it afterwards before dropping the mmap_lock. This poses a problem for page faults handled under per-VMA locks because they don't take the mmap_lock and can stumble on this VMA while it's still being modified. Currently this does not pose a problem since post-addition modifications are done only for file-backed VMAs, which are not handled under per-VMA lock. However, once support for handling file-backed page faults with per-VMA locks is added, this will become a race. Fix this by write-locking the VMA before inserting it into the VMA tree. Other places where a new VMA is added into VMA tree do not modify it after the insertion, so do not need the same locking. Cc: stable@vger.kernel.org Signed-off-by: Suren Baghdasaryan Signed-off-by: Linus Torvalds commit c137381f71aec755fbf47cd4e9bd4dce752c054c Author: Suren Baghdasaryan Date: Sat Jul 8 12:12:10 2023 -0700 mm: lock a vma before stack expansion With recent changes necessitating mmap_lock to be held for write while expanding a stack, per-VMA locks should follow the same rules and be write-locked to prevent page faults into the VMA being expanded. Add the necessary locking. Cc: stable@vger.kernel.org Signed-off-by: Suren Baghdasaryan Signed-off-by: Linus Torvalds commit 7fcd473a6455450428795d20db7afd2691c92336 Merge: 84dc5aa3f0d86 24033d71cc36a Author: Linus Torvalds Date: Sat Jul 8 12:35:18 2023 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull more SCSI updates from James Bottomley: "A few late arriving patches that missed the initial pull request. It's mostly bug fixes (the dt-bindings is a fix for the initial pull)" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Remove unused function declaration scsi: target: docs: Remove tcm_mod_builder.py scsi: target: iblock: Quiet bool conversion warning with pr_preempt use scsi: dt-bindings: ufs: qcom: Fix ICE phandle scsi: core: Simplify scsi_cdl_check_cmd() scsi: isci: Fix comment typo scsi: smartpqi: Replace one-element arrays with flexible-array members scsi: target: tcmu: Replace strlcpy() with strscpy() scsi: ncr53c8xx: Replace strlcpy() with strscpy() scsi: lpfc: Fix lpfc_name struct packing commit 84dc5aa3f0d861281d353e4b7f4ea03da31e9aba Merge: 8fc3b8f082cc2 6537ed3904a3b Author: Linus Torvalds Date: Sat Jul 8 12:28:00 2023 -0700 Merge tag 'i2c-for-6.5-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull more i2c updates from Wolfram Sang: - xiic patch should have been in the original pull but slipped through - mpc patch fixes a build regression - nomadik cleanup * tag 'i2c-for-6.5-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: mpc: Drop unused variable i2c: nomadik: Remove a useless call in the remove function i2c: xiic: Don't try to handle more interrupt events after error commit 8fc3b8f082cc2f5faa6eae315b938bc5e79c332e Merge: c206353dfdf02 01f23c5f1526f Author: Linus Torvalds Date: Sat Jul 8 12:08:39 2023 -0700 Merge tag 'hardening-v6.5-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - Check for NULL bdev in LoadPin (Matthias Kaehlcke) - Revert unwanted KUnit FORTIFY build default - Fix 1-element array causing boot warnings with xhci-hub * tag 'hardening-v6.5-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: usb: ch9: Replace bmSublinkSpeedAttr 1-element array with flexible array Revert "fortify: Allow KUnit test to build without FORTIFY" dm: verity-loadpin: Add NULL pointer check for 'bdev' parameter commit bff6efc54bd0e27a332eb733525d7f698fd4a5b7 Author: Anup Sharma Date: Sat May 13 01:54:34 2023 +0530 ntb: hw: amd: Fix debugfs_create_dir error checking The debugfs_create_dir function returns ERR_PTR in case of error, and the only correct way to check if an error occurred is 'IS_ERR' inline function. This patch will replace the null-comparison with IS_ERR. Signed-off-by: Anup Sharma Suggested-by: Ivan Orlov Signed-off-by: Jon Mason commit c206353dfdf026dafd42679cf82d6f0a89781e36 Merge: ad8258e87729e bcd981db12e6d Author: Linus Torvalds Date: Sat Jul 8 10:21:51 2023 -0700 Merge tag 'perf-tools-for-v6.5-2-2023-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next Pull more perf tools updates from Namhyung Kim: "These are remaining changes and fixes for this cycle. Build: - Allow generating vmlinux.h from BTF using `make GEN_VMLINUX_H=1` and skip if the vmlinux has no BTF. - Replace deprecated clang -target xxx option by --target=xxx. perf record: - Print event attributes with well known type and config symbols in the debug output like below: # perf record -e cycles,cpu-clock -C0 -vv true ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) size 136 config 0 (PERF_COUNT_HW_CPU_CYCLES) { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 5 ------------------------------------------------------------ perf_event_attr: type 1 (PERF_TYPE_SOFTWARE) size 136 config 0 (PERF_COUNT_SW_CPU_CLOCK) { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 - Update AMD IBS event error message since it now support per-process profiling but no priviledge filters. $ sudo perf record -e ibs_op//k -C 0 Error: AMD IBS doesn't support privilege filtering. Try again without the privilege modifiers (like 'k') at the end. perf lock contention: - Support CSV style output using -x option $ sudo perf lock con -ab -x, sleep 1 # output: contended, total wait, max wait, avg wait, type, caller 19, 194232, 21415, 10222, spinlock, process_one_work+0x1f0 15, 162748, 23843, 10849, rwsem:R, do_user_addr_fault+0x40e 4, 86740, 23415, 21685, rwlock:R, ep_poll_callback+0x2d 1, 84281, 84281, 84281, mutex, iwl_mvm_async_handlers_wk+0x135 8, 67608, 27404, 8451, spinlock, __queue_work+0x174 3, 58616, 31125, 19538, rwsem:W, do_mprotect_pkey+0xff 3, 52953, 21172, 17651, rwlock:W, do_epoll_wait+0x248 2, 30324, 19704, 15162, rwsem:R, do_madvise+0x3ad 1, 24619, 24619, 24619, spinlock, rcu_core+0xd4 - Add --output option to save the data to a file not to be interfered by other debug messages. Test: - Fix event parsing test on ARM where there's no raw PMU nor supports PERF_PMU_CAP_EXTENDED_HW_TYPE. - Update the lock contention test case for CSV output. - Fix a segfault in the daemon command test. Vendor events (JSON): - Add has_event() to check if the given event is available on system at runtime. On Intel machines, some transaction events may not be present when TSC extensions are disabled. - Update Intel event metrics. Misc: - Sort symbols by name using an external array of pointers instead of a rbtree node in the symbol. This will save 16-bytes or 24-bytes per symbol whether the sorting is actually requested or not. - Fix unwinding DWARF callstacks using libdw when --symfs option is used" * tag 'perf-tools-for-v6.5-2-2023-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next: (38 commits) perf test: Fix event parsing test when PERF_PMU_CAP_EXTENDED_HW_TYPE isn't supported. perf test: Fix event parsing test on Arm perf evsel amd: Fix IBS error message perf: unwind: Fix symfs with libdw perf symbol: Fix uninitialized return value in symbols__find_by_name() perf test: Test perf lock contention CSV output perf lock contention: Add --output option perf lock contention: Add -x option for CSV style output perf lock: Remove stale comments perf vendor events intel: Update tigerlake to 1.13 perf vendor events intel: Update skylakex to 1.31 perf vendor events intel: Update skylake to 57 perf vendor events intel: Update sapphirerapids to 1.14 perf vendor events intel: Update icelakex to 1.21 perf vendor events intel: Update icelake to 1.19 perf vendor events intel: Update cascadelakex to 1.19 perf vendor events intel: Update meteorlake to 1.03 perf vendor events intel: Add rocketlake events/metrics perf vendor metrics intel: Make transaction metrics conditional perf jevents: Support for has_event function ... commit ad8258e87729e4337569c4b7d30cfdd4b299179d Merge: 8689f4f2ea561 2a3110e3f97dd Author: Linus Torvalds Date: Sat Jul 8 10:02:24 2023 -0700 Merge tag 'bitmap-6.5-rc1' of https://github.com/norov/linux Pull bitmap updates from Yury Norov: "Fixes for different bitmap pieces: - lib/test_bitmap: increment failure counter properly The tests that don't use expect_eq() macro to determine that a test is failured must increment failed_tests explicitly. - lib/bitmap: drop optimization of bitmap_{from,to}_arr64 bitmap_{from,to}_arr64() optimization is overly optimistic on 32-bit LE architectures when it's wired to bitmap_copy_clear_tail(). - nodemask: Drop duplicate check in for_each_node_mask() As the return value type of first_node() became unsigned, the node >= 0 became unnecessary. - cpumask: fix function description kernel-doc notation - MAINTAINERS: Add bits.h and bitfield.h to the BITMAP API record Add linux/bits.h and linux/bitfield.h for visibility" * tag 'bitmap-6.5-rc1' of https://github.com/norov/linux: MAINTAINERS: Add bitfield.h to the BITMAP API record MAINTAINERS: Add bits.h to the BITMAP API record cpumask: fix function description kernel-doc notation nodemask: Drop duplicate check in for_each_node_mask() lib/bitmap: drop optimization of bitmap_{from,to}_arr64 lib/test_bitmap: increment failure counter properly commit 8ba388c06bc8056935ec1814b2689bfb42f3b89a Author: Geert Uytterhoeven Date: Wed Jul 5 16:54:04 2023 +0200 lib: dhry: fix sleeping allocations inside non-preemptable section The Smatch static checker reports the following warnings: lib/dhry_run.c:38 dhry_benchmark() warn: sleeping in atomic context lib/dhry_run.c:43 dhry_benchmark() warn: sleeping in atomic context Indeed, dhry() does sleeping allocations inside the non-preemptable section delimited by get_cpu()/put_cpu(). Fix this by using atomic allocations instead. Add error handling, as atomic these allocations may fail. Link: https://lkml.kernel.org/r/bac6d517818a7cd8efe217c1ad649fffab9cc371.1688568764.git.geert+renesas@glider.be Fixes: 13684e966d46283e ("lib: dhry: fix unstable smp_processor_id(_) usage") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/0469eb3a-02eb-4b41-b189-de20b931fa56@moroto.mountain Signed-off-by: Geert Uytterhoeven Signed-off-by: Andrew Morton commit fdb54d96600aafe45951f549866cd6fc1af59954 Author: Andrey Konovalov Date: Wed Jul 5 14:44:02 2023 +0200 kasan, slub: fix HW_TAGS zeroing with slub_debug Commit 946fa0dbf2d8 ("mm/slub: extend redzone check to extra allocated kmalloc space than requested") added precise kmalloc redzone poisoning to the slub_debug functionality. However, this commit didn't account for HW_TAGS KASAN fully initializing the object via its built-in memory initialization feature. Even though HW_TAGS KASAN memory initialization contains special memory initialization handling for when slub_debug is enabled, it does not account for in-object slub_debug redzones. As a result, HW_TAGS KASAN can overwrite these redzones and cause false-positive slub_debug reports. To fix the issue, avoid HW_TAGS KASAN memory initialization when slub_debug is enabled altogether. Implement this by moving the __slub_debug_enabled check to slab_post_alloc_hook. Common slab code seems like a more appropriate place for a slub_debug check anyway. Link: https://lkml.kernel.org/r/678ac92ab790dba9198f9ca14f405651b97c8502.1688561016.git.andreyknvl@google.com Fixes: 946fa0dbf2d8 ("mm/slub: extend redzone check to extra allocated kmalloc space than requested") Signed-off-by: Andrey Konovalov Reported-by: Will Deacon Acked-by: Marco Elver Cc: Mark Rutland Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Catalin Marinas Cc: Christoph Lameter Cc: David Rientjes Cc: Dmitry Vyukov Cc: Feng Tang Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Joonsoo Kim Cc: kasan-dev@googlegroups.com Cc: Pekka Enberg Cc: Peter Collingbourne Cc: Roman Gushchin Cc: Vincenzo Frascino Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 05c56e7b4319d7f6352f27da876a1acdc8fa5cc4 Author: Andrey Konovalov Date: Tue Jul 4 02:52:05 2023 +0200 kasan: fix type cast in memory_is_poisoned_n Commit bb6e04a173f0 ("kasan: use internal prototypes matching gcc-13 builtins") introduced a bug into the memory_is_poisoned_n implementation: it effectively removed the cast to a signed integer type after applying KASAN_GRANULE_MASK. As a result, KASAN started failing to properly check memset, memcpy, and other similar functions. Fix the bug by adding the cast back (through an additional signed integer variable to make the code more readable). Link: https://lkml.kernel.org/r/8c9e0251c2b8b81016255709d4ec42942dcaf018.1688431866.git.andreyknvl@google.com Fixes: bb6e04a173f0 ("kasan: use internal prototypes matching gcc-13 builtins") Signed-off-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Arnd Bergmann Cc: Dmitry Vyukov Cc: Marco Elver Cc: Signed-off-by: Andrew Morton commit d3a808ec787e8cbfee053405f95105b3be3c7743 Author: Heiko Stuebner Date: Tue Jul 4 18:39:19 2023 +0200 mailmap: add entries for Heiko Stuebner I am going to lose my vrull.eu address at the end of july, and while adding it to mailmap I also realised that there are more old addresses from me dangling, so update .mailmap for all of them. Link: https://lkml.kernel.org/r/20230704163919.1136784-3-heiko@sntech.de Signed-off-by: Heiko Stuebner Signed-off-by: Heiko Stuebner Signed-off-by: Andrew Morton commit ddcd91f4cb42fcc833b0a5e00d4e9f034da95249 Author: Heiko Stuebner Date: Tue Jul 4 18:39:18 2023 +0200 mailmap: update manpage link Patch series "Update .mailmap for my work address and fix manpage". While updating mailmap for the going-away address, I also found that on current systems the manpage linked from the header comment changed. And in fact it looks like the git mailmap feature got its own manpage. This patch (of 2): On recent systems the git-shortlog manpage only tells people to See gitmailmap(5) So instead of sending people on a scavenger hunt, put that info into the header directly. Though keep the old reference around for older systems. Link: https://lkml.kernel.org/r/20230704163919.1136784-1-heiko@sntech.de Link: https://lkml.kernel.org/r/20230704163919.1136784-2-heiko@sntech.de Signed-off-by: Heiko Stuebner Signed-off-by: Andrew Morton commit 028725e73375a1ff080bbdf9fb503306d0116f28 Author: Liu Shixin Date: Tue Jul 4 18:19:42 2023 +0800 bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page commit dd0ff4d12dd2 ("bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem") fix an overlaps existing problem of kmemleak. But the problem still existed when HAVE_BOOTMEM_INFO_NODE is disabled, because in this case, free_bootmem_page() will call free_reserved_page() directly. Fix the problem by adding kmemleak_free_part() in free_bootmem_page() when HAVE_BOOTMEM_INFO_NODE is disabled. Link: https://lkml.kernel.org/r/20230704101942.2819426-1-liushixin2@huawei.com Fixes: f41f2ed43ca5 ("mm: hugetlb: free the vmemmap pages associated with each HugeTLB page") Signed-off-by: Liu Shixin Acked-by: Muchun Song Cc: Matthew Wilcox Cc: Mike Kravetz Cc: Oscar Salvador Cc: Signed-off-by: Andrew Morton commit 0d707cdefb3b7f52d23967e1473d24d591329e13 Author: Randy Dunlap Date: Mon Jul 3 22:44:10 2023 -0700 MAINTAINERS: add linux-next info Add linux-next info to MAINTAINERS for ease of finding this data. Link: https://lkml.kernel.org/r/20230704054410.12527-1-rdunlap@infradead.org Signed-off-by: Randy Dunlap Acked-by: Stephen Rothwell Signed-off-by: Andrew Morton commit 6dedd768f380a6977234891fc3c7e0df656f1908 Author: Markus Schneider-Pargmann Date: Wed Jun 28 10:13:41 2023 +0200 mailmap: add Markus Schneider-Pargmann Add my old mail address and update my name. Link: https://lkml.kernel.org/r/20230628081341.3470229-1-msp@baylibre.com Signed-off-by: Markus Schneider-Pargmann Signed-off-by: Andrew Morton commit 8344a3d44be3d18671e18c4ba23bb03dd21e14ad Author: Matthew Wilcox (Oracle) Date: Wed Jun 28 19:55:48 2023 +0100 writeback: account the number of pages written back nr_to_write is a count of pages, so we need to decrease it by the number of pages in the folio we just wrote, not by 1. Most callers specify either LONG_MAX or 1, so are unaffected, but writeback_sb_inodes() might end up writing 512x as many pages as it asked for. Dave added: : XFS is the only filesystem this would affect, right? AFAIA, nothing : else enables large folios and uses writeback through : write_cache_pages() at this point... : : In which case, I'd be surprised if much difference, if any, gets : noticed by anyone. Link: https://lkml.kernel.org/r/20230628185548.981888-1-willy@infradead.org Fixes: 793917d997df ("mm/readahead: Add large folio readahead") Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Christoph Hellwig Cc: Jan Kara Cc: Dave Chinner Signed-off-by: Andrew Morton commit 6dca4ac6fc91fd41ea4d6c4511838d37f4e0eab2 Author: Peter Collingbourne Date: Mon May 22 17:43:08 2023 -0700 mm: call arch_swap_restore() from do_swap_page() Commit c145e0b47c77 ("mm: streamline COW logic in do_swap_page()") moved the call to swap_free() before the call to set_pte_at(), which meant that the MTE tags could end up being freed before set_pte_at() had a chance to restore them. Fix it by adding a call to the arch_swap_restore() hook before the call to swap_free(). Link: https://lkml.kernel.org/r/20230523004312.1807357-2-pcc@google.com Link: https://linux-review.googlesource.com/id/I6470efa669e8bd2f841049b8c61020c510678965 Fixes: c145e0b47c77 ("mm: streamline COW logic in do_swap_page()") Signed-off-by: Peter Collingbourne Reported-by: Qun-wei Lin Closes: https://lore.kernel.org/all/5050805753ac469e8d727c797c2218a9d780d434.camel@mediatek.com/ Acked-by: David Hildenbrand Acked-by: "Huang, Ying" Reviewed-by: Steven Price Acked-by: Catalin Marinas Cc: [6.1+] Signed-off-by: Andrew Morton commit 08bab74ae653b57bb2bfcec7d499bfe7ff0efe4f Author: Vincent Whitchurch Date: Thu Jun 29 16:17:57 2023 +0200 squashfs: fix cache race with migration Migration replaces the page in the mapping before copying the contents and the flags over from the old page, so check that the page in the page cache is really up to date before using it. Without this, stressing squashfs reads with parallel compaction sometimes results in squashfs reporting data corruption. Link: https://lkml.kernel.org/r/20230629-squashfs-cache-migration-v1-1-d50ebe55099d@axis.com Fixes: e994f5b677ee ("squashfs: cache partial compressed blocks") Signed-off-by: Vincent Whitchurch Cc: Christoph Hellwig Cc: Phillip Lougher Signed-off-by: Andrew Morton commit 191fcdb6c9cf8b738b1628cbcf3af63d545c825c Author: John Hubbard Date: Fri Jun 30 18:04:42 2023 -0700 mm/hugetlb.c: fix a bug within a BUG(): inconsistent pte comparison The following crash happens for me when running the -mm selftests (below). Specifically, it happens while running the uffd-stress subtests: kernel BUG at mm/hugetlb.c:7249! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 3238 Comm: uffd-stress Not tainted 6.4.0-hubbard-github+ #109 Hardware name: ASUS X299-A/PRIME X299-A, BIOS 1503 08/03/2018 RIP: 0010:huge_pte_alloc+0x12c/0x1a0 ... Call Trace: ? __die_body+0x63/0xb0 ? die+0x9f/0xc0 ? do_trap+0xab/0x180 ? huge_pte_alloc+0x12c/0x1a0 ? do_error_trap+0xc6/0x110 ? huge_pte_alloc+0x12c/0x1a0 ? handle_invalid_op+0x2c/0x40 ? huge_pte_alloc+0x12c/0x1a0 ? exc_invalid_op+0x33/0x50 ? asm_exc_invalid_op+0x16/0x20 ? __pfx_put_prev_task_idle+0x10/0x10 ? huge_pte_alloc+0x12c/0x1a0 hugetlb_fault+0x1a3/0x1120 ? finish_task_switch+0xb3/0x2a0 ? lock_is_held_type+0xdb/0x150 handle_mm_fault+0xb8a/0xd40 ? find_vma+0x5d/0xa0 do_user_addr_fault+0x257/0x5d0 exc_page_fault+0x7b/0x1f0 asm_exc_page_fault+0x22/0x30 That happens because a BUG() statement in huge_pte_alloc() attempts to check that a pte, if present, is a hugetlb pte, but it does so in a non-lockless-safe manner that leads to a false BUG() report. We got here due to a couple of bugs, each of which by itself was not quite enough to cause a problem: First of all, before commit c33c794828f2("mm: ptep_get() conversion"), the BUG() statement in huge_pte_alloc() was itself fragile: it relied upon compiler behavior to only read the pte once, despite using it twice in the same conditional. Next, commit c33c794828f2 ("mm: ptep_get() conversion") broke that delicate situation, by causing all direct pte reads to be done via READ_ONCE(). And so READ_ONCE() got called twice within the same BUG() conditional, leading to comparing (potentially, occasionally) different versions of the pte, and thus to false BUG() reports. Fix this by taking a single snapshot of the pte before using it in the BUG conditional. Now, that commit is only partially to blame here but, people doing bisections will invariably land there, so this will help them find a fix for a real crash. And also, the previous behavior was unlikely to ever expose this bug--it was fragile, yet not actually broken. So that's why I chose this commit for the Fixes tag, rather than the commit that created the original BUG() statement. Link: https://lkml.kernel.org/r/20230701010442.2041858-1-jhubbard@nvidia.com Fixes: c33c794828f2 ("mm: ptep_get() conversion") Signed-off-by: John Hubbard Acked-by: James Houghton Acked-by: Muchun Song Reviewed-by: Ryan Roberts Acked-by: Mike Kravetz Cc: Adrian Hunter Cc: Al Viro Cc: Alex Williamson Cc: Alexander Potapenko Cc: Alexander Shishkin Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Christian Brauner Cc: Christoph Hellwig Cc: Daniel Vetter Cc: Dave Airlie Cc: Dimitri Sivanich Cc: Dmitry Vyukov Cc: Ian Rogers Cc: Jason Gunthorpe Cc: Jiri Olsa Cc: Johannes Weiner Cc: Kirill A. Shutemov Cc: Lorenzo Stoakes Cc: Mark Rutland Cc: Matthew Wilcox Cc: Miaohe Lin Cc: Michal Hocko Cc: Mike Rapoport (IBM) Cc: Namhyung Kim Cc: Naoya Horiguchi Cc: Oleksandr Tyshchenko Cc: Pavel Tatashin Cc: Roman Gushchin Cc: SeongJae Park Cc: Shakeel Butt Cc: Uladzislau Rezki (Sony) Cc: Vincenzo Frascino Cc: Yu Zhao Signed-off-by: Andrew Morton commit 5a569db68c6a961cf75993b16bdcc2fed087df9d Author: Anthony Iliopoulos Date: Wed Jun 28 03:34:37 2023 +0200 docs: update ocfs2-devel mailing list address The ocfs2-devel mailing list has been migrated to the kernel.org infrastructure, update all related documentation pointers to reflect the change. Link: https://lkml.kernel.org/r/20230628013437.47030-3-ailiop@suse.com Signed-off-by: Anthony Iliopoulos Acked-by: Joseph Qi Acked-by: Joel Becker Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: Junxiao Bi Cc: Mark Fasheh Signed-off-by: Andrew Morton commit a57b4b7f0557be4fa40d57e2c5e71f17e4510248 Author: Anthony Iliopoulos Date: Wed Jun 28 03:34:36 2023 +0200 MAINTAINERS: update ocfs2-devel mailing list address The ocfs2-devel mailing list has been migrated to the kernel.org infrastructure, update the related entry to reflect the change. Link: https://lkml.kernel.org/r/20230628013437.47030-2-ailiop@suse.com Signed-off-by: Anthony Iliopoulos Acked-by: Joseph Qi Acked-by: Joel Becker Cc: Mark Fasheh Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton commit f96c48670319d685d18d50819ed0c1ef751ed2ac Author: Suren Baghdasaryan Date: Wed Jul 5 18:14:00 2023 -0700 mm: disable CONFIG_PER_VMA_LOCK until its fixed A memory corruption was reported in [1] with bisection pointing to the patch [2] enabling per-VMA locks for x86. Disable per-VMA locks config to prevent this issue until the fix is confirmed. This is expected to be a temporary measure. [1] https://bugzilla.kernel.org/show_bug.cgi?id=217624 [2] https://lore.kernel.org/all/20230227173632.3292573-30-surenb@google.com Link: https://lkml.kernel.org/r/20230706011400.2949242-3-surenb@google.com Reported-by: Jiri Slaby Closes: https://lore.kernel.org/all/dbdef34c-3a07-5951-e1ae-e9c6e3cdf51b@kernel.org/ Reported-by: Jacob Young Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217624 Fixes: 0bff0aaea03e ("x86/mm: try VMA lock-based page fault handling first") Signed-off-by: Suren Baghdasaryan Cc: David Hildenbrand Cc: Holger Hoffstätte Cc: Signed-off-by: Andrew Morton commit 2b4f3b4987b56365b981f44a7e843efa5b6619b9 Author: Suren Baghdasaryan Date: Wed Jul 5 18:13:59 2023 -0700 fork: lock VMAs of the parent process when forking Patch series "Avoid memory corruption caused by per-VMA locks", v4. A memory corruption was reported in [1] with bisection pointing to the patch [2] enabling per-VMA locks for x86. Based on the reproducer provided in [1] we suspect this is caused by the lack of VMA locking while forking a child process. Patch 1/2 in the series implements proper VMA locking during fork. I tested the fix locally using the reproducer and was unable to reproduce the memory corruption problem. This fix can potentially regress some fork-heavy workloads. Kernel build time did not show noticeable regression on a 56-core machine while a stress test mapping 10000 VMAs and forking 5000 times in a tight loop shows ~7% regression. If such fork time regression is unacceptable, disabling CONFIG_PER_VMA_LOCK should restore its performance. Further optimizations are possible if this regression proves to be problematic. Patch 2/2 disables per-VMA locks until the fix is tested and verified. This patch (of 2): When forking a child process, parent write-protects an anonymous page and COW-shares it with the child being forked using copy_present_pte(). Parent's TLB is flushed right before we drop the parent's mmap_lock in dup_mmap(). If we get a write-fault before that TLB flush in the parent, and we end up replacing that anonymous page in the parent process in do_wp_page() (because, COW-shared with the child), this might lead to some stale writable TLB entries targeting the wrong (old) page. Similar issue happened in the past with userfaultfd (see flush_tlb_page() call inside do_wp_page()). Lock VMAs of the parent process when forking a child, which prevents concurrent page faults during fork operation and avoids this issue. This fix can potentially regress some fork-heavy workloads. Kernel build time did not show noticeable regression on a 56-core machine while a stress test mapping 10000 VMAs and forking 5000 times in a tight loop shows ~7% regression. If such fork time regression is unacceptable, disabling CONFIG_PER_VMA_LOCK should restore its performance. Further optimizations are possible if this regression proves to be problematic. Link: https://lkml.kernel.org/r/20230706011400.2949242-1-surenb@google.com Link: https://lkml.kernel.org/r/20230706011400.2949242-2-surenb@google.com Fixes: 0bff0aaea03e ("x86/mm: try VMA lock-based page fault handling first") Signed-off-by: Suren Baghdasaryan Suggested-by: David Hildenbrand Reported-by: Jiri Slaby Closes: https://lore.kernel.org/all/dbdef34c-3a07-5951-e1ae-e9c6e3cdf51b@kernel.org/ Reported-by: Holger Hoffstätte Closes: https://lore.kernel.org/all/b198d649-f4bf-b971-31d0-e8433ec2a34c@applied-asynchrony.com/ Reported-by: Jacob Young Closes: https://bugzilla.kernel.org/show_bug.cgi?id=3D217624 Reviewed-by: Liam R. Howlett Acked-by: David Hildenbrand Tested-by: Holger Hoffsttte Cc: Signed-off-by: Andrew Morton commit 48063dfa4fbb4b5aac3d8aacbf1fd1170b51c5fa Author: Geoff Levand Date: Thu Jun 29 23:32:44 2023 +0000 ntb.rst: Fix copy and paste error It seems the text for the NTB MSI Test Client section was copied from the NTB Tool Test Client, but was not updated for the new section. Corrects the NTB MSI Test Client section text. Reviewed-by: Logan Gunthorpe Reviewed-by: Dave Jiang Signed-off-by: Geoff Levand Signed-off-by: Jon Mason commit ce946519f95fe8f74ee1dba25512a33895520f41 Author: Geoff Levand Date: Fri Jun 30 21:58:46 2023 +0000 ntb_netdev: Fix module_init problem With both the ntb_transport_init and the ntb_netdev_init_module routines in the module_init init group, the ntb_netdev_init_module routine can be called before the ntb_transport_init routine that it depends on is called. To assure the proper initialization order put ntb_netdev_init_module in the late_initcall group. Fixes runtime errors where the ntb_netdev_init_module call fails with ENODEV. Signed-off-by: Geoff Levand Reviewed-by: Dave Jiang Signed-off-by: Jon Mason commit d353fb4b70402f487c1c68bc0a86f526dc8384f3 Author: Cai Huoqing Date: Fri Mar 24 09:32:20 2023 +0800 ntb: intel: Remove redundant pci_clear_master Remove pci_clear_master to simplify the code, the bus-mastering is also cleared in do_pci_disable_device, like this: ./drivers/pci/pci.c:2197 static void do_pci_disable_device(struct pci_dev *dev) { u16 pci_command; pci_read_config_word(dev, PCI_COMMAND, &pci_command); if (pci_command & PCI_COMMAND_MASTER) { pci_command &= ~PCI_COMMAND_MASTER; pci_write_config_word(dev, PCI_COMMAND, pci_command); } pcibios_disable_device(dev); }. And dev->is_busmaster is set to 0 in pci_disable_device. Signed-off-by: Cai Huoqing Acked-by: Dave Jiang Signed-off-by: Jon Mason commit f2748c6d768bbf3448da883a69e254816d7408b4 Author: Cai Huoqing Date: Fri Mar 24 09:32:19 2023 +0800 ntb: epf: Remove redundant pci_clear_master Remove pci_clear_master to simplify the code, the bus-mastering is also cleared in do_pci_disable_device, like this: ./drivers/pci/pci.c:2197 static void do_pci_disable_device(struct pci_dev *dev) { u16 pci_command; pci_read_config_word(dev, PCI_COMMAND, &pci_command); if (pci_command & PCI_COMMAND_MASTER) { pci_command &= ~PCI_COMMAND_MASTER; pci_write_config_word(dev, PCI_COMMAND, pci_command); } pcibios_disable_device(dev); }. And dev->is_busmaster is set to 0 in pci_disable_device. Signed-off-by: Cai Huoqing Signed-off-by: Jon Mason commit da6b4dc49e3c10e13adfb79fc41c098bacf1dc09 Author: Cai Huoqing Date: Fri Mar 24 09:32:18 2023 +0800 ntb_hw_amd: Remove redundant pci_clear_master Remove pci_clear_master to simplify the code, the bus-mastering is also cleared in do_pci_disable_device, like this: ./drivers/pci/pci.c:2197 static void do_pci_disable_device(struct pci_dev *dev) { u16 pci_command; pci_read_config_word(dev, PCI_COMMAND, &pci_command); if (pci_command & PCI_COMMAND_MASTER) { pci_command &= ~PCI_COMMAND_MASTER; pci_write_config_word(dev, PCI_COMMAND, pci_command); } pcibios_disable_device(dev); }. And dev->is_busmaster is set to 0 in pci_disable_device. Signed-off-by: Cai Huoqing Signed-off-by: Jon Mason commit cb2a6d17353452e893194ce1b4e2699fcb24b955 Author: Bjorn Helgaas Date: Tue Mar 7 14:30:21 2023 -0600 ntb: idt: drop redundant pci_enable_pcie_error_reporting() pci_enable_pcie_error_reporting() enables the device to send ERR_* Messages. Since f26e58bf6f54 ("PCI/AER: Enable error reporting when AER is native"), the PCI core does this for all devices during enumeration, so the driver doesn't need to do it itself. Remove the redundant pci_enable_pcie_error_reporting() call from the driver. Also remove the corresponding pci_disable_pcie_error_reporting() from the driver .remove() path. Note that this only controls ERR_* Messages from the device. An ERR_* Message may cause the Root Port to generate an interrupt, depending on the AER Root Error Command register managed by the AER service driver. Signed-off-by: Bjorn Helgaas Acked-by: Serge Semin Signed-off-by: Jon Mason commit ce2188acad4a7356551ba1ef4a3fbc2b24da15a2 Author: Palmer Dabbelt Date: Thu Oct 13 14:46:38 2022 -0700 MAINTAINERS: git://github -> https://github.com for jonmason Github deprecated the git:// links about a year ago, so let's move to the https:// URLs instead. Reported-by: Conor Dooley Link: https://github.blog/2021-09-01-improving-git-protocol-security-github/ Signed-off-by: Palmer Dabbelt Signed-off-by: Jon Mason commit 956578e3d397e00d6254dc7b5194d28587f98518 Author: ruanjinjie Date: Wed Nov 9 17:28:52 2022 +0800 NTB: EPF: fix possible memory leak in pci_vntb_probe() As ntb_register_device() don't handle error of device_register(), if ntb_register_device() returns error in pci_vntb_probe(), name of kobject which is allocated in dev_set_name() called in device_add() is leaked. As comment of device_add() says, it should call put_device() to drop the reference count that was set in device_initialize() when it fails, so the name can be freed in kobject_cleanup(). Signed-off-by: ruanjinjie Signed-off-by: Jon Mason commit 2790143f09938776a3b4f69685b380bae8fd06c7 Author: Jiasheng Jiang Date: Tue Nov 22 11:32:44 2022 +0800 NTB: ntb_tool: Add check for devm_kcalloc As the devm_kcalloc may return NULL pointer, it should be better to add check for the return value, as same as the others. Fixes: 7f46c8b3a552 ("NTB: ntb_tool: Add full multi-port NTB API support") Signed-off-by: Jiasheng Jiang Reviewed-by: Serge Semin Reviewed-by: Dave Jiang Signed-off-by: Jon Mason commit 8623ccbfc55d962e19a3537652803676ad7acb90 Author: Yang Yingliang Date: Thu Nov 10 23:19:17 2022 +0800 NTB: ntb_transport: fix possible memory leak while device_register() fails If device_register() returns error, the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(), and client_dev is freed in ntb_transport_client_release(). Fixes: fce8a7bb5b4b ("PCI-Express Non-Transparent Bridge Support") Signed-off-by: Yang Yingliang Reviewed-by: Dave Jiang Signed-off-by: Jon Mason commit 4c3c796aca02883ad35bb117468938cc4022ca41 Author: Yuan Can Date: Sat Nov 5 09:43:22 2022 +0000 ntb: intel: Fix error handling in intel_ntb_pci_driver_init() A problem about ntb_hw_intel create debugfs failed is triggered with the following log given: [ 273.112733] Intel(R) PCI-E Non-Transparent Bridge Driver 2.0 [ 273.115342] debugfs: Directory 'ntb_hw_intel' with parent '/' already present! The reason is that intel_ntb_pci_driver_init() returns pci_register_driver() directly without checking its return value, if pci_register_driver() failed, it returns without destroy the newly created debugfs, resulting the debugfs of ntb_hw_intel can never be created later. intel_ntb_pci_driver_init() debugfs_create_dir() # create debugfs directory pci_register_driver() driver_register() bus_add_driver() priv = kzalloc(...) # OOM happened # return without destroy debugfs directory Fix by removing debugfs when pci_register_driver() returns error. Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers") Signed-off-by: Yuan Can Acked-by: Dave Jiang Signed-off-by: Jon Mason commit 98af0a33c1101c29b3ce4f0cf4715fd927c717f9 Author: Yuan Can Date: Sat Nov 5 09:43:09 2022 +0000 NTB: amd: Fix error handling in amd_ntb_pci_driver_init() A problem about ntb_hw_amd create debugfs failed is triggered with the following log given: [ 618.431232] AMD(R) PCI-E Non-Transparent Bridge Driver 1.0 [ 618.433284] debugfs: Directory 'ntb_hw_amd' with parent '/' already present! The reason is that amd_ntb_pci_driver_init() returns pci_register_driver() directly without checking its return value, if pci_register_driver() failed, it returns without destroy the newly created debugfs, resulting the debugfs of ntb_hw_amd can never be created later. amd_ntb_pci_driver_init() debugfs_create_dir() # create debugfs directory pci_register_driver() driver_register() bus_add_driver() priv = kzalloc(...) # OOM happened # return without destroy debugfs directory Fix by removing debugfs when pci_register_driver() returns error. Fixes: a1b3695820aa ("NTB: Add support for AMD PCI-Express Non-Transparent Bridge") Signed-off-by: Yuan Can Signed-off-by: Jon Mason commit c012968259b451dc4db407f2310fe131eaefd800 Author: Yuan Can Date: Sat Nov 5 09:43:01 2022 +0000 ntb: idt: Fix error handling in idt_pci_driver_init() A problem about ntb_hw_idt create debugfs failed is triggered with the following log given: [ 1236.637636] IDT PCI-E Non-Transparent Bridge Driver 2.0 [ 1236.639292] debugfs: Directory 'ntb_hw_idt' with parent '/' already present! The reason is that idt_pci_driver_init() returns pci_register_driver() directly without checking its return value, if pci_register_driver() failed, it returns without destroy the newly created debugfs, resulting the debugfs of ntb_hw_idt can never be created later. idt_pci_driver_init() debugfs_create_dir() # create debugfs directory pci_register_driver() driver_register() bus_add_driver() priv = kzalloc(...) # OOM happened # return without destroy debugfs directory Fix by removing debugfs when pci_register_driver() returns error. Fixes: bf2a952d31d2 ("NTB: Add IDT 89HPESxNTx PCIe-switches support") Signed-off-by: Yuan Can Signed-off-by: Jon Mason commit 51d03e2f2203e76ed02d33fb5ffbb5fc85ffaf54 Author: Eric Dumazet Date: Sat Jul 8 08:29:58 2023 +0000 udp6: fix udp6_ehashfn() typo Amit Klein reported that udp6_ehash_secret was initialized but never used. Fixes: 1bbdceef1e53 ("inet: convert inet_ehash_secret and ipv6_hash_secret to net_get_random_once") Reported-by: Amit Klein Signed-off-by: Eric Dumazet Cc: Willy Tarreau Cc: Willem de Bruijn Cc: David Ahern Cc: Hannes Frederic Sowa Signed-off-by: David S. Miller commit 0b7ec177b589842c0abf9e91459c83ba28d32452 Author: David Howells Date: Fri Jul 7 10:12:38 2023 +0100 crypto: algif_hash - Fix race between MORE and non-MORE sends The 'MSG_MORE' state of the previous sendmsg() is fetched without the socket lock held, so two sendmsg calls can race. This can be seen with a large sendfile() as that now does a series of sendmsg() calls, and if a write() comes in on the same socket at an inopportune time, it can flip the state. Fix this by moving the fetch of ctx->more inside the socket lock. Fixes: c662b043cdca ("crypto: af_alg/hash: Support MSG_SPLICE_PAGES") Reported-by: syzbot+689ec3afb1ef07b766b2@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/000000000000554b8205ffdea64e@google.com/ Signed-off-by: David Howells Tested-by: syzbot+689ec3afb1ef07b766b2@syzkaller.appspotmail.com cc: Herbert Xu cc: Paolo Abeni cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: linux-crypto@vger.kernel.org cc: netdev@vger.kernel.org Signed-off-by: Herbert Xu commit 2aaa8a15de73874847d62eb595c6683bface80fd Author: Kuniyuki Iwashima Date: Fri Jul 7 18:43:27 2023 -0700 icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that has the link-local address as src and dst IP and will be forwarded to an external IP in the IPv6 Ext Hdr. For example, the script below generates a packet whose src IP is the link-local address and dst is updated to 11::. # for f in $(find /proc/sys/net/ -name *seg6_enabled*); do echo 1 > $f; done # python3 >>> from socket import * >>> from scapy.all import * >>> >>> SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456" >>> >>> pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR) >>> pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1) >>> >>> sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW) >>> sk.sendto(bytes(pkt), (DST_ADDR, 0)) For such a packet, we call ip6_route_input() to look up a route for the next destination in these three functions depending on the header type. * ipv6_rthdr_rcv() * ipv6_rpl_srh_rcv() * ipv6_srh_rcv() If no route is found, ip6_null_entry is set to skb, and the following dst_input(skb) calls ip6_pkt_drop(). Finally, in icmp6_dev(), we dereference skb_rt6_info(skb)->rt6i_idev->dev as the input device is the loopback interface. Then, we have to check if skb_rt6_info(skb)->rt6i_idev is NULL or not to avoid NULL pointer deref for ip6_null_entry. BUG: kernel NULL pointer dereference, address: 0000000000000000 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 157 Comm: python3 Not tainted 6.4.0-11996-gb121d614371c #35 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503) Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01 RSP: 0018:ffffc90000003c70 EFLAGS: 00000286 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0 RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18 RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001 R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10 R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0 FS: 00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: ip6_pkt_drop (net/ipv6/route.c:4513) ipv6_rthdr_rcv (net/ipv6/exthdrs.c:640 net/ipv6/exthdrs.c:686) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:437 (discriminator 5)) ip6_input_finish (./include/linux/rcupdate.h:781 net/ipv6/ip6_input.c:483) __netif_receive_skb_one_core (net/core/dev.c:5455) process_backlog (./include/linux/rcupdate.h:781 net/core/dev.c:5895) __napi_poll (net/core/dev.c:6460) net_rx_action (net/core/dev.c:6529 net/core/dev.c:6660) __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554) do_softirq (kernel/softirq.c:454 kernel/softirq.c:441) __local_bh_enable_ip (kernel/softirq.c:381) __dev_queue_xmit (net/core/dev.c:4231) ip6_finish_output2 (./include/net/neighbour.h:544 net/ipv6/ip6_output.c:135) rawv6_sendmsg (./include/net/dst.h:458 ./include/linux/netfilter.h:303 net/ipv6/raw.c:656 net/ipv6/raw.c:914) sock_sendmsg (net/socket.c:725 net/socket.c:748) __sys_sendto (net/socket.c:2134) __x64_sys_sendto (net/socket.c:2146 net/socket.c:2142 net/socket.c:2142) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) RIP: 0033:0x7f9dc751baea Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007ffe98712c38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007ffe98712cf8 RCX: 00007f9dc751baea RDX: 0000000000000060 RSI: 00007f9dc6460b90 RDI: 0000000000000003 RBP: 00007f9dc56e8be0 R08: 00007ffe98712d70 R09: 000000000000001c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007f9dc6af5d1b Modules linked in: CR2: 0000000000000000 ---[ end trace 0000000000000000 ]--- RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503) Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01 RSP: 0018:ffffc90000003c70 EFLAGS: 00000286 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0 RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18 RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001 R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10 R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0 FS: 00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0 PKRU: 55555554 Kernel panic - not syncing: Fatal exception in interrupt Kernel Offset: disabled Fixes: 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address") Reported-by: Wang Yufen Closes: https://lore.kernel.org/netdev/c41403a9-c2f6-3b7e-0c96-e1901e605cd0@huawei.com/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: David Ahern Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit bbffab69d05dfbb7c60a811c7edc2bd57a03e89f Merge: c329b261afe71 266deeea34ffd Author: David S. Miller Date: Sat Jul 8 10:07:14 2023 +0100 Merge branch 's390-ism-fixes' Niklas Schnelle says: ==================== s390/ism: Fixes to client handling This is v2 of the patch previously titled "s390/ism: Detangle ISM client IRQ and event forwarding". As suggested by Paolo Abeni I split the patch up. While doing so I noticed another problem that was fixed by this patch concerning the way the workqueues access the client structs. This means the second patch turning the workqueues into simple direct calls also fixes a problem. Finally I split off a third patch just for fixing ism_unregister_client()s error path. The code after these 3 patches is identical to the result of the v1 patch except that I also turned the dev_err() for still registered DMBs into a WARN(). ==================== Signed-off-by: David S. Miller commit 266deeea34ffd28c6b6a63edf2af9b5a07161c24 Author: Niklas Schnelle Date: Fri Jul 7 12:56:22 2023 +0200 s390/ism: Do not unregister clients with registered DMBs When ism_unregister_client() is called but the client still has DMBs registered it returns -EBUSY and prints an error. This only happens after the client has already been unregistered however. This is unexpected as the unregister claims to have failed. Furthermore as this implies a client bug a WARN() is more appropriate. Thus move the deregistration after the check and use WARN(). Fixes: 89e7d2ba61b7 ("net/ism: Add new API for client registration") Signed-off-by: Niklas Schnelle Signed-off-by: David S. Miller commit 76631ffa2fd2d45bae5ad717eef716b94144e0e7 Author: Niklas Schnelle Date: Fri Jul 7 12:56:21 2023 +0200 s390/ism: Fix and simplify add()/remove() callback handling Previously the clients_lock was protecting the clients array against concurrent addition/removal of clients but was also accessed from IRQ context. This meant that it had to be a spinlock and that the add() and remove() callbacks in which clients need to do allocation and take mutexes can't be called under the clients_lock. To work around this these callbacks were moved to workqueues. This not only introduced significant complexity but is also subtly broken in at least one way. In ism_dev_init() and ism_dev_exit() clients[i]->tgt_ism is used to communicate the added/removed ISM device to the work function. While write access to client[i]->tgt_ism is protected by the clients_lock and the code waits that there is no pending add/remove work before and after setting clients[i]->tgt_ism this is not enough. The problem is that the wait happens based on per ISM device counters. Thus a concurrent ism_dev_init()/ism_dev_exit() for a different ISM device may overwrite a clients[i]->tgt_ism between unlocking the clients_lock and the subsequent wait for the work to finnish. Thankfully with the clients_lock no longer held in IRQ context it can be turned into a mutex which can be held during the calls to add()/remove() completely removing the need for the workqueues and the associated broken housekeeping including the per ISM device counters and the clients[i]->tgt_ism. Fixes: 89e7d2ba61b7 ("net/ism: Add new API for client registration") Signed-off-by: Niklas Schnelle Signed-off-by: David S. Miller commit 6b5c13b591d753c6022fbd12f8c0c0a9a07fc065 Author: Niklas Schnelle Date: Fri Jul 7 12:56:20 2023 +0200 s390/ism: Fix locking for forwarding of IRQs and events to clients The clients array references all registered clients and is protected by the clients_lock. Besides its use as general list of clients the clients array is accessed in ism_handle_irq() to forward ISM device events to clients. While the clients_lock is taken in the IRQ handler when calling handle_event() it is however incorrectly not held during the client->handle_irq() call and for the preceding clients[] access leaving it unprotected against concurrent client (un-)registration. Furthermore the accesses to ism->sba_client_arr[] in ism_register_dmb() and ism_unregister_dmb() are not protected by any lock. This is especially problematic as the client ID from the ism->sba_client_arr[] is not checked against NO_CLIENT and neither is the client pointer checked. Instead of expanding the use of the clients_lock further add a separate array in struct ism_dev which references clients subscribed to the device's events and IRQs. This array is protected by ism->lock which is already taken in ism_handle_irq() and can be taken outside the IRQ handler when adding/removing subscribers or the accessing ism->sba_client_arr[]. This also means that the clients_lock is no longer taken in IRQ context. Fixes: 89e7d2ba61b7 ("net/ism: Add new API for client registration") Signed-off-by: Niklas Schnelle Reviewed-by: Alexandra Winter Signed-off-by: David S. Miller commit c329b261afe71197d9da83c1f18eb45a7e97e089 Author: Paolo Abeni Date: Fri Jul 7 10:11:10 2023 +0200 net: prevent skb corruption on frag list segmentation Ian reported several skb corruptions triggered by rx-gro-list, collecting different oops alike: [ 62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0 [ 62.631083] #PF: supervisor read access in kernel mode [ 62.636312] #PF: error_code(0x0000) - not-present page [ 62.641541] PGD 0 P4D 0 [ 62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364 [ 62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022 [ 62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858 ./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261 net/ipv4/udp_offload.c:277) [ 62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246 [ 62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000 [ 62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4 [ 62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9 [ 62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2 [ 62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9 [ 62.728654] FS: 0000000000000000(0000) GS:ffffa127efa40000(0000) knlGS:0000000000000000 [ 62.736852] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0 [ 62.749948] Call Trace: [ 62.752498] [ 62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398) [ 62.787605] skb_mac_gso_segment (net/core/gro.c:141) [ 62.791906] __skb_gso_segment (net/core/dev.c:3403 (discriminator 2)) [ 62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862 net/core/dev.c:3659) [ 62.804695] validate_xmit_skb_list (net/core/dev.c:3710) [ 62.809158] sch_direct_xmit (net/sched/sch_generic.c:330) [ 62.813198] __dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210) net/netfilter/core.c:626) [ 62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55) [ 62.825652] maybe_deliver (net/bridge/br_forward.c:193) [ 62.829420] br_flood (net/bridge/br_forward.c:233) [ 62.832758] br_handle_frame_finish (net/bridge/br_input.c:215) [ 62.837403] br_handle_frame (net/bridge/br_input.c:298 net/bridge/br_input.c:416) [ 62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387) [ 62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570) [ 62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638 net/core/dev.c:5727) [ 62.876795] napi_complete_done (./include/linux/list.h:37 ./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067) [ 62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191) [ 62.893534] __napi_poll (net/core/dev.c:6498) [ 62.897133] napi_threaded_poll (./include/linux/netpoll.h:89 net/core/dev.c:6640) [ 62.905276] kthread (kernel/kthread.c:379) [ 62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314) [ 62.917119] In the critical scenario, rx-gro-list GRO-ed packets are fed, via a bridge, both to the local input path and to an egress device (tun). The segmentation of such packets unsafely writes to the cloned skbs with shared heads. This change addresses the issue by uncloning as needed the to-be-segmented skbs. Reported-by: Ian Kumlien Tested-by: Ian Kumlien Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.") Signed-off-by: Paolo Abeni Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller commit e7731194fdf085f46d58b1adccfddbd0dfee4873 Author: Rafał Miłecki Date: Fri Jul 7 08:53:25 2023 +0200 net: bgmac: postpone turning IRQs off to avoid SoC hangs Turning IRQs off is done by accessing Ethernet controller registers. That can't be done until device's clock is enabled. It results in a SoC hang otherwise. This bug remained unnoticed for years as most bootloaders keep all Ethernet interfaces turned on. It seems to only affect a niche SoC family BCM47189. It has two Ethernet controllers but CFE bootloader uses only the first one. Fixes: 34322615cbaa ("net: bgmac: Mask interrupts during probe") Signed-off-by: Rafał Miłecki Reviewed-by: Michal Kubiak Signed-off-by: David S. Miller commit ed04a91f718e6e1ab82d47a22b26e4b50c1666f6 Author: Darrick J. Wong Date: Thu Jul 6 18:00:59 2023 -0700 xfs: fix uninit warning in xfs_growfs_data Quiet down this gcc warning: fs/xfs/xfs_fsops.c: In function ‘xfs_growfs_data’: fs/xfs/xfs_fsops.c:219:21: error: ‘lastag_extended’ may be used uninitialized in this function [-Werror=maybe-uninitialized] 219 | if (lastag_extended) { | ^~~~~~~~~~~~~~~ fs/xfs/xfs_fsops.c:100:33: note: ‘lastag_extended’ was declared here 100 | bool lastag_extended; | ^~~~~~~~~~~~~~~ By setting its value explicitly. From code analysis I don't think this is a real problem, but I have better things to do than analyse this closely. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit 8689f4f2ea561dd080118eeb05c0255ac9542905 Merge: 4c8ab068bea2e fa700d73494ab Author: Linus Torvalds Date: Fri Jul 7 15:59:33 2023 -0700 Merge tag 'mmc-v6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull mmc fix from Ulf Hansson: - Fix regression of detection of eMMC/SD/SDIO cards * tag 'mmc-v6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: Revert "mmc: core: Allow mmc_start_host() synchronously detect a card" commit 4c8ab068bea2ed7b5b192cd66d436620a0b4f05e Merge: 3290badd1bb8c 5251605f4d297 Author: Linus Torvalds Date: Fri Jul 7 15:40:17 2023 -0700 Merge tag 'sound-fix-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes that have been gathered recently: - Two code-typo fixes in the new UMP core - A fix in jack reporting to avoid the usage of mutex - A potential data race fix in HD-audio core regmap code - A potential data race fix in PCM allocation helper code - HD-audio quirks for ASUS, Clevo and Unis machines - Constifications in FireWire drivers" * tag 'sound-fix-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V ALSA: jack: Fix mutex call in snd_jack_report() ALSA: seq: ump: fix typo in system_2p_ev_to_ump_midi1() ALSA: hda/realtek: Whitespace fix ALSA: hda/realtek: Add quirk for ASUS ROG G614Jx ALSA: hda/realtek: Amend G634 quirk to enable rear speakers ALSA: hda/realtek: Add quirk for ASUS ROG GA402X ALSA: hda/realtek: Add quirk for ASUS ROG GX650P ALSA: pcm: Fix potential data race at PCM memory allocation helpers ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 ALSA: hda/realtek: Add quirk for Clevo NPx0SNx ALSA: ump: Correct wrong byte size at converting a UMP System message ALSA: fireface: make read-only const array for model names static ALSA: oxfw: make read-only const array models static commit 3290badd1bb8c9ea91db5c0b2e1a635178119856 Merge: 36b93aed9ec07 257e6172ab36e Author: Linus Torvalds Date: Fri Jul 7 15:07:20 2023 -0700 Merge tag 'ceph-for-6.5-rc1' of https://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: "A bunch of CephFS fixups from Xiubo, mostly around dropping caps, along with a fix for a regression in the readahead handling code which sneaked in with the switch to netfs helpers" * tag 'ceph-for-6.5-rc1' of https://github.com/ceph/ceph-client: ceph: don't let check_caps skip sending responses for revoke msgs ceph: issue a cap release immediately if no cap exists ceph: trigger to flush the buffer when making snapshot ceph: fix blindly expanding the readahead windows ceph: add a dedicated private data for netfs rreq ceph: voluntarily drop Xx caps for requests those touch parent mtime ceph: try to dump the msgs when decoding fails ceph: only send metrics when the MDS rank is ready commit 36b93aed9ec07607e26630ecf210e065662f6b0d Merge: 986ffe6070d66 44b4494d5c597 Author: Linus Torvalds Date: Fri Jul 7 14:59:38 2023 -0700 Merge tag 'ntfs3_for_6.5' of https://github.com/Paragon-Software-Group/linux-ntfs3 Pull ntfs3 updates from Konstantin Komarov: "Updates: - support /proc/fs/ntfs3//volinfo and label - alternative boot if primary boot is corrupted - small optimizations Fixes: - fix endian problems - fix logic errors - code refactoring and reformatting" * tag 'ntfs3_for_6.5' of https://github.com/Paragon-Software-Group/linux-ntfs3: fs/ntfs3: Correct mode for label entry inside /proc/fs/ntfs3/ fs/ntfs3: Add support /proc/fs/ntfs3//volinfo and /proc/fs/ntfs3//label fs/ntfs3: Fix endian problem fs/ntfs3: Add ability to format new mft records with bigger/smaller header fs/ntfs3: Code refactoring fs/ntfs3: Code formatting fs/ntfs3: Do not update primary boot in ntfs_init_from_boot() fs/ntfs3: Alternative boot if primary boot is corrupted fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted fs/ntfs3: Fix ntfs_atomic_open fs/ntfs3: Correct checking while generating attr_list fs/ntfs3: Use __GFP_NOWARN allocation at ntfs_load_attr_list() fs: ntfs3: Fix possible null-pointer dereferences in mi_read() fs/ntfs3: Return error for inconsistent extended attributes fs/ntfs3: Enhance sanity check while generating attr_list fs/ntfs3: Use wrapper i_blocksize() in ntfs_zero_range() ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() commit 986ffe6070d661650f8198069f6f3c228e23bca0 Merge: 4f6b6c2b2f86b 69562eb0bd3e6 Author: Linus Torvalds Date: Fri Jul 7 14:51:37 2023 -0700 Merge tag 'fsnotify_for_v6.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify fix from Jan Kara: "A fix for fanotify to disallow creating of mount or superblock marks for kernel internal pseudo filesystems" * tag 'fsnotify_for_v6.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fanotify: disallow mount/sb marks on kernel internal pseudo fs commit 8a796565cec3601071cbbd27d6304e202019d014 Author: Andres Freund Date: Fri Jul 7 09:20:07 2023 -0700 io_uring: Use io_schedule* in cqring wait I observed poor performance of io_uring compared to synchronous IO. That turns out to be caused by deeper CPU idle states entered with io_uring, due to io_uring using plain schedule(), whereas synchronous IO uses io_schedule(). The losses due to this are substantial. On my cascade lake workstation, t/io_uring from the fio repository e.g. yields regressions between 20% and 40% with the following command: ./t/io_uring -r 5 -X0 -d 1 -s 1 -c 1 -p 0 -S$use_sync -R 0 /mnt/t2/fio/write.0.0 This is repeatable with different filesystems, using raw block devices and using different block devices. Use io_schedule_prepare() / io_schedule_finish() in io_cqring_wait_schedule() to address the difference. After that using io_uring is on par or surpassing synchronous IO (using registered files etc makes it reliably win, but arguably is a less fair comparison). There are other calls to schedule() in io_uring/, but none immediately jump out to be similarly situated, so I did not touch them. Similarly, it's possible that mutex_lock_io() should be used, but it's not clear if there are cases where that matters. Cc: stable@vger.kernel.org # 5.10+ Cc: Pavel Begunkov Cc: io-uring@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Andres Freund Link: https://lore.kernel.org/r/20230707162007.194068-1-andres@anarazel.de [axboe: minor style fixup] Signed-off-by: Jens Axboe commit 4f6b6c2b2f86b7878a770736bf478d8a263ff0bc Merge: 22dcc7d77fa46 e8605e8fdf426 Author: Linus Torvalds Date: Fri Jul 7 10:07:19 2023 -0700 Merge tag 'riscv-for-linus-6.5-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull more RISC-V updates from Palmer Dabbelt: - A bunch of fixes/cleanups from the first part of the merge window, mostly related to ACPI and vector as those were large - Some documentation improvements, mostly related to the new code - The "riscv,isa" DT key is deprecated - Support for link-time dead code elimination - Support for minor fault registration in userfaultd - A handful of cleanups around CMO alternatives * tag 'riscv-for-linus-6.5-mw2' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (23 commits) riscv: mm: mark noncoherent_supported as __ro_after_init riscv: mm: mark CBO relate initialization funcs as __init riscv: errata: thead: only set cbom size & noncoherent during boot riscv: Select HAVE_ARCH_USERFAULTFD_MINOR RISC-V: Document the ISA string parsing rules for ACPI risc-v: Fix order of IPI enablement vs RCU startup mm: riscv: fix an unsafe pte read in huge_pte_alloc() dt-bindings: riscv: deprecate riscv,isa RISC-V: drop error print from riscv_hartid_to_cpuid() riscv: Discard vector state on syscalls riscv: move memblock_allow_resize() after linear mapping is ready riscv: Enable ARCH_SUSPEND_POSSIBLE for s2idle riscv: vdso: include vdso/vsyscall.h for vdso_data selftests: Test RISC-V Vector's first-use handler riscv: vector: clear V-reg in the first-use trap riscv: vector: only enable interrupts in the first-use trap RISC-V: Fix up some vector state related build failures RISC-V: Document that V registers are clobbered on syscalls riscv: disable HAVE_LD_DEAD_CODE_DATA_ELIMINATION for LLD riscv: enable HAVE_LD_DEAD_CODE_DATA_ELIMINATION ... commit 22dcc7d77fa463914bc2a2fb4580e6d183ca415d Merge: 70806ee18a871 abaa02fc944f2 Author: Linus Torvalds Date: Fri Jul 7 10:00:30 2023 -0700 Merge tag 'powerpc-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: - Fix PCIe MEM size for pci2 node on Turris 1.x boards - Two minor build fixes Thanks to Christophe Leroy, Douglas Anderson, Pali Rohár, Petr Mladek, and Randy Dunlap. * tag 'powerpc-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc: dts: turris1x.dts: Fix PCIe MEM size for pci2 node powerpc: Include asm/nmi.c in mobility.c for watchdog_hardlockup_set_timeout_pct() powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y commit 70806ee18a871140a73a2524a29865e1d904348c Merge: 5133c9e51de41 3f069c4c64322 Author: Linus Torvalds Date: Fri Jul 7 09:55:31 2023 -0700 Merge tag 'apparmor-pr-2023-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor Pull apparmor updates from John Johansen: - fix missing error check for rhashtable_insert_fast - add missing failure check in compute_xmatch_perms - fix policy_compat permission remap with extended permissions - fix profile verification and enable it - fix kzalloc perms tables for shared dfas - Fix kernel-doc header for verify_dfa_accept_index - aa_buffer: Convert 1-element array to flexible array - Return directly after a failed kzalloc() in two functions - fix use of strcpy in policy_unpack_test - fix kernel-doc complaints - Fix some kernel-doc comments * tag 'apparmor-pr-2023-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: apparmor: Fix kernel-doc header for verify_dfa_accept_index apparmor: fix: kzalloc perms tables for shared dfas apparmor: fix profile verification and enable it apparmor: fix policy_compat permission remap with extended permissions apparmor: aa_buffer: Convert 1-element array to flexible array apparmor: add missing failure check in compute_xmatch_perms apparmor: fix missing error check for rhashtable_insert_fast apparmor: Return directly after a failed kzalloc() in two functions AppArmor: Fix some kernel-doc comments apparmor: fix use of strcpy in policy_unpack_test apparmor: fix kernel-doc complaints commit b1472a60a584694875a05cf8bcba8bdf0dc1cd3a Author: Thomas Gleixner Date: Wed Jul 5 10:59:23 2023 +0200 x86/smp: Don't send INIT to boot CPU Parking CPUs in INIT works well, except for the crash case when the CPU which invokes smp_park_other_cpus_in_init() is not the boot CPU. Sending INIT to the boot CPU resets the whole machine. Prevent this by validating that this runs on the boot CPU. If not fall back and let CPUs hang in HLT. Fixes: 45e34c8af58f ("x86/smp: Put CPUs into INIT on shutdown if possible") Reported-by: Baokun Li Signed-off-by: Thomas Gleixner Tested-by: Baokun Li Link: https://lore.kernel.org/r/87ttui91jo.ffs@tglx commit 3a6dbb691782e88e07e5c70b327495dbd58a2e7f Author: Thomas Bogendoerfer Date: Thu Jul 6 18:36:10 2023 +0200 MIPS: kvm: Fix build error with KVM_MIPS_DEBUG_COP0_COUNTERS enabled Commit e4de20576986 ("MIPS: KVM: Fix NULL pointer dereference") missed converting one place accessing cop0 registers, which results in a build error, if KVM_MIPS_DEBUG_COP0_COUNTERS is enabled. Fixes: e4de20576986 ("MIPS: KVM: Fix NULL pointer dereference") Signed-off-by: Thomas Bogendoerfer Reviewed-by: Philippe Mathieu-Daudé commit 8139dccd464aaee4a2c351506ff883733c6ca5a3 Author: Ivan Babrou Date: Thu Jul 6 21:39:20 2023 -0700 udp6: add a missing call into udp_fail_queue_rcv_skb tracepoint The tracepoint has existed for 12 years, but it only covered udp over the legacy IPv4 protocol. Having it enabled for udp6 removes the unnecessary difference in error visibility. Signed-off-by: Ivan Babrou Fixes: 296f7ea75b45 ("udp: add tracepoints for queueing skb to rcvbuf") Acked-by: Paolo Abeni Signed-off-by: David S. Miller commit 3a7af34fb6ecd9fbeb4454fc03c654b26fab5f5e Author: Shannon Nelson Date: Thu Jul 6 13:59:24 2023 -0700 ionic: remove dead device fail path Remove the probe error path code that leaves the driver bound to the device, but with essentially a dead device. This was useful maybe twice early in the driver's life and no longer makes sense to keep. Fixes: 30a1e6d0f8e2 ("ionic: keep ionic dev on lif init fail") Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller commit abfb2a58a5377ebab717d4362d6180f901b6e5c1 Author: Nitya Sunkad Date: Thu Jul 6 11:20:06 2023 -0700 ionic: remove WARN_ON to prevent panic_on_warn Remove unnecessary early code development check and the WARN_ON that it uses. The irq alloc and free paths have long been cleaned up and this check shouldn't have stuck around so long. Fixes: 77ceb68e29cc ("ionic: Add notifyq support") Signed-off-by: Nitya Sunkad Signed-off-by: Shannon Nelson Reviewed-by: Jacob Keller Signed-off-by: David S. Miller commit 7709fbd4922c197efabda03660d93e48a3e80323 Author: Sai Krishna Date: Thu Jul 6 13:59:36 2023 +0530 octeontx2-af: Move validation of ptp pointer before its usage Moved PTP pointer validation before its use to avoid smatch warning. Also used kzalloc/kfree instead of devm_kzalloc/devm_kfree. Fixes: 2ef4e45d99b1 ("octeontx2-af: Add PTP PPS Errata workaround on CN10K silicon") Signed-off-by: Naveen Mamindlapalli Signed-off-by: Sunil Goutham Signed-off-by: Sai Krishna Signed-off-by: David S. Miller commit af42088bdaf292060b8d8a00d8644ca7b2b3f2d1 Author: Ratheesh Kannoth Date: Thu Jul 6 09:57:05 2023 +0530 octeontx2-af: Promisc enable/disable through mbox In legacy silicon, promiscuous mode is only modified through CGX mbox messages. In CN10KB silicon, it is modified from CGX mbox and NIX. This breaks legacy application behaviour. Fix this by removing call from NIX. Fixes: d6c9784baf59 ("octeontx2-af: Invoke exact match functions if supported") Signed-off-by: Ratheesh Kannoth Reviewed-by: Leon Romanovsky Reviewed-by: Michal Kubiak Signed-off-by: David S. Miller commit 15008052b34efaa86c1d56190ac73c4bf8c462f9 Author: Geert Uytterhoeven Date: Thu Jul 6 17:30:31 2023 +0200 drm/fbdev-dma: Fix documented default preferred_bpp value As of commit 6c80a93be62d398e ("drm/fb-helper: Initialize fb-helper's preferred BPP in prepare function"), the preferred_bpp parameter of drm_fb_helper_prepare() defaults to 32 instead of drm_mode_config.preferred_depth. Hence this also applies to drm_fbdev_dma_setup(), which just passes its own preferred_bpp parameter. Fixes: b79fe9abd58bab73 ("drm/fbdev-dma: Implement fbdev emulation for GEM DMA helpers") Signed-off-by: Geert Uytterhoeven Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/91f093ffe436a9f94d58fb2bfbc1407f1ebe8bb0.1688656591.git.geert+renesas@glider.be commit b61aac027b019155199db1f8580c3d50d417c6d8 Merge: 0503efeadbf6b 84a192e461063 Author: David S. Miller Date: Fri Jul 7 08:56:12 2023 +0100 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-07-05 (igc) This series contains updates to igc driver only. Husaini adds check to increment Qbv change error counter only on taprio Qbvs. He also removes delay during Tx ring configuration and resolves Tx hang that could occur when transmitting on a gate to be closed. Prasad Koya reports ethtool link mode as TP (twisted pair). Tee Min corrects value for max SDU. Aravindhan ensures that registers for PPS are always programmed to occur in future. ==================== Signed-off-by: David S. Miller commit 5251605f4d297a0eb5d3b7f39f9dcee9e4d0115a Author: Luke D. Jones Date: Fri Jul 7 10:33:23 2023 +1200 ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V Adds the required quirk to enable the Cirrus amp and correct pins on the ASUS ROG GZ301V series which uses an SPI connected Cirrus amp. While this works if the related _DSD properties are made available, these aren't included in the ACPI of these laptops (yet). Signed-off-by: Luke D. Jones Link: https://lore.kernel.org/r/20230706223323.30871-2-luke@ljones.dev Signed-off-by: Takashi Iwai commit 5133c9e51de41bfa902153888e11add3342ede18 Merge: 94e0d43e51ff8 6725f33228077 Author: Linus Torvalds Date: Thu Jul 6 22:42:54 2023 -0700 Merge tag 'drm-next-2023-07-07' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Lots of fixes, mostly i915 and amdgpu. It's two weeks of i915, and I think three weeks of amdgpu. fbdev: - Fix module infos on sparc panel: - Fix mode on Starry-ili9882t i915: - Allow DC states along with PW2 only for PWB functionality [adlp+] - Fix SSC selection for MPLLA [mtl] - Use hw.adjusted mode when calculating io/fast wake times [psr] - Apply min softlimit correctly [guc/slpc] - Assign correct hdcp content type [hdcp] - Add missing forward declarations/includes to display power headers - Fix BDW PSR AUX CH data register offsets [psr] - Use mock device info for creating mock device amdgpu: - Misc cleanups - GFX 9.4.3 fixes - DEBUGFS build fix - Fix LPDDR5 reporting - ASPM fixes - DCN 3.1.4 fixes - DP MST fixes - DCN 3.2.x fixes - Display PSR TCON fixes - SMU 13.x fixes - RAS fixes - Vega12/20 SMU fixes - PSP flashing cleanup - GFX9 MCBP fixes - SR-IOV fixes - GPUVM clear mappings fix for always valid BOs - Add FAMS quirk for problematic monitor - Fix possible UAF - Better handle monentary temperature fluctuations - SDMA 4.4.2 fixes - Fencing fix" * tag 'drm-next-2023-07-07' of git://anongit.freedesktop.org/drm/drm: (83 commits) drm/i915: use mock device info for creating mock device drm/i915/psr: Fix BDW PSR AUX CH data register offsets drm/amdgpu: Fix potential fence use-after-free v2 drm/amd/pm: avoid unintentional shutdown due to temperature momentary fluctuation drm/amd/pm: expose swctf threshold setting for legacy powerplay drm/amd/display: 3.2.241 drm/amd/display: Take full update path if number of planes changed drm/amd/display: Create debugging mechanism for Gaming FAMS drm/amd/display: Add monitor specific edid quirk drm/amd/display: For new fast update path, loop through each surface drm/amd/display: Remove Phantom Pipe Check When Calculating K1 and K2 drm/amd/display: Limit new fast update path to addr and gamma / color drm/amd/display: Fix the delta clamping for shaper LUT drm/amdgpu: Keep non-psp path for partition switch drm/amd/display: program DPP shaper and 3D LUT if updated Revert "drm/amd/display: edp do not add non-edid timings" drm/amdgpu: share drm device for pci amdgpu device with 1st partition device drm/amd/pm: Add GFX v9.4.3 unique id to sysfs drm/amd/pm: Enable pp_feature attribute drm/amdgpu/vcn: Need to unpause dpg before stop dpg ... commit 94e0d43e51ff8577ad273032bb1cacfd68e9297b Merge: 7210de3a328c4 2e178ee13b02d Author: Linus Torvalds Date: Thu Jul 6 22:25:06 2023 -0700 Merge tag 'acpi-6.5-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI updates from Rafael Wysocki: "These fix a couple of compiler warnings, refine an ACPI device enumeration quirk to address a driver regression and clean up code. Specifics: - Make acpi_companion_match() return a const pointer and update its callers accordingly (Andy Shevchenko) - Move the extern declaration of the acpi_root variable to a header file so as to address a compiler warning (Andy Shevchenko) - Address compiler warnings in the ACPI device enumeration code by adding a missing header file include to it (Ben Dooks) - Refine the SMB0001 quirk in the ACPI device enumeration code so as to address an i2c-scmi driver regression (Andy Shevchenko) - Clean up two pieces of the ACPI device enumeration code (Andy Shevchenko)" * tag 'acpi-6.5-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: scan: Use the acpi_match_acpi_device() helper ACPI: platform: Move SMB0001 HID to the header and reuse ACPI: platform: Ignore SMB0001 only when it has resources ACPI: bus: Introduce acpi_match_acpi_device() helper ACPI: scan: fix undeclared variable warnings by including sleep.h ACPI: bus: Constify acpi_companion_match() returned value ACPI: scan: Move acpi_root to internal header commit 7210de3a328c4df5cb8b25b2ef5703c72d8842e9 Merge: 1793eac148d01 e27cb89a22ada Author: Linus Torvalds Date: Thu Jul 6 22:15:38 2023 -0700 Merge tag 'docs-6.5-2' of git://git.lwn.net/linux Pull mode documentation updates from Jonathan Corbet: "A half-dozen late arriving docs patches. They are mostly fixes, but we also have a kernel-doc tweak for enums and the long-overdue removal of the outdated and redundant patch-submission comments at the top of the MAINTAINERS file" * tag 'docs-6.5-2' of git://git.lwn.net/linux: scripts: kernel-doc: support private / public marking for enums Documentation: KVM: SEV: add a missing backtick Documentation: ACPI: fix typo in ssdt-overlays.rst Fix documentation of panic_on_warn docs: remove the tips on how to submit patches from MAINTAINERS docs: fix typo in zh_TW and zh_CN translation commit 9e9311e04e63ede92be98425efd843f9836336bd Author: Dan Carpenter Date: Mon Jul 3 17:18:08 2023 +0300 KEYS: asymmetric: Fix error codes These error paths should return the appropriate error codes instead of returning success. Fixes: 63ba4d67594a ("KEYS: asymmetric: Use new crypto interface without scatterlists") Signed-off-by: Dan Carpenter Signed-off-by: Herbert Xu commit 1793eac148d0136f9afe877766b9d8f4458fbf21 Merge: 146d7ce3e01cb 879a879c216a4 Author: Linus Torvalds Date: Thu Jul 6 19:24:11 2023 -0700 Merge tag 'spi-fix-v6.5-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few mostly minor fixes that came in during the merge window, plus one administrative update for Jonas' e-mail address. The spi-geni-qcom fix is more major than the others, fixing the newly added DMA support for large reads which trigger DMA" * tag 'spi-fix-v6.5-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: bcm{63xx,bca}-hsspi: update my email address spi: rzv2m-csi: Fix SoC product name spi: bcm-qspi: return error if neither hif_mspi nor mspi is available spi: spi-geni-qcom: enable SPI_CONTROLLER_MUST_TX for GPI DMA mode commit 146d7ce3e01cba1eae25dcdc6d39cec68347962e Merge: 8066178f53089 e9bd04e52d649 Author: Linus Torvalds Date: Thu Jul 6 19:20:23 2023 -0700 Merge tag 'regulator-fix-v6.5-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "A simple dependency fix for a newly added driver" * tag 'regulator-fix-v6.5-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: raa215300: Add build dependency with COMMON_CLK commit 0503efeadbf6bb8bf24397613a73b67e665eac5f Author: Junfeng Guo Date: Thu Jul 6 12:41:28 2023 +0800 gve: Set default duplex configuration to full Current duplex mode was unset in the driver, resulting in the default parameter being set to 0, which corresponds to half duplex. It might mislead users to have incorrect expectation about the driver's transmission capabilities. Set the default duplex configuration to full, as the driver runs in full duplex mode at this point. Fixes: 7e074d5a76ca ("gve: Enable Link Speed Reporting in the driver.") Signed-off-by: Junfeng Guo Reviewed-by: Leon Romanovsky Message-ID: <20230706044128.2726747-1-junfeng.guo@intel.com> Signed-off-by: Jakub Kicinski commit 41b9eff0ce2257958531e7cd38068845da38ac53 Merge: 4863b57bfdb47 479cdfe388a04 Author: Jakub Kicinski Date: Thu Jul 6 19:14:16 2023 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-07-05 (ice) This series contains updates to ice driver only. Sridhar fixes incorrect comparison of max Tx rate limit to occur against each TC value rather than the aggregate. He also resolves an issue with the wrong VSI being used when setting max Tx rate when TCs are enabled. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ice: Fix tx queue rate limit when TCs are configured ice: Fix max_rate check while configuring TX rate limits ==================== Link: https://lore.kernel.org/r/20230705201346.49370-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 4863b57bfdb471f50c6143fcca24f2b098a9eff1 Merge: 0323bce598eea 7abd955a58fb0 Author: Jakub Kicinski Date: Thu Jul 6 19:11:20 2023 -0700 Merge tag 'mlx5-fixes-2023-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5 fixes 2023-07-05 This series provides bug fixes to mlx5 driver. * tag 'mlx5-fixes-2023-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5e: RX, Fix page_pool page fragment tracking for XDP net/mlx5: Query hca_cap_2 only when supported net/mlx5e: TC, CT: Offload ct clear only once net/mlx5e: Check for NOT_READY flag state after locking net/mlx5: Register a unique thermal zone per device net/mlx5e: RX, Fix flush and close release flow of regular rq for legacy rq net/mlx5e: fix memory leak in mlx5e_ptp_open net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create net/mlx5e: fix double free in mlx5e_destroy_flow_table ==================== Link: https://lore.kernel.org/r/20230705175757.284614-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 0323bce598eea038714f941ce2b22541c46d488f Author: M A Ramdhan Date: Wed Jul 5 12:15:30 2023 -0400 net/sched: cls_fw: Fix improper refcount update leads to use-after-free In the event of a failure in tcf_change_indev(), fw_set_parms() will immediately return an error after incrementing or decrementing reference counter in tcf_bind_filter(). If attacker can control reference counter to zero and make reference freed, leading to use after free. In order to prevent this, move the point of possible failure above the point where the TC_FW_CLASSID is handled. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: M A Ramdhan Signed-off-by: M A Ramdhan Acked-by: Jamal Hadi Salim Reviewed-by: Pedro Tammela Message-ID: <20230705161530.52003-1-ramdhan@starlabs.sg> Signed-off-by: Jakub Kicinski commit 525c469e5de9bf7e53574396196e80fc716ac9eb Author: Quan Zhou Date: Wed Jul 5 23:26:38 2023 +0800 wifi: mt76: mt7921e: fix init command fail with enabled device For some cases as below, we may encounter the unpreditable chip stats in driver probe() * The system reboot flow do not work properly, such as kernel oops while rebooting, and then the driver do not go back to default status at this moment. * Similar to the flow above. If the device was enabled in BIOS or UEFI, the system may switch to Linux without driver fully shutdown. To avoid the problem, force push the device back to default in probe() * mt7921e_mcu_fw_pmctrl() : return control privilege to chip side. * mt7921_wfsys_reset() : cleanup chip config before resource init. Error log [59007.600714] mt7921e 0000:02:00.0: ASIC revision: 79220010 [59010.889773] mt7921e 0000:02:00.0: Message 00000010 (seq 1) timeout [59010.889786] mt7921e 0000:02:00.0: Failed to get patch semaphore [59014.217839] mt7921e 0000:02:00.0: Message 00000010 (seq 2) timeout [59014.217852] mt7921e 0000:02:00.0: Failed to get patch semaphore [59017.545880] mt7921e 0000:02:00.0: Message 00000010 (seq 3) timeout [59017.545893] mt7921e 0000:02:00.0: Failed to get patch semaphore [59020.874086] mt7921e 0000:02:00.0: Message 00000010 (seq 4) timeout [59020.874099] mt7921e 0000:02:00.0: Failed to get patch semaphore [59024.202019] mt7921e 0000:02:00.0: Message 00000010 (seq 5) timeout [59024.202033] mt7921e 0000:02:00.0: Failed to get patch semaphore [59027.530082] mt7921e 0000:02:00.0: Message 00000010 (seq 6) timeout [59027.530096] mt7921e 0000:02:00.0: Failed to get patch semaphore [59030.857888] mt7921e 0000:02:00.0: Message 00000010 (seq 7) timeout [59030.857904] mt7921e 0000:02:00.0: Failed to get patch semaphore [59034.185946] mt7921e 0000:02:00.0: Message 00000010 (seq 8) timeout [59034.185961] mt7921e 0000:02:00.0: Failed to get patch semaphore [59037.514249] mt7921e 0000:02:00.0: Message 00000010 (seq 9) timeout [59037.514262] mt7921e 0000:02:00.0: Failed to get patch semaphore [59040.842362] mt7921e 0000:02:00.0: Message 00000010 (seq 10) timeout [59040.842375] mt7921e 0000:02:00.0: Failed to get patch semaphore [59040.923845] mt7921e 0000:02:00.0: hardware init failed Cc: stable@vger.kernel.org Fixes: 5c14a5f944b9 ("mt76: mt7921: introduce mt7921e support") Tested-by: Kai-Heng Feng Tested-by: Juan Martinez Co-developed-by: Leon Yen Signed-off-by: Leon Yen Signed-off-by: Quan Zhou Signed-off-by: Deren Wu Message-ID: <39fcb7cee08d4ab940d38d82f21897483212483f.1688569385.git.deren.wu@mediatek.com> Signed-off-by: Jakub Kicinski commit 1ce1a745b3711322424134fe8f3986d7599c6961 Merge: ceb20a3cc5261 c6efb4ae387c7 Author: Jakub Kicinski Date: Thu Jul 6 19:10:25 2023 -0700 Merge branch 'fix-dropping-of-oversize-preemptible-frames-with-felix-dsa-driver' Vladimir Oltean says: ==================== Fix dropping of oversize preemptible frames with felix DSA driver It has been reported that preemptible traffic doesn't completely behave as expected. Namely, large packets should be able to be squeezed (through fragmentation) through taprio time slots smaller than the transmission time of the full frame. That does not happen due to logic in the driver (for oversize frame dropping with taprio) that was not updated in order for this use case to work. I am not sure whether it qualifies as "net" material, because some structural changes are involved, and it is a "never worked" scenario. OTOH, this is a complaint coming from users for a v6.4 kernel. It's up to maintainers to decide whether this series can be considered; I've submitted it as non-RFC in the optimistic case that it will be :) Demo script illustrating the issue below. add_taprio() { local ifname=$1 echo "Creating root taprio" tc qdisc replace dev $ifname handle 8001: parent root stab overhead 24 taprio \ num_tc 8 \ map 0 1 2 3 4 5 6 7 \ queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 \ base-time 0 \ sched-entry S 01 1216 \ sched-entry S fe 12368 \ fp P E E E E E E E \ flags 0x2 } remove_taprio() { local ifname=$1 echo "Removing taprio" tc qdisc del dev $ifname root } ip netns add ns0 ip link set eno0 netns ns0 && ip -n ns0 link set eno0 up && ip -n ns0 addr add 192.168.100.1/24 dev eno0 ip addr add 192.168.100.2/24 dev swp0 && ip link set swp0 up ip netns exec ns0 ethtool --set-mm eno0 pmac-enabled on verify-enabled off tx-enabled on ethtool --set-mm swp0 pmac-enabled on verify-enabled off tx-enabled on add_taprio swp0 ping 192.168.100.1 -s 1000 -c 5 # sent through TC0 ethtool -I --show-mm swp0 | grep MACMergeFragCountTx # should increase ip addr flush swp0 && ip link set swp0 down remove_taprio swp0 ethtool --set-mm swp0 pmac-enabled off verify-enabled off tx-enabled off ip netns exec ns0 ethtool --set-mm eno0 pmac-enabled off verify-enabled off tx-enabled off ip netns del ns0 ==================== Link: https://lore.kernel.org/r/20230705104422.49025-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit c6efb4ae387c79bf0d4da286108c810b7b40de3c Author: Vladimir Oltean Date: Wed Jul 5 13:44:22 2023 +0300 net: mscc: ocelot: fix oversize frame dropping for preemptible TCs This switch implements Hold/Release in a strange way, with no control from the user as required by IEEE 802.1Q-2018 through Set-And-Hold-MAC and Set-And-Release-MAC, but rather, it emits HOLD requests implicitly based on the schedule. Namely, when the gate of a preemptible TC is about to close (actually QSYS::PREEMPTION_CFG.HOLD_ADVANCE octet times in advance of this event), the QSYS seems to emit a HOLD request pulse towards the MAC which preempts the currently transmitted packet, and further packets are held back in the queue system. This allows large frames to be squeezed through small time slots, because HOLD requests initiated by the gate events result in the frame being segmented in multiple fragments, the bit time of which is equal to the size of the time slot. It has been reported that the vsc9959_tas_guard_bands_update() logic breaks this, because it doesn't take preemptible TCs into account, and enables oversized frame dropping when the time slot doesn't allow a full MTU to be sent, but it does allow 2*minFragSize to be sent (128B). Packets larger than 128B are dropped instead of being sent in multiple fragments. Confusingly, the manual says: | For guard band, SDU calculation of a traffic class of a port, if | preemption is enabled (through 'QSYS::PREEMPTION_CFG.P_QUEUES') then | QSYS::PREEMPTION_CFG.HOLD_ADVANCE is used, otherwise | QSYS::QMAXSDU_CFG_*.QMAXSDU_* is used. but this only refers to the static guard band durations, and the QMAXSDU_CFG_* registers have dual purpose - the other being oversized frame dropping, which takes place irrespective of whether frames are preemptible or express. So, to fix the problem, we need to call vsc9959_tas_guard_bands_update() from ocelot_port_update_active_preemptible_tcs(), and modify the guard band logic to consider a different (lower) oversize limit for preemptible traffic classes. Fixes: 403ffc2c34de ("net: mscc: ocelot: add support for preemptible traffic classes") Signed-off-by: Vladimir Oltean Message-ID: <20230705104422.49025-4-vladimir.oltean@nxp.com> Signed-off-by: Jakub Kicinski commit c60819149b637d0f9f7f66e110d2a0d90a3993ea Author: Vladimir Oltean Date: Wed Jul 5 13:44:21 2023 +0300 net: dsa: felix: make vsc9959_tas_guard_bands_update() visible to ocelot->ops In a future change we will need to make ocelot_port_update_active_preemptible_tcs() call vsc9959_tas_guard_bands_update(), but that is currently not possible, since the ocelot switch lib does not have access to functions private to the DSA wrapper. Move the pointer to vsc9959_tas_guard_bands_update() from felix->info (which is private to the DSA driver) to ocelot->ops (which is also visible to the ocelot switch lib). Signed-off-by: Vladimir Oltean Message-ID: <20230705104422.49025-3-vladimir.oltean@nxp.com> Signed-off-by: Jakub Kicinski commit 009d30f1a77795014f151ba317fcbfc2f17153c6 Author: Vladimir Oltean Date: Wed Jul 5 13:44:20 2023 +0300 net: mscc: ocelot: extend ocelot->fwd_domain_lock to cover ocelot->tas_lock In a future commit we will have to call vsc9959_tas_guard_bands_update() from ocelot_port_update_active_preemptible_tcs(), and that will be impossible due to the AB/BA locking dependencies between ocelot->tas_lock and ocelot->fwd_domain_lock. Just like we did in commit 3ff468ef987e ("net: mscc: ocelot: remove struct ocelot_mm_state :: lock"), the only solution is to expand the scope of ocelot->fwd_domain_lock for it to also serialize changes made to the Time-Aware Shaper, because those will have to result in a recalculation of cut-through TCs, which is something that depends on the forwarding domain. Signed-off-by: Vladimir Oltean Message-ID: <20230705104422.49025-2-vladimir.oltean@nxp.com> Signed-off-by: Jakub Kicinski commit 8066178f530898e4be07406a4c359a2cd14754e8 Merge: 7fdeb23f32d68 fddca7db4a4c1 Author: Linus Torvalds Date: Thu Jul 6 19:07:15 2023 -0700 Merge tag 'trace-v6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix bad git merge of #endif in arm64 code A merge of the arm64 tree caused #endif to go into the wrong place - Fix crash on lseek of write access to tracefs/error_log Opening error_log as write only, and then doing an lseek() causes a kernel panic, because the lseek() handle expects a "seq_file" to exist (which is not done on write only opens). Use tracing_lseek() that tests for this instead of calling the default seq lseek handler. - Check for negative instead of -E2BIG for error on strscpy() returns Instead of testing for -E2BIG from strscpy(), to be more robust, check for less than zero, which will make sure it catches any error that strscpy() may someday return. * tag 'trace-v6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/boot: Test strscpy() against less than zero for error arm64: ftrace: fix build error with CONFIG_FUNCTION_GRAPH_TRACER=n tracing: Fix null pointer dereference in tracing_err_log_open() commit 7fdeb23f32d6843c34ad1a4200d04069ff339906 Merge: a452483508d7b 33ab231f83cc1 Author: Linus Torvalds Date: Thu Jul 6 19:01:38 2023 -0700 Merge tag 'v6.5/vfs.fixes.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: "This contains two minor fixes for Jan's rename locking work: - Unlocking the source inode was guarded by a check whether source was non-NULL. This doesn't make sense because source must be non-NULL and the commit message explains in detail why - The lock_two_nondirectories() helper called WARN_ON_ONCE() and dereferenced the inodes unconditionally but the underlying lock_two_inodes() helper and the kernel documentation for that function are clear that it is valid to pass NULL arguments, so a non-NULL check is needed. No callers currently pass NULL arguments but let's not knowingly leave landmines around" * tag 'v6.5/vfs.fixes.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: don't assume arguments are non-NULL fs: no need to check source commit 6725f33228077902ddac2a05e0ab361dee36e4ba Merge: bd10668c5c68d 59bba51ec2a50 Author: Dave Airlie Date: Fri Jul 7 11:05:09 2023 +1000 Merge tag 'drm-misc-next-fixes-2023-07-06' of git://anongit.freedesktop.org/drm/drm-misc into drm-next Short summary of fixes pull: * panel: Fix mode on Starry-ili9882t Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230706112203.GA30555@linux-uq9g commit bd10668c5c68d8909526c591b57d75945026f529 Merge: 5874d11c29dbc f6cf3883df471 Author: Dave Airlie Date: Fri Jul 7 10:52:23 2023 +1000 Merge tag 'drm-intel-next-fixes-2023-07-06' of git://anongit.freedesktop.org/drm/drm-intel into drm-next - Fix BDW PSR AUX CH data register offsets [psr] (Ville Syrjälä) - Use mock device info for creating mock device (Jani Nikula) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/ZKZ6VIeInBYrBuph@tursulin-desk commit 5874d11c29dbc2e9f21896c2635d0866e946c049 Merge: 67ebda8cf4a9b 2e54154b9f272 Author: Dave Airlie Date: Fri Jul 7 10:14:26 2023 +1000 Merge tag 'amd-drm-fixes-6.5-2023-06-30-1' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-fixes-6.5-2023-06-30-1: amdgpu: - Misc cleanups - GFX 9.4.3 fixes - DEBUGFS build fix - Fix LPDDR5 reporting - ASPM fixes - DCN 3.1.4 fixes - DP MST fixes - DCN 3.2.x fixes - Display PSR TCON fixes - SMU 13.x fixes - RAS fixes - Vega12/20 SMU fixes - PSP flashing cleanup - GFX9 MCBP fixes - SR-IOV fixes - GPUVM clear mappings fix for always valid BOs - Add FAMS quirk for problematic monitor - Fix possible UAF - Better handle monentary temperature fluctuations - SDMA 4.4.2 fixes - Fencing fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230630175757.8128-1-alexander.deucher@amd.com commit 67ebda8cf4a9b43036232ca883503a1088c112a6 Merge: d011f0c395c6f 5b7826355e5b9 Author: Dave Airlie Date: Fri Jul 7 09:53:01 2023 +1000 Merge tag 'drm-intel-next-fixes-2023-06-29' of git://anongit.freedesktop.org/drm/drm-intel into drm-next - Allow DC states along with PW2 only for PWB functionality [adlp+] (Imre Deak) - Fix SSC selection for MPLLA [mtl] (Radhakrishna Sripada) - Use hw.adjusted mode when calculating io/fast wake times [psr] (Jouni Högander) - Apply min softlimit correctly [guc/slpc] (Vinay Belgaumkar) - Assign correct hdcp content type [hdcp] (Suraj Kandpal) - Add missing forward declarations/includes to display power headers (Imre Deak) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/ZJ1WpY+GF9NcsWXp@tursulin-desk commit a452483508d7b70b0f6c69e249ec0b3ea2330b5c Merge: 7b82e90411826 54372cf043276 Author: Linus Torvalds Date: Thu Jul 6 13:18:30 2023 -0700 Merge tag 's390-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull more s390 updates from Alexander Gordeev: - Fix virtual vs physical address confusion in vmem_add_range() and vmem_remove_range() functions - Include instead of and throughout s390 code - Make all PSW related defines also available for assembler files. Remove PSW_DEFAULT_KEY define from uapi for that - When adding an undefined symbol the build still succeeds, but userspace crashes trying to execute VDSO, because the symbol is not resolved. Add undefined symbols check to prevent that - Use kvmalloc_array() instead of kzalloc() for allocaton of 256k memory when executing s390 crypto adapter IOCTL - Add -fPIE flag to prevent decompressor misaligned symbol build error with clang - Use .balign instead of .align everywhere. This is a no-op for s390, but with this there no mix in using .align and .balign anymore - Filter out -mno-pic-data-is-text-relative flag when compiling kernel to prevent VDSO build error - Rework entering of DAT-on mode on CPU restart to use PSW_KERNEL_BITS mask directly - Do not retry administrative requests to some s390 crypto cards, since the firmware assumes replay attacks - Remove most of the debug code, which is build in when kernel config option CONFIG_ZCRYPT_DEBUG is enabled - Remove CONFIG_ZCRYPT_MULTIDEVNODES kernel config option and switch off the multiple devices support for the s390 zcrypt device driver - With the conversion to generic entry machine checks are accounted to the current context instead of irq time. As result, the STCKF instruction at the beginning of the machine check handler and the lowcore member are no longer required, therefore remove it - Fix various typos found with codespell - Minor cleanups to CPU-measurement Counter and Sampling Facilities code - Revert patch that removes VMEM_MAX_PHYS macro, since it causes a regression * tag 's390-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (25 commits) Revert "s390/mm: get rid of VMEM_MAX_PHYS macro" s390/cpum_sf: remove check on CPU being online s390/cpum_sf: handle casts consistently s390/cpum_sf: remove unnecessary debug statement s390/cpum_sf: remove parameter in call to pr_err s390/cpum_sf: simplify function setup_pmu_cpu s390/cpum_cf: remove unneeded debug statements s390/entry: remove mcck clock s390: fix various typos s390/zcrypt: remove ZCRYPT_MULTIDEVNODES kernel config option s390/zcrypt: do not retry administrative requests s390/zcrypt: cleanup some debug code s390/entry: rework entering DAT-on mode on CPU restart s390/mm: fence off VM macros from asm and linker s390: include linux/io.h instead of asm/io.h s390/ptrace: make all psw related defines also available for asm s390/ptrace: remove PSW_DEFAULT_KEY from uapi s390/vdso: filter out mno-pic-data-is-text-relative cflag s390: consistently use .balign instead of .align s390/decompressor: fix misaligned symbol build error ... commit 6537ed3904a3b3720e5e238dd5d542448fcf94c2 Author: Guenter Roeck Date: Tue Jul 4 08:00:31 2023 -0700 i2c: mpc: Drop unused variable Fix the following build error. Error log: drivers/i2c/busses/i2c-mpc.c: In function 'mpc_i2c_setup_512x': drivers/i2c/busses/i2c-mpc.c:310:20: error: unused variable 'pval' Fixes: 9d178e00583e ("i2c: mpc: Use of_property_read_reg() to parse "reg"") Signed-off-by: Guenter Roeck Signed-off-by: Wolfram Sang commit 05f933d5f7318b03ff2028c1704dc867ac16f2c7 Author: Christophe JAILLET Date: Tue Jul 4 21:50:28 2023 +0200 i2c: nomadik: Remove a useless call in the remove function Since commit 235602146ec9 ("i2c-nomadik: turn the platform driver to an amba driver"), there is no more request_mem_region() call in this driver. So remove the release_mem_region() call from the remove function which is likely a left over. Fixes: 235602146ec9 ("i2c-nomadik: turn the platform driver to an amba driver") Cc: # v3.6+ Acked-by: Linus Walleij Reviewed-by: Andi Shyti Signed-off-by: Christophe JAILLET Signed-off-by: Wolfram Sang commit cb6e45c9a0ad9e0f8664fd06db0227d185dc76ab Author: Robert Hancock Date: Tue Jun 6 12:25:58 2023 -0600 i2c: xiic: Don't try to handle more interrupt events after error In xiic_process, it is possible that error events such as arbitration lost or TX error can be raised in conjunction with other interrupt flags such as TX FIFO empty or bus not busy. Error events result in the controller being reset and the error returned to the calling request, but the function could potentially try to keep handling the other events, such as by writing more messages into the TX FIFO. Since the transaction has already failed, this is not helpful and will just cause issues. This problem has been present ever since: commit 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr") which allowed non-error events to be handled after errors, but became more obvious after: commit 743e227a8959 ("i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process()") which reworked the code to add a WARN_ON which triggers if both the xfer_more and wakeup_req flags were set, since this combination is not supposed to happen, but was occurring in this scenario. Skip further interrupt handling after error flags are detected to avoid this problem. Fixes: 7f9906bd7f72 ("i2c: xiic: Service all interrupts in isr") Signed-off-by: Robert Hancock Acked-by: Andi Shyti Signed-off-by: Wolfram Sang commit 3f069c4c643225f2b96b4b3f8c30e4445f079d2e Author: John Johansen Date: Wed Jun 21 02:04:58 2023 -0700 apparmor: Fix kernel-doc header for verify_dfa_accept_index Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306141934.UKmM9bFX-lkp@intel.com/ Signed-off-by: John Johansen commit ec6851ae0ab4587e610e260ddda75f92f3389f91 Author: John Johansen Date: Sat Apr 15 00:50:32 2023 -0700 apparmor: fix: kzalloc perms tables for shared dfas Currently the permstables of the shared dfas are not shared, and need to be allocated and copied. In the future this should be addressed with a larger rework on dfa and pdb ref counts and structure sharing. BugLink: http://bugs.launchpad.net/bugs/2017903 Fixes: 217af7e2f4de ("apparmor: refactor profile rules and attachments") Cc: stable@vger.kernel.org Signed-off-by: John Johansen Reviewed-by: Jon Tourville commit 6f442d42c0d89876994a4a135eadf82b0e6ff6e4 Author: John Johansen Date: Mon Apr 17 02:57:55 2023 -0700 apparmor: fix profile verification and enable it The transition table size was not being set by compat mappings resulting in the profile verification code not being run. Unfortunately the checks were also buggy not being correctly updated from the old accept perms, to the new layout. Also indicate to userspace that the kernel has the permstable verification fixes. BugLink: http://bugs.launchpad.net/bugs/2017903 Fixes: 670f31774ab6 ("apparmor: verify permission table indexes") Signed-off-by: John Johansen Reviewed-by: Jon Tourville commit 0bac2002b397fda7c9ea81ee0b06a02242958107 Author: John Johansen Date: Fri Mar 10 15:59:45 2023 -0800 apparmor: fix policy_compat permission remap with extended permissions If the extended permission table is present we should not be attempting to do a compat_permission remap as the compat_permissions are not stored in the dfa accept states. Fixes: fd1b2b95a211 ("apparmor: add the ability for policy to specify a permission table") Signed-off-by: John Johansen Reviewed-by: Jon Tourville commit ba808cb5edfdf032db9e849e194d28169b6efbcd Author: Kees Cook Date: Thu May 11 14:34:45 2023 -0700 apparmor: aa_buffer: Convert 1-element array to flexible array In the ongoing effort to convert all fake flexible arrays to proper flexible arrays, replace aa_buffer's 1-element "buffer" member with a flexible array. Signed-off-by: Kees Cook Signed-off-by: John Johansen commit 6600e9f692e36e265ef0828f08337fa294bb330f Author: John Johansen Date: Fri Apr 14 00:24:47 2023 -0700 apparmor: add missing failure check in compute_xmatch_perms Add check for failure to allocate the permission table. Fixes: caa9f579ca72 ("apparmor: isolate policy backwards compatibility to its own file") Signed-off-by: John Johansen commit 000518bc5aef25d3f703592a0296d578c98b1517 Author: Danila Chernetsov Date: Tue Apr 4 19:05:49 2023 +0000 apparmor: fix missing error check for rhashtable_insert_fast rhashtable_insert_fast() could return err value when memory allocation is failed. but unpack_profile() do not check values and this always returns success value. This patch just adds error check code. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: e025be0f26d5 ("apparmor: support querying extended trusted helper extra data") Signed-off-by: Danila Chernetsov Signed-off-by: John Johansen commit 6d7467957ecdc9018fb860bb60738e997abeaecb Author: Markus Elfring Date: Wed Mar 29 11:50:44 2023 +0200 apparmor: Return directly after a failed kzalloc() in two functions 1. Return directly after a call of the function “kzalloc” failed at the beginning in these function implementations. 2. Omit extra initialisations (for a few local variables) which became unnecessary with this refactoring. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: John Johansen commit 755a22c74345a7b4c18dbb86f553eeb7895a97c9 Author: Yang Li Date: Fri Mar 3 09:28:33 2023 +0800 AppArmor: Fix some kernel-doc comments Make the description of @table to @strs in function unpack_trans_table() to silence the warnings: security/apparmor/policy_unpack.c:456: warning: Function parameter or member 'strs' not described in 'unpack_trans_table' security/apparmor/policy_unpack.c:456: warning: Excess function parameter 'table' description in 'unpack_trans_table' Reported-by: Abaci Robot Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=4332 Signed-off-by: Yang Li Signed-off-by: John Johansen commit b54aebd4411134b525a82d663a26b2f135ecb7e8 Author: Rae Moar Date: Fri Jan 27 20:12:19 2023 +0000 apparmor: fix use of strcpy in policy_unpack_test Replace the use of strcpy() in build_aa_ext_struct() in policy_unpack_test.c with strscpy(). strscpy() is the safer method to use to ensure the buffer does not overflow. This was found by kernel test robot: https://lore.kernel.org/all/202301040348.NbfVsXO0-lkp@intel.com/. Reported-by: kernel test robot Signed-off-by: Rae Moar Signed-off-by: John Johansen commit e8605e8fdf42642048b7e59141deaf8e4cf06d71 Merge: a2492ca86c98f 8500808a991f0 Author: Palmer Dabbelt Date: Thu Jul 6 10:32:08 2023 -0700 Merge patch series "riscv: some CMO alternative related clean up" These cleanups came up as part of the discussion on the "riscv: Reduce ARCH_KMALLOC_MINALIGN to 8" patch set, but that needs additional work and thus will be delayed at least a cycle. * b4-shazam-merge: riscv: mm: mark noncoherent_supported as __ro_after_init riscv: mm: mark CBO relate initialization funcs as __init riscv: errata: thead: only set cbom size & noncoherent during boot Link: https://lore.kernel.org/linux-riscv/20230526165958.908-1-jszhang@kernel.org/ Link: https://lore.kernel.org/r/20230614165504.532-1-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit 8500808a991f0e569b3d835a6223848c0717a6c7 Author: Jisheng Zhang Date: Thu Jun 15 00:55:04 2023 +0800 riscv: mm: mark noncoherent_supported as __ro_after_init The noncoherent_supported indicates whether the HW is coherent or not, it won't change after booting, mark it as __ro_after_init. Signed-off-by: Jisheng Zhang Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230614165504.532-4-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit 3b472f860c5c73244a9b951c10c289cc9ee080f3 Author: Jisheng Zhang Date: Thu Jun 15 00:55:03 2023 +0800 riscv: mm: mark CBO relate initialization funcs as __init The two functions cbo_get_block_size() and riscv_init_cbo_blocksizes() are only called during booting, mark them as __init. Signed-off-by: Jisheng Zhang Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230614165504.532-3-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit 31ca5d49264ba6197aa48a926f6a035ed08b3715 Author: Jisheng Zhang Date: Thu Jun 15 00:55:02 2023 +0800 riscv: errata: thead: only set cbom size & noncoherent during boot The CBOM size and whether the HW is noncoherent is known and determined during booting and won't change after that. Signed-off-by: Jisheng Zhang Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230614165504.532-2-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit a2492ca86c98f676561f7d318b1e2e1786af0caf Author: Samuel Holland Date: Fri Jun 23 23:03:20 2023 -0700 riscv: Select HAVE_ARCH_USERFAULTFD_MINOR This allocates the VM flag needed to support the userfaultfd minor fault functionality. Because the flag bit is >= bit 32, it can only be enabled for 64-bit kernels. See commit 7677f7fd8be7 ("userfaultfd: add minor fault registration mode") for more information. Signed-off-by: Samuel Holland Link: https://lore.kernel.org/r/20230624060321.3401504-1-samuel.holland@sifive.com Signed-off-by: Palmer Dabbelt commit 5177978ee074d55577aabad7c42b431e8af68fcc Author: Palmer Dabbelt Date: Wed Jun 28 20:17:05 2023 -0700 RISC-V: Document the ISA string parsing rules for ACPI We've had a ton of issues around the ISA string parsing rules elsewhere in RISC-V, so let's at least be clear about what the rules are so we can try and avoid more issues. Link: https://lore.kernel.org/r/CAK9=C2Vy-4V9kgnga98tiC3TeHkR2LFPakyBbS8s_h3_Z=ieyQ@mail.gmail.com/ Link: https://lore.kernel.org/r/20230629031705.15575-1-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit 2e178ee13b02d95c7380f6a21149de535ccdfc7f Merge: b5539eb5ee702 86fca926c0421 59e8d4bb8d485 Author: Rafael J. Wysocki Date: Thu Jul 6 19:24:06 2023 +0200 Merge branches 'acpi-bus' and 'acpi-scan' Merge additional ACPI device enumeration code changes for 6.5-rc1. - Make acpi_companion_match() return a const pointer and update its callers accordingly (Andy Shevchenko). - Move the extern declaration of the acpi_root variable to a header file so as to address a compiler warning (Andy Shevchenko). - Address compiler warnings in the ACPI device enumeration code by adding a missing header file include to it (Ben Dooks). - Refine the SMB0001 quirk in the ACPI device enumeration code so as to address an i2c-scmi driver regression (Andy Shevchenko). - Clean up two pieces of the ACPI device enumeration code (Andy Shevchenko). * acpi-bus: ACPI: bus: Constify acpi_companion_match() returned value * acpi-scan: ACPI: scan: Use the acpi_match_acpi_device() helper ACPI: platform: Move SMB0001 HID to the header and reuse ACPI: platform: Ignore SMB0001 only when it has resources ACPI: bus: Introduce acpi_match_acpi_device() helper ACPI: scan: fix undeclared variable warnings by including sleep.h ACPI: scan: Move acpi_root to internal header commit 7b82e90411826deee07c180ec35f64d31051d154 Merge: 9f57c13f7ed70 4dd595c34c4bb Author: Linus Torvalds Date: Thu Jul 6 10:06:04 2023 -0700 Merge tag 'asm-generic-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull asm-generic updates from Arnd Bergmann: "These are cleanups for architecture specific header files: - the comments in include/linux/syscalls.h have gone out of sync and are really pointless, so these get removed - The asm/bitsperlong.h header no longer needs to be architecture specific on modern compilers, so use a generic version for newer architectures that use new enough userspace compilers - A cleanup for virt_to_pfn/virt_to_bus to have proper type checking, forcing the use of pointers" * tag 'asm-generic-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: syscalls: Remove file path comments from headers tools arch: Remove uapi bitsperlong.h of hexagon and microblaze asm-generic: Unify uapi bitsperlong.h for arm64, riscv and loongarch m68k/mm: Make pfn accessors static inlines arm64: memory: Make virt_to_pfn() a static inline ARM: mm: Make virt_to_pfn() a static inline asm-generic/page.h: Make pfn accessors static inlines xen/netback: Pass (void *) to virt_to_page() netfs: Pass a pointer to virt_to_page() cifs: Pass a pointer to virt_to_page() in cifsglob cifs: Pass a pointer to virt_to_page() riscv: mm: init: Pass a pointer to virt_to_page() ARC: init: Pass a pointer to virt_to_pfn() in init m68k: Pass a pointer to virt_to_pfn() virt_to_page() fs/proc/kcore.c: Pass a pointer to virt_addr_valid() commit 9f57c13f7ed70a94ecc135645bc764efdd378acd Merge: 0b907305022be 6722e46513e0a Author: Linus Torvalds Date: Thu Jul 6 09:56:53 2023 -0700 Merge tag 'soc-fixes-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "There are three small fixes that came up sincie the past week: - an incorrect bit offset in ixp4xx bus driver - a riscv randconfig regression in the thead platform I merged - whitespace fixes for some dts files" * tag 'soc-fixes-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: bus: ixp4xx: fix IXP4XX_EXP_T1_MASK ARM: dts: st: add missing space before { RISC-V: make ARCH_THEAD preclude XIP_KERNEL commit 0b907305022beb1a4cf5b9f6d776483a2356c841 Merge: c91e587be8e26 907514a7dc4c5 Author: Linus Torvalds Date: Thu Jul 6 09:48:31 2023 -0700 Merge tag 'dmaengine-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: "New support: - TI J721S2 CSI BCDMA support Updates: - Native HDMI support for dw edma driver - ste dma40 updates for supporting proper SRAM handle in DT - removal of dma device chancnt setting in drivers" * tag 'dmaengine-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (28 commits) dmaengine: sprd: Don't set chancnt dmaengine: hidma: Don't set chancnt dmaengine: plx_dma: Don't set chancnt dmaengine: axi-dmac: Don't set chancnt dmaengine: dw-axi-dmac: Don't set chancnt dmaengine: qcom: bam_dma: allow omitting num-{channels,ees} dmaengine: dw-edma: Add HDMA DebugFS support dmaengine: dw-edma: Add support for native HDMA dmaengine: dw-edma: Create a new dw_edma_core_ops structure to abstract controller operation dmaengine: dw-edma: Rename dw_edma_core_ops structure to dw_edma_plat_ops dmaengine: ste_dma40: use proper format string for resource_size_t dmaengine: make QCOM_HIDMA depend on HAS_IOMEM dmaengine: ste_dma40: fix typo in enum documentation dmaengine: ste_dma40: use correct print specfier for resource_size_t MAINTAINERS: Add myself as the DW eDMA driver reviewer MAINTAINERS: Add Manivannan to DW eDMA driver maintainers list MAINTAINERS: Demote Gustavo Pimentel to DW EDMA driver reviewer dmaengine: ti: k3-udma: Add support for J721S2 CSI BCDMA instance dt-bindings: dma: ti: Add J721S2 BCDMA dmaengine: ti: k3-psil-j721s2: Add PSI-L thread map for main CPSW2G ... commit c91e587be8e2680786cbf0b87fa7ae92c345857f Merge: c17414a273b81 009637de1f65c Author: Linus Torvalds Date: Thu Jul 6 09:44:33 2023 -0700 Merge tag 'linux-watchdog-6.5-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - add Xilinx Versal watchdog - support Hygon FCH/SCH (Server Controller Hub) - convert GPL notices to SPDX identifiers - other improvements * tag 'linux-watchdog-6.5-rc1' of git://www.linux-watchdog.org/linux-watchdog: watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub) dt-bindings: watchdog: restrict node name suffixes MAINTAINERS: Add support for Xilinx versal watchdog watchdog: xilinx_wwdt: Add Versal window watchdog support dt-bindings: watchdog: xlnx,versal-wwdt: Add versal watchdog watchdog: ziirave_wdt: Switch i2c driver back to use .probe() watchdog: ibmasr: Replace GPL license notice with SPDX identifier watchdog: Convert GPL 2.0 notice to SPDX identifier watchdog: loongson1_wdt: Add DT support commit 89dbb335cb6a627a4067bc42caa09c8bc3326d40 Author: Takashi Iwai Date: Thu Jul 6 17:53:57 2023 +0200 ALSA: jack: Fix mutex call in snd_jack_report() snd_jack_report() is supposed to be callable from an IRQ context, too, and it's indeed used in that way from virtsnd driver. The fix for input_dev race in commit 1b6a6fc5280e ("ALSA: jack: Access input_dev under mutex"), however, introduced a mutex lock in snd_jack_report(), and this resulted in a potential sleep-in-atomic. For addressing that problem, this patch changes the relevant code to use the object get/put and removes the mutex usage. That is, snd_jack_report(), it takes input_get_device() and leaves with input_put_device() for assuring the input_dev being assigned. Although the whole mutex could be reduced, we keep it because it can be still a protection for potential races between creation and deletion. Fixes: 1b6a6fc5280e ("ALSA: jack: Access input_dev under mutex") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/cf95f7fe-a748-4990-8378-000491b40329@moroto.mountain Tested-by: Amadeusz Sławiński Cc: Link: https://lore.kernel.org/r/20230706155357.3470-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 980d97efdb30b8baa74b61fec086becb3aedbb90 Merge: e231cd833f646 f09b6e9679605 Author: Mark Brown Date: Thu Jul 6 16:03:07 2023 +0100 ASoC/soundwire/qdsp6/wcd: fix leaks and probe deferral Merge series from Johan Hovold : I've been hitting a race during boot which breaks probe of the sound card on the Lenovo ThinkPad X13s as I've previously reported here: https://lore.kernel.org/all/ZIHMMFtuDtvdpFAZ@hovoldconsulting.com/ The immediate issue appeared to be a probe deferral that was turned into a hard failure, but addressing that in itself only made things worse as it exposed further bugs. I was hoping someone more familiar with the code in question would look into this, but as this affects users of the X13s and breaks audio on my machine every fifth boot or so, I decided to investigate it myself. As expected, the Qualcomm codec drivers are broken and specifically leak resources on component remove, which in turn breaks sound card probe deferrals. The source of the deferral itself appears to be legitimate and was simply due to some audio component not yet having been registered due to random changes in timing during boot. These issues can most easily be reproduced by simply blacklisting the q6apm_dai module and loading it manually after boot. Included are also two patches that suppresses error messages on component probe deferral to avoid spamming the logs during boot. commit 00ae1491f970acc454be0df63f50942d94825860 Author: Dan Carpenter Date: Thu Jul 6 15:37:51 2023 +0300 dma-buf: fix an error pointer vs NULL bug Smatch detected potential error pointer dereference. drivers/gpu/drm/drm_syncobj.c:888 drm_syncobj_transfer_to_timeline() error: 'fence' dereferencing possible ERR_PTR() The error pointer comes from dma_fence_allocate_private_stub(). One caller expected error pointers and one expected NULL pointers. Change it to return NULL and update the caller which expected error pointers, drm_syncobj_assign_null_handle(), to check for NULL instead. Fixes: f781f661e8c9 ("dma-buf: keep the signaling time of merged fences v3") Signed-off-by: Dan Carpenter Reviewed-by: Christian König Reviewed-by: Sumit Semwal Signed-off-by: Sumit Semwal Link: https://patchwork.freedesktop.org/patch/msgid/b09f1996-3838-4fa2-9193-832b68262e43@moroto.mountain commit e231cd833f6463e9a1d54acae9614b513c74d45e Author: Geert Uytterhoeven Date: Thu Jul 6 13:42:04 2023 +0200 ASoC: codecs: SND_SOC_WCD934X should select REGMAP_IRQ If CONFIG_SND_SOC_WCD934X=y, CONFIG_COMPILE_TEST=y, CONFIG_MFD_WCD934X=n, CONFIG_REGMAP_IRQ=n: aarch64-linux-gnu-ld: sound/soc/codecs/wcd934x.o: in function `wcd934x_codec_probe': wcd934x.c:(.text+0x33cc): undefined reference to `regmap_irq_get_virq' aarch64-linux-gnu-ld: sound/soc/codecs/wcd934x.o: in function `wcd934x_comp_probe': wcd934x.c:(.text+0x4cb0): undefined reference to `regmap_irq_get_virq' aarch64-linux-gnu-ld: wcd934x.c:(.text+0x4cc0): undefined reference to `regmap_irq_get_virq' aarch64-linux-gnu-ld: wcd934x.c:(.text+0x4cd0): undefined reference to `regmap_irq_get_virq' aarch64-linux-gnu-ld: wcd934x.c:(.text+0x4ce0): undefined reference to `regmap_irq_get_virq' aarch64-linux-gnu-ld: sound/soc/codecs/wcd934x.o:wcd934x.c:(.text+0x4cf0): more undefined references to `regmap_irq_get_virq' follow Fix this by making SND_SOC_WCD934X select REGMAP_IRQ. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/cafd878747e7951914a7d9fea33788a4a230d1f0.1688643442.git.geert@linux-m68k.org Signed-off-by: Mark Brown commit c1be62923d4d86e7c06b1224626e27eb8d9ab32e Author: Srinivas Kandagatla Date: Wed Jul 5 14:18:42 2023 +0100 ASoC: qcom: q6apm: do not close GPR port before closing graph Closing GPR port before graph close can result in un handled notifications from DSP, this results in spam of errors from GPR driver as there is no one to handle these notification at that point in time. Fix this by closing GPR port after graph close is finished. Fixes: 5477518b8a0e ("ASoC: qdsp6: audioreach: add q6apm support") Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230705131842.41584-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit f09b6e96796056633453cb0d07b720d09f1efc68 Author: Johan Hovold Date: Wed Jul 5 14:30:18 2023 +0200 ASoC: core: suppress probe deferral errors Suppress probe deferral error messages when probing link components to avoid spamming the logs, for example, if a required component has not yet been registered: snd-sc8280xp sound: ASoC: failed to instantiate card -517 Note that dev_err_probe() is not used as the card can be unbound and rebound while the underlying platform device remains bound to its driver. Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230705123018.30903-9-johan+linaro@kernel.org Signed-off-by: Mark Brown commit b6c3bdda3a7e43acfcec711ce20e7cfe44744740 Author: Johan Hovold Date: Wed Jul 5 14:30:17 2023 +0200 ASoC: topology: suppress probe deferral errors Suppress probe deferral error messages when loading topologies and creating frontend links to avoid spamming the logs when a component has not yet been registered: snd-sc8280xp sound: ASoC: adding FE link failed snd-sc8280xp sound: ASoC: topology: could not load header: -517 Note that dev_err_probe() is not used as the topology component can be probed and removed while the underlying platform device remains bound to its driver. Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230705123018.30903-8-johan+linaro@kernel.org Signed-off-by: Mark Brown commit a5475829adcc600bc69ee9ff7c9e3e43fb4f8d30 Author: Johan Hovold Date: Wed Jul 5 14:30:16 2023 +0200 ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove The MBHC resources must be released on component probe failure and removal so can not be tied to the lifetime of the component device. This is specifically needed to allow probe deferrals of the sound card which otherwise fails when reprobing the codec component: snd-sc8280xp sound: ASoC: failed to instantiate card -517 genirq: Flags mismatch irq 299. 00002001 (mbhc sw intr) vs. 00002001 (mbhc sw intr) wcd938x_codec audio-codec: Failed to request mbhc interrupts -16 wcd938x_codec audio-codec: mbhc initialization failed wcd938x_codec audio-codec: ASoC: error at snd_soc_component_probe on audio-codec: -16 snd-sc8280xp sound: ASoC: failed to instantiate card -16 Fixes: 0e5c9e7ff899 ("ASoC: codecs: wcd: add multi button Headset detection support") Cc: stable@vger.kernel.org # 5.14 Cc: Srinivas Kandagatla Signed-off-by: Johan Hovold Reviewed-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230705123018.30903-7-johan+linaro@kernel.org Signed-off-by: Mark Brown commit 798590cc7d3c2b5f3a7548d96dd4d8a081c1bc39 Author: Johan Hovold Date: Wed Jul 5 14:30:15 2023 +0200 ASoC: codecs: wcd934x: fix resource leaks on component remove Make sure to release allocated MBHC resources also on component remove. This is specifically needed to allow probe deferrals of the sound card which otherwise fails when reprobing the codec component. Fixes: 9fb9b1690f0b ("ASoC: codecs: wcd934x: add mbhc support") Cc: stable@vger.kernel.org # 5.14 Cc: Srinivas Kandagatla Signed-off-by: Johan Hovold Reviewed-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230705123018.30903-6-johan+linaro@kernel.org Signed-off-by: Mark Brown commit a3406f87775fee986876e03f93a84385f54d5999 Author: Johan Hovold Date: Wed Jul 5 14:30:14 2023 +0200 ASoC: codecs: wcd938x: fix resource leaks on component remove Make sure to release allocated resources on component probe failure and on remove. This is specifically needed to allow probe deferrals of the sound card which otherwise fails when reprobing the codec component: snd-sc8280xp sound: ASoC: failed to instantiate card -517 genirq: Flags mismatch irq 289. 00002001 (HPHR PDM WD INT) vs. 00002001 (HPHR PDM WD INT) wcd938x_codec audio-codec: Failed to request HPHR WD interrupt (-16) genirq: Flags mismatch irq 290. 00002001 (HPHL PDM WD INT) vs. 00002001 (HPHL PDM WD INT) wcd938x_codec audio-codec: Failed to request HPHL WD interrupt (-16) genirq: Flags mismatch irq 291. 00002001 (AUX PDM WD INT) vs. 00002001 (AUX PDM WD INT) wcd938x_codec audio-codec: Failed to request Aux WD interrupt (-16) genirq: Flags mismatch irq 292. 00002001 (mbhc sw intr) vs. 00002001 (mbhc sw intr) wcd938x_codec audio-codec: Failed to request mbhc interrupts -16 Fixes: 8d78602aa87a ("ASoC: codecs: wcd938x: add basic driver") Cc: stable@vger.kernel.org # 5.14 Cc: Srinivas Kandagatla Signed-off-by: Johan Hovold Reviewed-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230705123018.30903-5-johan+linaro@kernel.org Signed-off-by: Mark Brown commit ed0dd9205bf69593edb495cb4b086dbae96a3f05 Author: Johan Hovold Date: Wed Jul 5 14:30:13 2023 +0200 ASoC: codecs: wcd938x: fix missing clsh ctrl error handling Allocation of the clash control structure may fail so add the missing error handling to avoid dereferencing an error pointer. Fixes: 8d78602aa87a ("ASoC: codecs: wcd938x: add basic driver") Cc: stable@vger.kernel.org # 5.14 Cc: Srinivas Kandagatla Signed-off-by: Johan Hovold Reviewed-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230705123018.30903-4-johan+linaro@kernel.org Signed-off-by: Mark Brown commit 46ec420573cefa1fc98025e7e6841bdafd6f1e20 Author: Johan Hovold Date: Wed Jul 5 14:30:12 2023 +0200 ASoC: qdsp6: audioreach: fix topology probe deferral Propagate errors when failing to load the topology component so that probe deferrals can be handled. Fixes: 36ad9bf1d93d ("ASoC: qdsp6: audioreach: add topology support") Cc: stable@vger.kernel.org # 5.17 Cc: Srinivas Kandagatla Signed-off-by: Johan Hovold Reviewed-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230705123018.30903-3-johan+linaro@kernel.org Signed-off-by: Mark Brown commit 826eeaf68b03e5b96bdbc11e3e796f8b562bc0e3 Author: Krzysztof Kozlowski Date: Wed Jul 5 16:57:24 2023 +0200 MIPS: dts: add missing space before { Add missing whitespace between node name/label and opening {. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Thomas Bogendoerfer commit 2500df55a615f2f177bacf1a261f927790a137db Author: Keguang Zhang Date: Thu May 11 20:11:58 2023 +0800 dt-bindings: watchdog: Add Loongson-1 watchdog Add devicetree binding document for Loongson-1 watchdog. Signed-off-by: Keguang Zhang Reviewed-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lkml.kernel.org/r/20230511121159.463645-2-keguang.zhang@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ceb20a3cc52611cb84d164f03e466f64b4ed9fb4 Merge: 21327f81db633 caf3ef7468f75 Author: Paolo Abeni Date: Thu Jul 6 11:02:57 2023 +0200 Merge tag 'nf-23-07-06' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Fix missing overflow use refcount checks in nf_tables. 2) Do not set IPS_ASSURED for IPS_NAT_CLASH entries in GRE tracker, from Florian Westphal. 3) Bail out if nf_ct_helper_hash is NULL before registering helper, from Florent Revest. 4) Use siphash() instead siphash_4u64() to fix performance regression, also from Florian. 5) Do not allow to add rules to removed chains via ID, from Thadeu Lima de Souza Cascardo. 6) Fix oob read access in byteorder expression, also from Thadeu. netfilter pull request 23-07-06 ==================== Link: https://lore.kernel.org/r/20230705230406.52201-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit 21327f81db6337c8843ce755b01523c7d3df715b Author: Klaus Kudielka Date: Wed Jul 5 07:37:12 2023 +0200 net: mvneta: fix txq_map in case of txq_number==1 If we boot with mvneta.txq_number=1, the txq_map is set incorrectly: MVNETA_CPU_TXQ_ACCESS(1) refers to TX queue 1, but only TX queue 0 is initialized. Fix this. Fixes: 50bf8cb6fc9c ("net: mvneta: Configure XPS support") Signed-off-by: Klaus Kudielka Reviewed-by: Michal Kubiak Link: https://lore.kernel.org/r/20230705053712.3914-1-klaus.kudielka@gmail.com Signed-off-by: Paolo Abeni commit d011f0c395c6f59ae3d494b1beec0d101eab1115 Merge: 5ff2977b19769 861c249cd782c Author: Dave Airlie Date: Thu Jul 6 18:01:47 2023 +1000 Merge tag 'drm-misc-next-fixes-2023-06-29' of git://anongit.freedesktop.org/drm/drm-misc into drm-next Short summary of fixes pull: * fbdev: Fix module infos on sparc Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20230629113814.GA10448@linux-uq9g commit c17414a273b81fe4e34e11d69fc30cc8b1431614 Merge: 7afb9d76bc513 7497840d462c8 Author: Linus Torvalds Date: Wed Jul 5 21:45:32 2023 -0700 Merge tag 'sh-for-v6.5-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux Pull sh updates from Adrian Glaubitz: "Fix a compiler warning in the J2 probing code and a fix by Sergey Shtylyov to avoid using IRQ0 on SH3 and SH4 targets. Masahiro Yamada made some clean-up in the build system to address reports by the 0day bot. The most notable changes come from Artur Rojek who addressed a number of issues in the DMA code, in particular a fix for the DMA channel offset calculation that was introduced in in 7f47c7189b3e ("sh: dma: More legacy cpu dma chainsawing.") in 2012! Together with another change to correct the number of DMA channels for each SuperH SoC according to specification, Artur's series unbreaks the kernel on the SH7709 SoC allowing Linux to boot on the HP Jornada 680 handheld again. Summary: - Provide unxlate_dev_mem_ptr() in asm/io.h - dma: Correct the number of DMA channels for SH7709 - dma: Drop incorrect SH_DMAC_BASE1 definition for SH4 - dma: Fix DMA channel offset calculation - Remove compiler flag duplication - Refactor header include path addition - Move build rule for cchips/hd6446x/ to arch/sh/Kbuild - Fix -Wmissing-include-dirs warnings for various platforms - Avoid using IRQ0 on SH3 and SH4 - j2: Use ioremap() to translate device tree address into kernel memory" * tag 'sh-for-v6.5-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux: sh: Provide unxlate_dev_mem_ptr() in asm/io.h sh: dma: Correct the number of DMA channels for SH7709 sh: dma: Drop incorrect SH_DMAC_BASE1 definition for SH4 sh: dma: Fix DMA channel offset calculation sh: Remove compiler flag duplication sh: Refactor header include path addition sh: Move build rule for cchips/hd6446x/ to arch/sh/Kbuild sh: Fix -Wmissing-include-dirs warnings for various platforms sh: Avoid using IRQ0 on SH3 and SH4 sh: j2: Use ioremap() to translate device tree address into kernel memory commit 7afb9d76bc513cb8a2409092dbd3610524a198fe Merge: 6843306689aff a454850a815e6 Author: Linus Torvalds Date: Wed Jul 5 21:38:13 2023 -0700 Merge tag 'phy-for-6.5_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy updates from Vinod Koul: "New Support: - Debugfs support for phy core and mediatek driver - Hisilicon inno-usb2-phy driver supporting Hi3798MV100 - Qualcomm SGMII SerDes PHY driver, SM6115 & QCM2290 QMP-USB support, SA8775P USB PHY & USB3 UNI support, QUSB2 support for IPQ9574, IPQ9574 USB3 PHY UpdatesL - Sparx5 serdes phy power optimzation - cadence salvo usb properties and updates and torrent DP with PCIe & USB support - Yaml conversion for Broadcom kona USB bindings and MXS USB binding" * tag 'phy-for-6.5_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (67 commits) dt-bindings: phy: brcm,brcmstb-usb-phy: Fix error in "compatible" conditional schema dt-bindings: phy: mixel,mipi-dsi-phy: Remove assigned-clock* properties dt-bindings: phy: intel,combo-phy: restrict node name suffixes dt-bindings: phy: qcom,usb-hs-phy: Add compatible phy: tegra: xusb: check return value of devm_kzalloc() phy: qcom: qmp-combo: fix Display Port PHY configuration for SM8550 phy: qcom: add the SGMII SerDes PHY driver dt-bindings: phy: describe the Qualcomm SGMII PHY phy: qualcomm: fix indentation in Makefile phy: usb: suppress OC condition for 7439b2 phy: usb: Turn off phy when port is in suspend phy: tegra: xusb: Clear the driver reference in usb-phy dev dt-bindings: phy: mxs-usb-phy: add imx8ulp and imx8qm compatible dt-bindings: phy: mxs-usb-phy: convert to DT schema format dt-bindings: phy: qcom,qmp-usb: fix bindings error dt-bindings: phy: qcom,qmp-ufs: fix the sc8180x regs dt-bindings: phy: qcom,qmp-pcie: fix the sc8180x regs phy: mediatek: tphy: add debugfs files phy: core: add debugfs files phy: fsl-imx8mp-usb: add support for phy tuning ... commit d14de8067e3f9653cdef5a094176d00f3260ab20 Author: Ronnie Sahlberg Date: Thu Jul 6 12:32:24 2023 +1000 cifs: Add a laundromat thread for cached directories and drop cached directories after 30 seconds Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French commit 496720b7cfb6574a8f6f4d434f23e3d1e6cfaeb9 Merge: 6843306689aff 906bd22a44c7c Author: Alexei Starovoitov Date: Wed Jul 5 19:14:54 2023 -0700 Merge branch 'Fix for check_max_stack_depth' Kumar Kartikeya Dwivedi says: ==================== Fix for a bug in check_max_stack_depth which allows bypassing the 512-byte stack limit. ==================== Signed-off-by: Alexei Starovoitov commit 906bd22a44c7c381ae92996129b075ea7beba8f6 Author: Kumar Kartikeya Dwivedi Date: Wed Jul 5 20:17:30 2023 +0530 selftests/bpf: Add selftest for check_stack_max_depth bug Use the bpf_timer_set_callback helper to mark timer_cb as an async callback, and put a direct call to timer_cb in the main subprog. As the check_stack_max_depth happens after the do_check pass, the order does not matter. Without the previous fix, the test passes successfully. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20230705144730.235802-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 5415ccd50a8620c8cbaa32d6f18c946c453566f5 Author: Kumar Kartikeya Dwivedi Date: Wed Jul 5 20:17:29 2023 +0530 bpf: Fix max stack depth check for async callbacks The check_max_stack_depth pass happens after the verifier's symbolic execution, and attempts to walk the call graph of the BPF program, ensuring that the stack usage stays within bounds for all possible call chains. There are two cases to consider: bpf_pseudo_func and bpf_pseudo_call. In the former case, the callback pointer is loaded into a register, and is assumed that it is passed to some helper later which calls it (however there is no way to be sure), but the check remains conservative and accounts the stack usage anyway. For this particular case, asynchronous callbacks are skipped as they execute asynchronously when their corresponding event fires. The case of bpf_pseudo_call is simpler and we know that the call is definitely made, hence the stack depth of the subprog is accounted for. However, the current check still skips an asynchronous callback even if a bpf_pseudo_call was made for it. This is erroneous, as it will miss accounting for the stack usage of the asynchronous callback, which can be used to breach the maximum stack depth limit. Fix this by only skipping asynchronous callbacks when the instruction is not a pseudo call to the subprog. Fixes: 7ddc80a476c2 ("bpf: Teach stack depth check about async callbacks.") Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20230705144730.235802-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit a97ccaa4f04396c594c25877fd2b78cc5baea4ed Merge: 24befa92ed47e 03e51c4a74b91 Author: Martin K. Petersen Date: Wed Jul 5 22:02:01 2023 -0400 Merge patch series "Improve checks in blk_revalidate_disk_zones()" Damien Le Moal says: blk_revalidate_disk_zones() implements checks of the zones of a zoned block device, verifying that the zone size is a power of 2 number of sectors, that all zones (except possibly the last one) have the same size and that zones cover the entire addressing space of the device. While these checks are appropriate to verify that well tested hardware devices have an adequate zone configurations, they lack in certain areas which may result in issues with potentially buggy emulated devices implemented with user drivers such as ublk or tcmu. Specifically, this function does not check if the device driver indicated support for the mandatory zone append writes, that is, if the device max_zone_append_sectors queue limit is set to a non-zero value. Additionally, invalid zones such as a zero length zone with a start sector equal to the device capacity will not be detected and result in out of bounds use of the zone bitmaps prepared with the callback function blk_revalidate_zone_cb(). This series address these issues by modifying the 4 block device drivers that currently support zoned block devices to ensure that they all set a zoned device zone size and max zone append sectors limit before executing blk_revalidate_disk_zones(). With these changes in place, patch 5 improves blk_revalidate_disk_zones() to address the missing checks, relying on the fact that the zone size and zone append limit are normally set when this function is called. Link: https://lore.kernel.org/r/20230703024812.76778-1-dlemoal@kernel.org Signed-off-by: Martin K. Petersen commit 03e51c4a74b91b0b1a9ca091029b0b58f014be81 Author: Damien Le Moal Date: Mon Jul 3 11:48:12 2023 +0900 scsi: block: Improve checks in blk_revalidate_disk_zones() blk_revalidate_disk_zones() implements checks of the zones of a zoned block device, verifying that the zone size is a power of 2 number of sectors, that all zones (except possibly the last one) have the same size and that zones cover the entire addressing space of the device. While these checks are appropriate to verify that well tested hardware devices have an adequate zone configurations, they lack in certain areas which may result in issues with emulated devices implemented with user drivers such as ublk or tcmu. Specifically, this function does not check if the device driver indicated support for the mandatory zone append writes, that is, if the device max_zone_append_sectors queue limit is set to a non-zero value. Additionally, invalid zones such as a zero length zone with a start sector equal to the device capacity will not be detected and result in out of bounds use of the zone bitmaps prepared with the callback function blk_revalidate_zone_cb(). Improve blk_revalidate_disk_zones() to address these inadequate checks, relying on the fact that all device drivers supporting zoned block devices must set the device zone size (chunk_sectors queue limit) and the max_zone_append_sectors queue limit before executing this function. The check for a non-zero max_zone_append_sectors value is done in blk_revalidate_disk_zones() before executing the zone report. The zone report callback function blk_revalidate_zone_cb() is also modified to add a check that a zone start is below the device capacity. The check that the zone size is a power of 2 number of sectors is moved to blk_revalidate_disk_zones() as the zone size is already known. Similarly, the number of zones of the device can be calculated in blk_revalidate_disk_zones() before executing the zone report. The kdoc comment for blk_revalidate_disk_zones() is also updated to mention that device drivers must set the device zone size and the max_zone_append_sectors queue limit before calling this function. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20230703024812.76778-6-dlemoal@kernel.org Reviewed-by: Bart Van Assche Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit a3d96ed21507e8d70ddab6c7abc93d5e56aaeeb0 Author: Damien Le Moal Date: Mon Jul 3 11:48:11 2023 +0900 scsi: block: virtio_blk: Set zone limits before revalidating zones In virtblk_probe_zoned_device(), execute blk_queue_chunk_sectors() and blk_queue_max_zone_append_sectors() to respectively set the zoned device zone size and maximum zone append sector limit before executing blk_revalidate_disk_zones(). This is to allow the block layer zone reavlidation to check these device characteristics prior to checking all zones of the device. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20230703024812.76778-5-dlemoal@kernel.org Reviewed-by: Bart Van Assche Reviewed-by: Dmitry Fomichev Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit a442b899fe17118e672647f664bf7f1dd5d7fcb0 Author: Damien Le Moal Date: Mon Jul 3 11:48:10 2023 +0900 scsi: block: nullblk: Set zone limits before revalidating zones In null_register_zoned_dev(), execute blk_queue_chunk_sectors() and blk_queue_max_zone_append_sectors() to respectively set the zoned device zone size and maximum zone append sector limit before executing blk_revalidate_disk_zones(). This is to allow the block layer zone reavlidation to check these device characteristics prior to checking all zones of the device. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20230703024812.76778-4-dlemoal@kernel.org Reviewed-by: Bart Van Assche Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit d226b0a2b683e27fce060669dc7cb8d6917b785a Author: Damien Le Moal Date: Mon Jul 3 11:48:09 2023 +0900 scsi: nvme: zns: Set zone limits before revalidating zones In nvme_revalidate_zones(), execute blk_queue_chunk_sectors() and blk_queue_max_zone_append_sectors() to respectively set a ZNS namespace zone size and maximum zone append sector limit before executing blk_revalidate_disk_zones(). This is to allow the block layer zone reavlidation to check these device characteristics prior to checking all zones of the device. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20230703024812.76778-3-dlemoal@kernel.org Reviewed-by: Bart Van Assche Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit f79846ca2f04c9744627c24034d675c88f0da3a0 Author: Damien Le Moal Date: Mon Jul 3 11:48:08 2023 +0900 scsi: sd_zbc: Set zone limits before revalidating zones In sd_zbc_revalidate_zones(), execute blk_queue_chunk_sectors() and blk_queue_max_zone_append_sectors() to respectively set a ZBC device zone size and maximum zone append sector limit before executing blk_revalidate_disk_zones(). This is to allow the block layer zone reavlidation to check these device characteristics prior to checking all zones of the device. Since blk_queue_max_zone_append_sectors() already caps the device maximum zone append limit to the zone size and to the maximum command size, the max_append value passed to blk_queue_max_zone_append_sectors() is simplified to the maximum number of segments times the number of sectors per page. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20230703024812.76778-2-dlemoal@kernel.org Reviewed-by: Bart Van Assche Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen commit 24befa92ed47ed2af25868412a1275602ca8f4ea Author: Arthur Simchaev Date: Mon Jun 26 13:33:19 2023 +0300 scsi: ufs: core: Add support for qTimestamp attribute The new qTimestamp attribute was added to UFS 4.0 spec, in order to synchronize timestamp between device logs and the host. The spec recommends to send this attribute upon device power-on Reset/HW reset or when switching to Active state (using SSU command). Due to this attribute, the attribute's max value was extended to 8 bytes. As a result, the new definition of struct utp_upiu_query_v4_0 was added. Signed-off-by: Arthur Simchaev ----------------- Changes to v2: - Adressed Bart's comments - Add missed response variable to ufshcd_set_timestamp_attr Link: https://lore.kernel.org/r/20230626103320.8737-1-arthur.simchaev@wdc.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 47699a2b63caaa0de4841d4402627c2fdf3452a6 Author: Arnd Bergmann Date: Mon Jul 3 13:48:46 2023 +0200 scsi: aacraid: Avoid -Warray-bounds warning The one-element array in aac_aifcmd is actually meant as a flexible array, and causes an overflow warning that can be avoided using the normal flex arrays: drivers/scsi/aacraid/commsup.c:1166:17: error: array index 1 is past the end of the array (that has type 'u8[1]' (aka 'unsigned char[1]'), cast to '__le32 *' (aka 'unsigned int *')) [-Werror,-Warray-bounds] (((__le32 *)aifcmd->data)[1] == cpu_to_le32(3)); ^ ~ Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230703114851.1194510-1-arnd@kernel.org Signed-off-by: Martin K. Petersen commit 89f7ef7f2b23b2a7b8ce346c23161916eae5b15c Author: Randy Dunlap Date: Fri Jun 30 22:23:48 2023 -0700 scsi: ufs: ufs-mediatek: Add dependency for RESET_CONTROLLER When RESET_CONTROLLER is not set, kconfig complains about missing dependencies for RESET_TI_SYSCON, so add the missing dependency just as is done above for SCSI_UFS_QCOM. Silences this kconfig warning: WARNING: unmet direct dependencies detected for RESET_TI_SYSCON Depends on [n]: RESET_CONTROLLER [=n] && HAS_IOMEM [=y] Selected by [m]: - SCSI_UFS_MEDIATEK [=m] && SCSI_UFSHCD [=y] && SCSI_UFSHCD_PLATFORM [=y] && ARCH_MEDIATEK [=y] Fixes: de48898d0cb6 ("scsi: ufs-mediatek: Create reset control device_link") Signed-off-by: Randy Dunlap Link: lore.kernel.org/r/202306020859.1wHg9AaT-lkp@intel.com Link: https://lore.kernel.org/r/20230701052348.28046-1-rdunlap@infradead.org Cc: Stanley Chu Cc: Peter Wang Cc: Paul Gazzillo Cc: Necip Fazil Yildiran Cc: linux-scsi@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org Cc: linux-mediatek@lists.infradead.org Cc: "James E.J. Bottomley" Cc: "Martin K. Petersen" Reported-by: kernel test robot Signed-off-by: Martin K. Petersen commit ef470b862dc7e5e169167301b9862bed54d7f969 Author: Can Guo Date: Thu Jun 29 17:39:09 2023 -0700 scsi: ufs: core: Update contact email for monitor sysfs nodes Update contact email addresses for Can Guo and Asutosh Das, replace Subhash Jadavani's contact. Signed-off-by: Can Guo Link: https://lore.kernel.org/r/20230630003913.3713155-1-quic_cang@quicinc.com Signed-off-by: Martin K. Petersen commit 23815df5af5790c6e99b6bb1ffd39d509d0a7bdb Author: Maurizio Lombardi Date: Wed Jun 28 17:06:38 2023 +0200 scsi: scsi_debug: Remove dead code The ramdisk rwlocks are not used anymore. Fixes: 87c715dcde63 ("scsi: scsi_debug: Add per_host_store option") Signed-off-by: Maurizio Lombardi Link: https://lore.kernel.org/r/20230628150638.53218-1-mlombard@redhat.com Reviewed-by: Laurence Oberman Signed-off-by: Martin K. Petersen commit 04d91b783acf910ceda2af31fe969e4eb572110b Author: Julia Lawall Date: Tue Jun 27 16:43:39 2023 +0200 scsi: qla2xxx: Use vmalloc_array() and vcalloc() Use vmalloc_array() and vcalloc() to protect against multiplication overflows. The changes were done using the following Coccinelle semantic patch: // @initialize:ocaml@ @@ let rename alloc = match alloc with "vmalloc" -> "vmalloc_array" | "vzalloc" -> "vcalloc" | _ -> failwith "unknown" @@ size_t e1,e2; constant C1, C2; expression E1, E2, COUNT, x1, x2, x3; typedef u8; typedef __u8; type t = {u8,__u8,char,unsigned char}; identifier alloc = {vmalloc,vzalloc}; fresh identifier realloc = script:ocaml(alloc) { rename alloc }; @@ ( alloc(x1*x2*x3) | alloc(C1 * C2) | alloc((sizeof(t)) * (COUNT), ...) | - alloc((e1) * (e2)) + realloc(e1, e2) | - alloc((e1) * (COUNT)) + realloc(COUNT, e1) | - alloc((E1) * (E2)) + realloc(E1, E2) ) // Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/20230627144339.144478-25-Julia.Lawall@inria.fr Signed-off-by: Martin K. Petersen commit b34c7dcaf311521f6a0edaffc157d115d386ed9c Author: Julia Lawall Date: Tue Jun 27 16:43:22 2023 +0200 scsi: fnic: Use vmalloc_array() and vcalloc() Use vmalloc_array() and vcalloc() to protect against multiplication overflows. The changes were done using the following Coccinelle semantic patch: // @initialize:ocaml@ @@ let rename alloc = match alloc with "vmalloc" -> "vmalloc_array" | "vzalloc" -> "vcalloc" | _ -> failwith "unknown" @@ size_t e1,e2; constant C1, C2; expression E1, E2, COUNT, x1, x2, x3; typedef u8; typedef __u8; type t = {u8,__u8,char,unsigned char}; identifier alloc = {vmalloc,vzalloc}; fresh identifier realloc = script:ocaml(alloc) { rename alloc }; @@ ( alloc(x1*x2*x3) | alloc(C1 * C2) | alloc((sizeof(t)) * (COUNT), ...) | - alloc((e1) * (e2)) + realloc(e1, e2) | - alloc((e1) * (COUNT)) + realloc(COUNT, e1) | - alloc((E1) * (E2)) + realloc(E1, E2) ) // Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/20230627144339.144478-8-Julia.Lawall@inria.fr Signed-off-by: Martin K. Petersen commit e579b007eff3ff8d29d59d16214cd85fb9e573f7 Author: Dan Carpenter Date: Mon Jun 26 13:58:47 2023 +0300 scsi: qla2xxx: Fix error code in qla2x00_start_sp() This should be negative -EAGAIN instead of positive. The callers treat non-zero error codes the same so it doesn't really impact runtime beyond some trivial differences to debug output. Fixes: 80676d054e5a ("scsi: qla2xxx: Fix session cleanup hang") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/49866d28-4cfe-47b0-842b-78f110e61aab@moroto.mountain Signed-off-by: Martin K. Petersen commit 134f66959cd0bc90a745f2eed4c10a0519d455c4 Author: Dan Carpenter Date: Mon Jun 26 13:58:03 2023 +0300 scsi: qla2xxx: Silence a static checker warning Smatch and Clang both complain that LOGIN_TEMPLATE_SIZE is more than sizeof(ha->plogi_els_payld.fl_csp). Smatch warning: drivers/scsi/qla2xxx/qla_iocb.c:3075 qla24xx_els_dcmd2_iocb() warn: '&ha->plogi_els_payld.fl_csp' sometimes too small '16' size = 112 Clang warning: include/linux/fortify-string.h:592:4: error: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror,-Wattribute-warning] __read_overflow2_field(q_size_field, size); When I was reading this code I assumed the "- 4" meant that we were skipping the last 4 bytes but actually it turned out that we are skipping the first four bytes. I have re-written it remove the magic numbers, be more clear and silence the static checker warnings. Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/4aa0485e-766f-4b02-8d5d-c6781ea8f511@moroto.mountain Signed-off-by: Martin K. Petersen commit 0e881c0a4b6146b7e856735226208f48251facd8 Author: Tuo Li Date: Fri Jun 30 10:47:48 2023 +0800 scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan() The variable phba->fcf.fcf_flag is often protected by the lock phba->hbalock() when is accessed. Here is an example in lpfc_unregister_fcf_rescan(): spin_lock_irq(&phba->hbalock); phba->fcf.fcf_flag |= FCF_INIT_DISC; spin_unlock_irq(&phba->hbalock); However, in the same function, phba->fcf.fcf_flag is assigned with 0 without holding the lock, and thus can cause a data race: phba->fcf.fcf_flag = 0; To fix this possible data race, a lock and unlock pair is added when accessing the variable phba->fcf.fcf_flag. Reported-by: BassCheck Signed-off-by: Tuo Li Link: https://lore.kernel.org/r/20230630024748.1035993-1-islituo@gmail.com Reviewed-by: Justin Tee Reviewed-by: Laurence Oberman Signed-off-by: Martin K. Petersen commit caf3ef7468f7534771b5c44cd8dbd6f7f87c2cbd Author: Thadeu Lima de Souza Cascardo Date: Wed Jul 5 18:05:35 2023 -0300 netfilter: nf_tables: prevent OOB access in nft_byteorder_eval When evaluating byteorder expressions with size 2, a union with 32-bit and 16-bit members is used. Since the 16-bit members are aligned to 32-bit, the array accesses will be out-of-bounds. It may lead to a stack-out-of-bounds access like the one below: [ 23.095215] ================================================================== [ 23.095625] BUG: KASAN: stack-out-of-bounds in nft_byteorder_eval+0x13c/0x320 [ 23.096020] Read of size 2 at addr ffffc90000007948 by task ping/115 [ 23.096358] [ 23.096456] CPU: 0 PID: 115 Comm: ping Not tainted 6.4.0+ #413 [ 23.096770] Call Trace: [ 23.096910] [ 23.097030] dump_stack_lvl+0x60/0xc0 [ 23.097218] print_report+0xcf/0x630 [ 23.097388] ? nft_byteorder_eval+0x13c/0x320 [ 23.097577] ? kasan_addr_to_slab+0xd/0xc0 [ 23.097760] ? nft_byteorder_eval+0x13c/0x320 [ 23.097949] kasan_report+0xc9/0x110 [ 23.098106] ? nft_byteorder_eval+0x13c/0x320 [ 23.098298] __asan_load2+0x83/0xd0 [ 23.098453] nft_byteorder_eval+0x13c/0x320 [ 23.098659] nft_do_chain+0x1c8/0xc50 [ 23.098852] ? __pfx_nft_do_chain+0x10/0x10 [ 23.099078] ? __kasan_check_read+0x11/0x20 [ 23.099295] ? __pfx___lock_acquire+0x10/0x10 [ 23.099535] ? __pfx___lock_acquire+0x10/0x10 [ 23.099745] ? __kasan_check_read+0x11/0x20 [ 23.099929] nft_do_chain_ipv4+0xfe/0x140 [ 23.100105] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 23.100327] ? lock_release+0x204/0x400 [ 23.100515] ? nf_hook.constprop.0+0x340/0x550 [ 23.100779] nf_hook_slow+0x6c/0x100 [ 23.100977] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 23.101223] nf_hook.constprop.0+0x334/0x550 [ 23.101443] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 23.101677] ? __pfx_nf_hook.constprop.0+0x10/0x10 [ 23.101882] ? __pfx_ip_rcv_finish+0x10/0x10 [ 23.102071] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 23.102291] ? rcu_read_lock_held+0x4b/0x70 [ 23.102481] ip_local_deliver+0xbb/0x110 [ 23.102665] ? __pfx_ip_rcv+0x10/0x10 [ 23.102839] ip_rcv+0x199/0x2a0 [ 23.102980] ? __pfx_ip_rcv+0x10/0x10 [ 23.103140] __netif_receive_skb_one_core+0x13e/0x150 [ 23.103362] ? __pfx___netif_receive_skb_one_core+0x10/0x10 [ 23.103647] ? mark_held_locks+0x48/0xa0 [ 23.103819] ? process_backlog+0x36c/0x380 [ 23.103999] __netif_receive_skb+0x23/0xc0 [ 23.104179] process_backlog+0x91/0x380 [ 23.104350] __napi_poll.constprop.0+0x66/0x360 [ 23.104589] ? net_rx_action+0x1cb/0x610 [ 23.104811] net_rx_action+0x33e/0x610 [ 23.105024] ? _raw_spin_unlock+0x23/0x50 [ 23.105257] ? __pfx_net_rx_action+0x10/0x10 [ 23.105485] ? mark_held_locks+0x48/0xa0 [ 23.105741] __do_softirq+0xfa/0x5ab [ 23.105956] ? __dev_queue_xmit+0x765/0x1c00 [ 23.106193] do_softirq.part.0+0x49/0xc0 [ 23.106423] [ 23.106547] [ 23.106670] __local_bh_enable_ip+0xf5/0x120 [ 23.106903] __dev_queue_xmit+0x789/0x1c00 [ 23.107131] ? __pfx___dev_queue_xmit+0x10/0x10 [ 23.107381] ? find_held_lock+0x8e/0xb0 [ 23.107585] ? lock_release+0x204/0x400 [ 23.107798] ? neigh_resolve_output+0x185/0x350 [ 23.108049] ? mark_held_locks+0x48/0xa0 [ 23.108265] ? neigh_resolve_output+0x185/0x350 [ 23.108514] neigh_resolve_output+0x246/0x350 [ 23.108753] ? neigh_resolve_output+0x246/0x350 [ 23.109003] ip_finish_output2+0x3c3/0x10b0 [ 23.109250] ? __pfx_ip_finish_output2+0x10/0x10 [ 23.109510] ? __pfx_nf_hook+0x10/0x10 [ 23.109732] __ip_finish_output+0x217/0x390 [ 23.109978] ip_finish_output+0x2f/0x130 [ 23.110207] ip_output+0xc9/0x170 [ 23.110404] ip_push_pending_frames+0x1a0/0x240 [ 23.110652] raw_sendmsg+0x102e/0x19e0 [ 23.110871] ? __pfx_raw_sendmsg+0x10/0x10 [ 23.111093] ? lock_release+0x204/0x400 [ 23.111304] ? __mod_lruvec_page_state+0x148/0x330 [ 23.111567] ? find_held_lock+0x8e/0xb0 [ 23.111777] ? find_held_lock+0x8e/0xb0 [ 23.111993] ? __rcu_read_unlock+0x7c/0x2f0 [ 23.112225] ? aa_sk_perm+0x18a/0x550 [ 23.112431] ? filemap_map_pages+0x4f1/0x900 [ 23.112665] ? __pfx_aa_sk_perm+0x10/0x10 [ 23.112880] ? find_held_lock+0x8e/0xb0 [ 23.113098] inet_sendmsg+0xa0/0xb0 [ 23.113297] ? inet_sendmsg+0xa0/0xb0 [ 23.113500] ? __pfx_inet_sendmsg+0x10/0x10 [ 23.113727] sock_sendmsg+0xf4/0x100 [ 23.113924] ? move_addr_to_kernel.part.0+0x4f/0xa0 [ 23.114190] __sys_sendto+0x1d4/0x290 [ 23.114391] ? __pfx___sys_sendto+0x10/0x10 [ 23.114621] ? __pfx_mark_lock.part.0+0x10/0x10 [ 23.114869] ? lock_release+0x204/0x400 [ 23.115076] ? find_held_lock+0x8e/0xb0 [ 23.115287] ? rcu_is_watching+0x23/0x60 [ 23.115503] ? __rseq_handle_notify_resume+0x6e2/0x860 [ 23.115778] ? __kasan_check_write+0x14/0x30 [ 23.116008] ? blkcg_maybe_throttle_current+0x8d/0x770 [ 23.116285] ? mark_held_locks+0x28/0xa0 [ 23.116503] ? do_syscall_64+0x37/0x90 [ 23.116713] __x64_sys_sendto+0x7f/0xb0 [ 23.116924] do_syscall_64+0x59/0x90 [ 23.117123] ? irqentry_exit_to_user_mode+0x25/0x30 [ 23.117387] ? irqentry_exit+0x77/0xb0 [ 23.117593] ? exc_page_fault+0x92/0x140 [ 23.117806] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 23.118081] RIP: 0033:0x7f744aee2bba [ 23.118282] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 [ 23.119237] RSP: 002b:00007ffd04a7c9f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 23.119644] RAX: ffffffffffffffda RBX: 00007ffd04a7e0a0 RCX: 00007f744aee2bba [ 23.120023] RDX: 0000000000000040 RSI: 000056488e9e6300 RDI: 0000000000000003 [ 23.120413] RBP: 000056488e9e6300 R08: 00007ffd04a80320 R09: 0000000000000010 [ 23.120809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040 [ 23.121219] R13: 00007ffd04a7dc38 R14: 00007ffd04a7ca00 R15: 00007ffd04a7e0a0 [ 23.121617] [ 23.121749] [ 23.121845] The buggy address belongs to the virtual mapping at [ 23.121845] [ffffc90000000000, ffffc90000009000) created by: [ 23.121845] irq_init_percpu_irqstack+0x1cf/0x270 [ 23.122707] [ 23.122803] The buggy address belongs to the physical page: [ 23.123104] page:0000000072ac19f0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24a09 [ 23.123609] flags: 0xfffffc0001000(reserved|node=0|zone=1|lastcpupid=0x1fffff) [ 23.123998] page_type: 0xffffffff() [ 23.124194] raw: 000fffffc0001000 ffffea0000928248 ffffea0000928248 0000000000000000 [ 23.124610] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 23.125023] page dumped because: kasan: bad access detected [ 23.125326] [ 23.125421] Memory state around the buggy address: [ 23.125682] ffffc90000007800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 23.126072] ffffc90000007880: 00 00 00 00 00 f1 f1 f1 f1 f1 f1 00 00 f2 f2 00 [ 23.126455] >ffffc90000007900: 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00 00 00 [ 23.126840] ^ [ 23.127138] ffffc90000007980: 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 f3 f3 [ 23.127522] ffffc90000007a00: f3 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 [ 23.127906] ================================================================== [ 23.128324] Disabling lock debugging due to kernel taint Using simple s16 pointers for the 16-bit accesses fixes the problem. For the 32-bit accesses, src and dst can be used directly. Fixes: 96518518cc41 ("netfilter: add nftables") Cc: stable@vger.kernel.org Reported-by: Tanguy DUBROCA (@SidewayRE) from @Synacktiv working with ZDI Signed-off-by: Thadeu Lima de Souza Cascardo Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 6843306689aff3aea608e4d2630b2a5a0137f827 Merge: 73a3fcdaa7320 cc7eab25b1cf3 Author: Linus Torvalds Date: Wed Jul 5 15:44:45 2023 -0700 Merge tag 'net-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from bluetooth, bpf and wireguard. Current release - regressions: - nvme-tcp: fix comma-related oops after sendpage changes Current release - new code bugs: - ptp: make max_phase_adjustment sysfs device attribute invisible when not supported Previous releases - regressions: - sctp: fix potential deadlock on &net->sctp.addr_wq_lock - mptcp: - ensure subflow is unhashed before cleaning the backlog - do not rely on implicit state check in mptcp_listen() Previous releases - always broken: - net: fix net_dev_start_xmit trace event vs skb_transport_offset() - Bluetooth: - fix use-bdaddr-property quirk - L2CAP: fix multiple UaFs - ISO: use hci_sync for setting CIG parameters - hci_event: fix Set CIG Parameters error status handling - hci_event: fix parsing of CIS Established Event - MGMT: fix marking SCAN_RSP as not connectable - wireguard: queuing: use saner cpu selection wrapping - sched: act_ipt: various bug fixes for iptables <> TC interactions - sched: act_pedit: add size check for TCA_PEDIT_PARMS_EX - dsa: fixes for receiving PTP packets with 8021q and sja1105 tagging - eth: sfc: fix null-deref in devlink port without MAE access - eth: ibmvnic: do not reset dql stats on NON_FATAL err Misc: - xsk: honor SO_BINDTODEVICE on bind" * tag 'net-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (70 commits) nfp: clean mc addresses in application firmware when closing port selftests: mptcp: pm_nl_ctl: fix 32-bit support selftests: mptcp: depend on SYN_COOKIES selftests: mptcp: userspace_pm: report errors with 'remove' tests selftests: mptcp: userspace_pm: use correct server port selftests: mptcp: sockopt: return error if wrong mark selftests: mptcp: sockopt: use 'iptables-legacy' if available selftests: mptcp: connect: fail if nft supposed to work mptcp: do not rely on implicit state check in mptcp_listen() mptcp: ensure subflow is unhashed before cleaning the backlog s390/qeth: Fix vipa deletion octeontx-af: fix hardware timestamp configuration net: dsa: sja1105: always enable the send_meta options net: dsa: tag_sja1105: fix MAC DA patching from meta frames net: Replace strlcpy with strscpy pptp: Fix fib lookup calls. mlxsw: spectrum_router: Fix an IS_ERR() vs NULL check net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX xsk: Honor SO_BINDTODEVICE on bind ptp: Make max_phase_adjustment sysfs device attribute invisible when not supported ... commit 2fb48d88e77f29bf9d278f25bcfe82cf59a0e09b Author: Eric Biggers Date: Fri Jun 9 23:11:39 2023 -0700 blk-crypto: use dynamic lock class for blk_crypto_profile::lock When a device-mapper device is passing through the inline encryption support of an underlying device, calls to blk_crypto_evict_key() take the blk_crypto_profile::lock of the device-mapper device, then take the blk_crypto_profile::lock of the underlying device (nested). This isn't a real deadlock, but it causes a lockdep report because there is only one lock class for all instances of this lock. Lockdep subclasses don't really work here because the hierarchy of block devices is dynamic and could have more than 2 levels. Instead, register a dynamic lock class for each blk_crypto_profile, and associate that with the lock. This avoids false-positive lockdep reports like the following: ============================================ WARNING: possible recursive locking detected 6.4.0-rc5 #2 Not tainted -------------------------------------------- fscryptctl/1421 is trying to acquire lock: ffffff80829ca418 (&profile->lock){++++}-{3:3}, at: __blk_crypto_evict_key+0x44/0x1c0 but task is already holding lock: ffffff8086b68ca8 (&profile->lock){++++}-{3:3}, at: __blk_crypto_evict_key+0xc8/0x1c0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&profile->lock); lock(&profile->lock); *** DEADLOCK *** May be due to missing lock nesting notation Fixes: 1b2628397058 ("block: Keyslot Manager for Inline Encryption") Reported-by: Bart Van Assche Signed-off-by: Eric Biggers Reviewed-by: Bart Van Assche Link: https://lore.kernel.org/r/20230610061139.212085-1-ebiggers@kernel.org Signed-off-by: Jens Axboe commit 7eb1e47696aa231b1a567846bbe3a1e1befe1854 Author: Michael Schmitz Date: Wed Jul 5 11:38:08 2023 +1200 block/partition: fix signedness issue for Amiga partitions Making 'blk' sector_t (i.e. 64 bit if LBD support is active) fails the 'blk>0' test in the partition block loop if a value of (signed int) -1 is used to mark the end of the partition block list. Explicitly cast 'blk' to signed int to allow use of -1 to terminate the partition block linked list. Fixes: b6f3f28f604b ("block: add overflow checks for Amiga partition support") Reported-by: Christian Zigotzky Link: https://lore.kernel.org/r/024ce4fa-cc6d-50a2-9aae-3701d0ebf668@xenosoft.de Signed-off-by: Michael Schmitz Reviewed-by: Martin Steigerwald Tested-by: Christian Zigotzky Signed-off-by: Jens Axboe commit 73a3fcdaa73200e38e38f7e8a32c9b901c5b95b5 Merge: bb8e7e9f0bc47 a6ec83786ab9f Author: Linus Torvalds Date: Wed Jul 5 14:14:37 2023 -0700 Merge tag 'f2fs-for-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this cycle, we've mainly investigated the zoned block device support along with patches such as correcting write pointers between f2fs and storage, adding asynchronous zone reset flow, and managing the number of open zones. Other than them, f2fs adds another mount option, "errors=x" to specify how to handle when it detects an unexpected behavior at runtime. Enhancements: - support 'errors=remount-ro|continue|panic' mount option - enforce some inode flag policies - allow .tmp compression given extensions - add some ioctls to manage the f2fs compression - improve looped node chain flow - avoid issuing small-sized discard commands during checkpoint - implement an asynchronous zone reset Bug fixes: - fix deadlock in xattr and inode page lock - fix and add sanity check in some error paths - fix to avoid NULL pointer dereference f2fs_write_end_io() along with put_super - set proper flags to quota files - fix potential deadlock due to unpaired node_write lock use - fix over-estimating free section during FG GC - fix the wrong condition to determine atomic context As usual, also there are a number of patches with code refactoring and minor clean-ups" * tag 'f2fs-for-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (46 commits) f2fs: fix to do sanity check on direct node in truncate_dnode() f2fs: only set release for file that has compressed data f2fs: fix compile warning in f2fs_destroy_node_manager() f2fs: fix error path handling in truncate_dnode() f2fs: fix deadlock in i_xattr_sem and inode page lock f2fs: remove unneeded page uptodate check/set f2fs: update mtime and ctime in move file range method f2fs: compress tmp files given extension f2fs: refactor struct f2fs_attr macro f2fs: convert to use sbi directly f2fs: remove redundant assignment to variable err f2fs: do not issue small discard commands during checkpoint f2fs: check zone write pointer points to the end of zone f2fs: add f2fs_ioc_get_compress_blocks f2fs: cleanup MIN_INLINE_XATTR_SIZE f2fs: add helper to check compression level f2fs: set FMODE_CAN_ODIRECT instead of a dummy direct_IO method f2fs: do more sanity check on inode f2fs: compress: fix to check validity of i_compress_flag field f2fs: add sanity compress level check for compressed file ... commit 01f23c5f1526f5b6ff744887aa511b9e69d4401b Author: Kees Cook Date: Thu Jun 29 12:09:00 2023 -0700 usb: ch9: Replace bmSublinkSpeedAttr 1-element array with flexible array Since commit 2d47c6956ab3 ("ubsan: Tighten UBSAN_BOUNDS on GCC"), UBSAN_BOUNDS no longer pretends 1-element arrays are unbounded. Walking bmSublinkSpeedAttr will trigger a warning, so make it a proper flexible array. Add a union to keep the struct size identical for userspace in case anything was depending on the old size. False positive warning was: UBSAN: array-index-out-of-bounds in drivers/usb/host/xhci-hub.c:231:31 index 1 is out of range for type '__le32 [1]' for this line of code: ssp_cap->bmSublinkSpeedAttr[offset++] = cpu_to_le32(attr); Reported-by: Borislav Petkov Closes: https://lore.kernel.org/lkml/2023062945-fencing-pebble-0411@gregkh/ Reported-by: Mirsad Todorovac Closes: https://lore.kernel.org/lkml/9a8e34ad-8a8b-3830-4878-3c2c82e69dd9@alu.unizg.hr/ Cc: Greg Kroah-Hartman Cc: "Gustavo A. R. Silva" Tested-by: "Borislav Petkov (AMD)" Tested-by: Mirsad Todorovac Reviewed-by: "Gustavo A. R. Silva" Link: https://lore.kernel.org/r/20230629190900.never.787-kees@kernel.org Signed-off-by: Kees Cook commit bb8e7e9f0bc47d01bea310808ab8c27f6484d850 Merge: ace1ba1c9038b 34acceaa8818a Author: Linus Torvalds Date: Wed Jul 5 14:08:03 2023 -0700 Merge tag 'xfs-6.5-merge-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull more xfs updates from Darrick Wong: - Fix some ordering problems with log items during log recovery - Don't deadlock the system by trying to flush busy freed extents while holding on to busy freed extents - Improve validation of log geometry parameters when reading the primary superblock - Validate the length field in the AGF header - Fix recordset filtering bugs when re-calling GETFSMAP to return more results when the resultset didn't previously fit in the caller's buffer - Fix integer overflows in GETFSMAP when working with rt volumes larger than 2^32 fsblocks - Fix GETFSMAP reporting the undefined space beyond the last rtextent - Fix filtering bugs in GETFSMAP's log device backend if the log ever becomes longer than 2^32 fsblocks - Improve validation of file offsets in the GETFSMAP range parameters - Fix an off by one bug in the pmem media failure notification computation - Validate the length field in the AGI header too * tag 'xfs-6.5-merge-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: Remove unneeded semicolon xfs: AGI length should be bounds checked xfs: fix the calculation for "end" and "length" xfs: fix xfs_btree_query_range callers to initialize btree rec fully xfs: validate fsmap offsets specified in the query keys xfs: fix logdev fsmap query result filtering xfs: clean up the rtbitmap fsmap backend xfs: fix getfsmap reporting past the last rt extent xfs: fix integer overflows in the fsmap rtbitmap and logdev backends xfs: fix interval filtering in multi-step fsmap queries xfs: fix bounds check in xfs_defer_agfl_block() xfs: AGF length has never been bounds checked xfs: journal geometry is not properly bounds checked xfs: don't block in busy flushing when freeing extents xfs: allow extent free intents to be retried xfs: pass alloc flags through to xfs_extent_busy_flush() xfs: use deferred frees for btree block freeing xfs: don't reverse order of items in bulk AIL insertion xfs: remove redundant initializations of pointers drop_leaf and save_leaf commit 6722e46513e0af8e2fff4698f7cb78bc50a9f13f Author: Jonas Gorski Date: Sat Jun 24 14:21:39 2023 +0200 bus: ixp4xx: fix IXP4XX_EXP_T1_MASK The IXP4XX_EXP_T1_MASK was shifted one bit to the right, overlapping IXP4XX_EXP_T2_MASK and leaving bit 29 unused. The offset being wrong is also confirmed at least by the datasheet of IXP45X/46X [1]. Fix this by aligning it to IXP4XX_EXP_T1_SHIFT. [1] https://www.intel.com/content/dam/www/public/us/en/documents/manuals/ixp45x-ixp46x-developers-manual.pdf Cc: stable@vger.kernel.org Fixes: 1c953bda90ca ("bus: ixp4xx: Add a driver for IXP4xx expansion bus") Signed-off-by: Jonas Gorski Link: https://lore.kernel.org/r/20230624112958.27727-1-jonas.gorski@gmail.com Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20230624122139.3229642-1-linus.walleij@linaro.org Signed-off-by: Arnd Bergmann commit 7fb75904d7ce8bb4ab98865918f41274b55942c0 Author: Krzysztof Kozlowski Date: Wed Jul 5 17:00:33 2023 +0200 ARM: dts: st: add missing space before { Add missing whitespace between node name/label and opening {. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230705150033.293832-1-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 2fa4139f3e4812de1b827b44ade35a406413f31f Author: Conor Dooley Date: Wed Jun 28 08:12:30 2023 +0100 RISC-V: make ARCH_THEAD preclude XIP_KERNEL Randy reported build errors in linux-next where XIP_KERNEL was enabled. ARCH_THEAD requires alternatives to support the non-standard ISA extensions used by the THEAD cores, which are mutually exclusive with XIP kernels. Clone the dependency list from the Allwinner entry, since Allwinner's D1 uses T-Head cores with the same non-standard extensions. Reported-by: Randy Dunlap Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap # build-tested Link: https://lore.kernel.org/all/ab38f6af-cb68-a918-1a63-2e7c927a8ffc@infradead.org/ Fixes: da47ce003963 ("riscv: Add the T-HEAD SoC family Kconfig option") Reviewed-by: Palmer Dabbelt Acked-by: Palmer Dabbelt Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20230628-left-attractor-94b7bd5fbb83@wendy Signed-off-by: Arnd Bergmann commit ace1ba1c9038b30f29c5759bc4726bbed7748f15 Merge: b986158164122 92554cdd428fc Author: Linus Torvalds Date: Wed Jul 5 12:55:06 2023 -0700 Merge tag 'pwm/for-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "There's a little bit of everything in here: we've got various improvements and cleanups to drivers, some fixes across the board and a bit of new hardware support" * tag 'pwm/for-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: (22 commits) dt-bindings: pwm: convert pwm-bcm2835 bindings to YAML pwm: Add Renesas RZ/G2L MTU3a PWM driver pwm: mtk_disp: Fix the disable flow of disp_pwm dt-bindings: pwm: restrict node name suffixes pwm: pca9685: Switch i2c driver back to use .probe() pwm: ab8500: Fix error code in probe() MAINTAINERS: add pwm to PolarFire SoC entry pwm: add microchip soft ip corePWM driver pwm: sysfs: Do not apply state to already disabled PWMs pwm: imx-tpm: force 'real_period' to be zero in suspend pwm: meson: make full use of common clock framework pwm: meson: don't use hdmi/video clock as mux parent pwm: meson: switch to using struct clk_parent_data for mux parents pwm: meson: remove not needed check in meson_pwm_calc pwm: meson: fix handling of period/duty if greater than UINT_MAX pwm: meson: modify and simplify calculation in meson_pwm_get_state dt-bindings: pwm: Add R-Car V3U device tree bindings dt-bindings: pwm: imx: add i.MX8QXP compatible pwm: mediatek: Add support for MT7981 dt-bindings: pwm: mediatek: Add mediatek,mt7981 compatible ... commit b9861581641225262b836508ec2980e1c4fd0c91 Merge: fe1de55167963 31e9f406efae5 Author: Linus Torvalds Date: Wed Jul 5 12:50:27 2023 -0700 Merge tag 'devicetree-for-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull more devicetree updates from Rob Herring: - Whitespace clean-ups in binding examples - Restrict node name suffixes to "-[0-9]+" for cases of multiple instances which don't have unit-addresses - Convert brcm,kona-wdt and cdns,wdt-r1p2 watchdog bindings to DT schema * tag 'devicetree-for-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: soc: qcom: stats: Update maintainer email dt-bindings: cleanup DTS example whitespaces dt-bindings: timestamp: restrict node name suffixes dt-bindings: slimbus: restrict node name suffixes dt-bindings: watchdog: restrict node name suffixes dt-bindings: watchdog: brcm,kona-wdt: convert txt file to yaml dt-bindings: watchdog: cdns,wdt-r1p2: Convert cadence watchdog to yaml commit bcd981db12e6d26111609802fc7c358f30a8c72a Author: James Clark Date: Wed Jul 5 09:26:52 2023 +0100 perf test: Fix event parsing test when PERF_PMU_CAP_EXTENDED_HW_TYPE isn't supported. Arm has multiple PMU types for heterogeneous systems, but doesn't currently support PERF_PMU_CAP_EXTENDED_HW_TYPE. Make the tests support both scenarios so that they pass on Arm, and will still pass once PERF_PMU_CAP_EXTENDED_HW_TYPE support is added. Fixes: 27c9fcfc1e14 ("perf test: Update parse-events expectations to test for multiple events") Acked-by: Ian Rogers Signed-off-by: James Clark Cc: Mark Rutland Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Alexander Shishkin Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230705082653.23566-3-james.clark@arm.com Signed-off-by: Namhyung Kim commit 808ce56e7d6bfc144b18ded8c11819c45a889520 Author: James Clark Date: Wed Jul 5 09:26:51 2023 +0100 perf test: Fix event parsing test on Arm The test looks for a PMU from sysfs with type = PERF_TYPE_RAW when opening a raw event. Arm doesn't have a real raw PMU, only core PMUs with unique types other than raw. Instead of looking for a matching PMU, just test that the event type was parsed as raw and skip the PMU search on Arm. The raw event type test should also apply to all platforms so add it outside of the ifdef. Fixes: aefde50a446b ("perf test: Fix parse-events tests for >1 core PMU") Acked-by: Ian Rogers Signed-off-by: James Clark Cc: Mark Rutland Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Alexander Shishkin Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230705082653.23566-2-james.clark@arm.com Signed-off-by: Namhyung Kim commit 84a192e46106355de1a314d709e657231d4b1026 Author: Aravindhan Gunasekaran Date: Thu Jun 15 12:00:43 2023 +0530 igc: Handle PPS start time programming for past time values I225/6 hardware can be programmed to start PPS output once the time in Target Time registers is reached. The time programmed in these registers should always be into future. Only then PPS output is triggered when SYSTIM register reaches the programmed value. There are two modes in i225/6 hardware to program PPS, pulse and clock mode. There were issues reported where PPS is not generated when start time is in past. Example 1, "echo 0 0 0 2 0 > /sys/class/ptp/ptp0/period" In the current implementation, a value of '0' is programmed into Target time registers and PPS output is in pulse mode. Eventually an interrupt which is triggered upon SYSTIM register reaching Target time is not fired. Thus no PPS output is generated. Example 2, "echo 0 0 0 1 0 > /sys/class/ptp/ptp0/period" Above case, a value of '0' is programmed into Target time registers and PPS output is in clock mode. Here, HW tries to catch-up the current time by incrementing Target Time register. This catch-up time seem to vary according to programmed PPS period time as per the HW design. In my experiments, the delay ranged between few tens of seconds to few minutes. The PPS output is only generated after the Target time register reaches current time. In my experiments, I also observed PPS stopped working with below test and could not recover until module is removed and loaded again. 1) echo 0 0 1 0 > /sys/class/ptp/ptp1/period 2) echo 0 0 0 1 0 > /sys/class/ptp/ptp1/period 3) echo 0 0 0 1 0 > /sys/class/ptp/ptp1/period After this PPS did not work even if i re-program with proper values. I could only get this back working by reloading the driver. This patch takes care of calculating and programming appropriate future time value into Target Time registers. Fixes: 5e91c72e560c ("igc: Fix PPS delta between two synchronized end-points") Signed-off-by: Aravindhan Gunasekaran Reviewed-by: Muhammad Husaini Zulkifli Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit 25102893e409bc02761ab82dbcfa092006404790 Author: Tan Tee Min Date: Fri Jun 9 11:28:42 2023 +0800 igc: Include the length/type field and VLAN tag in queueMaxSDU IEEE 802.1Q does not have clear definitions of what constitutes an SDU (Service Data Unit), but IEEE Std 802.3 clause 3.1.2 does define the MAC service primitives and clause 3.2.7 does define the MAC Client Data for Q-tagged frames. It shows that the mac_service_data_unit (MSDU) does NOT contain the preamble, destination and source address, or FCS. The MSDU does contain the length/type field, MAC client data, VLAN tag and any padding data (prior to the FCS). Thus, the maximum 802.3 frame size that is allowed to be transmitted should be QueueMaxSDU (MSDU) + 16 (6 byte SA + 6 byte DA + 4 byte FCS). Fixes: 92a0dcb8427d ("igc: offload queue max SDU from tc-taprio") Signed-off-by: Tan Tee Min Reviewed-by: Muhammad Husaini Zulkifli Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit 9ac3fc2f42e5ffa1e927dcbffb71b15fa81459e2 Author: Prasad Koya Date: Mon Jun 5 11:09:01 2023 -0700 igc: set TP bit in 'supported' and 'advertising' fields of ethtool_link_ksettings set TP bit in the 'supported' and 'advertising' fields. i225/226 parts only support twisted pair copper. Fixes: 8c5ad0dae93c ("igc: Add ethtool support") Signed-off-by: Prasad Koya Acked-by: Sasha Neftin Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit cc7eab25b1cf3f9594fe61142d3523ce4d14a788 Author: Yinjun Zhang Date: Wed Jul 5 07:28:18 2023 +0200 nfp: clean mc addresses in application firmware when closing port When moving devices from one namespace to another, mc addresses are cleaned in software while not removed from application firmware. Thus the mc addresses are remained and will cause resource leak. Now use `__dev_mc_unsync` to clean mc addresses when closing port. Fixes: e20aa071cd95 ("nfp: fix schedule in atomic context when sync mc address") Cc: stable@vger.kernel.org Signed-off-by: Yinjun Zhang Acked-by: Simon Horman Signed-off-by: Louis Peens Reviewed-by: Jacob Keller Message-ID: <20230705052818.7122-1-louis.peens@corigine.com> Signed-off-by: Jakub Kicinski commit fdaff05b4a67ae6789a8d45c10f891990329f85e Merge: c451410ca7e3d f7306acec9aae Author: Jakub Kicinski Date: Wed Jul 5 10:57:13 2023 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2023-07-05 We've added 2 non-merge commits during the last 1 day(s) which contain a total of 3 files changed, 16 insertions(+), 4 deletions(-). The main changes are: 1) Fix BTF to warn but not returning an error for a NULL BTF to still be able to load modules under CONFIG_DEBUG_INFO_BTF, from SeongJae Park. 2) Fix xsk sockets to honor SO_BINDTODEVICE in bind(), from Ilya Maximets. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: xsk: Honor SO_BINDTODEVICE on bind bpf, btf: Warn but return no error for NULL btf from __register_btf_kfunc_id_set() ==================== Link: https://lore.kernel.org/r/20230705171716.6494-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 7abd955a58fb0fcd4e756fa2065c03ae488fcfa7 Author: Dragos Tatulea Date: Wed May 31 21:18:49 2023 +0300 net/mlx5e: RX, Fix page_pool page fragment tracking for XDP Currently mlx5e releases pages directly to the page_pool for XDP_TX and does page fragment counting for XDP_REDIRECT. RX pages from the page_pool are leaking on XDP_REDIRECT because the xdp core will release only one fragment out of MLX5E_PAGECNT_BIAS_MAX and subsequently the page is marked as "skip release" which avoids the driver release. A fix would be to take an extra fragment for XDP_REDIRECT and not set the "skip release" bit so that the release on the driver side can handle the remaining bias fragments. But this would be a shortsighted solution. Instead, this patch converges the two XDP paths (XDP_TX and XDP_REDIRECT) to always do fragment tracking. The "skip release" bit is no longer necessary for XDP. Fixes: 6f5742846053 ("net/mlx5e: RX, Enable skb page recycling through the page_pool") Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit 6496357aa5f710eec96f91345b9da1b37c3231f6 Author: Maher Sanalla Date: Tue Jun 20 14:07:03 2023 +0300 net/mlx5: Query hca_cap_2 only when supported On vport enable, where fw's hca caps are queried, the driver queries hca_caps_2 without checking if fw truly supports them, causing a false failure of vfs vport load and blocking SRIOV enablement on old devices such as CX4 where hca_caps_2 support is missing. Thus, add a check for the said caps support before accessing them. Fixes: e5b9642a33be ("net/mlx5: E-Switch, Implement devlink port function cmds to control migratable") Signed-off-by: Maher Sanalla Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit f7a485115ad4cfc560833942014bf791abf1f827 Author: Yevgeny Kliteynik Date: Sun Jun 4 12:45:38 2023 +0300 net/mlx5e: TC, CT: Offload ct clear only once Non-clear CT action causes a flow rule split, while CT clear action doesn't and is just a header-rewrite to the current flow rule. But ct offload is done in post_parse and is per ct action instance, so ct clear offload is parsed multiple times, while its deleted once. Fix this by post_parsing the ct action only once per flow attribute (which is per flow rule) by using a offloaded ct_attr flag. Fixes: 08fe94ec5f77 ("net/mlx5e: TC, Remove special handling of CT action") Signed-off-by: Paul Blakey Signed-off-by: Yevgeny Kliteynik Signed-off-by: Saeed Mahameed commit 65e64640e97c0f223e77f9ea69b5a46186b93470 Author: Vlad Buslov Date: Thu Jun 8 09:32:10 2023 +0200 net/mlx5e: Check for NOT_READY flag state after locking Currently the check for NOT_READY flag is performed before obtaining the necessary lock. This opens a possibility for race condition when the flow is concurrently removed from unready_flows list by the workqueue task, which causes a double-removal from the list and a crash[0]. Fix the issue by moving the flag check inside the section protected by uplink_priv->unready_flows_lock mutex. [0]: [44376.389654] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] SMP [44376.391665] CPU: 7 PID: 59123 Comm: tc Not tainted 6.4.0-rc4+ #1 [44376.392984] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [44376.395342] RIP: 0010:mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core] [44376.396857] Code: 00 48 8b b8 68 ce 02 00 e8 8a 4d 02 00 4c 8d a8 a8 01 00 00 4c 89 ef e8 8b 79 88 e1 48 8b 83 98 06 00 00 48 8b 93 90 06 00 00 <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 90 06 [44376.399167] RSP: 0018:ffff88812cc97570 EFLAGS: 00010246 [44376.399680] RAX: dead000000000122 RBX: ffff8881088e3800 RCX: ffff8881881bac00 [44376.400337] RDX: dead000000000100 RSI: ffff88812cc97500 RDI: ffff8881242f71b0 [44376.401001] RBP: ffff88811cbb0940 R08: 0000000000000400 R09: 0000000000000001 [44376.401663] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88812c944000 [44376.402342] R13: ffff8881242f71a8 R14: ffff8881222b4000 R15: 0000000000000000 [44376.402999] FS: 00007f0451104800(0000) GS:ffff88852cb80000(0000) knlGS:0000000000000000 [44376.403787] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [44376.404343] CR2: 0000000000489108 CR3: 0000000123a79003 CR4: 0000000000370ea0 [44376.405004] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [44376.405665] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [44376.406339] Call Trace: [44376.406651] [44376.406939] ? die_addr+0x33/0x90 [44376.407311] ? exc_general_protection+0x192/0x390 [44376.407795] ? asm_exc_general_protection+0x22/0x30 [44376.408292] ? mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core] [44376.408876] __mlx5e_tc_del_fdb_peer_flow+0xbc/0xe0 [mlx5_core] [44376.409482] mlx5e_tc_del_flow+0x42/0x210 [mlx5_core] [44376.410055] mlx5e_flow_put+0x25/0x50 [mlx5_core] [44376.410529] mlx5e_delete_flower+0x24b/0x350 [mlx5_core] [44376.411043] tc_setup_cb_reoffload+0x22/0x80 [44376.411462] fl_reoffload+0x261/0x2f0 [cls_flower] [44376.411907] ? mlx5e_rep_indr_setup_ft_cb+0x160/0x160 [mlx5_core] [44376.412481] ? mlx5e_rep_indr_setup_ft_cb+0x160/0x160 [mlx5_core] [44376.413044] tcf_block_playback_offloads+0x76/0x170 [44376.413497] tcf_block_unbind+0x7b/0xd0 [44376.413881] tcf_block_setup+0x17d/0x1c0 [44376.414269] tcf_block_offload_cmd.isra.0+0xf1/0x130 [44376.414725] tcf_block_offload_unbind+0x43/0x70 [44376.415153] __tcf_block_put+0x82/0x150 [44376.415532] ingress_destroy+0x22/0x30 [sch_ingress] [44376.415986] qdisc_destroy+0x3b/0xd0 [44376.416343] qdisc_graft+0x4d0/0x620 [44376.416706] tc_get_qdisc+0x1c9/0x3b0 [44376.417074] rtnetlink_rcv_msg+0x29c/0x390 [44376.419978] ? rep_movs_alternative+0x3a/0xa0 [44376.420399] ? rtnl_calcit.isra.0+0x120/0x120 [44376.420813] netlink_rcv_skb+0x54/0x100 [44376.421192] netlink_unicast+0x1f6/0x2c0 [44376.421573] netlink_sendmsg+0x232/0x4a0 [44376.421980] sock_sendmsg+0x38/0x60 [44376.422328] ____sys_sendmsg+0x1d0/0x1e0 [44376.422709] ? copy_msghdr_from_user+0x6d/0xa0 [44376.423127] ___sys_sendmsg+0x80/0xc0 [44376.423495] ? ___sys_recvmsg+0x8b/0xc0 [44376.423869] __sys_sendmsg+0x51/0x90 [44376.424226] do_syscall_64+0x3d/0x90 [44376.424587] entry_SYSCALL_64_after_hwframe+0x46/0xb0 [44376.425046] RIP: 0033:0x7f045134f887 [44376.425403] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [44376.426914] RSP: 002b:00007ffd63a82b98 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [44376.427592] RAX: ffffffffffffffda RBX: 000000006481955f RCX: 00007f045134f887 [44376.428195] RDX: 0000000000000000 RSI: 00007ffd63a82c00 RDI: 0000000000000003 [44376.428796] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [44376.429404] R10: 00007f0451208708 R11: 0000000000000246 R12: 0000000000000001 [44376.430039] R13: 0000000000409980 R14: 000000000047e538 R15: 0000000000485400 [44376.430644] [44376.430907] Modules linked in: mlx5_ib mlx5_core act_mirred act_tunnel_key cls_flower vxlan dummy sch_ingress openvswitch nsh rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_g ss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: mlx5_core] [44376.433936] ---[ end trace 0000000000000000 ]--- [44376.434373] RIP: 0010:mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core] [44376.434951] Code: 00 48 8b b8 68 ce 02 00 e8 8a 4d 02 00 4c 8d a8 a8 01 00 00 4c 89 ef e8 8b 79 88 e1 48 8b 83 98 06 00 00 48 8b 93 90 06 00 00 <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 90 06 [44376.436452] RSP: 0018:ffff88812cc97570 EFLAGS: 00010246 [44376.436924] RAX: dead000000000122 RBX: ffff8881088e3800 RCX: ffff8881881bac00 [44376.437530] RDX: dead000000000100 RSI: ffff88812cc97500 RDI: ffff8881242f71b0 [44376.438179] RBP: ffff88811cbb0940 R08: 0000000000000400 R09: 0000000000000001 [44376.438786] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88812c944000 [44376.439393] R13: ffff8881242f71a8 R14: ffff8881222b4000 R15: 0000000000000000 [44376.439998] FS: 00007f0451104800(0000) GS:ffff88852cb80000(0000) knlGS:0000000000000000 [44376.440714] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [44376.441225] CR2: 0000000000489108 CR3: 0000000123a79003 CR4: 0000000000370ea0 [44376.441843] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [44376.442471] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: ad86755b18d5 ("net/mlx5e: Protect unready flows with dedicated lock") Signed-off-by: Vlad Buslov Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed commit 631079e08aa4a20b73e70de4cf457886194f029f Author: Saeed Mahameed Date: Mon Jun 26 20:36:41 2023 -0700 net/mlx5: Register a unique thermal zone per device Prior to this patch only one "mlx5" thermal zone could have been registered regardless of the number of individual mlx5 devices in the system. To fix this setup a unique name per device to register its own thermal zone. In order to not register a thermal zone for a virtual device (VF/SF) add a check for PF device type. The new name is a concatenation between "mlx5_" and "", which will also help associating a thermal zone with its PCI device. $ lspci | grep ConnectX 00:04.0 Ethernet controller: Mellanox Technologies MT2892 Family [ConnectX-6 Dx] 00:05.0 Ethernet controller: Mellanox Technologies MT2892 Family [ConnectX-6 Dx] $ cat /sys/devices/virtual/thermal/thermal_zone0/type mlx5_0000:00:04.0 $ cat /sys/devices/virtual/thermal/thermal_zone1/type mlx5_0000:00:05.0 Fixes: c1fef618d611 ("net/mlx5: Implement thermal zone") CC: Sandipan Patra Signed-off-by: Saeed Mahameed commit 2e2d1965794d22fbe86df45bf4f933216743577d Author: Dragos Tatulea Date: Mon May 22 21:18:53 2023 +0300 net/mlx5e: RX, Fix flush and close release flow of regular rq for legacy rq Regular (non-XSK) RQs get flushed on XSK setup and re-activated on XSK close. If the same regular RQ is closed (a config change for example) soon after the XSK close, a double release occurs because the missing wqes get released a second time. Fixes: 3f93f82988bc ("net/mlx5e: RX, Defer page release in legacy rq for better recycling") Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed commit d543b649ffe58a0cb4b6948b3305069c5980a1fa Author: Zhengchao Shao Date: Fri Jun 30 09:49:03 2023 +0800 net/mlx5e: fix memory leak in mlx5e_ptp_open When kvzalloc_node or kvzalloc failed in mlx5e_ptp_open, the memory pointed by "c" or "cparams" is not freed, which can lead to a memory leak. Fix by freeing the array in the error path. Fixes: 145e5637d941 ("net/mlx5e: Add TX PTP port object support") Signed-off-by: Zhengchao Shao Reviewed-by: Rahul Rameshbabu Reviewed-by: Gal Pressman Reviewed-by: Simon Horman Signed-off-by: Saeed Mahameed commit 3250affdc658557a41df9c5fb567723e421f8bf2 Author: Zhengchao Shao Date: Fri Jun 30 09:49:02 2023 +0800 net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create The memory pointed to by the fs->any pointer is not freed in the error path of mlx5e_fs_tt_redirect_any_create, which can lead to a memory leak. Fix by freeing the memory in the error path, thereby making the error path identical to mlx5e_fs_tt_redirect_any_destroy(). Fixes: 0f575c20bf06 ("net/mlx5e: Introduce Flow Steering ANY API") Signed-off-by: Zhengchao Shao Reviewed-by: Simon Horman Reviewed-by: Rahul Rameshbabu Signed-off-by: Saeed Mahameed commit 884abe45a9014d0de2e6edb0630dfd64f23f1d1b Author: Zhengchao Shao Date: Wed Jun 28 08:59:34 2023 +0800 net/mlx5e: fix double free in mlx5e_destroy_flow_table In function accel_fs_tcp_create_groups(), when the ft->g memory is successfully allocated but the 'in' memory fails to be allocated, the memory pointed to by ft->g is released once. And in function accel_fs_tcp_create_table, mlx5e_destroy_flow_table is called to release the memory pointed to by ft->g again. This will cause double free problem. Fixes: c062d52ac24c ("net/mlx5e: Receive flow steering framework for accelerated TCP flows") Signed-off-by: Zhengchao Shao Signed-off-by: Saeed Mahameed commit fe1de55167963a1c0ebe1579e37a8a41495f0a81 Merge: 15ac468614e5e a4857d1afdd1f Author: Linus Torvalds Date: Wed Jul 5 10:54:43 2023 -0700 Merge tag 'soundwire-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire updates from Vinod Koul: - Stream handling and slave alert handling - Qualcomm Soundwire v2.0.0 controller support - Intel ACE2.x initial support and code reorganization * tag 'soundwire-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: (55 commits) soundwire: stream: Make master_list ordered to prevent deadlocks soundwire: bus: Prevent lockdep asserts when stream has multiple buses soundwire: qcom: fix storing port config out-of-bounds soundwire: intel_ace2x: fix SND_SOC_SOF_HDA_MLINK dependency soundwire: debugfs: Add missing SCP registers soundwire: stream: Remove unnecessary gotos soundwire: stream: Invert logic on runtime alloc flags soundwire: stream: Remove unneeded checks for NULL bus soundwire: bandwidth allocation: Remove pointless variable soundwire: cadence: revisit parity injection soundwire: intel/cadence: update hardware reset sequence soundwire: intel_bus_common: enable interrupts last soundwire: intel_bus_common: update error log soundwire: amd: Improve error message in remove callback soundwire: debugfs: fix unbalanced pm_runtime_put() soundwire: qcom: fix unbalanced pm_runtime_put() soundwire: qcom: set clk stop need reset flag at runtime soundwire: qcom: add software workaround for bus clash interrupt assertion soundwire: qcom: wait for fifo to be empty before suspend soundwire: qcom: drop unused struct qcom_swrm_ctrl members ... commit 15ac468614e5e4fee82e1eb32568f427b0e51adc Merge: 2784d74bcc811 c61480a2ea5e5 Author: Linus Torvalds Date: Wed Jul 5 10:42:32 2023 -0700 Merge tag 'media/v6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - Lots of improvement at atomisp driver, which is starting to look in good shape - Mediatek vcodec driver has gained support for av1 and hevc stateless codecs - New sensor driver: ov01a10 - verisilicon driver has gained AV1 entropy helpers - tegra-video has gained support for Tegra20 parallel input - dvb core has gained an extra property to better support DVB-S2X - as usual, lots of cleanups, fixes and improvements on media drivers * tag 'media/v6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (253 commits) media: wl128x: fix a clang warning media: dvb: mb86a20s: get rid of a clang-15 warning media: cec: i2c: ch7322: also select REGMAP media: add HAS_IOPORT dependencies media: tc358746: select CONFIG_GENERIC_PHY media: mediatek: vcodec: Add dbgfs help function media: mediatek: vcodec: Add encode to support dbgfs media: mediatek: vcodec: Change dbgfs interface to support encode media: mediatek: vcodec: Get each instance format type media: mediatek: vcodec: Get each context resolution information media: mediatek: vcodec: Add a debugfs file to get different useful information media: mediatek: vcodec: Add debug params to control different log level media: mediatek: vcodec: Add debugfs interface to get debug information media: mediatek: vcodec: support stateless AV1 decoder media: verisilicon: Conditionally ignore native formats media: verisilicon: Enable AV1 decoder on rk3588 media: verisilicon: Add film grain feature to AV1 driver media: verisilicon: Add Rockchip AV1 decoder media: verisilicon: Add AV1 entropy helpers media: verisilicon: Compute motion vectors size for AV1 frames ... commit 175c241288c09f81eb7b44d65c1ef6045efa4d1a Author: Muhammad Husaini Zulkifli Date: Sat Jun 3 20:59:34 2023 +0800 igc: Fix TX Hang issue when QBV Gate is closed If a user schedules a Gate Control List (GCL) to close one of the QBV gates while also transmitting a packet to that closed gate, TX Hang will be happen. HW would not drop any packet when the gate is closed and keep queuing up in HW TX FIFO until the gate is re-opened. This patch implements the solution to drop the packet for the closed gate. This patch will also reset the adapter to perform SW initialization for each 1st Gate Control List (GCL) to avoid hang. This is due to the HW design, where changing to TSN transmit mode requires SW initialization. Intel Discrete I225/6 transmit mode cannot be changed when in dynamic mode according to Software User Manual Section 7.5.2.1. Subsequent Gate Control List (GCL) operations will proceed without a reset, as they already are in TSN Mode. Step to reproduce: DUT: 1) Configure GCL List with certain gate close. BASE=$(date +%s%N) tc qdisc replace dev $IFACE parent root handle 100 taprio \ num_tc 4 \ map 0 1 2 3 3 3 3 3 3 3 3 3 3 3 3 3 \ queues 1@0 1@1 1@2 1@3 \ base-time $BASE \ sched-entry S 0x8 500000 \ sched-entry S 0x4 500000 \ flags 0x2 2) Transmit the packet to closed gate. You may use udp_tai application to transmit UDP packet to any of the closed gate. ./udp_tai -i -P 100000 -p 90 -c 1 -t <0/1> -u 30004 Fixes: ec50a9d437f0 ("igc: Add support for taprio offloading") Co-developed-by: Tan Tee Min Signed-off-by: Tan Tee Min Tested-by: Chwee Lin Choong Signed-off-by: Muhammad Husaini Zulkifli Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit 2784d74bcc811e9d743398da38552e6f9c73e96b Merge: 2a95b03d4cf78 6127383217741 Author: Linus Torvalds Date: Wed Jul 5 10:34:30 2023 -0700 Merge tag 'trace-tools-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing tooling updates from Steven Rostedt: - Add cgroup support for rtla via the -C option - Add --house-keeping option that tells rtla where to place the housekeeping threads - Have rtla/timerlat have its own tracing instance instead of using the top level tracing instance that is the default for other tracing users to use - Add auto analysis to timerlat_hist - Have rtla start the tracers after creating the instances - Reduce rtla hwnoise down to 75% from 100% as it runs with preemption disabled and can cause system instability at 100% - Add support to run timerlat_top and timerlat_hist threads in user-space instead of just using the kernel tasks - Some minor clean ups and documentation changes * tag 'trace-tools-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: Documentation: Add tools/rtla timerlat -u option documentation rtla/timerlat_hist: Add timerlat user-space support rtla/timerlat_top: Add timerlat user-space support rtla/hwnoise: Reduce runtime to 75% rtla: Start the tracers after creating all instances rtla/timerlat_hist: Add auto-analysis support rtla/timerlat: Give timerlat auto analysis its own instance rtla: Automatically move rtla to a house-keeping cpu rtla: Change monitored_cpus from char * to cpu_set_t rtla: Add --house-keeping option rtla: Add -C cgroup support commit 2a95b03d4cf780611ac6903fddc79e6d9789966e Merge: 6cd06ab12d1af f8a473bf5db7a Author: Linus Torvalds Date: Wed Jul 5 10:28:38 2023 -0700 Merge tag 'parisc-for-6.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull more parisc architecture updates from Helge Deller: - Fix all compiler warnings in arch/parisc and drivers/parisc when compiled with W=1 * tag 'parisc-for-6.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: syscalls: Avoid compiler warnings with W=1 parisc: math-emu: Avoid compiler warnings with W=1 parisc: Raise minimal GCC version to 12.0.0 parisc: unwind: Avoid missing prototype warning for handle_interruption() parisc: smp: Add declaration for start_cpu_itimer() parisc: pdt: Get prototype for arch_report_meminfo() commit cca28ceac7c7857bc2d313777017585aef00bcc4 Author: Muhammad Husaini Zulkifli Date: Wed May 17 08:18:12 2023 +0800 igc: Remove delay during TX ring configuration Remove unnecessary delay during the TX ring configuration. This will cause delay, especially during link down and link up activity. Furthermore, old SKUs like as I225 will call the reset_adapter to reset the controller during TSN mode Gate Control List (GCL) setting. This will add more time to the configuration of the real-time use case. It doesn't mentioned about this delay in the Software User Manual. It might have been ported from legacy code I210 in the past. Fixes: 13b5b7fd6a4a ("igc: Add support for Tx/Rx rings") Signed-off-by: Muhammad Husaini Zulkifli Acked-by: Sasha Neftin Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit ed89b74d2dc920cb61d3094e0e97ec8775b13086 Author: Muhammad Husaini Zulkifli Date: Mon May 15 14:03:36 2023 +0800 igc: Add condition for qbv_config_change_errors counter Add condition to increase the qbv counter during taprio qbv configuration only. There might be a case when TC already been setup then user configure the ETF/CBS qdisc and this counter will increase if no condition above. Fixes: ae4fe4698300 ("igc: Add qbv_config_change_errors counter") Signed-off-by: Muhammad Husaini Zulkifli Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit 7497840d462c8f54c4888c22ab3726a8cde4b9a2 Author: Guenter Roeck Date: Tue Jul 4 12:01:44 2023 -0700 sh: Provide unxlate_dev_mem_ptr() in asm/io.h The unxlate_dev_mem_ptr() function has no prototype on the sh architecture which does not include asm-generic/io.h. This results in the following build failure: drivers/char/mem.c: In function 'read_mem': drivers/char/mem.c:164:25: error: implicit declaration of function 'unxlate_dev_mem_ptr' This compile error is now seen because commit 99b619b37ae1 ("mips: provide unxlate_dev_mem_ptr() in asm/io.h") removed the weak function which was previously in place to handle this problem. Add a trivial macro to the sh header to provide the now missing dummy function. Fixes: 99b619b37ae1 ("mips: provide unxlate_dev_mem_ptr() in asm/io.h") Cc: Arnd Bergmann Signed-off-by: Guenter Roeck Acked-by: Arnd Bergmann Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20230704190144.2888679-1-linux@roeck-us.net Signed-off-by: John Paul Adrian Glaubitz commit 3ad4dcbc31d1a8860183cb01e507d75f296c661b Author: Artur Rojek Date: Sat May 27 18:44:52 2023 +0200 sh: dma: Correct the number of DMA channels for SH7709 According to the hardware manual [1], the DMAC found in the SH7709 SoC features only 4 channels. While at it, also sort the existing targets. [1] https://www.renesas.com/us/en/document/mah/sh7709s-group-hardware-manual (p. 373) Signed-off-by: Artur Rojek Reviewed-by: Geert Uytterhoeven Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20230527164452.64797-4-contact@artur-rojek.eu Signed-off-by: John Paul Adrian Glaubitz commit d2f4a190b137b4a2e0ec3efe87905841dfdc8c66 Author: Artur Rojek Date: Sat May 27 18:44:51 2023 +0200 sh: dma: Drop incorrect SH_DMAC_BASE1 definition for SH4 None of the supported SH4 family SoCs features a second DMAC module. As this definition negatively impacts DMA channel calculation for the above targets, remove it from the code. Signed-off-by: Artur Rojek Reviewed-by: Geert Uytterhoeven Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20230527164452.64797-3-contact@artur-rojek.eu Signed-off-by: John Paul Adrian Glaubitz commit e82e47584847129a20b8c9f4a1dcde09374fb0e0 Author: Artur Rojek Date: Sat May 27 18:44:50 2023 +0200 sh: dma: Fix DMA channel offset calculation Various SoCs of the SH3, SH4 and SH4A family, which use this driver, feature a differing number of DMA channels, which can be distributed between up to two DMAC modules. The existing implementation fails to correctly accommodate for all those variations, resulting in wrong channel offset calculations and leading to kernel panics. Rewrite dma_base_addr() in order to properly calculate channel offsets in a DMAC module. Fix dmaor_read_reg() and dmaor_write_reg(), so that the correct DMAC module base is selected for the DMAOR register. Fixes: 7f47c7189b3e8f19 ("sh: dma: More legacy cpu dma chainsawing.") Signed-off-by: Artur Rojek Reviewed-by: Geert Uytterhoeven Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20230527164452.64797-2-contact@artur-rojek.eu Signed-off-by: John Paul Adrian Glaubitz commit 4bd04b2037423f11e6be03709d1fccdc6045c4a1 Author: Masahiro Yamada Date: Sun Feb 19 23:15:55 2023 +0900 sh: Remove compiler flag duplication Every compiler flag added by arch/sh/Makefile is passed to the compiler twice: $(KBUILD_CPPFLAGS) + $(KBUILD_CFLAGS) is used for compiling *.c $(KBUILD_CPPFLAGS) + $(KBUILD_AFLAGS) is used for compiling *.S Given the above, adding $(cflags-y) to all of KBUILD_{CPP/C/A}FLAGS ends up with duplication. Add -I options to $(KBUILD_CPPFLAGS), and the rest of $(cflags-y) to KBUILD_{C,A}FLAGS. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20230219141555.2308306-4-masahiroy@kernel.org Signed-off-by: John Paul Adrian Glaubitz commit 01658fe3d6c02992846a038c8111e70ace169295 Author: Masahiro Yamada Date: Sun Feb 19 23:15:54 2023 +0900 sh: Refactor header include path addition Shorten the code. No functional change intended. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20230219141555.2308306-3-masahiroy@kernel.org Signed-off-by: John Paul Adrian Glaubitz commit 9b4daf52b67b97ada589a0bd9bf127488f00925a Author: Masahiro Yamada Date: Sun Feb 19 23:15:53 2023 +0900 sh: Move build rule for cchips/hd6446x/ to arch/sh/Kbuild This is the last user of core-y in arch/sh. Use the standard obj-y syntax. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20230219141555.2308306-2-masahiroy@kernel.org Signed-off-by: John Paul Adrian Glaubitz commit 706afcea16cd83fecb7c2229ccc31bb237ffdbef Author: Masahiro Yamada Date: Sun Feb 19 23:15:52 2023 +0900 sh: Fix -Wmissing-include-dirs warnings for various platforms The 0day bot reports a lot of warnings (or errors due to CONFIG_WERROR) like this: cc1: error: arch/sh/include/mach-hp6xx: No such file or directory [-Werror=missing-include-dirs] Indeed, arch/sh/include/mach-hp6xx does not exist. While -Wmissing-include-dirs is only a W=1 warning, it may be annoying when CONFIG_BTRFS_FS is enabled because fs/btrfs/Makefile unconditionally adds this warning option. arch/sh/Makefile defines machdir-y for two purposes: - Build platform code in arch/sh/boards/mach-*/ - Add arch/sh/include/mach-*/ to the header search path For the latter, some platforms use arch/sh/include/mach-common/ instead of having its own arch/sh/include/mach-*/. Drop unneeded machdir-y to omit non-existing include directories. To build arch/sh/boards/mach-*/, use the standard obj-y syntax in arch/sh/boards/Makefile. Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202302190641.30VVXnPb-lkp@intel.com/ Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20230219141555.2308306-1-masahiroy@kernel.org Signed-off-by: John Paul Adrian Glaubitz commit 6cd06ab12d1afdab3847e7981f301bd0404aaa5c Author: Linus Torvalds Date: Wed Jul 5 09:33:31 2023 -0700 gup: make the stack expansion warning a bit more targeted I added a warning about about GUP no longer expanding the stack in commit a425ac5365f6 ("gup: add warning if some caller would seem to want stack expansion"), but didn't really expect anybody to hit it. And it's true that nobody seems to have hit a _real_ case yet, but we certainly have a number of reports of false positives. Which not only causes extra noise in itself, but might also end up hiding any real cases if they do exist. So let's tighten up the warning condition, and replace the simplistic vma = find_vma(mm, start); if (vma && (start < vma->vm_start)) { WARN_ON_ONCE(vma->vm_flags & VM_GROWSDOWN); with a vma = gup_vma_lookup(mm, start); helper function which works otherwise like just "vma_lookup()", but with some heuristics for when to warn about gup no longer causing stack expansion. In particular, don't just warn for "below the stack", but warn if it's _just_ below the stack (with "just below" arbitrarily defined as 64kB, because why not?). And rate-limit it to at most once per hour, which means that any false positives shouldn't completely hide subsequent reports, but we won't be flooding the logs about it either. The previous code triggered when some GUP user (chromium crashpad) accessing past the end of the previous vma, for example. That has never expanded the stack, it just causes GUP to return early, and as such we shouldn't be warning about it. This is still going trigger the randomized testers, but to mitigate the noise from that, use "dump_stack()" instead of "WARN_ON_ONCE()" to get the kernel call chain. We'll get the relevant information, but syzbot shouldn't get too upset about it. Also, don't even bother with the GROWSUP case, which would be using different heuristics entirely, but only happens on parisc. Reported-by: kernel test robot Reported-by: John Hubbard Reported-by: syzbot+6cf44e127903fdf9d929@syzkaller.appspotmail.com Signed-off-by: Linus Torvalds commit 479cdfe388a04a16fdd127f3e9e9e019e45e5573 Author: Sridhar Samudrala Date: Fri Jun 9 17:40:24 2023 -0700 ice: Fix tx queue rate limit when TCs are configured Configuring tx_maxrate via sysfs interface /sys/class/net/eth0/queues/tx-1/tx_maxrate was not working when TCs are configured because always main VSI was being used. Fix by using correct VSI in ice_set_tx_maxrate when TCs are configured. Fixes: 1ddef455f4a8 ("ice: Add NDO callback to set the maximum per-queue bitrate") Signed-off-by: Sridhar Samudrala Signed-off-by: Sudheer Mogilappagari Tested-by: Bharathi Sreenivas Signed-off-by: Tony Nguyen commit 5f16da6ee6ac32e6c8098bc4cfcc4f170694f9da Author: Sridhar Samudrala Date: Fri Jun 9 17:40:23 2023 -0700 ice: Fix max_rate check while configuring TX rate limits Remove incorrect check in ice_validate_mqprio_opt() that limits filter configuration when sum of max_rates of all TCs exceeds the link speed. The max rate of each TC is unrelated to value used by other TCs and is valid as long as it is less than link speed. Fixes: fbc7b27af0f9 ("ice: enable ndo_setup_tc support for mqprio_qdisc") Signed-off-by: Sridhar Samudrala Signed-off-by: Sudheer Mogilappagari Tested-by: Bharathi Sreenivas Signed-off-by: Tony Nguyen commit 31e9f406efae513156c129e9f7ad16b9f0ec7a65 Author: Maulik Shah Date: Mon Jul 3 14:50:26 2023 +0530 dt-bindings: soc: qcom: stats: Update maintainer email Replace my email. Cc: devicetree@vger.kernel.org Signed-off-by: Maulik Shah Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230703092026.4923-1-quic_mkshah@quicinc.com Signed-off-by: Rob Herring commit ad5d960168303a172b69bdf3708fecffb0810948 Author: Krzysztof Kozlowski Date: Sun Jul 2 20:23:08 2023 +0200 dt-bindings: cleanup DTS example whitespaces The DTS code coding style expects spaces around '=' sign. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Matthias Brugger Acked-by: Jonathan Cameron Reviewed-by: Conor Dooley Acked-by: Dmitry Baryshkov #display/msm Acked-by: Neil Armstrong Acked-by: Mike Leach Reviewed-by: Mathieu Poirier Acked-by: Vinod Koul Link: https://lore.kernel.org/r/20230702182308.7583-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit fddca7db4a4c17f7333793dfb5308d80c76d2896 Author: Steven Rostedt (Google) Date: Tue Jul 4 10:08:07 2023 -0400 tracing/boot: Test strscpy() against less than zero for error Instead of checking for -E2BIG, it is better to just check for less than zero of strscpy() for error. Testing for -E2BIG is not very robust, and the calling code does not really care about the error code, just that there was an error. One of the updates to convert strlcpy() to strscpy() had a v2 version that changed the test from testing against -E2BIG to less than zero, but I took the v1 version that still tested for -E2BIG. Link: https://lore.kernel.org/linux-trace-kernel/20230615180420.400769-1-azeemshaikh38@gmail.com/ Link: https://lore.kernel.org/linux-trace-kernel/20230704100807.707d1605@rorschach.local.home Cc: Mark Rutland Cc: Azeem Shaikh Cc: Kees Cook Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 6259f3443c6a376aa077816ac92e9ddeb0817d09 Author: Marc Zyngier Date: Mon Jul 3 19:31:26 2023 +0100 risc-v: Fix order of IPI enablement vs RCU startup Conor reports that risc-v tries to enable IPIs before telling the core code to enable RCU. With the introduction of the mapple tree as a backing store for the irq descriptors, this results in a very shouty boot sequence, as RCU is legitimately upset. Restore some sanity by moving the risc_ipi_enable() call after notify_cpu_starting(), which explicitly enables RCU on the calling CPU. Fixes: 832f15f42646 ("RISC-V: Treat IPIs as normal Linux IRQs") Reported-by: Conor Dooley Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230703-dupe-frying-79ae2ccf94eb@spud Cc: Anup Patel Cc: Palmer Dabbelt Cc: Linus Torvalds Tested-by: Conor Dooley Link: https://lore.kernel.org/r/20230703183126.1567625-1-maz@kernel.org Signed-off-by: Palmer Dabbelt commit 62ba41d2761206664a1fdc998051324457da2dd6 Author: John Hubbard Date: Mon Jul 3 12:00:44 2023 -0700 mm: riscv: fix an unsafe pte read in huge_pte_alloc() The WARN_ON_ONCE() statement in riscv's huge_pte_alloc() is susceptible to false positives, because the pte is read twice at the C language level, locklessly, within the same conditional statement. Depending on compiler behavior, this can lead to generated machine code that actually reads the pte just once, or twice. Reading twice will expose the code to changing pte values and cause incorrect behavior. In [1], similar code actually caused a kernel crash on 64-bit x86, when using clang to build the kernel, but only after the conversion from *pte reads, to ptep_get(pte). The latter uses READ_ONCE(), which forced a double read of *pte. Rather than waiting for the upcoming ptep_get() conversion, just convert this part of the code now, but in a way that avoids the above problem: take a single snapshot of the pte before using it in the WARN conditional. As expected, this preparatory step does not actually change the generated code ("make mm/hugetlbpage.s"), on riscv64, when using a gcc 12.2 cross compiler. [1] https://lore.kernel.org/20230630013203.1955064-1-jhubbard@nvidia.com Suggested-by: James Houghton Cc: Ryan Roberts Signed-off-by: John Hubbard Reviewed-by: Andrew Jones Reviewed-by: Ryan Roberts Link: https://lore.kernel.org/r/20230703190044.311730-1-jhubbard@nvidia.com Signed-off-by: Palmer Dabbelt commit aeb71e42caae2031ec849a858080d81462cacca9 Author: Conor Dooley Date: Sun Jul 2 00:10:01 2023 +0100 dt-bindings: riscv: deprecate riscv,isa intro ===== When the RISC-V dt-bindings were accepted upstream in Linux, the base ISA etc had yet to be ratified. By the ratification of the base ISA, incompatible changes had snuck into the specifications - for example the Zicsr and Zifencei extensions were spun out of the base ISA. Fast forward to today, and the reason for this patch. Currently the riscv,isa dt property permits only a specific subset of the ISA string - in particular it excludes version numbering. With the current constraints, it is not possible to discern whether "rv64i" means that the hart supports the fence.i instruction, for example. Future systems may choose to implement their own instruction fencing, perhaps using a vendor extension, or they may not implement the optional counter extensions. Software needs a way to determine this. versioning schemes ================== "Use the extension versions that are described in the ISA manual" you may say, and it's not like this has not been considered. Firstly, software that parses the riscv,isa property at runtime will need to contain a lookup table of some sort that maps arbitrary versions to versions it understands. There is not a consistent application of version number applied to extensions, with a higgledy-piggledy collection of tags, "bare" and versioned documents awaiting the reader on the "recently ratified extensions" page: https://wiki.riscv.org/display/HOME/Recently+Ratified+Extensions As an aside, and this is reflected in the patch too, since many extensions have yet to appear in a release of the ISA specs, they are defined by commits in their respective "working draft" repositories. Secondly, there is an issue of backwards compatibility, whereby allowing numbers in the ISA string, some parsers may be broken. This would require an additional property to be created to even use the versions in this manner. ~boolean properties~ string array property ========================================== If a new property is needed, the whole approach may as well be looked at from the bottom up. A string with limited character choices etc is hardly the best approach for communicating extension information to software. Switching to using properties that are defined on a per extension basis, allows us to define explicit meanings for the DT representation of each extension - rather than the current situation where different operating systems or other bits of software may impart different meanings to characters in the string. Clearly the best source of meanings is the specifications themselves, this just provides us the ability to choose at what point in time the meaning is set. If an extension changes incompatibility in the future, a new property will be required. Off-list, some of the RVI folks have committed to shoring up the wording in either the ISA specifications, the riscv-isa-manual or so that in the future, modifications to and additions or removals of features will require a new extension. Codifying that assertion somewhere would make it quite unlikely that compatibility would be broken, but we have the tools required to deal with it, if & when it crops up. It is in our collective interest, as consumers of extension meanings, to define a scheme that enforces compatibility. The use of individual elements, rather than a single string, will also permit validation that the properties have a meaning, as well as potentially reject mutually exclusive combinations, or enforce dependencies between extensions. That would not have be possible with the current dt-schema infrastructure for arbitrary strings, as we would need to add a riscv,isa parser to dt-validate! That's not implemented in this patch, but rather left as future work (for the brave, or the foolish). parser simplicity ================= Many systems that parse DT at runtime already implement an function that can check for the presence of a string in an array of string, as it is similar to the process for parsing a list of compatible strings, so a bunch of new, custom, DT parsing should not be needed. Getting rid of "riscv,isa" parsing would be a nice simplification, but unfortunately for backwards compatibility with old dtbs, existing parsers may not be removable - which may greatly simplify dt parsing code. In Linux, for example, checking for whether a hart supports an extension becomes as simple as: of_property_match_string(node, "riscv,isa-extensions", "zicbom") vendor extensions ================= Compared to riscv,isa, this proposed scheme promotes vendor extensions, oft touted as the strength of RISC-V, to first-class citizens. At present, extensions are defined as meaning what the RISC-V ISA specifications say they do. There is no realistic way of using that interface to provide cross-platform definitions for what vendor extensions mean. Vendor extensions may also have even less consistency than RVI do in terms of versioning, or no care about backwards compatibility. The new property allows us to assign explicit meanings on a per vendor extension basis, backed up by a description of their meanings. fin === Create a new file to store the extension meanings and a new riscv,isa-base property to replace the aspect of riscv,isa that is not represented by the new property - the base ISA implemented by a hart. As a starting point, add properties for extensions currently used in Linux. Finally, mark riscv,isa as deprecated, as removing support for it in existing programs would be an ABI break. CC: Palmer Dabbelt CC: Paul Walmsley CC: Rob Herring CC: Krzysztof Kozlowski CC: Alistair Francis CC: Andrew Jones CC: Anup Patel CC: Atish Patra CC: Jessica Clarke CC: Rick Chen CC: Leo CC: Oleksii CC: linux-riscv@lists.infradead.org CC: qemu-riscv@nongnu.org CC: u-boot@lists.denx.de CC: devicetree@vger.kernel.org CC: linux-kernel@vger.kernel.org Reviewed-by: Palmer Dabbelt Acked-by: Palmer Dabbelt Reviewed-by: Rob Herring Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20230702-eats-scorebook-c951f170d29f@spud Signed-off-by: Palmer Dabbelt commit c03226ba15fe3c42d13907ec7d8536396602557b Author: Srinivas Kandagatla Date: Wed Jul 5 13:57:23 2023 +0100 ASoC: codecs: wcd938x: fix dB range for HPHL and HPHR dB range for HPHL and HPHR gains are from +6dB to -30dB in steps of 1.5dB with register values range from 0 to 24. Current code maps these dB ranges incorrectly, fix them to allow proper volume setting. Fixes: e8ba1e05bdc0 ("ASoC: codecs: wcd938x: add basic controls") Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230705125723.40464-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit 4f3fcf5f6dc8ab561e152c8747fd7e502b32266c Author: Srinivas Kandagatla Date: Wed Jul 5 13:48:50 2023 +0100 ASoC: qcom: q6afe-dai: fix Display Port Playback stream name With recent changes to add more display ports did not change the Stream name in q6afe-dai. This results in below error "ASoC: Failed to add route DISPLAY_PORT_RX -> Display Port Playback(*)" and sound card fails to probe. Fix this by adding correct stream name. Fixes: 90848a2557fe ("ASoC: qcom: q6dsp: add support to more display ports") Reported-by: Amit Pundir Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230705124850.40069-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit 931a2ca6a5ba4bfa6062aa9475d4e6a835d75e83 Author: Arnd Bergmann Date: Fri Jun 23 17:21:55 2023 +0200 arm64: ftrace: fix build error with CONFIG_FUNCTION_GRAPH_TRACER=n It appears that a merge conflict ended up hiding a newly added constant in some configurations: arch/arm64/kernel/entry-ftrace.S: Assembler messages: arch/arm64/kernel/entry-ftrace.S:59: Error: undefined symbol FTRACE_OPS_DIRECT_CALL used as an immediate value FTRACE_OPS_DIRECT_CALL is still used when CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS is enabled, even if CONFIG_FUNCTION_GRAPH_TRACER is disabled, so change the ifdef accordingly. Link: https://lkml.kernel.org/r/20230623152204.2216297-1-arnd@kernel.org Cc: Will Deacon Cc: Mark Rutland Cc: Donglin Peng Fixes: 3646970322464 ("arm64: ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL") Signed-off-by: Arnd Bergmann Acked-by: Florent Revest Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap # build-tested Acked-by: Catalin Marinas Signed-off-by: Steven Rostedt (Google) commit 02b0095e2fbbc060560c1065f86a211d91e27b26 Author: Mateusz Stachyra Date: Tue Jul 4 12:27:06 2023 +0200 tracing: Fix null pointer dereference in tracing_err_log_open() Fix an issue in function 'tracing_err_log_open'. The function doesn't call 'seq_open' if the file is opened only with write permissions, which results in 'file->private_data' being left as null. If we then use 'lseek' on that opened file, 'seq_lseek' dereferences 'file->private_data' in 'mutex_lock(&m->lock)', resulting in a kernel panic. Writing to this node requires root privileges, therefore this bug has very little security impact. Tracefs node: /sys/kernel/tracing/error_log Example Kernel panic: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 Call trace: mutex_lock+0x30/0x110 seq_lseek+0x34/0xb8 __arm64_sys_lseek+0x6c/0xb8 invoke_syscall+0x58/0x13c el0_svc_common+0xc4/0x10c do_el0_svc+0x24/0x98 el0_svc+0x24/0x88 el0t_64_sync_handler+0x84/0xe4 el0t_64_sync+0x1b4/0x1b8 Code: d503201f aa0803e0 aa1f03e1 aa0103e9 (c8e97d02) ---[ end trace 561d1b49c12cf8a5 ]--- Kernel panic - not syncing: Oops: Fatal exception Link: https://lore.kernel.org/linux-trace-kernel/20230703155237eucms1p4dfb6a19caa14c79eb6c823d127b39024@eucms1p4 Link: https://lore.kernel.org/linux-trace-kernel/20230704102706eucms1p30d7ecdcc287f46ad67679fc8491b2e0f@eucms1p3 Cc: stable@vger.kernel.org Fixes: 8a062902be725 ("tracing: Add tracing error log") Signed-off-by: Mateusz Stachyra Suggested-by: Steven Rostedt Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 515ad530795c118f012539ed76d02bacfd426d89 Author: Thadeu Lima de Souza Cascardo Date: Wed Jul 5 09:12:55 2023 -0300 netfilter: nf_tables: do not ignore genmask when looking up chain by id When adding a rule to a chain referring to its ID, if that chain had been deleted on the same batch, the rule might end up referring to a deleted chain. This will lead to a WARNING like following: [ 33.098431] ------------[ cut here ]------------ [ 33.098678] WARNING: CPU: 5 PID: 69 at net/netfilter/nf_tables_api.c:2037 nf_tables_chain_destroy+0x23d/0x260 [ 33.099217] Modules linked in: [ 33.099388] CPU: 5 PID: 69 Comm: kworker/5:1 Not tainted 6.4.0+ #409 [ 33.099726] Workqueue: events nf_tables_trans_destroy_work [ 33.100018] RIP: 0010:nf_tables_chain_destroy+0x23d/0x260 [ 33.100306] Code: 8b 7c 24 68 e8 64 9c ed fe 4c 89 e7 e8 5c 9c ed fe 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7 c3 cc cc cc cc <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7 [ 33.101271] RSP: 0018:ffffc900004ffc48 EFLAGS: 00010202 [ 33.101546] RAX: 0000000000000001 RBX: ffff888006fc0a28 RCX: 0000000000000000 [ 33.101920] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 33.102649] RBP: ffffc900004ffc78 R08: 0000000000000000 R09: 0000000000000000 [ 33.103018] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880135ef500 [ 33.103385] R13: 0000000000000000 R14: dead000000000122 R15: ffff888006fc0a10 [ 33.103762] FS: 0000000000000000(0000) GS:ffff888024c80000(0000) knlGS:0000000000000000 [ 33.104184] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.104493] CR2: 00007fe863b56a50 CR3: 00000000124b0001 CR4: 0000000000770ee0 [ 33.104872] PKRU: 55555554 [ 33.104999] Call Trace: [ 33.105113] [ 33.105214] ? show_regs+0x72/0x90 [ 33.105371] ? __warn+0xa5/0x210 [ 33.105520] ? nf_tables_chain_destroy+0x23d/0x260 [ 33.105732] ? report_bug+0x1f2/0x200 [ 33.105902] ? handle_bug+0x46/0x90 [ 33.106546] ? exc_invalid_op+0x19/0x50 [ 33.106762] ? asm_exc_invalid_op+0x1b/0x20 [ 33.106995] ? nf_tables_chain_destroy+0x23d/0x260 [ 33.107249] ? nf_tables_chain_destroy+0x30/0x260 [ 33.107506] nf_tables_trans_destroy_work+0x669/0x680 [ 33.107782] ? mark_held_locks+0x28/0xa0 [ 33.107996] ? __pfx_nf_tables_trans_destroy_work+0x10/0x10 [ 33.108294] ? _raw_spin_unlock_irq+0x28/0x70 [ 33.108538] process_one_work+0x68c/0xb70 [ 33.108755] ? lock_acquire+0x17f/0x420 [ 33.108977] ? __pfx_process_one_work+0x10/0x10 [ 33.109218] ? do_raw_spin_lock+0x128/0x1d0 [ 33.109435] ? _raw_spin_lock_irq+0x71/0x80 [ 33.109634] worker_thread+0x2bd/0x700 [ 33.109817] ? __pfx_worker_thread+0x10/0x10 [ 33.110254] kthread+0x18b/0x1d0 [ 33.110410] ? __pfx_kthread+0x10/0x10 [ 33.110581] ret_from_fork+0x29/0x50 [ 33.110757] [ 33.110866] irq event stamp: 1651 [ 33.111017] hardirqs last enabled at (1659): [] __up_console_sem+0x79/0xa0 [ 33.111379] hardirqs last disabled at (1666): [] __up_console_sem+0x5e/0xa0 [ 33.111740] softirqs last enabled at (1616): [] __irq_exit_rcu+0x9e/0xe0 [ 33.112094] softirqs last disabled at (1367): [] __irq_exit_rcu+0x9e/0xe0 [ 33.112453] ---[ end trace 0000000000000000 ]--- This is due to the nft_chain_lookup_byid ignoring the genmask. After this change, adding the new rule will fail as it will not find the chain. Fixes: 837830a4b439 ("netfilter: nf_tables: add NFTA_RULE_CHAIN_ID attribute") Cc: stable@vger.kernel.org Reported-by: Mingi Cho of Theori working with ZDI Signed-off-by: Thadeu Lima de Souza Cascardo Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit eaf9e7192ec9af2fbf1b6eb2299dd0feca6c5f7e Author: Florian Westphal Date: Tue Jul 4 12:25:23 2023 +0200 netfilter: conntrack: don't fold port numbers into addresses before hashing Originally this used jhash2() over tuple and folded the zone id, the pernet hash value, destination port and l4 protocol number into the 32bit seed value. When the switch to siphash was done, I used an on-stack temporary buffer to build a suitable key to be hashed via siphash(). But this showed up as performance regression, so I got rid of the temporary copy and collected to-be-hashed data in 4 u64 variables. This makes it easy to build tuples that produce the same hash, which isn't desirable even though chain lengths are limited. Switch back to plain siphash, but just like with jhash2(), take advantage of the fact that most of to-be-hashed data is already in a suitable order. Use an empty struct as annotation in 'struct nf_conntrack_tuple' to mark last member that can be used as hash input. The only remaining data that isn't present in the tuple structure are the zone identifier and the pernet hash: fold those into the key. Fixes: d2c806abcf0b ("netfilter: conntrack: use siphash_4u64") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 6eef7a2b933885a17679eb8ed0796ddf0ee5309b Author: Florent Revest Date: Mon Jul 3 16:52:16 2023 +0200 netfilter: conntrack: Avoid nf_ct_helper_hash uses after free If nf_conntrack_init_start() fails (for example due to a register_nf_conntrack_bpf() failure), the nf_conntrack_helper_fini() clean-up path frees the nf_ct_helper_hash map. When built with NF_CONNTRACK=y, further netfilter modules (e.g: netfilter_conntrack_ftp) can still be loaded and call nf_conntrack_helpers_register(), independently of whether nf_conntrack initialized correctly. This accesses the nf_ct_helper_hash dangling pointer and causes a uaf, possibly leading to random memory corruption. This patch guards nf_conntrack_helper_register() from accessing a freed or uninitialized nf_ct_helper_hash pointer and fixes possible uses-after-free when loading a conntrack module. Cc: stable@vger.kernel.org Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure") Signed-off-by: Florent Revest Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 8a9dc07ba92497a81f1ff65d25c2ba7b6f9a8bdc Author: Florian Westphal Date: Mon Jul 3 13:43:18 2023 +0200 netfilter: conntrack: gre: don't set assured flag for clash entries Now that conntrack core is allowd to insert clashing entries, make sure GRE won't set assured flag on NAT_CLASH entries, just like UDP. Doing so prevents early_drop logic for these entries. Fixes: d671fd82eaa9 ("netfilter: conntrack: allow insertion clash of gre protocol") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 1689f25924ada8fe14a4a82c38925d04994c7142 Author: Pablo Neira Ayuso Date: Wed Jun 28 16:24:27 2023 +0200 netfilter: nf_tables: report use refcount overflow Overflow use refcount checks are not complete. Add helper function to deal with object reference counter tracking. Report -EMFILE in case UINT_MAX is reached. nft_use_dec() splats in case that reference counter underflows, which should not ever happen. Add nft_use_inc_restore() and nft_use_dec_restore() which are used to restore reference counter from error and abort paths. Use u32 in nft_flowtable and nft_object since helper functions cannot work on bitfields. Remove the few early incomplete checks now that the helper functions are in place and used to check for refcount overflow. Fixes: 96518518cc41 ("netfilter: add nftables") Signed-off-by: Pablo Neira Ayuso commit bf62eec5cdecbe7eeab02407da98f36cd7b1dea7 Author: Shuming Fan Date: Wed Jul 5 12:29:14 2023 +0800 ASoC: rt5645: check return value after reading device id If the I2C controller encounters some problems like timed-out, the codec driver will report the error code for the first read. Signed-off-by: Shuming Fan Link: https://lore.kernel.org/r/20230705042915.24932-1-shumingf@realtek.com Signed-off-by: Mark Brown commit d9ba2975e98a4bec0a9f8d4be4c1de8883fccb71 Author: Nathan Chancellor Date: Mon Jul 3 14:43:15 2023 -0700 ASoC: cs35l45: Select REGMAP_IRQ After commit 6085f9e6dc19 ("ASoC: cs35l45: IRQ support"), without any other configuration that selects CONFIG_REGMAP_IRQ, modpost errors out with: ERROR: modpost: "regmap_irq_get_virq" [sound/soc/codecs/snd-soc-cs35l45.ko] undefined! ERROR: modpost: "devm_regmap_add_irq_chip" [sound/soc/codecs/snd-soc-cs35l45.ko] undefined! Add the Kconfig selection to ensure these functions get built and included, which resolves the build failure. Cc: stable@vger.kernel.org Fixes: 6085f9e6dc19 ("ASoC: cs35l45: IRQ support") Reported-by: Marcus Seyfarth Closes: https://github.com/ClangBuiltLinux/linux/issues/1882 Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20230703-cs35l45-select-regmap_irq-v1-1-37d7e838b614@kernel.org Signed-off-by: Mark Brown commit 7f34e01f77f811ecb2ef83e60301b38cf89af466 Author: Karol Wachowski Date: Mon Jul 3 10:07:25 2023 +0200 accel/ivpu: Clear specific interrupt status bits on C0 MTL C0 stepping fixed issue related to butrress interrupt status clearing, to clear an interrupt status it is required to write 1 to specific status bit field. This allows to execute read, modify and write routine. Writing 0 will not clear the interrupt and will cause interrupt storm. Fixes: 35b137630f08 ("accel/ivpu: Introduce a new DRM driver for Intel VPU") Cc: stable@vger.kernel.org # 6.3.x Signed-off-by: Karol Wachowski Reviewed-by: Jacek Lawrynowicz Signed-off-by: Stanislaw Gruszka Link: https://patchwork.freedesktop.org/patch/msgid/20230703080725.2065635-2-stanislaw.gruszka@linux.intel.com commit 020b527b556a35cf636015c1c3cbdfe7c7acd5f0 Author: Karol Wachowski Date: Mon Jul 3 10:07:24 2023 +0200 accel/ivpu: Fix VPU register access in irq disable Incorrect REGB_WR32() macro was used to access VPUIP register. Use correct REGV_WR32(). Fixes: 35b137630f08 ("accel/ivpu: Introduce a new DRM driver for Intel VPU") Cc: stable@vger.kernel.org # 6.3.x Signed-off-by: Karol Wachowski Reviewed-by: Jacek Lawrynowicz Signed-off-by: Stanislaw Gruszka Link: https://patchwork.freedesktop.org/patch/msgid/20230703080725.2065635-1-stanislaw.gruszka@linux.intel.com commit c451410ca7e3d8eeb31d141fc20c200e21754ba4 Merge: 80de809bd35e2 61d9658050260 Author: David S. Miller Date: Wed Jul 5 10:51:14 2023 +0100 Merge branch 'mptcp-fixes' Matthieu Baerts says: ==================== mptcp: fixes for v6.5 Here is a first batch of fixes for v6.5 and older. The fixes are not linked to each others. Patch 1 ensures subflows are unhashed before cleaning the backlog to avoid races. This fixes another recent fix from v6.4. Patch 2 does not rely on implicit state check in mptcp_listen() to avoid races when receiving an MP_FASTCLOSE. A regression from v5.17. The rest fixes issues in the selftests. Patch 3 makes sure errors when setting up the environment are no longer ignored. For v5.17+. Patch 4 uses 'iptables-legacy' if available to be able to run on older kernels. A fix for v5.13 and newer. Patch 5 catches errors when issues are detected with packet marks. Also for v5.13+. Patch 6 uses the correct variable instead of an undefined one. Even if there was no visible impact, it can help to find regressions later. An issue visible in v5.19+. Patch 7 makes sure errors with some sub-tests are reported to have the selftest marked as failed as expected. Also for v5.19+. Patch 8 adds a kernel config that is required to execute MPTCP selftests. It is valid for v5.9+. Patch 9 fixes issues when validating the userspace path-manager with 32-bit arch, an issue affecting v5.19+. ==================== Signed-off-by: Matthieu Baerts commit 61d9658050260dbcbf9055479b7ac5bbbe1e8831 Author: Matthieu Baerts Date: Tue Jul 4 22:44:41 2023 +0200 selftests: mptcp: pm_nl_ctl: fix 32-bit support When using pm_nl_ctl to validate userspace path-manager's behaviours, it was failing on 32-bit architectures ~half of the time. pm_nl_ctl was not reporting any error but the command was not doing what it was expected to do. As a result, the expected linked event was not triggered after and the test failed. This is due to the fact the token given in argument to the application was parsed as an integer with atoi(): in a 32-bit arch, if the number was bigger than INT_MAX, 2147483647 was used instead. This can simply be fixed by using strtoul() instead of atoi(). The errors have been seen "by chance" when manually looking at the results from LKFT. Fixes: 9a0b36509df0 ("selftests: mptcp: support MPTCP_PM_CMD_ANNOUNCE") Cc: stable@vger.kernel.org Fixes: ecd2a77d672f ("selftests: mptcp: support MPTCP_PM_CMD_REMOVE") Fixes: cf8d0a6dfd64 ("selftests: mptcp: support MPTCP_PM_CMD_SUBFLOW_CREATE") Fixes: 57cc361b8d38 ("selftests: mptcp: support MPTCP_PM_CMD_SUBFLOW_DESTROY") Fixes: ca188a25d43f ("selftests: mptcp: userspace PM support for MP_PRIO signals") Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit 6c8880fcaa5c45355179b759c1d11737775e31fc Author: Matthieu Baerts Date: Tue Jul 4 22:44:40 2023 +0200 selftests: mptcp: depend on SYN_COOKIES MPTCP selftests are using TCP SYN Cookies for quite a while now, since v5.9. Some CIs don't have this config option enabled and this is causing issues in the tests: # ns1 MPTCP -> ns1 (10.0.1.1:10000 ) MPTCP (duration 167ms) sysctl: cannot stat /proc/sys/net/ipv4/tcp_syncookies: No such file or directory # [ OK ]./mptcp_connect.sh: line 554: [: -eq: unary operator expected There is no impact in the results but the test is not doing what it is supposed to do. Fixes: fed61c4b584c ("selftests: mptcp: make 2nd net namespace use tcp syn cookies unconditionally") Cc: stable@vger.kernel.org Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit 966c6c3adfb1257ea8a839cdfad2b74092cc5532 Author: Matthieu Baerts Date: Tue Jul 4 22:44:39 2023 +0200 selftests: mptcp: userspace_pm: report errors with 'remove' tests A message was mentioning an issue with the "remove" tests but the selftest was not marked as failed. Directly exit with an error like it is done everywhere else in this selftest. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 259a834fadda ("selftests: mptcp: functional tests for the userspace PM type") Cc: stable@vger.kernel.org Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit d8566d0e03922217f70d9be2d401fcb860986374 Author: Matthieu Baerts Date: Tue Jul 4 22:44:38 2023 +0200 selftests: mptcp: userspace_pm: use correct server port "server4_port" variable is not set but "app4_port" is the server port in v4 and the correct variable name to use. The port is optional so there was no visible impact. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: ca188a25d43f ("selftests: mptcp: userspace PM support for MP_PRIO signals") Cc: stable@vger.kernel.org Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit 9ac4c28eb70cd5ea5472a5e1c495dcdd597d4597 Author: Matthieu Baerts Date: Tue Jul 4 22:44:37 2023 +0200 selftests: mptcp: sockopt: return error if wrong mark When an error was detected when checking the marks, a message was correctly printed mentioning the error but followed by another one saying everything was OK and the selftest was not marked as failed as expected. Now the 'ret' variable is directly set to 1 in order to make sure the exit is done with an error, similar to what is done in other functions. While at it, the error is correctly propagated to the caller. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: dc65fe82fb07 ("selftests: mptcp: add packet mark test case") Cc: stable@vger.kernel.org Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit a5a5990c099dd354e05e89ee77cd2dbf6655d4a1 Author: Matthieu Baerts Date: Tue Jul 4 22:44:36 2023 +0200 selftests: mptcp: sockopt: use 'iptables-legacy' if available IPTables commands using 'iptables-nft' fail on old kernels, at least on v5.15 because it doesn't see the default IPTables chains: $ iptables -L iptables/1.8.2 Failed to initialize nft: Protocol not supported As a first step before switching to NFTables, we can use iptables-legacy if available. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: dc65fe82fb07 ("selftests: mptcp: add packet mark test case") Cc: stable@vger.kernel.org Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit 221e4550454a822f9a11834e30694c7d1d65747c Author: Matthieu Baerts Date: Tue Jul 4 22:44:35 2023 +0200 selftests: mptcp: connect: fail if nft supposed to work In case of "external" errors when preparing the environment for the TProxy tests, the subtests were marked as skipped. This is fine but it means these errors are ignored. On MPTCP Public CI, we do want to catch such issues and mark the selftest as failed if there are such issues. We can then use mptcp_lib_fail_if_expected_feature() helper that has been recently added to fail if needed. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 5fb62e9cd3ad ("selftests: mptcp: add tproxy test case") Cc: stable@vger.kernel.org Acked-by: Paolo Abeni Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit 0226436acf2495cde4b93e7400e5a87305c26054 Author: Paolo Abeni Date: Tue Jul 4 22:44:34 2023 +0200 mptcp: do not rely on implicit state check in mptcp_listen() Since the blamed commit, closing the first subflow resets the first subflow socket state to SS_UNCONNECTED. The current mptcp listen implementation relies only on such state to prevent touching not-fully-disconnected sockets. Incoming mptcp fastclose (or paired endpoint removal) unconditionally closes the first subflow. All the above allows an incoming fastclose followed by a listen() call to successfully race with a blocking recvmsg(), potentially causing the latter to hit a divide by zero bug in cleanup_rbuf/__tcp_select_window(). Address the issue explicitly checking the msk socket state in mptcp_listen(). An alternative solution would be moving the first subflow socket state update into mptcp_disconnect(), but in the long term the first subflow socket should be removed: better avoid relaying on it for internal consistency check. Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation") Cc: stable@vger.kernel.org Reported-by: Christoph Paasch Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/414 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit 3fffa15bfef48b0ad6424779c03e68ae8ace5acb Author: Paolo Abeni Date: Tue Jul 4 22:44:33 2023 +0200 mptcp: ensure subflow is unhashed before cleaning the backlog While tacking care of the mptcp-level listener I unintentionally moved the subflow level unhash after the subflow listener backlog cleanup. That could cause some nasty race and makes the code harder to read. Address the issue restoring the proper order of operations. Fixes: 57fc0f1ceaa4 ("mptcp: ensure listener is unhashed before updating the sk status") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: David S. Miller commit 5284876d82da4453df0e21f1d243b026281a6558 Merge: 72cea3a3175b5 983b9180db962 Author: Takashi Iwai Date: Wed Jul 5 11:50:51 2023 +0200 Merge branch 'topic/midi20' into for-linus Pull yet more a typo fix in the converter code. Signed-off-by: Takashi Iwai commit 983b9180db96255183c30f69fe43c0db75bf8502 Author: Minjie Du Date: Wed Jul 5 17:35:45 2023 +0800 ALSA: seq: ump: fix typo in system_2p_ev_to_ump_midi1() Fix data->system.parm2 typo. Fixes: e9e02819a98a ("ALSA: seq: Automatic conversion of UMP events") Signed-off-by: Minjie Du Link: https://lore.kernel.org/r/20230705093545.14695-1-duminjie@vivo.com Signed-off-by: Takashi Iwai commit 80de809bd35e2a8999edf9f5aaa2d8de18921f11 Author: Thorsten Winkler Date: Tue Jul 4 16:41:21 2023 +0200 s390/qeth: Fix vipa deletion Change boolean parameter of function "qeth_l3_vipa_store" inside the "qeth_l3_dev_vipa_del4_store" function from "true" to "false" because "true" is used for adding a virtual ip address and "false" for deleting. Fixes: 2390166a6b45 ("s390/qeth: clean up L3 sysfs code") Reviewed-by: Alexandra Winter Reviewed-by: Wenjia Zhang Signed-off-by: Thorsten Winkler Signed-off-by: Alexandra Winter Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit fe3e0a13e597c1c8617814bf9b42ab732db5c26e Author: Juergen Gross Date: Mon Jul 3 15:00:32 2023 +0200 x86/xen: Fix secondary processors' FPU initialization Moving the call of fpu__init_cpu() from cpu_init() to start_secondary() broke Xen PV guests, as those don't call start_secondary() for APs. Call fpu__init_cpu() in Xen's cpu_bringup(), which is the Xen PV replacement of start_secondary(). Fixes: b81fac906a8f ("x86/fpu: Move FPU initialization into arch_cpu_finalize_init()") Signed-off-by: Juergen Gross Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Boris Ostrovsky Acked-by: Thomas Gleixner Link: https://lore.kernel.org/r/20230703130032.22916-1-jgross@suse.com commit d3dccb0a487d065ce097e565d9ca8ae85d892a55 Author: David Howells Date: Tue Jul 4 16:56:24 2023 +0100 crypto: af_alg - Fix merging of written data into spliced pages af_alg_sendmsg() takes data-to-be-copied that's provided by write(), send(), sendmsg() and similar into pages that it allocates and will merge new data into the last page in the list, based on the value of ctx->merge. Now that af_alg_sendmsg() accepts MSG_SPLICE_PAGES, it adds spliced pages directly into the list and then incorrectly appends data to them if there's space left because ctx->merge says that it can. This was cleared by af_alg_sendpage(), but that got lost. Fix this by skipping the merge if MSG_SPLICE_PAGES is specified and clearing ctx->merge after MSG_SPLICE_PAGES has added stuff to the list. Fixes: bf63e250c4b1 ("crypto: af_alg: Support MSG_SPLICE_PAGES") Reported-by: Ondrej Mosnáček Link: https://lore.kernel.org/r/CAAUqJDvFuvms55Td1c=XKv6epfRnnP78438nZQ-JKyuCptGBiQ@mail.gmail.com/ Signed-off-by: David Howells cc: Herbert Xu cc: Paolo Abeni cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: linux-crypto@vger.kernel.org cc: netdev@vger.kernel.org Signed-off-by: Herbert Xu commit d528014517f2b0531862c02865b9d4c908019dc4 Author: Linus Torvalds Date: Tue Jul 4 15:05:12 2023 -0700 Revert ".gitignore: ignore *.cover and *.mbx" This reverts commit 534066a983df0935847061c844eb178f8a53a9e7. It's actively detrimental in that it hides files that shouldn't be hidden. If I have some b4 mbx file in my git directory, it either was already applied with "git am" and is now stale, or maybe it's waiting for that to happen. In neither case is "ignore it" the right option. Signed-off-by: Linus Torvalds commit 04f2933d375e3f90d4435b7b518d3065afd1fa25 Merge: 03275585cabd0 b5ec6fd286dfa Author: Linus Torvalds Date: Tue Jul 4 13:50:38 2023 -0700 Merge tag 'core_guards_for_6.5_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peterz/queue Pull scope-based resource management infrastructure from Peter Zijlstra: "These are the first few patches in the Scope-based Resource Management series that introduce the infrastructure but not any conversions as of yet. Adding the infrastructure now allows multiple people to start using them. Of note is that Sparse will need some work since it doesn't yet understand this attribute and might have decl-after-stmt issues" * tag 'core_guards_for_6.5_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peterz/queue: kbuild: Drop -Wdeclaration-after-statement locking: Introduce __cleanup() based infrastructure apparmor: Free up __cleanup() name dmaengine: ioat: Free up __cleanup() name commit 03275585cabd0240944f19f33d7584a1b099a3a8 Author: David Howells Date: Tue Jul 4 20:22:15 2023 +0100 afs: Fix accidental truncation when storing data When an AFS FS.StoreData RPC call is made, amongst other things it is given the resultant file size to be. On the server, this is processed by truncating the file to new size and then writing the data. Now, kafs has a lock (vnode->io_lock) that serves to serialise operations against a specific vnode (ie. inode), but the parameters for the op are set before the lock is taken. This allows two writebacks (say sync and kswapd) to race - and if writes are ongoing the writeback for a later write could occur before the writeback for an earlier one if the latter gets interrupted. Note that afs_writepages() cannot take i_mutex and only takes a shared lock on vnode->validate_lock. Also note that the server does the truncation and the write inside a lock, so there's no problem at that end. Fix this by moving the calculation for the proposed new i_size inside the vnode->io_lock. Also reset the iterator (which we might have read from) and update the mtime setting there. Fixes: bd80d8a80e12 ("afs: Use ITER_XARRAY for writing") Reported-by: Marc Dionne Signed-off-by: David Howells Reviewed-by: Jeffrey Altman Reviewed-by: Marc Dionne cc: linux-afs@lists.infradead.org cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/3526895.1687960024@warthog.procyon.org.uk/ Signed-off-by: Linus Torvalds commit 14bb236b29922c4f57d8c05bfdbcb82677f917c9 Author: Hariprasad Kelam Date: Tue Jul 4 09:56:53 2023 +0530 octeontx-af: fix hardware timestamp configuration MAC block on CN10K (RPM) supports hardware timestamp configuration. The previous patch which added timestamp configuration support has a bug. Though the netdev driver requests to disable timestamp configuration, the driver is always enabling it. This patch fixes the same. Fixes: d1489208681d ("octeontx2-af: cn10k: RPM hardware timestamp configuration") Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Goutham Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 538140ca602b1c5f3870bef051c93b491045f70a Merge: 94c76955e86a5 7fb7998b599a2 Author: Linus Torvalds Date: Tue Jul 4 11:52:54 2023 -0700 Merge tag 'ovl-update-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs Pull more overlayfs updates from Amir Goldstein: "This is a small 'move code around' followup by Christian to his work on porting overlayfs to the new mount api for 6.5. It makes things a bit cleaner and simpler for the next development cycle when I hand overlayfs back over to Miklos" * tag 'ovl-update-6.5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs: ovl: move all parameter handling into params.{c,h} commit 94c76955e86a5a4f16a1d690b66dcc268c156e6a Merge: ccf46d8531832 432928c937795 Author: Linus Torvalds Date: Tue Jul 4 11:45:16 2023 -0700 Merge tag 'gfs2-v6.4-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Move the freeze/thaw logic from glock callback context to process / worker thread context to prevent deadlocks - Fix a quota reference couting bug in do_qc() - Carry on deallocating inodes even when gfs2_rindex_update() fails - Retry filesystem-internal reads when they are interruped by a signal - Eliminate kmap_atomic() in favor of kmap_local_page() / memcpy_{from,to}_page() - Get rid of noop_direct_IO - And a few more minor fixes and cleanups * tag 'gfs2-v6.4-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: (23 commits) gfs2: Add quota_change type gfs2: Use memcpy_{from,to}_page where appropriate gfs2: Convert remaining kmap_atomic calls to kmap_local_page gfs2: Replace deprecated kmap_atomic with kmap_local_page gfs: Get rid of unnucessary locking in inode_go_dump gfs2: gfs2_freeze_lock_shared cleanup gfs2: Replace sd_freeze_state with SDF_FROZEN flag gfs2: Rework freeze / thaw logic gfs2: Rename SDF_{FS_FROZEN => FREEZE_INITIATOR} gfs2: Reconfiguring frozen filesystem already rejected gfs2: Rename gfs2_freeze_lock{ => _shared } gfs2: Rename the {freeze,thaw}_super callbacks gfs2: Rename remaining "transaction" glock references gfs2: retry interrupted internal reads gfs2: Fix possible data races in gfs2_show_options() gfs2: Fix duplicate should_fault_in_pages() call gfs2: set FMODE_CAN_ODIRECT instead of a dummy direct_IO method gfs2: Don't remember delete unless it's successful gfs2: Update rl_unlinked before releasing rgrp lock gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold ... commit 95c41842bcbdeab8debda1a4285850bd8235fbbe Merge: ba7bdec3cbec7 a372d66af4850 Author: David S. Miller Date: Tue Jul 4 19:42:27 2023 +0100 Merge branch 'dsa-ll-fixes' Vladimir Oltean says: ==================== dsa: Fix mangled link-local MAC DAs with SJA1105 DSA The SJA1105 hardware tagging protocol is weird and will put DSA information (source port, switch ID) in the MAC DA of the packets sent to the CPU, and then send some additional (meta) packets which contain the original bytes from the previous packet's MAC DA. The tagging protocol driver contains logic to handle this, but the meta frames are optional functionality, and there are configurations when they aren't received (no PTP RX timestamping). Thus, the MAC DA from packets sent to the stack is not correct in all cases. Also, during testing it was found that the MAC DA patching procedure was incorrect. The investigation comes as a result of this discussion with Paolo: https://lore.kernel.org/netdev/f494387c8d55d9b1d5a3e88beedeeb448f2e6cc3.camel@redhat.com/ ==================== Signed-off-by: David S. Miller commit a372d66af48506d9f7aaae2a474cd18f14d98cb8 Author: Vladimir Oltean Date: Tue Jul 4 01:05:45 2023 +0300 net: dsa: sja1105: always enable the send_meta options incl_srcpt has the limitation, mentioned in commit b4638af8885a ("net: dsa: sja1105: always enable the INCL_SRCPT option"), that frames with a MAC DA of 01:80:c2:xx:yy:zz will be received as 01:80:c2:00:00:zz unless PTP RX timestamping is enabled. The incl_srcpt option was initially unconditionally enabled, then that changed with commit 42824463d38d ("net: dsa: sja1105: Limit use of incl_srcpt to bridge+vlan mode"), then again with b4638af8885a ("net: dsa: sja1105: always enable the INCL_SRCPT option"). Bottom line is that it now needs to be always enabled, otherwise the driver does not have a reliable source of information regarding source_port and switch_id for link-local traffic (tag_8021q VLANs may be imprecise since now they identify an entire bridging domain when ports are not standalone). If we accept that PTP RX timestamping (and therefore, meta frame generation) is always enabled in hardware, then that limitation could be avoided and packets with any MAC DA can be properly received, because meta frames do contain the original bytes from the MAC DA of their associated link-local packet. This change enables meta frame generation unconditionally, which also has the nice side effects of simplifying the switch control path (a switch reset is no longer required on hwtstamping settings change) and the tagger data path (it no longer needs to be informed whether to expect meta frames or not - it always does). Fixes: 227d07a07ef1 ("net: dsa: sja1105: Add support for traffic through standalone ports") Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit 1dcf6efd5f0c1f4496b3ef7ec5a7db104a53b38c Author: Vladimir Oltean Date: Tue Jul 4 01:05:44 2023 +0300 net: dsa: tag_sja1105: fix MAC DA patching from meta frames The SJA1105 manual says that at offset 4 into the meta frame payload we have "MAC destination byte 2" and at offset 5 we have "MAC destination byte 1". These are counted from the LSB, so byte 1 is h_dest[ETH_HLEN-2] aka h_dest[4] and byte 2 is h_dest[ETH_HLEN-3] aka h_dest[3]. The sja1105_meta_unpack() function decodes these the other way around, so a frame with MAC DA 01:80:c2:11:22:33 is received by the network stack as having 01:80:c2:22:11:33. Fixes: e53e18a6fe4d ("net: dsa: sja1105: Receive and decode meta frames") Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller commit ba7bdec3cbec7b0135f7ec0458073cbe9ae74de5 Author: Azeem Shaikh Date: Mon Jul 3 17:58:40 2023 +0000 net: Replace strlcpy with strscpy strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh Reviewed-by: Simon Horman Reviewed-by: David Ahern Signed-off-by: David S. Miller commit 84bef5b6037c15180ef88ac4216dc621d16df1a6 Author: Guillaume Nault Date: Mon Jul 3 19:14:46 2023 +0200 pptp: Fix fib lookup calls. PPTP uses pppox sockets (struct pppox_sock). These sockets don't embed an inet_sock structure, so it's invalid to call inet_sk() on them. Therefore, the ip_route_output_ports() call in pptp_connect() has two problems: * The tos variable is set with RT_CONN_FLAGS(sk), which calls inet_sk() on the pppox socket. * ip_route_output_ports() tries to retrieve routing flags using inet_sk_flowi_flags(), which is also going to call inet_sk() on the pppox socket. While PPTP doesn't use inet sockets, it's actually really layered on top of IP and therefore needs a proper way to do fib lookups. So let's define pptp_route_output() to get a struct rtable from a pptp socket. Let's also replace the ip_route_output_ports() call of pptp_xmit() for consistency. In practice, this means that: * pptp_connect() sets ->flowi4_tos and ->flowi4_flags to zero instead of using bits of unrelated struct pppox_sock fields. * pptp_xmit() now respects ->sk_mark and ->sk_uid. * pptp_xmit() now calls the security_sk_classify_flow() security hook, thus allowing to set ->flowic_secid. * pptp_xmit() now passes the pppox socket to xfrm_lookup_route(). Found by code inspection. Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)") Signed-off-by: Guillaume Nault Signed-off-by: David S. Miller commit 90a8007bbeb616e3ea57e2696190e57aa0329531 Author: Dan Carpenter Date: Mon Jul 3 18:24:52 2023 +0300 mlxsw: spectrum_router: Fix an IS_ERR() vs NULL check The mlxsw_sp_crif_alloc() function returns NULL on error. It doesn't return error pointers. Fix the check. Fixes: 78126cfd5dc9 ("mlxsw: spectrum_router: Maintain CRIF for fallback loopback RIF") Signed-off-by: Dan Carpenter Reviewed-by: Alexander Lobakin Reviewed-by: Ido Schimmel Signed-off-by: David S. Miller commit ccf46d85318327e5aebaae53f1fe33cc31ed1fd1 Merge: b869e9f49964a 40c565a429d70 Author: Linus Torvalds Date: Tue Jul 4 11:22:50 2023 -0700 Merge tag 'pm-6.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These add support for new hardware (ap807 and AM62A7), fix several issues in cpufreq drivers and in the operating performance points (OPP) framework, fix up intel_idle after recent changes and add documentation. Specifics: - Add missing __init annotation to one function in the intel_idle drvier (Rafael Wysocki) - Make intel_pstate use a correct scaling factor when mapping HWP performance levels to frequency values on hybrid-capable systems with disabled E-cores (Srinivas Pandruvada) - Fix Kconfig dependencies of the cpufreq-dt-platform driver (Viresh Kumar) - Add support to build cpufreq-dt-platdev as a module (Zhipeng Wang) - Don't allocate Sparc's cpufreq_driver dynamically (Viresh Kumar) - Add support for TI's AM62A7 platform (Vibhore Vardhan) - Add support for Armada's ap807 platform (Russell King (Oracle)) - Add support for StarFive JH7110 SoC (Mason Huo) - Fix voltage selection for Mediatek Socs (Daniel Golle) - Fix error handling in Tegra's cpufreq driver (Christophe JAILLET) - Document Qualcomm's IPQ8074 in DT bindings (Robert Marko) - Don't warn for disabling a non-existing frequency for imx6q cpufreq driver (Christoph Niedermaier) - Use dev_err_probe() in Qualcomm's cpufreq driver (Andrew Halaney) - Simplify performance state related logic in the OPP core (Viresh Kumar) - Fix use-after-free and improve locking around lazy_opp_tables (Viresh Kumar, Stephan Gerhold) - Minor cleanups - using dev_err_probe() and rate-limiting debug messages (Andrew Halaney, Adrián Larumbe)" * tag 'pm-6.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (23 commits) cpufreq: intel_pstate: Fix scaling for hybrid-capable systems with disabled E-cores cpufreq: Make CONFIG_CPUFREQ_DT_PLATDEV depend on OF intel_idle: Add __init annotation to matchup_vm_state_with_baremetal() OPP: Properly propagate error along when failing to get icc_path OPP: Use dev_err_probe() when failing to get icc_path cpufreq: qcom-cpufreq-hw: Use dev_err_probe() when failing to get icc paths cpufreq: mediatek: correct voltages for MT7622 and MT7623 cpufreq: armada-8k: add ap807 support OPP: Simplify the over-designed pstate <-> level dance OPP: pstate is only valid for genpd OPP tables OPP: don't drop performance constraint on OPP table removal OPP: Protect `lazy_opp_tables` list with `opp_table_lock` OPP: Staticize `lazy_opp_tables` in of.c cpufreq: dt-platdev: Support building as module opp: Fix use-after-free in lazy_opp_tables after probe deferral dt-bindings: cpufreq: qcom-cpufreq-nvmem: document IPQ8074 cpufreq: dt-platdev: Blacklist ti,am62a7 SoC cpufreq: ti-cpufreq: Add support for AM62A7 OPP: rate-limit debug messages when no change in OPP is required cpufreq: imx6q: don't warn for disabling a non-existing frequency ... commit b869e9f49964aace737a5a3fadd958ea94e96288 Merge: 406fb9eb198a0 f679e89acdd3e Author: Linus Torvalds Date: Tue Jul 4 11:07:45 2023 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull more clk updates from Stephen Boyd: "Another set of clk driver updates and fixes for the merge window. The driver updates needed more time to bake in linux-next. Updates: - Support for more clk controllers in Qualcomm SoCs such as SM8350, SM8450, SDX75, SC8280XP, and IPQ9574 - Runtime PM enablement of some more Qualcomm clk controllers - Various fixes to Qualcomm clk driver data to use correct clk_ops and to check halt bits properly - AT91 updates to modernize with clk_parent_data structures Fixes: - Remove 'syscon' from dt binding fix for ti,j721e-system-controller - Fix determine rate in the Tegra driver that got wrecked by the refactorting of muxes this merge window" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (69 commits) clk: tegra: Avoid calling an uninitialized function dt-bindings: mfd: ti,j721e-system-controller: Remove syscon from example clk: at91: sama7g5: s/ep_chg_chg_id/ep_chg_id clk: at91: sama7g5: switch to parent_hw and parent_data clk: at91: sckc: switch to parent_data/parent_hw clk: at91: clk-sam9x60-pll: add support for parent_hw clk: at91: clk-utmi: add support for parent_hw clk: at91: clk-system: add support for parent_hw clk: at91: clk-programmable: add support for parent_hw clk: at91: clk-peripheral: add support for parent_hw clk: at91: clk-master: add support for parent_hw clk: at91: clk-generated: add support for parent_hw clk: at91: clk-main: add support for parent_data/parent_hw clk: qcom: gcc-sc8280xp: Add runtime PM clk: qcom: gpucc-sc8280xp: Add runtime PM clk: qcom: mmcc-msm8974: fix MDSS_GDSC power flags clk: qcom: gpucc-sm6375: Enable runtime pm dt-bindings: clock: sm6375-gpucc: Add VDD_GX clk: qcom: gcc-sm6115: Add missing PLL config properties clk: qcom: clk-alpha-pll: Add a way to update some bits of test_ctl(_hi) ... commit 406fb9eb198a05fa61c31ec8a6e667c8440749c8 Merge: f1962207150c8 3ff256751a285 Author: Linus Torvalds Date: Tue Jul 4 11:02:34 2023 -0700 Merge tag 'firewire-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire updates from Takashi Sakamoto: "This consist of three parts; UAPI update, OHCI driver update, and several bug fixes. Firstly, the 1394 OHCI specification defines method to retrieve hardware time stamps for asynchronous communication, which was previously unavailable in user space. This adds new events to the UAPI, allowing applications to retrieve the time when asynchronous packet are received and sent. The new events are tested in the bleeding edge of libhinawa and look to work well. The new version of libhinawa will be released after current merge window is closed: https://git.kernel.org/pub/scm/libs/ieee1394/libhinawa.git/ Secondly, the FireWire stack includes a PCM device driver for 1394 OHCI hardware, This change modernizes the driver by managed resource (devres) framework. Lastly, bug fixes for firewire-net and firewire-core" * tag 'firewire-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: (25 commits) firewire: net: fix use after free in fwnet_finish_incoming_packet() firewire: core: obsolete usage of GFP_ATOMIC at building node tree firewire: ohci: release buffer for AR req/resp contexts when managed resource is released firewire: ohci: use devres for content of configuration ROM firewire: ohci: use devres for IT, IR, AT/receive, and AT/request contexts firewire: ohci: use devres for list of isochronous contexts firewire: ohci: use devres for requested IRQ firewire: ohci: use devres for misc DMA buffer firewire: ohci: use devres for MMIO region mapping firewire: ohci: use devres for PCI-related resources firewire: ohci: use devres for memory object of ohci structure firewire: fix warnings to generate UAPI documentation firewire: fix build failure due to missing module license firewire: cdev: implement new event relevant to phy packet with time stamp firewire: cdev: add new event to notify phy packet with time stamp firewire: cdev: code refactoring to dispatch event for phy packet firewire: cdev: implement new event to notify response subaction with time stamp firewire: cdev: add new event to notify response subaction with time stamp firewire: cdev: code refactoring to operate event of response firewire: core: implement variations to send request and wait for response with time stamp ... commit 59e8d4bb8d485a3c125dc1c66439dde589b9d9cd Author: Andy Shevchenko Date: Mon Jul 3 15:14:10 2023 +0300 ACPI: scan: Use the acpi_match_acpi_device() helper Instead of doing two pass parsing of the table, replace acpi_match_device_ids() with acpi_match_acpi_device(). Signed-off-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit bf6067a6caa6717c40156fd8dfa443fd568c193a Author: Andy Shevchenko Date: Mon Jul 3 15:14:09 2023 +0300 ACPI: platform: Move SMB0001 HID to the header and reuse There are at least two places in the kernel that are using the SMB0001 HID. Make it to be available via acpi_drivers.h header file. While at it, replace hard coded one with a definition. Reviewed-by: Andi Shyti Acked-by: Wolfram Sang # for I2C Link: https://lore.kernel.org/r/20230621151652.79579-2-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit cefbd80bf52c791fede129ab5cf8be6ed9e8ce38 Author: Andy Shevchenko Date: Mon Jul 3 15:14:08 2023 +0300 ACPI: platform: Ignore SMB0001 only when it has resources After switching i2c-scmi driver to be a platform one, it stopped being enumerated on number of Kontron platforms, because it's listed in the forbidden_id_list. To resolve the situation, add a flag to driver data to allow devices with no resources in _CRS to be enumerated via platform bus. Fixes: 03d4287add6e ("i2c: scmi: Convert to be a platform driver") Closes: https://lore.kernel.org/r/60c1756765b9a3f1eab0dcbd84f59f00fe1caf48.camel@kontron.com Link: https://lore.kernel.org/r/20230621151652.79579-1-andriy.shevchenko@linux.intel.com Signed-off-by: Andy Shevchenko Reviewed-by: Andi Shyti [ rjw: Move has_resource definition to the block in which it is used and initialize it to 'false' ] Signed-off-by: Rafael J. Wysocki commit 2b5ae9604949391da6661eab0a854de4ecd140f6 Author: Andy Shevchenko Date: Mon Jul 3 15:14:07 2023 +0300 ACPI: bus: Introduce acpi_match_acpi_device() helper Match the ACPI device against a given list of ACPI IDs. Subsequent changes will make use of this. Signed-off-by: Andy Shevchenko [ rjw: Changelog edit ] Signed-off-by: Rafael J. Wysocki commit f1962207150c8b602e980616f04b37ea4e64bb9f Author: Linus Torvalds Date: Tue Jul 4 06:37:32 2023 -0700 module: fix init_module_from_file() error handling Vegard Nossum pointed out two different problems with the error handling in init_module_from_file(): (a) the idempotent loading code didn't clean up properly in some error cases, leaving the on-stack 'struct idempotent' element still in the hash table (b) failure to read the module file would nonsensically update the 'invalid_kread_bytes' stat counter with the error value The first error is quite nasty, in that it can then cause subsequent idempotent loads of that same file to access stale stack contents of the previous failure. The case may not happen in any normal situation (explaining all the "Tested-by's on the original change), and requires admin privileges, but syzkaller triggers random bad behavior as a result: BUG: soft lockup in sys_finit_module BUG: unable to handle kernel paging request in init_module_from_file general protection fault in init_module_from_file INFO: task hung in init_module_from_file KASAN: out-of-bounds Read in init_module_from_file KASAN: slab-out-of-bounds Read in init_module_from_file ... The second error is fairly benign and just leads to nonsensical stats (and has been around since the debug stats were added). Vegard also provided a patch for the idempotent loading issue, but I'd rather re-organize the code and make it more legible using another level of helper functions than add the usual "goto out" error handling. Link: https://lore.kernel.org/lkml/20230704100852.23452-1-vegard.nossum@oracle.com/ Fixes: 9b9879fc0327 ("modules: catch concurrent module loads, treat them as idempotent") Reported-by: Vegard Nossum Reported-by: Harshit Mogalapalli Reported-by: syzbot+9c2bdc9d24e4a7abe741@syzkaller.appspotmail.com Signed-off-by: Linus Torvalds commit 90f6af81604c7f831273c08ac9994d0d0724b553 Author: Ben Dooks Date: Mon Jul 3 13:48:31 2023 +0100 ACPI: scan: fix undeclared variable warnings by including sleep.h There are two pieces of data being exported from drivers/acpi/scan.c (acpi_device_lock and acpi_wakeup_device_list) that don't have their definitions declared in anything scan.c is including. Fix the following sparse warnings by including sleep.h to add the declarations of acpi_device_lock and acpi_wakeup_device_list to fix the followng sparse warnings: drivers/acpi/scan.c:42:1: warning: symbol 'acpi_device_lock' was not declared. Should it be static? drivers/acpi/scan.c:43:1: warning: symbol 'acpi_wakeup_device_list' was not declared. Should it be static? Signed-off-by: Ben Dooks Signed-off-by: Rafael J. Wysocki commit 40c565a429d706951f18fe07ccd9f6fded23a4dc Merge: bb814518bf7c2 0fcfc9e519902 b2918089d5cb4 Author: Rafael J. Wysocki Date: Tue Jul 4 18:26:44 2023 +0200 Merge branches 'pm-cpufreq' and 'pm-cpuidle' Merge CPU power management updates for 6.5-rc1: - Add missing __init annotation to one function in the intel_idle drvier (Rafael Wysocki). - Make intel_pstate use a correct scaling factor when mapping HWP performance levels to frequency values on hybrid-capable systems with disabled E-cores (Srinivas Pandruvada). - Fix Kconfig dependencies of the cpufreq-dt-platform driver (Viresh Kumar). - Add support to build cpufreq-dt-platdev as a module (Zhipeng Wang). - Don't allocate Sparc's cpufreq_driver dynamically (Viresh Kumar). - Add support for TI's AM62A7 platform (Vibhore Vardhan). - Add support for Armada's ap807 platform (Russell King (Oracle)). - Add support for StarFive JH7110 SoC (Mason Huo). - Fix voltage selection for Mediatek Socs (Daniel Golle). - Fix error handling in Tegra's cpufreq driver (Christophe JAILLET). - Document Qualcomm's IPQ8074 in DT bindings (Robert Marko). - Don't warn for disabling a non-existing frequency for imx6q cpufreq driver (Christoph Niedermaier). - Use dev_err_probe() in Qualcomm's cpufreq driver (Andrew Halaney). * pm-cpufreq: cpufreq: intel_pstate: Fix scaling for hybrid-capable systems with disabled E-cores cpufreq: Make CONFIG_CPUFREQ_DT_PLATDEV depend on OF cpufreq: qcom-cpufreq-hw: Use dev_err_probe() when failing to get icc paths cpufreq: mediatek: correct voltages for MT7622 and MT7623 cpufreq: armada-8k: add ap807 support cpufreq: dt-platdev: Support building as module dt-bindings: cpufreq: qcom-cpufreq-nvmem: document IPQ8074 cpufreq: dt-platdev: Blacklist ti,am62a7 SoC cpufreq: ti-cpufreq: Add support for AM62A7 cpufreq: imx6q: don't warn for disabling a non-existing frequency cpufreq: sparc: Don't allocate cpufreq_driver dynamically cpufreq: tegra194: Fix an error handling path in tegra194_cpufreq_probe() cpufreq: dt-platdev: Add JH7110 SOC to the allowlist * pm-cpuidle: intel_idle: Add __init annotation to matchup_vm_state_with_baremetal() commit 52909f1768023656d5c429873e2246a134289a95 Author: Conor Dooley Date: Thu Jun 29 12:33:34 2023 +0100 RISC-V: drop error print from riscv_hartid_to_cpuid() As of commit 2ac874343749 ("RISC-V: split early & late of_node to hartid mapping") my CI complains about newly added pr_err() messages during boot, for example: [ 0.000000] Couldn't find cpu id for hartid [0] [ 0.000000] riscv-intc: unable to find hart id for /cpus/cpu@0/interrupt-controller Before the split, riscv_of_processor_hartid() contained a check for whether the cpu was "available", before calling riscv_hartid_to_cpuid(), but after the split riscv_of_processor_hartid() can be called for cpus that are disabled. Most callers of riscv_hartid_to_cpuid() already report custom errors where it falls, making this print superfluous in those case. In other places, the print adds nothing - see riscv_intc_init() for example. Fixes: 2ac874343749 ("RISC-V: split early & late of_node to hartid mapping") Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20230629-paternity-grafted-b901b76d04a0@wendy Signed-off-by: Palmer Dabbelt commit 9657e9b7d2538dc73c24947aa00a8525dfb8062c Author: Björn Töpel Date: Thu Jun 29 16:22:28 2023 +0200 riscv: Discard vector state on syscalls The RISC-V vector specification states: Executing a system call causes all caller-saved vector registers (v0-v31, vl, vtype) and vstart to become unspecified. The vector registers are set to all 1s, vill is set (invalid), and the vector status is set to Dirty. That way we can prevent userspace from accidentally relying on the stated save. Rémi pointed out [1] that writing to the registers might be superfluous, and setting vill is sufficient. Link: https://lore.kernel.org/linux-riscv/12784326.9UPPK3MAeB@basile.remlab.net/ # [1] Suggested-by: Darius Rad Suggested-by: Palmer Dabbelt Suggested-by: Rémi Denis-Courmont Signed-off-by: Björn Töpel Link: https://lore.kernel.org/r/20230629142228.1125715-1-bjorn@kernel.org Signed-off-by: Palmer Dabbelt commit 85fadc0d04119c2fe4a20287767ab904c6d21ba1 Author: Woody Zhang Date: Wed Jun 14 21:19:07 2023 +0800 riscv: move memblock_allow_resize() after linear mapping is ready The initial memblock metadata is accessed from kernel image mapping. The regions arrays need to "reallocated" from memblock and accessed through linear mapping to cover more memblock regions. So the resizing should not be allowed until linear mapping is ready. Note that there are memblock allocations when building linear mapping. This patch is similar to 24cc61d8cb5a ("arm64: memblock: don't permit memblock resizing until linear mapping is up"). In following log, many memblock regions are reserved before create_linear_mapping_page_table(). And then it triggered reallocation of memblock.reserved.regions and memcpy the old array in kernel image mapping to the new array in linear mapping which caused a page fault. [ 0.000000] memblock_reserve: [0x00000000bf01f000-0x00000000bf01ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 [ 0.000000] memblock_reserve: [0x00000000bf021000-0x00000000bf021fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 [ 0.000000] memblock_reserve: [0x00000000bf023000-0x00000000bf023fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 [ 0.000000] memblock_reserve: [0x00000000bf025000-0x00000000bf025fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 [ 0.000000] memblock_reserve: [0x00000000bf027000-0x00000000bf027fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 [ 0.000000] memblock_reserve: [0x00000000bf029000-0x00000000bf029fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 [ 0.000000] memblock_reserve: [0x00000000bf02b000-0x00000000bf02bfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 [ 0.000000] memblock_reserve: [0x00000000bf02d000-0x00000000bf02dfff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 [ 0.000000] memblock_reserve: [0x00000000bf02f000-0x00000000bf02ffff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 [ 0.000000] memblock_reserve: [0x00000000bf030000-0x00000000bf030fff] early_init_fdt_scan_reserved_mem+0x28c/0x2c6 [ 0.000000] OF: reserved mem: 0x0000000080000000..0x000000008007ffff (512 KiB) map non-reusable mmode_resv0@80000000 [ 0.000000] memblock_reserve: [0x00000000bf000000-0x00000000bf001fed] paging_init+0x19a/0x5ae [ 0.000000] memblock_phys_alloc_range: 4096 bytes align=0x1000 from=0x0000000000000000 max_addr=0x0000000000000000 alloc_pmd_fixmap+0x14/0x1c [ 0.000000] memblock_reserve: [0x000000017ffff000-0x000000017fffffff] memblock_alloc_range_nid+0xb8/0x128 [ 0.000000] memblock: reserved is doubled to 256 at [0x000000017fffd000-0x000000017fffe7ff] [ 0.000000] Unable to handle kernel paging request at virtual address ff600000ffffd000 [ 0.000000] Oops [#1] [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.4.0-rc1-00011-g99a670b2069c #66 [ 0.000000] Hardware name: riscv-virtio,qemu (DT) [ 0.000000] epc : __memcpy+0x60/0xf8 [ 0.000000] ra : memblock_double_array+0x192/0x248 [ 0.000000] epc : ffffffff8081d214 ra : ffffffff80a3dfc0 sp : ffffffff81403bd0 [ 0.000000] gp : ffffffff814fbb38 tp : ffffffff8140dac0 t0 : 0000000001600000 [ 0.000000] t1 : 0000000000000000 t2 : 000000008f001000 s0 : ffffffff81403c60 [ 0.000000] s1 : ffffffff80c0bc98 a0 : ff600000ffffd000 a1 : ffffffff80c0bcd8 [ 0.000000] a2 : 0000000000000c00 a3 : ffffffff80c0c8d8 a4 : 0000000080000000 [ 0.000000] a5 : 0000000000080000 a6 : 0000000000000000 a7 : 0000000080200000 [ 0.000000] s2 : ff600000ffffd000 s3 : 0000000000002000 s4 : 0000000000000c00 [ 0.000000] s5 : ffffffff80c0bc60 s6 : ffffffff80c0bcc8 s7 : 0000000000000000 [ 0.000000] s8 : ffffffff814fd0a8 s9 : 000000017fffe7ff s10: 0000000000000000 [ 0.000000] s11: 0000000000001000 t3 : 0000000000001000 t4 : 0000000000000000 [ 0.000000] t5 : 000000008f003000 t6 : ff600000ffffd000 [ 0.000000] status: 0000000200000100 badaddr: ff600000ffffd000 cause: 000000000000000f [ 0.000000] [] __memcpy+0x60/0xf8 [ 0.000000] [] memblock_add_range.isra.14+0x12c/0x162 [ 0.000000] [] memblock_reserve+0x6e/0x8c [ 0.000000] [] memblock_alloc_range_nid+0xb8/0x128 [ 0.000000] [] memblock_phys_alloc_range+0x5e/0x6a [ 0.000000] [] alloc_pmd_fixmap+0x14/0x1c [ 0.000000] [] alloc_p4d_fixmap+0xc/0x14 [ 0.000000] [] create_pgd_mapping+0x98/0x17c [ 0.000000] [] create_linear_mapping_range.constprop.10+0xe4/0x112 [ 0.000000] [] paging_init+0x3ec/0x5ae [ 0.000000] [] setup_arch+0xb2/0x576 [ 0.000000] [] start_kernel+0x72/0x57e [ 0.000000] Code: b303 0285 b383 0305 be03 0385 be83 0405 bf03 0485 (b023) 00ef [ 0.000000] ---[ end trace 0000000000000000 ]--- [ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task! [ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]--- Fixes: 671f9a3e2e24 ("RISC-V: Setup initial page tables in two stages") Signed-off-by: Woody Zhang Tested-by: Song Shuai Link: https://lore.kernel.org/r/tencent_FBB94CE615C5CCE7701CD39C15CCE0EE9706@qq.com Signed-off-by: Palmer Dabbelt commit c1f048a6bd7d7cb42e9bfd79eff85b33894997fe Author: Song Shuai Date: Mon May 29 18:15:24 2023 +0800 riscv: Enable ARCH_SUSPEND_POSSIBLE for s2idle With this configuration opened, the basic platform-independent s2idle is provided by the sole "s2idle" string in `/sys/power/mem_sleep`. At the end of s2idle, harts will hit the `wfi` instruction or enter the SUSPENDED state through the sbi_cpuidle driver. The interrupt of possible wakeup devices will be kept to wake the system up. And platform-specific sleep states can be provided by future ACPI and SBI SUSP extension support. Signed-off-by: Song Shuai Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/20230529101524.322076-1-songshuaishuai@tinylab.org Signed-off-by: Palmer Dabbelt commit f679e89acdd3e825995a84b1b07e2ea33ea882ee Author: Thierry Reding Date: Fri Jun 30 15:07:48 2023 +0200 clk: tegra: Avoid calling an uninitialized function Commit 493ffb046cf5 ("clk: tegra: super: Switch to determine_rate") replaced clk_super_round_rate() by clk_super_determine_rate(), but didn't update one callsite that was explicitly calling the old tegra_clk_super_ops.round_rate() function, which was now NULL. This resulted in a crash on Tegra30 systems during early boot. Switch this callsite over to the clk_super_determine_rate() equivalent to avoid the crash. Fixes: 493ffb046cf5 ("clk: tegra: super: Switch to determine_rate") Tested-by: Dmitry Osipenko Signed-off-by: Thierry Reding Link: https://lore.kernel.org/r/20230630130748.840729-1-thierry.reding@gmail.com Signed-off-by: Stephen Boyd commit 54cdede08f2f4414629001b124110d656161080a Author: Ben Dooks Date: Fri Jun 16 12:43:57 2023 +0100 riscv: vdso: include vdso/vsyscall.h for vdso_data Add include of to pull in the defition of vdso_data to remove the following sparse warning: arch/riscv/kernel/vdso.c:39:18: warning: symbol 'vdso_data' was not declared. Should it be static? Signed-off-by: Ben Dooks Link: https://lore.kernel.org/r/20230616114357.159601-1-ben.dooks@codethink.co.uk Signed-off-by: Palmer Dabbelt commit e27cb89a22ada4e3e7bee1567a8daa1fb2260b78 Author: Jakub Kicinski Date: Wed Jun 21 15:35:25 2023 -0700 scripts: kernel-doc: support private / public marking for enums Enums benefit from private markings, too. For netlink attribute name enums always end with a pair of __$n_MAX and $n_MAX members. Documenting them feels a bit tedious. Signed-off-by: Jakub Kicinski Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Jonathan Corbet Message-ID: <20230621223525.2722703-1-kuba@kernel.org> commit 1e6115f50bca20417e9d4d95ce99e36d6f145fa4 Author: Changyuan Lyu Date: Sat Jun 24 09:58:57 2023 -0700 Documentation: KVM: SEV: add a missing backtick ``ENOTTY` -> ``ENOTTY``. Signed-off-by: Changyuan Lyu Signed-off-by: Jonathan Corbet Message-ID: <20230624165858.21777-1-changyuanl@google.com> commit 29e31a8ee811f5d85274f0381f13cd6fe650aea4 Author: David Heidelberg Date: Sun Jun 25 12:33:04 2023 +0200 Documentation: ACPI: fix typo in ssdt-overlays.rst Signed-off-by: David Heidelberg Signed-off-by: Jonathan Corbet Message-ID: <20230625103305.115484-1-david@ixit.cz> commit 57ada2358fae8c3df0f810c3a7196f074da01c98 Author: Olaf Hering Date: Fri Jun 30 16:53:02 2023 +0200 Fix documentation of panic_on_warn The kernel cmdline option panic_on_warn expects an integer, it is not a plain option as documented. A number of uses in the tree figured this already, and use panic_on_warn=1 for their purpose. Adjust a comment which otherwise may mislead people in the future. Fixes: 9e3961a09798 ("kernel: add panic_on_warn") Signed-off-by: Olaf Hering Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet commit b5641a5d8b8b14643bfe3d017d64da90a5c55479 Author: Linus Torvalds Date: Mon Jul 3 19:29:48 2023 -0700 mm: don't do validate_mm() unnecessarily and without mmap locking This is an addition to commit ae80b4041984 ("mm: validate the mm before dropping the mmap lock"), because it turns out there were two problems, but lockdep just stopped complaining after finding the first one. The do_vmi_align_munmap() function now drops the mmap lock after doing the validate_mm() call, but it turns out that one of the callers then immediately calls validate_mm() again. That's both a bit silly, and now (again) happens without the mmap lock held. So just remove that validate_mm() call from the caller, but make sure to not lose any coverage by doing that mm sanity checking in the error path of do_vmi_align_munmap() too. Reported-and-tested-by: kernel test robot Link: https://lore.kernel.org/lkml/ZKN6CdkKyxBShPHi@xsang-OptiPlex-9020/ Fixes: 408579cd627a ("mm: Update do_vmi_align_munmap() return semantics") Signed-off-by: Linus Torvalds commit 879a879c216a41f5403d8d3dbc204a48501912bf Author: Jonas Gorski Date: Fri Jun 30 22:22:55 2023 +0200 spi: bcm{63xx,bca}-hsspi: update my email address Update my email address to a working one, as the openwrt.org one is broken since ages. Signed-off-by: Jonas Gorski Acked-by: William Zhang Link: https://lore.kernel.org/r/20230630202257.8449-2-jonas.gorski@gmail.com Signed-off-by: Mark Brown commit 7dfae2631bfbdebecd35fe7b472ab3cc95c9ed66 Author: Johan Hovold Date: Mon Jul 3 14:47:01 2023 +0200 ASoC: codecs: wcd938x: fix missing mbhc init error handling MBHC initialisation can fail so add the missing error handling to avoid dereferencing an error pointer when later configuring the jack: Unable to handle kernel paging request at virtual address fffffffffffffff8 pc : wcd_mbhc_start+0x28/0x380 [snd_soc_wcd_mbhc] lr : wcd938x_codec_set_jack+0x28/0x48 [snd_soc_wcd938x] Call trace: wcd_mbhc_start+0x28/0x380 [snd_soc_wcd_mbhc] wcd938x_codec_set_jack+0x28/0x48 [snd_soc_wcd938x] snd_soc_component_set_jack+0x28/0x8c [snd_soc_core] qcom_snd_wcd_jack_setup+0x7c/0x19c [snd_soc_qcom_common] sc8280xp_snd_init+0x20/0x2c [snd_soc_sc8280xp] snd_soc_link_init+0x28/0x90 [snd_soc_core] snd_soc_bind_card+0x628/0xbfc [snd_soc_core] snd_soc_register_card+0xec/0x104 [snd_soc_core] devm_snd_soc_register_card+0x4c/0xa4 [snd_soc_core] sc8280xp_platform_probe+0xf0/0x108 [snd_soc_sc8280xp] Fixes: bcee7ed09b8e ("ASoC: codecs: wcd938x: add Multi Button Headset Control support") Cc: stable@vger.kernel.org # 5.15 Cc: Srinivas Kandagatla Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230703124701.11734-1-johan+linaro@kernel.org Signed-off-by: Mark Brown commit 69562eb0bd3e6bb8e522a7b254334e0fb30dff0c Author: Amir Goldstein Date: Thu Jun 29 07:20:44 2023 +0300 fanotify: disallow mount/sb marks on kernel internal pseudo fs Hopefully, nobody is trying to abuse mount/sb marks for watching all anonymous pipes/inodes. I cannot think of a good reason to allow this - it looks like an oversight that dated back to the original fanotify API. Link: https://lore.kernel.org/linux-fsdevel/20230628101132.kvchg544mczxv2pm@quack3/ Fixes: 0ff21db9fcc3 ("fanotify: hooks the fanotify_mark syscall to the vfsmount code") Signed-off-by: Amir Goldstein Reviewed-by: Christian Brauner Signed-off-by: Jan Kara Message-Id: <20230629042044.25723-1-amir73il@gmail.com> commit f6cf3883df471abbcf1553127681dc244c8ff8dd Author: Jani Nikula Date: Tue Jun 27 18:13:58 2023 +0300 drm/i915: use mock device info for creating mock device Instead of modifying the device info on the fly, use static const mock device info. It's not okay to modify device info at runtime; we've added separate runtime info for info that needs to be modified at runtime. We've added safeguards to device info to prevent it from being modified, but commit 5e352e32aec2 ("drm/i915: preparation for using PAT index") just cast the const away and modified it anyway. This prevents device info from being moved to rodata. Fixes: 5e352e32aec2 ("drm/i915: preparation for using PAT index") Suggested-by: Tvrtko Ursulin Cc: Fei Yang Cc: Andi Shyti Cc: Andrzej Hajda Cc: Matt Roper Signed-off-by: Jani Nikula Reviewed-by: Tvrtko Ursulin Reviewed-by: Andi Shyti Reviewed-by: Andrzej Hajda Link: https://patchwork.freedesktop.org/patch/msgid/b0db62045a96a3fd4cf123685da88cc777f9b485.1687878757.git.jani.nikula@intel.com (cherry picked from commit ecc7a3ce078a209a62af4c53ffb7370620f65c24) Signed-off-by: Tvrtko Ursulin commit fdffb7dbc74f48cb1d404d9ab0c9fd769a59caf0 Author: Ville Syrjälä Date: Fri Jun 9 17:13:53 2023 +0300 drm/i915/psr: Fix BDW PSR AUX CH data register offsets The multiplication got replaced by an addition in some cleanup. This means we never write the correct data to some of the BDW PSR data registers and thus we fail to actually wake up the panel from PSR. Fixes: 4ab4fa103217 ("drm/i915/psr: Make PSR registers relative to transcoders") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20230609141404.12729-3-ville.syrjala@linux.intel.com Reviewed-by: Jouni Högander (cherry picked from commit 460dc4ba1442b3e5e543328d11db2702b98d3d7c) Signed-off-by: Tvrtko Ursulin commit 30c45b5361d39b4b793780ffac5538090b9e2eb1 Author: Lin Ma Date: Mon Jul 3 19:08:42 2023 +0800 net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX The attribute TCA_PEDIT_PARMS_EX is not be included in pedit_policy and one malicious user could fake a TCA_PEDIT_PARMS_EX whose length is smaller than the intended sizeof(struct tc_pedit). Hence, the dereference in tcf_pedit_init() could access dirty heap data. static int tcf_pedit_init(...) { // ... pattr = tb[TCA_PEDIT_PARMS]; // TCA_PEDIT_PARMS is included if (!pattr) pattr = tb[TCA_PEDIT_PARMS_EX]; // but this is not // ... parm = nla_data(pattr); index = parm->index; // parm is able to be smaller than 4 bytes // and this dereference gets dirty skb_buff // data created in netlink_sendmsg } This commit adds TCA_PEDIT_PARMS_EX length in pedit_policy which avoid the above case, just like the TCA_PEDIT_PARMS. Fixes: 71d0ed7079df ("net/act_pedit: Support using offset relative to the conventional network headers") Signed-off-by: Lin Ma Reviewed-by: Pedro Tammela Link: https://lore.kernel.org/r/20230703110842.590282-1-linma@zju.edu.cn Signed-off-by: Paolo Abeni commit 33ab231f83cc12d0157711bbf84e180c3be7d7bc Author: Christian Brauner Date: Mon Jul 3 16:49:12 2023 +0200 fs: don't assume arguments are non-NULL The helper is explicitly documented as locking zero, one, or two arguments. While all current callers do pass non-NULL arguments there's no need or requirement for them to do so according to the code and the unlock_two_nondirectories() helper is pretty clear about it as well. So only call WARN_ON_ONCE() if the checked inode is valid. Fixes: 2454ad83b90a ("fs: Restrict lock_two_nondirectories() to non-directory inodes") Reviewed-by: Jan Kara Cc: Jan Kara Message-Id: <20230703-vfs-rename-source-v1-2-37eebb29b65b@kernel.org> Signed-off-by: Christian Brauner commit 66d8fc0539b0d49941f313c9509a8384e4245ac1 Author: Jan Kara Date: Mon Jul 3 16:49:11 2023 +0200 fs: no need to check source The @source inode must be valid. It is even checked via IS_SWAPFILE() above making it pretty clear. So no need to check it when we unlock. What doesn't need to exist is the @target inode. The lock_two_inodes() helper currently swaps the @inode1 and @inode2 arguments if @inode1 is NULL to have consistent lock class usage. However, we know that at least for vfs_rename() that @inode1 is @source and thus is never NULL as per above. We also know that @source is a different inode than @target as that is checked right at the beginning of vfs_rename(). So we know that @source is valid and locked and that @target is locked. So drop the check whether @source is non-NULL. Fixes: 28eceeda130f ("fs: Lock moved directories") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202307030026.9sE2pk2x-lkp@intel.com Message-Id: <20230703-vfs-rename-source-v1-1-37eebb29b65b@kernel.org> [brauner: use commit message from patch I sent concurrently] Signed-off-by: Christian Brauner commit f7306acec9aae9893d15e745c8791124d42ab10a Author: Ilya Maximets Date: Mon Jul 3 19:53:29 2023 +0200 xsk: Honor SO_BINDTODEVICE on bind Initial creation of an AF_XDP socket requires CAP_NET_RAW capability. A privileged process might create the socket and pass it to a non-privileged process for later use. However, that process will be able to bind the socket to any network interface. Even though it will not be able to receive any traffic without modification of the BPF map, the situation is not ideal. Sockets already have a mechanism that can be used to restrict what interface they can be attached to. That is SO_BINDTODEVICE. To change the SO_BINDTODEVICE binding the process will need CAP_NET_RAW. Make xsk_bind() honor the SO_BINDTODEVICE in order to allow safer workflow when non-privileged process is using AF_XDP. The intended workflow is following: 1. First process creates a bare socket with socket(AF_XDP, ...). 2. First process loads the XSK program to the interface. 3. First process adds the socket fd to a BPF map. 4. First process ties socket fd to a particular interface using SO_BINDTODEVICE. 5. First process sends socket fd to a second process. 6. Second process allocates UMEM. 7. Second process binds socket to the interface with bind(...). 8. Second process sends/receives the traffic. All the steps above are possible today if the first process is privileged and the second one has sufficient RLIMIT_MEMLOCK and no capabilities. However, the second process will be able to bind the socket to any interface it wants on step 7 and send traffic from it. With the proposed change, the second process will be able to bind the socket only to a specific interface chosen by the first process at step 4. Fixes: 965a99098443 ("xsk: add support for bind for Rx") Signed-off-by: Ilya Maximets Signed-off-by: Daniel Borkmann Acked-by: Magnus Karlsson Acked-by: John Fastabend Acked-by: Jason Wang Link: https://lore.kernel.org/bpf/20230703175329.3259672-1-i.maximets@ovn.org commit 72cea3a3175b50a4875b3c112fb13df20c6218a5 Author: Luke D. Jones Date: Tue Jul 4 16:46:19 2023 +1200 ALSA: hda/realtek: Whitespace fix Remove an erroneous whitespace. Fixes: 31278997add6 ("ALSA: hda/realtek - Add headset quirk for Dell DT") Signed-off-by: Luke D. Jones Link: https://lore.kernel.org/r/20230704044619.19343-6-luke@ljones.dev Signed-off-by: Takashi Iwai commit 33d7c9c3bf70ed91191a2bedbbc03783b824b5de Author: Luke D. Jones Date: Tue Jul 4 16:46:18 2023 +1200 ALSA: hda/realtek: Add quirk for ASUS ROG G614Jx Adds the required quirk to enable the Cirrus amp and correct pins on the ASUS ROG G614J series which uses an SPI connected Cirrus amp. While this works if the related _DSD properties are made available, these aren't included in the ACPI of these laptops (yet). Signed-off-by: Luke D. Jones Link: https://lore.kernel.org/r/20230704044619.19343-5-luke@ljones.dev Signed-off-by: Takashi Iwai commit b759a5f097cd42c666f1ebca8da50ff507435fbe Author: Luke D. Jones Date: Tue Jul 4 16:46:17 2023 +1200 ALSA: hda/realtek: Amend G634 quirk to enable rear speakers Amends the last quirk for the G634 with 0x1caf subsys to enable the rear speakers via pincfg. Signed-off-by: Luke D. Jones Link: https://lore.kernel.org/r/20230704044619.19343-4-luke@ljones.dev Signed-off-by: Takashi Iwai commit 9abc77fb144fe916fd2f592dc4b8c7bade02e58a Author: Luke D. Jones Date: Tue Jul 4 16:46:16 2023 +1200 ALSA: hda/realtek: Add quirk for ASUS ROG GA402X Adds the required quirk to enable the Cirrus amp and correct pins on the ASUS ROG GA402X series which uses an I2C connected Cirrus amp. While this works if the related _DSD properties are made available, these aren't included in the ACPI of these laptops (yet). Signed-off-by: Luke D. Jones Link: https://lore.kernel.org/r/20230704044619.19343-3-luke@ljones.dev Signed-off-by: Takashi Iwai commit 8cc87c055d28320e5fa5457922f43bc07dec58bd Author: Luke D. Jones Date: Tue Jul 4 16:46:15 2023 +1200 ALSA: hda/realtek: Add quirk for ASUS ROG GX650P Adds the required quirk to enable the Cirrus amp and correct pins on the ASUS ROG GV601V series which uses an I2C connected Cirrus amp. While this works if the related _DSD properties are made available, these aren't included in the ACPI of these laptops (yet). Signed-off-by: Luke D. Jones Link: https://lore.kernel.org/r/20230704044619.19343-2-luke@ljones.dev Signed-off-by: Takashi Iwai commit 21a235bce12361e64adfc2ef97e4ae2e51ad63d4 Author: Petr Pavlu Date: Wed Jun 21 15:12:13 2023 +0200 xen/virtio: Fix NULL deref when a bridge of PCI root bus has no parent When attempting to run Xen on a QEMU/KVM virtual machine with virtio devices (all x86_64), function xen_dt_get_node() crashes on accessing bus->bridge->parent->of_node because a bridge of the PCI root bus has no parent set: [ 1.694192][ T1] BUG: kernel NULL pointer dereference, address: 0000000000000288 [ 1.695688][ T1] #PF: supervisor read access in kernel mode [ 1.696297][ T1] #PF: error_code(0x0000) - not-present page [ 1.696297][ T1] PGD 0 P4D 0 [ 1.696297][ T1] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 1.696297][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.3.7-1-default #1 openSUSE Tumbleweed a577eae57964bb7e83477b5a5645a1781df990f0 [ 1.696297][ T1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014 [ 1.696297][ T1] RIP: e030:xen_virtio_restricted_mem_acc+0xd9/0x1c0 [ 1.696297][ T1] Code: 45 0c 83 e8 c9 a3 ea ff 31 c0 eb d7 48 8b 87 40 ff ff ff 48 89 c2 48 8b 40 10 48 85 c0 75 f4 48 8b 82 10 01 00 00 48 8b 40 40 <48> 83 b8 88 02 00 00 00 0f 84 45 ff ff ff 66 90 31 c0 eb a5 48 89 [ 1.696297][ T1] RSP: e02b:ffffc90040013cc8 EFLAGS: 00010246 [ 1.696297][ T1] RAX: 0000000000000000 RBX: ffff888006c75000 RCX: 0000000000000029 [ 1.696297][ T1] RDX: ffff888005ed1000 RSI: ffffc900400f100c RDI: ffff888005ee30d0 [ 1.696297][ T1] RBP: ffff888006c75010 R08: 0000000000000001 R09: 0000000330000006 [ 1.696297][ T1] R10: ffff888005850028 R11: 0000000000000002 R12: ffffffff830439a0 [ 1.696297][ T1] R13: 0000000000000000 R14: ffff888005657900 R15: ffff888006e3e1e8 [ 1.696297][ T1] FS: 0000000000000000(0000) GS:ffff88804a000000(0000) knlGS:0000000000000000 [ 1.696297][ T1] CS: e030 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1.696297][ T1] CR2: 0000000000000288 CR3: 0000000002e36000 CR4: 0000000000050660 [ 1.696297][ T1] Call Trace: [ 1.696297][ T1] [ 1.696297][ T1] virtio_features_ok+0x1b/0xd0 [ 1.696297][ T1] virtio_dev_probe+0x19c/0x270 [ 1.696297][ T1] really_probe+0x19b/0x3e0 [ 1.696297][ T1] __driver_probe_device+0x78/0x160 [ 1.696297][ T1] driver_probe_device+0x1f/0x90 [ 1.696297][ T1] __driver_attach+0xd2/0x1c0 [ 1.696297][ T1] bus_for_each_dev+0x74/0xc0 [ 1.696297][ T1] bus_add_driver+0x116/0x220 [ 1.696297][ T1] driver_register+0x59/0x100 [ 1.696297][ T1] virtio_console_init+0x7f/0x110 [ 1.696297][ T1] do_one_initcall+0x47/0x220 [ 1.696297][ T1] kernel_init_freeable+0x328/0x480 [ 1.696297][ T1] kernel_init+0x1a/0x1c0 [ 1.696297][ T1] ret_from_fork+0x29/0x50 [ 1.696297][ T1] [ 1.696297][ T1] Modules linked in: [ 1.696297][ T1] CR2: 0000000000000288 [ 1.696297][ T1] ---[ end trace 0000000000000000 ]--- The PCI root bus is in this case created from ACPI description via acpi_pci_root_add() -> pci_acpi_scan_root() -> acpi_pci_root_create() -> pci_create_root_bus() where the last function is called with parent=NULL. It indicates that no parent is present and then bus->bridge->parent is NULL too. Fix the problem by checking bus->bridge->parent in xen_dt_get_node() for NULL first. Fixes: ef8ae384b4c9 ("xen/virtio: Handle PCI devices which Host controller is described in DT") Signed-off-by: Petr Pavlu Reviewed-by: Oleksandr Tyshchenko Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/r/20230621131214.9398-2-petr.pavlu@suse.com Signed-off-by: Juergen Gross commit 54372cf043276735e29045abf998895b2ac277cf Author: Alexander Gordeev Date: Tue Jul 4 07:46:26 2023 +0200 Revert "s390/mm: get rid of VMEM_MAX_PHYS macro" This reverts commit 456be42aa713e7f83b467db66ceae779431c7d9d. The assumption VMEM_MAX_PHYS should match ident_map_size is wrong. At least discontiguous saved segments (DCSS) could be loaded at addresses beyond ident_map_size and dcssblk device driver might fail as result. Reported-by: Gerald Schaefer Signed-off-by: Alexander Gordeev commit 6aca56c024e42577c28706a85979a6967b9b5e97 Author: Thomas Richter Date: Fri Jun 23 11:26:30 2023 +0200 s390/cpum_sf: remove check on CPU being online During sampling event initialization, a check is done if that particular CPU the event is to be installed on is actually online. This check is not necessary, as it is also performed in the system call entry point. Therefore remove this check. No functional change. Signed-off-by: Thomas Richter Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit b2534c28b23b099fc399021283ffaf9f40513abf Author: Thomas Richter Date: Fri Jun 23 11:22:40 2023 +0200 s390/cpum_sf: handle casts consistently The casts are written in two different notations: (cast) expression and (cast)expression Convert statements with the first notation to the second notation. No functional change. Signed-off-by: Thomas Richter Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit c13166bdb23976e2cde8f25dd669e2d8250492c9 Author: Thomas Richter Date: Mon Mar 27 14:02:10 2023 +0200 s390/cpum_sf: remove unnecessary debug statement Remove debug_sprint_event() statement right after an pr_err() statement. No additional debug information is generated. No functional change. Signed-off-by: Thomas Richter Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit b2ae4969497ee982fc9f30e53301d53e88ea5b65 Author: Thomas Richter Date: Thu Mar 23 15:14:35 2023 +0100 s390/cpum_sf: remove parameter in call to pr_err The op argument is hardcoded in the parameter list of function pr_err. Make the op code part of the text printed by pr_err. No functional change. Signed-off-by: Thomas Richter Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit eeeff534e9946f1db16eedd35acb9554ad77f4cd Author: Thomas Richter Date: Thu Mar 23 15:07:04 2023 +0100 s390/cpum_sf: simplify function setup_pmu_cpu Print the error message when the FAILURE flag is set. This saves on pr_err statement as the text of the error message is identical in both failures. Also observe reverse Xmas tree variable declarations in this function. No functional change. Signed-off-by: Thomas Richter Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit f4767f9f32b7b1abf43baf3beb077e554e35eea7 Author: Thomas Richter Date: Thu Jun 22 15:08:24 2023 +0200 s390/cpum_cf: remove unneeded debug statements Remove most debug statements which are not needed anymore from the CPU Measurement counter facility device driver. Signed-off-by: Thomas Richter Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 1cfd4ccb3014922c8516557d857b6bc83e7db980 Author: Jan Beulich Date: Fri Jun 16 08:36:00 2023 +0200 x86/Xen: tidy xen-head.S First of all move PV-only ELF notes inside the XEN_PV conditional; note that - HV_START_LOW is dropped altogether, as it was meaningful for 32-bit PV only, - the 32-bit instance of VIRT_BASE is dropped, as it would be dead code once inside the conditional, - while PADDR_OFFSET is not exactly unused for PVH, it defaults to zero there, and the hypervisor (or tool stack) complains if it is present but VIRT_BASE isn't. Then have the "supported features" note actually report reality: All three of the features there are supported and/or applicable only in certain cases. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/f99bacc6-2a2f-41b0-5c0b-e01b7051cb07@suse.com Signed-off-by: Juergen Gross commit 24be4d0b46bb0c3c1dc7bacd30957d6144a70dfc Author: SeongJae Park Date: Tue Jul 4 01:00:03 2023 +0000 arch/arm64/mm/fault: Fix undeclared variable error in do_page_fault() Commit ae870a68b5d1 ("arm64/mm: Convert to using lock_mm_and_find_vma()") made do_page_fault() to use 'vma' even if CONFIG_PER_VMA_LOCK is not defined, but the declaration is still in the ifdef. As a result, building kernel without the config fails with undeclared variable error as below: arch/arm64/mm/fault.c: In function 'do_page_fault': arch/arm64/mm/fault.c:624:2: error: 'vma' undeclared (first use in this function); did you mean 'vmap'? 624 | vma = lock_mm_and_find_vma(mm, addr, regs); | ^~~ | vmap Fix it by moving the declaration out of the ifdef. Fixes: ae870a68b5d1 ("arm64/mm: Convert to using lock_mm_and_find_vma()") Signed-off-by: SeongJae Park Signed-off-by: Linus Torvalds commit e50df24979fd02f920aa7baada714a58bc61bfd9 Merge: 4f52875366bfb 3c2f765c81be1 Author: Linus Torvalds Date: Mon Jul 3 18:48:38 2023 -0700 Merge tag 'block-6.5-2023-07-03' of git://git.kernel.dk/linux Pull more block updates from Jens Axboe: "Mostly items that came in a bit late for the initial pull request, wanted to make sure they had the appropriate amount of linux-next soak before going upstream. Outside of stragglers, just generic fixes for either merge window items, or longer standing bugs" * tag 'block-6.5-2023-07-03' of git://git.kernel.dk/linux: (25 commits) md/raid0: add discard support for the 'original' layout nvme: disable controller on reset state failure nvme: sync timeout work on failed reset nvme: ensure unquiesce on teardown cdrom/gdrom: Fix build error nvme: improved uring polling block: add request polling helper nvme-mpath: fix I/O failure with EAGAIN when failing over I/O nvme: host: fix command name spelling blk-sysfs: add a new attr_group for blk_mq blk-iocost: move wbt_enable/disable_default() out of spinlock blk-wbt: cleanup rwb_enabled() and wbt_disabled() blk-wbt: remove dead code to handle wbt enable/disable with io inflight blk-wbt: don't create wbt sysfs entry if CONFIG_BLK_WBT is disabled blk-mq: fix two misuses on RQF_USE_SCHED blk-throttle: Fix io statistics for cgroup v1 bcache: Fix bcache device claiming bcache: Alloc holder object before async registration raid10: avoid spin_lock from fastpath from raid10_unplug() md: fix 'delete_mutex' deadlock ... commit 4f52875366bfbd6ddc19c1045b603d853e0a889c Merge: 69c9f23070f8b dfbe5561ae933 Author: Linus Torvalds Date: Mon Jul 3 18:43:10 2023 -0700 Merge tag 'io_uring-6.5-2023-07-03' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "The fix for the msghdr->msg_inq assigned value being wrong, using -1 instead of -1U for the signed type. Also a fix for ensuring when we're trying to run task_work on an exiting task, that we wait for it. This is not really a correctness thing as the work is being canceled, but it does help with ensuring file descriptors are closed when the task has exited." * tag 'io_uring-6.5-2023-07-03' of git://git.kernel.dk/linux: io_uring: flush offloaded and delayed task_work on exit io_uring: remove io_fallback_tw() forward declaration io_uring/net: use proper value for msg_inq commit 69c9f23070f8b4651b17557a0108d07b87437ede Merge: 0df241385b696 42877c38ac78e Author: Linus Torvalds Date: Mon Jul 3 17:31:36 2023 -0700 Merge tag 'hsi-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi Pull HSI updates from Sebastian Reichel: - fix build warning with W=1 - drop error handling for debugfs * tag 'hsi-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi: HSI: omap_ssi_port: Drop error checking for debugfs_create_dir HSI: fix ssi_waketest() declaration commit 0df241385b69616f5d7d41824348528b189ffd01 Merge: 02676ecca76ce ef8d95b4a3af4 Author: Linus Torvalds Date: Mon Jul 3 17:23:16 2023 -0700 Merge tag 'for-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: - Add new Qualcomm PMI8998/PM660 SMB2 charger - bq256xx: support systems without thermistors - cros_pchg: fix peripheral device status after system resume - axp20x_usb_power: add support for AXP192 - qcom-pon: add support for pm8941 - at91-reset: prepare to expose reset reason to sysfs - switch all I2C drivers back to use .probe instead of .probe_new - convert some more DT bindings to YAML - misc cleanups * tag 'for-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (28 commits) MAINTAINERS: add documentation file for Microchip SAMA5D2 shutdown controller dt-bindings: power: reset: atmel,sama5d2-shdwc: convert to yaml dt-bindings: power: reset: atmel,at91sam9260-shdwc: convert to yaml power: reset: at91-reset: change the power on reason prototype power: reset: qcom-pon: add support for pm8941-pon dt-bindings: power: reset: qcom-pon: define pm8941-pon power: supply: add Qualcomm PMI8998 SMB2 Charger driver dt-bindings: power: supply: qcom,pmi8998-charger: add bindings for smb2 driver power: supply: rt9467: Make charger-enable control as logic level power: supply: Switch i2c drivers back to use .probe() power: reset: add HAS_IOPORT dependencies dt-bindings: power: supply: axp20x: Add AXP192 compatible power: supply: axp20x_usb_power: Add support for AXP192 power: supply: axp20x_usb_power: Remove variant IDs from VBUS polling check power: supply: axp20x_usb_power: Use regmap field for VBUS disabling power: supply: axp20x_usb_power: Use regmap fields for USB BC feature power: supply: axp20x_usb_power: Use regmap fields for VBUS monitor feature power: supply: axp20x_usb_power: Simplify USB current limit handling power: supply: hwmon: constify pointers to hwmon_channel_info power: supply: twl4030_madc_battery: Refactor twl4030_madc_bat_ext_changed() ... commit 02676ecca76cea4316c8a1e867850d88f6149806 Merge: 6afb24a0fe729 181da4bcc3d4b Author: Linus Torvalds Date: Mon Jul 3 17:03:05 2023 -0700 Merge tag 'rproc-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: "The bulk of these patches relates to the moving to a void-returning remove callback. The i.MX HiFi remoteproc driver gets its pm_ops helpers updated to resolve build warnings about 'defined but not used' variables in certain configurations. The ST STM32 remoteproc driver is extended to allow using a SCMI reset controller to hold boot, and has an error message corrected. The Qualcomm Q6V5 PAS driver gains a missing 'static' qualifier on adsp_segment_dump()" * tag 'rproc-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (23 commits) remoteproc: qcom_q6v5_pas: staticize adsp_segment_dump() remoteproc: stm32: Fix error code in stm32_rproc_parse_dt() remoteproc: stm32: Allow hold boot management by the SCMI reset controller dt-bindings: remoteproc: st,stm32-rproc: Rework reset declarations remoteproc: imx_dsp_rproc: use modern pm_ops remoteproc: wkup_m3: Convert to platform remove callback returning void remoteproc: stm32: Convert to platform remove callback returning void remoteproc: st: Convert to platform remove callback returning void remoteproc: virtio: Convert to platform remove callback returning void remoteproc: rcar: Convert to platform remove callback returning void remoteproc: qcom_wcnss: Convert to platform remove callback returning void remoteproc: qcom_q6v5_wcss: Convert to platform remove callback returning void remoteproc: qcom_q6v5_pas: Convert to platform remove callback returning void remoteproc: qcom_q6v5_mss: Convert to platform remove callback returning void remoteproc: qcom_q6v5_adsp: Convert to platform remove callback returning void remoteproc: pru: Convert to platform remove callback returning void remoteproc: omap: Convert to platform remove callback returning void remoteproc: mtk_scp: Convert to platform remove callback returning void remoteproc: meson_mx_ao_arc: Convert to platform remove callback returning void remoteproc: keystone: Convert to platform remove callback returning void ... commit 6afb24a0fe7294f004ee6c43b10251ff86218d56 Merge: b39aeb338a6f3 1b39e76071443 Author: Linus Torvalds Date: Mon Jul 3 16:59:51 2023 -0700 Merge tag 'hwlock-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull hwspinlock update from Bjorn Andersson: "This drops the last of_match_ptr() from the hwspinlock drivers, solving the resulting 'defined but not used' warning/error" * tag 'hwlock-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: hwspinlock: omap: drop of_match_ptr for ID table commit b39aeb338a6f3854fe52c7e669438731ec2138c9 Author: Arnd Bergmann Date: Mon Jul 3 13:30:06 2023 +0200 rdma: fix INFINIBAND_USER_ACCESS dependency After a change to the bnxt_re driver, it fails to link when CONFIG_INFINIBAND_USER_ACCESS is disabled: aarch64-linux-ld: drivers/infiniband/hw/bnxt_re/ib_verbs.o: in function `bnxt_re_handler_BNXT_RE_METHOD_ALLOC_PAGE': ib_verbs.c:(.text+0xd64): undefined reference to `ib_uverbs_get_ucontext_file' aarch64-linux-ld: drivers/infiniband/hw/bnxt_re/ib_verbs.o:(.rodata+0x168): undefined reference to `uverbs_idr_class' aarch64-linux-ld: drivers/infiniband/hw/bnxt_re/ib_verbs.o:(.rodata+0x1a8): undefined reference to `uverbs_destroy_def_handler' The problem is that the 'bnxt_re_uapi_defs' structure is built unconditionally and references a couple of functions that are never really called in this configuration but instead require other functions that are left out. Adding an #ifdef around the new code, or a Kconfig dependency would address this problem, but adding the compile-time check inside of the UAPI_DEF_CHAIN_OBJ_TREE_NAMED() macro seems best because that also addresses the problem in other drivers that may run into the same dependency. Fixes: 360da60d6c6ed ("RDMA/bnxt_re: Enable low latency push") Signed-off-by: Arnd Bergmann Acked-by: Leon Romanovsky Signed-off-by: Linus Torvalds commit a8d70602b186f3c347e62c59a418be802b71886d Merge: e8069f5a8e3bd 9e396a2f434f8 Author: Linus Torvalds Date: Mon Jul 3 15:38:26 2023 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: - resume support in vdpa/solidrun - structure size optimizations in virtio_pci - new pds_vdpa driver - immediate initialization mechanism for vdpa/ifcvf - interrupt bypass for vdpa/mlx5 - multiple worker support for vhost - viirtio net in Intel F2000X-PL support for vdpa/ifcvf - fixes, cleanups all over the place * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (48 commits) vhost: Make parameter name match of vhost_get_vq_desc() vduse: fix NULL pointer dereference vhost: Allow worker switching while work is queueing vhost_scsi: add support for worker ioctls vhost: allow userspace to create workers vhost: replace single worker pointer with xarray vhost: add helper to parse userspace vring state/file vhost: remove vhost_work_queue vhost_scsi: flush IO vqs then send TMF rsp vhost_scsi: convert to vhost_vq_work_queue vhost_scsi: make SCSI cmd completion per vq vhost_sock: convert to vhost_vq_work_queue vhost: convert poll work to be vq based vhost: take worker or vq for flushing vhost: take worker or vq instead of dev for queueing vhost, vhost_net: add helper to check if vq has work vhost: add vhost_worker pointer to vhost_virtqueue vhost: dynamically allocate vhost_worker vhost: create worker at end of vhost_dev_set_owner virtio_bt: call scheduler when we free unused buffs ... commit e8069f5a8e3bdb5fdeeff895780529388592ee7a Merge: eded37770c9f8 255006adb3da7 Author: Linus Torvalds Date: Mon Jul 3 15:32:22 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "ARM64: - Eager page splitting optimization for dirty logging, optionally allowing for a VM to avoid the cost of hugepage splitting in the stage-2 fault path. - Arm FF-A proxy for pKVM, allowing a pKVM host to safely interact with services that live in the Secure world. pKVM intervenes on FF-A calls to guarantee the host doesn't misuse memory donated to the hyp or a pKVM guest. - Support for running the split hypervisor with VHE enabled, known as 'hVHE' mode. This is extremely useful for testing the split hypervisor on VHE-only systems, and paves the way for new use cases that depend on having two TTBRs available at EL2. - Generalized framework for configurable ID registers from userspace. KVM/arm64 currently prevents arbitrary CPU feature set configuration from userspace, but the intent is to relax this limitation and allow userspace to select a feature set consistent with the CPU. - Enable the use of Branch Target Identification (FEAT_BTI) in the hypervisor. - Use a separate set of pointer authentication keys for the hypervisor when running in protected mode, as the host is untrusted at runtime. - Ensure timer IRQs are consistently released in the init failure paths. - Avoid trapping CTR_EL0 on systems with Enhanced Virtualization Traps (FEAT_EVT), as it is a register commonly read from userspace. - Erratum workaround for the upcoming AmpereOne part, which has broken hardware A/D state management. RISC-V: - Redirect AMO load/store misaligned traps to KVM guest - Trap-n-emulate AIA in-kernel irqchip for KVM guest - Svnapot support for KVM Guest s390: - New uvdevice secret API - CMM selftest and fixes - fix racy access to target CPU for diag 9c x86: - Fix missing/incorrect #GP checks on ENCLS - Use standard mmu_notifier hooks for handling APIC access page - Drop now unnecessary TR/TSS load after VM-Exit on AMD - Print more descriptive information about the status of SEV and SEV-ES during module load - Add a test for splitting and reconstituting hugepages during and after dirty logging - Add support for CPU pinning in demand paging test - Add support for AMD PerfMonV2, with a variety of cleanups and minor fixes included along the way - Add a "nx_huge_pages=never" option to effectively avoid creating NX hugepage recovery threads (because nx_huge_pages=off can be toggled at runtime) - Move handling of PAT out of MTRR code and dedup SVM+VMX code - Fix output of PIC poll command emulation when there's an interrupt - Add a maintainer's handbook to document KVM x86 processes, preferred coding style, testing expectations, etc. - Misc cleanups, fixes and comments Generic: - Miscellaneous bugfixes and cleanups Selftests: - Generate dependency files so that partial rebuilds work as expected" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (153 commits) Documentation/process: Add a maintainer handbook for KVM x86 Documentation/process: Add a label for the tip tree handbook's coding style KVM: arm64: Fix misuse of KVM_ARM_VCPU_POWER_OFF bit index RISC-V: KVM: Remove unneeded semicolon RISC-V: KVM: Allow Svnapot extension for Guest/VM riscv: kvm: define vcpu_sbi_ext_pmu in header RISC-V: KVM: Expose IMSIC registers as attributes of AIA irqchip RISC-V: KVM: Add in-kernel virtualization of AIA IMSIC RISC-V: KVM: Expose APLIC registers as attributes of AIA irqchip RISC-V: KVM: Add in-kernel emulation of AIA APLIC RISC-V: KVM: Implement device interface for AIA irqchip RISC-V: KVM: Skeletal in-kernel AIA irqchip support RISC-V: KVM: Set kvm_riscv_aia_nr_hgei to zero RISC-V: KVM: Add APLIC related defines RISC-V: KVM: Add IMSIC related defines RISC-V: KVM: Implement guest external interrupt line management KVM: x86: Remove PRIx* definitions as they are solely for user space s390/uv: Update query for secret-UVCs s390/uv: replace scnprintf with sysfs_emit s390/uvdevice: Add 'Lock Secret Store' UVC ... commit eded37770c9f80ecd5ba842359c4f1058d9812c3 Merge: 56cbceab928d7 b6464883f45ae Author: Linus Torvalds Date: Mon Jul 3 15:19:56 2023 -0700 Merge tag 'kgdb-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux Pull kgdb updates from Daniel Thompson: "Fairly small changes this cycle: - An additional static inline function when kgdb is not enabled to reduce boilerplate in arch files - kdb will now handle input with linefeeds more like carriage return. This will make little difference for interactive use but can make it script to use expect-like interaction with kdb - A couple of warning fixes" * tag 'kgdb-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux: kdb: move kdb_send_sig() declaration to a better header file kdb: Handle LF in the command parser kdb: include kdb_private.h for function prototypes kgdb: Provide a stub kgdb_nmicallback() if !CONFIG_KGDB commit 432928c9377959684c748a9bc6553ed2d3c2ea4f Author: Bob Peterson Date: Wed Jun 28 09:54:41 2023 -0500 gfs2: Add quota_change type Function do_qc has two main uses: (1) to re-sync the local quota changes (qd) to the master quotas, and (2) normal quota changes. In the case of normal quota changes, the change can be positive or negative, as the quota usage goes up and down. Before this patch function do_qc was distinguishing one from another by whether the resulting value is or isn't zero: In the case of a re-sync (called do_sync) the quota value is moved from the temporary value to a master value, so the amount is added to one and subtracted from the other. The problem is that since the values can be positive or negative we can occasionally run into situations where we are not doing a re-sync but the quota change just happens to cancel out the previous value. In the case of a re-sync extra references and locks are taken, and so do_qc needs to release them. In the case of a normal quota change, no extra references and locks are taken, so it must not try to release them. The problem is: if the quota change is not a re-sync but the value just happens to cancel out the original quota change, the resulting zero value fools do_qc into thinking this is a re-sync and therefore it must release the extra references. This results in problems, mainly having to do with slot reference numbers going smaller than zero. This patch introduces new constants, QC_SYNC and QC_CHANGE so do_qc can really tell the difference. For QC_SYNC calls it must release the extra references acquired by gfs2_quota_unlock's call to qd_check_sync. For QC_CHANGE calls it does not have extra references to put. Note that this allows quota changes back to a value of zero, and so I removed an assert warning related to that. Signed-off-by: Bob Peterson Signed-off-by: Andreas Gruenbacher commit d68d0c6c3fc781c8a130e6a4d0666dbbd69e917b Author: Andreas Gruenbacher Date: Tue Jun 27 15:34:36 2023 +0200 gfs2: Use memcpy_{from,to}_page where appropriate Replace kmap_local_page() + memcpy() + kunmap_local() sequences with memcpy_{from,to}_page() where we are not doing anything else with the mapped page. Signed-off-by: Andreas Gruenbacher commit b0c21c6d527491276b1f7c9580bd2bf08c081add Author: Andreas Gruenbacher Date: Tue Jun 27 00:22:54 2023 +0200 gfs2: Convert remaining kmap_atomic calls to kmap_local_page Replace the remaining instances of kmap_atomic() ... kunmap_atomic() with kmap_local_page() ... kunmap_local(). In gfs2_write_buf_to_page(), we can call flush_dcache_page() after unmapping the page. Signed-off-by: Andreas Gruenbacher commit 58721bd46c9aaa2d890b2d61cbb8740745455aa9 Author: Deepak R Varma Date: Mon Jun 26 12:21:09 2023 +0530 gfs2: Replace deprecated kmap_atomic with kmap_local_page kmap_atomic() is deprecated in favor of kmap_local_{folio,page}(). Therefore, replace kmap_atomic() with kmap_local_page() in gfs2_internal_read() and stuffed_readpage(). kmap_atomic() disables page-faults and preemption (the latter only for !PREEMPT_RT kernels), However, the code within the mapping/un-mapping in gfs2_internal_read() and stuffed_readpage() does not depend on the above-mentioned side effects. Therefore, a mere replacement of the old API with the new one is all that is required (i.e., there is no need to explicitly add any calls to pagefault_disable() and/or preempt_disable()). Signed-off-by: Deepak R Varma Signed-off-by: Andreas Gruenbacher commit f246dd4b78e0efda8aa3f93f831a44e12ef0e59e Author: Andreas Gruenbacher Date: Wed Jun 21 22:32:06 2023 +0200 gfs: Get rid of unnucessary locking in inode_go_dump Commit 27a2660f1ef9 ("gfs2: Dump nrpages for inodes and their glocks") added some locking around reading inode->i_data.nrpages. That locking doesn't do anything really, so get rid of it. With that, the glock argument to ->go_dump() can be made const again as well. Signed-off-by: Andreas Gruenbacher commit 6c7410f44961cf72d49a18e455ad4ae833f6fb7c Author: Andreas Gruenbacher Date: Mon Nov 28 02:30:35 2022 +0100 gfs2: gfs2_freeze_lock_shared cleanup All the remaining users of gfs2_freeze_lock_shared() set freeze_gh to &sdp->sd_freeze_gh and flags to 0, so remove those two parameters. Signed-off-by: Andreas Gruenbacher commit 5432af15f8772d5e1a44d59d6ffcd513da8436b4 Author: Andreas Gruenbacher Date: Thu Aug 18 16:12:24 2022 +0200 gfs2: Replace sd_freeze_state with SDF_FROZEN flag Replace sd_freeze_state with a new SDF_FROZEN flag. There no longer is a need for indicating that a freeze is in progress (SDF_STARTING_FREEZE); we are now protecting the critical sections with the sd_freeze_mutex. Signed-off-by: Andreas Gruenbacher commit b77b4a4815a9651d1d6e07b8e6548eee9531a5eb Author: Andreas Gruenbacher Date: Mon Nov 14 23:34:50 2022 +0100 gfs2: Rework freeze / thaw logic So far, at mount time, gfs2 would take the freeze glock in shared mode and then immediately drop it again, turning it into a cached glock that can be reclaimed at any time. To freeze the filesystem cluster-wide, the node initiating the freeze would take the freeze glock in exclusive mode, which would cause the freeze glock's freeze_go_sync() callback to run on each node. There, gfs2 would freeze the filesystem and schedule gfs2_freeze_func() to run. gfs2_freeze_func() would re-acquire the freeze glock in shared mode, thaw the filesystem, and drop the freeze glock again. The initiating node would keep the freeze glock held in exclusive mode. To thaw the filesystem, the initiating node would drop the freeze glock again, which would allow gfs2_freeze_func() to resume on all nodes, leaving the filesystem in the thawed state. It turns out that in freeze_go_sync(), we cannot reliably and safely freeze the filesystem. This is primarily because the final unmount of a filesystem takes a write lock on the s_umount rw semaphore before calling into gfs2_put_super(), and freeze_go_sync() needs to call freeze_super() which also takes a write lock on the same semaphore, causing a deadlock. We could work around this by trying to take an active reference on the super block first, which would prevent unmount from running at the same time. But that can fail, and freeze_go_sync() isn't actually allowed to fail. To get around this, this patch changes the freeze glock locking scheme as follows: At mount time, each node takes the freeze glock in shared mode. To freeze a filesystem, the initiating node first freezes the filesystem locally and then drops and re-acquires the freeze glock in exclusive mode. All other nodes notice that there is contention on the freeze glock in their go_callback callbacks, and they schedule gfs2_freeze_func() to run. There, they freeze the filesystem locally and drop and re-acquire the freeze glock before re-thawing the filesystem. This is happening outside of the glock state engine, so there, we are allowed to fail. From a cluster point of view, taking and immediately dropping a glock is indistinguishable from taking the glock and only dropping it upon contention, so this new scheme is compatible with the old one. Thanks to Li Dong for reporting a locking bug in gfs2_freeze_func() in a previous version of this commit. Signed-off-by: Andreas Gruenbacher commit 56cbceab928d7ac3702de172ff8dcc1da2a6aaeb Merge: 868a9fd948078 18af4b5c97915 Author: Linus Torvalds Date: Mon Jul 3 13:23:10 2023 -0700 Merge tag 'usb-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt driver updates from Greg KH: "Here is the big set of USB and Thunderbolt driver updates for 6.5-rc1. Included in here are: - Lots of USB4/Thunderbolt additions and updates for new hardware types and fixes as people are starting to get access to the hardware in the wild - new gadget controller driver, cdns2, added - new typec drivers added - xhci driver updates - typec driver updates - usbip driver fixes - usb-serial driver updates and fixes - lots of smaller USB driver updates All of these have been in linux-next for a while with no reported problems" * tag 'usb-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (265 commits) usb: host: xhci-plat: Set XHCI_STATE_REMOVING before resuming XHCI HC usb: host: xhci: Do not re-initialize the XHCI HC if being removed usb: typec: nb7vpq904m: fix CONFIG_DRM dependency usbip: usbip_host: Replace strlcpy with strscpy usb: dwc3: gadget: Propagate core init errors to UDC during pullup USB: serial: option: add LARA-R6 01B PIDs usb: ulpi: Make container_of() no-op in to_ulpi_dev() usb: gadget: legacy: fix error return code in gfs_bind usb: typec: fsa4480: add support for Audio Accessory Mode usb: typec: fsa4480: rework mux & switch setup to handle more states usb: typec: ucsi: call typec_set_mode on non-altmode partner change USB: gadget: f_hid: make hidg_class a static const structure USB: gadget: f_printer: make usb_gadget_class a static const structure USB: mon: make mon_bin_class a static const structure USB: gadget: udc: core: make udc_class a static const structure USB: roles: make role_class a static const structure dt-bindings: usb: dwc3: Add interrupt-names property support for wakeup interrupt dt-bindings: usb: Add StarFive JH7110 USB controller dt-bindings: usb: dwc3: Add IPQ9574 compatible usb: cdns2: Fix spelling mistake in a trace message "Wakupe" -> "Wakeup" ... commit 2c5d234d7f55e4ba7f3ee00fb9452ac7c97b4a46 Author: Rahul Rameshbabu Date: Tue Jun 27 16:21:39 2023 -0700 ptp: Make max_phase_adjustment sysfs device attribute invisible when not supported The .adjphase operation is an operation that is implemented only by certain PHCs. The sysfs device attribute node for querying the maximum phase adjustment supported should not be exposed on devices that do not support .adjphase. Fixes: c3b60ab7a4df ("ptp: Add .getmaxphase callback to ptp_clock_info") Signed-off-by: Rahul Rameshbabu Reported-by: Nathan Chancellor Reported-by: Naresh Kamboju Reported-by: Linux Kernel Functional Testing Link: https://lore.kernel.org/netdev/20230627162146.GA114473@dev-arch.thelio-3990X/ Link: https://lore.kernel.org/all/CA+G9fYtKCZeAUTtwe69iK8Xcz1mOKQzwcy49wd+imZrfj6ifXA@mail.gmail.com/ Tested-by: Nathan Chancellor Reviewed-by: Andrew Lunn Acked-by: Richard Cochran Reviewed-by: Petr Vorel Message-ID: <20230627232139.213130-1-rrameshbabu@nvidia.com> Signed-off-by: Jakub Kicinski commit 868a9fd9480785952336e5f119e1f75877c423a8 Merge: db9c6d1d7fcc6 e534755c9412b Author: Linus Torvalds Date: Mon Jul 3 13:14:58 2023 -0700 Merge tag 'tty-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver updates from Greg KH: "Here is the big set of tty/serial driver updates for 6.5-rc1. Included in here are: - tty_audit code cleanups from Jiri - more 8250 cleanups from Ilpo - samsung_tty driver bugfixes - 8250 lock port updates - usual fsl_lpuart driver updates and fixes - other small serial driver fixes and updates, full details in the shortlog All of these have been in linux-next for a while with no reported issues" * tag 'tty-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (58 commits) tty_audit: make data of tty_audit_log() const tty_audit: make tty pointers in exposed functions const tty_audit: make icanon a bool tty_audit: invert the condition in tty_audit_log() tty_audit: use kzalloc() in tty_audit_buf_alloc() tty_audit: use TASK_COMM_LEN for task comm Revert "8250: add support for ASIX devices with a FIFO bug" serial: atmel: don't enable IRQs prematurely tty: serial: Add Nuvoton ma35d1 serial driver support tty: serial: fsl_lpuart: add earlycon for imx8ulp platform tty: serial: imx: fix rs485 rx after tx selftests: tty: add selftest for tty timestamp updates tty: tty_io: update timestamps on all device nodes tty: fix hang on tty device with no_room set serial: core: fix -EPROBE_DEFER handling in init serial: 8250_omap: Use force_suspend and resume for system suspend tty: serial: samsung_tty: Use abs() to simplify some code tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error serial: 8250: Apply FSL workarounds also without SERIAL_8250_CONSOLE ... commit db9c6d1d7fcc6dc803f042bf3d29bbff91837f57 Merge: fc75f21645935 4a22870cede37 Author: Linus Torvalds Date: Mon Jul 3 13:07:13 2023 -0700 Merge tag 'staging-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver updates from Greg KH: "Here is a set of staging driver updates for 6.5-rc1. It's a small update this merge window, nothing major at all, overall just under 1000 lines of code removed, not a huge churn. Nothing major to highlight here either, just lots of small coding style fixes. All of these have been in linux-next for a while with no reported problems" * tag 'staging-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (62 commits) staging: rtl8192e: Remove whitespace and blank lines staging: rtl8192e: remove 5G related code staging: rtl8192e: remove comparison to true staging: rtl8192e: remove return statement from void function staging: rtl8192e: convert else if sequence to switch staging: rtl8192e: clean up brace coding style issues staging: rtl8723bs: Fix blank line issues staging: rtl8723bs: Fix block comment issue staging: rtl8723bs: Fix indentation issues staging: vchiq_arm: Remove extra struct vchiq_instance declaration staging: rtl8192e: Rename variable InitialGainHandler staging: rtl8192e: Rename variable LeisurePSLeave staging: rtl8192e: Rename variable SetBWModeHandler staging: rtl8192e: Rename variable SetWirelessMode staging: rtl8192e: Rename RTLLIB_LINKED_SCANNING staging: rtl8192e: Rename RTLLIB_LINKED to MAC80211_LINKED staging: rtl8192e: Rename RTLLIB_NOLINK to MAC80211_NOLINK staging: rtl8192e: Rename state to link_state staging: rtl8192e: Rename rtllib_state to rtl_link_state staging: rtl8192e: Remove unused enum led_ctl_mode ... commit fc75f2164593554e3ec36261cec0588c8ed32641 Merge: 44aeec836da88 a91845b9a8720 Author: Linus Torvalds Date: Mon Jul 3 12:56:23 2023 -0700 Merge tag 'driver-core-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core updates from Greg KH: "Here are a small set of changes for 6.5-rc1 for some driver core changes. Included in here are: - device property cleanups to make it easier to write "agnostic" drivers when regards to the firmware layer underneath them (DT vs. ACPI) - debugfs documentation updates - devres additions - sysfs documentation and changes to handle empty directory creation logic better - tiny kernfs optimizations - other tiny changes All of these have been in linux-next for a while with no reported problems" * tag 'driver-core-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: sysfs: Skip empty folders creation sysfs: Improve readability by following the kernel coding style drivers: fwnode: fix fwnode_irq_get[_byname]() ata: ahci_platform: Make code agnostic to OF/ACPI device property: Implement device_is_compatible() ACPI: Move ACPI_DEVICE_CLASS() to mod_devicetable.h base/node: Use 'property' to identify an access parameter driver core: device.h: add some missing kerneldocs kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR isa: Remove unnecessary checks MAINTAINERS: add entry for auxiliary bus debugfs: Correct the 'debugfs_create_str' docs serial: qcom_geni: Comment use of devm_krealloc rather than devm_krealloc_array iio: adc: Use devm_krealloc_array hwmon: pmbus: Use devm_krealloc_array commit 5e2956ee46244ffba1d345bae8115aa5dc199adc Author: Kees Cook Date: Mon Jul 3 12:50:26 2023 -0700 Revert "fortify: Allow KUnit test to build without FORTIFY" This reverts commit a9dc8d0442294b426b1ebd4ec6097c82ebe282e0. The standard for KUnit is to not build tests at all when required functionality is missing, rather than doing test "skip". Restore this for the fortify tests, so that architectures without CONFIG_ARCH_HAS_FORTIFY_SOURCE do not emit unsolvable warnings. Reported-by: Geert Uytterhoeven Closes: https://lore.kernel.org/all/CAMuHMdUrxOEroHVUt7-mAnKSBjY=a-D3jr+XiAifuwv06Ob9Pw@mail.gmail.com Signed-off-by: Kees Cook commit 44aeec836da880c73a8deb2c7735c6e7c36f47c3 Merge: 0a8d6c9c7128a adfdaf81f9d48 Author: Linus Torvalds Date: Mon Jul 3 12:46:47 2023 -0700 Merge tag 'char-misc-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull Char/Misc updates from Greg KH: "Here is the big set of char/misc and other driver subsystem updates for 6.5-rc1. Lots of different, tiny, stuff in here, from a range of smaller driver subsystems, including pulls from some substems directly: - IIO driver updates and additions - W1 driver updates and fixes (and a new maintainer!) - FPGA driver updates and fixes - Counter driver updates - Extcon driver updates - Interconnect driver updates - Coresight driver updates - mfd tree tag merge needed for other updates on top of that, lots of small driver updates as patches, including: - static const updates for class structures - nvmem driver updates - pcmcia driver fix - lots of other small driver updates and fixes All of these have been in linux-next for a while with no reported problems" * tag 'char-misc-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (243 commits) bsr: fix build problem with bsr_class static cleanup comedi: make all 'class' structures const char: xillybus: make xillybus_class a static const structure xilinx_hwicap: make icap_class a static const structure virtio_console: make port class a static const structure ppdev: make ppdev_class a static const structure char: misc: make misc_class a static const structure /dev/mem: make mem_class a static const structure char: lp: make lp_class a static const structure dsp56k: make dsp56k_class a static const structure bsr: make bsr_class a static const structure oradax: make 'cl' a static const structure hwtracing: hisi_ptt: Fix potential sleep in atomic context hwtracing: hisi_ptt: Advertise PERF_PMU_CAP_NO_EXCLUDE for PTT PMU hwtracing: hisi_ptt: Export available filters through sysfs hwtracing: hisi_ptt: Add support for dynamically updating the filter list hwtracing: hisi_ptt: Factor out filter allocation and release operation samples: pfsm: add CC_CAN_LINK dependency misc: fastrpc: check return value of devm_kasprintf() coresight: dummy: Update type of mode parameter in dummy_{sink,source}_enable() ... commit 567f67acac94e7bbc4cb4b71ff9773555d02609a Author: Sebastian Reichel Date: Mon Jul 3 18:41:29 2023 +0200 irqchip/gic-v3: Enable Rockchip 3588001 erratum workaround for RK3588S Commit a8707f553884 ("irqchip/gic-v3: Add Rockchip 3588001 erratum workaround") mentioned RK3588S (the slimmed down variant of RK3588) being affected, but did not check for its compatible value. Thus the quirk is not applied on RK3588S. Since the GIC ITS node got added to the upstream DT, boards using RK3588S are no longer booting without this quirk being applied. Fixes: 06cdac8e8407 ("arm64: dts: rockchip: add GIC ITS support to rk3588") Signed-off-by: Sebastian Reichel Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230703164129.193991-1-sebastian.reichel@collabora.com commit 926846a703cbf5d0635cc06e67d34b228746554b Author: Marc Zyngier Date: Sat Jun 17 08:32:42 2023 +0100 irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation We normally rely on the irq_to_cpuid_[un]lock() primitives to make sure nothing will change col->idx while performing a LPI invalidation. However, these primitives do not cover VPE doorbells, and we have some open-coded locking for that. Unfortunately, this locking is pretty bogus. Instead, extend the above primitives to cover VPE doorbells and convert the whole thing to it. Fixes: f3a059219bc7 ("irqchip/gic-v4.1: Ensure mutual exclusion between vPE affinity change and RD access") Reported-by: Kunkun Jiang Signed-off-by: Marc Zyngier Cc: Zenghui Yu Cc: wanghaibin.wang@huawei.com Tested-by: Kunkun Jiang Reviewed-by: Zenghui Yu Link: https://lore.kernel.org/r/20230617073242.3199746-1-maz@kernel.org commit 55ad24857341c36616ecc1d9580af5626c226cf1 Author: Jonas Gorski Date: Thu Jun 29 09:26:20 2023 +0200 irq-bcm6345-l1: Do not assume a fixed block to cpu mapping The irq to block mapping is fixed, and interrupts from the first block will always be routed to the first parent IRQ. But the parent interrupts themselves can be routed to any available CPU. This is used by the bootloader to map the first parent interrupt to the boot CPU, regardless wether the boot CPU is the first one or the second one. When booting from the second CPU, the assumption that the first block's IRQ is mapped to the first CPU breaks, and the system hangs because interrupts do not get routed correctly. Fix this by passing the appropriate bcm6434_l1_cpu to the interrupt handler instead of the chip itself, so the handler always has the right block. Fixes: c7c42ec2baa1 ("irqchips/bmips: Add bcm6345-l1 interrupt controller") Signed-off-by: Jonas Gorski Reviewed-by: Philippe Mathieu-Daudé Reviewed-by: Florian Fainelli Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20230629072620.62527-1-jonas.gorski@gmail.com commit 0a8d6c9c7128a93689fba384cdd7f72b0ce19abd Merge: c156d4af43540 a33677b9211b6 Author: Linus Torvalds Date: Mon Jul 3 11:31:01 2023 -0700 Merge tag 'backlight-next-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "New Functionality: - Add lots of Device Tree bindings / support - Turn off LED strings when display is blank - Switch I2C drivers from .probe_new() to .probe() - Remove superfluous NULL checks - Only obtain PWM information once and do it in .probe() Fix-ups: - Ensure locks are obtained and held when required" * tag 'backlight-next-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: led_bl: Take led_access lock when required video: backlight: lp855x: Get PWM for PWM mode during probe dt-bindings: backlight: lp855x: Convert to YAML and modernize dt-bindings: backlight: pwm: Make power-supply not required backlight: pwm_bl: Remove unneeded checks for valid GPIOs backlight: Switch i2c drivers back to use .probe() backlight: lm3630a: Turn off both led strings when display is blank dt-bindings: leds: backlight: ktz8866: Add reg property and update example commit c156d4af4354091c38a1cbef62c0b1574e8c4394 Merge: b8ec70ab66b09 877e91191ccf0 Author: Linus Torvalds Date: Mon Jul 3 11:26:05 2023 -0700 Merge tag 'leds-next-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: "New Drivers: - Add support for Intel Cherry Trail Whiskey Cove PMIC LEDs - Add support for Awinic AW20036/AW20054/AW20072 LEDs New Device Support: - Add support for PMI632 LPG to QCom LPG - Add support for PMI8998 to QCom Flash - Add support for MT6331, WLEDs and MT6332 to Mediatek MT6323 PMIC New Functionality: - Implement the LP55xx Charge Pump - Add support for suspend / resume to Intel Cherry Trail Whiskey Cove PMIC - Add support for breathing mode to Intel Cherry Trail Whiskey Cove PMIC - Enable per-pin resolution Pinctrl in LEDs GPIO Fix-ups: - Allow thread to sleep by switching from spinlock to mutex - Add lots of Device Tree bindings / support - Adapt relationships / dependencies driven by Kconfig - Switch I2C drivers from .probe_new() to .probe() - Remove superfluous / duplicate code - Replace strlcpy() with strscpy() for efficiency and overflow prevention - Staticify various functions - Trivial: Fixing coding style - Simplify / reduce code Bug Fixes: - Prevent NETDEV_LED_MODE_LINKUP from being cleared on rename - Repair race between led_set_brightness(LED_{OFF,FULL}) - Fix Oops relating to sleeping in critical sections - Clear LED_INIT_DEFAULT_TRIGGER flag when clearing the current trigger - Do not leak resources in error handling paths - Fix unsigned comparison which can never be negative - Provide missing NULL terminating entries in tables - Fix misnaming issues" * tag 'leds-next-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (53 commits) leds: leds-mt6323: Adjust return/parameter types in wled get/set callbacks leds: sgm3140: Add richtek,rt5033-led compatible dt-bindings: leds: sgm3140: Document richtek,rt5033 compatible dt-bindings: backlight: kinetic,ktz8866: Add missing type for "current-num-sinks" dt-bindings: leds: Drop unneeded quotes leds: Fix config reference for AW200xx driver leds: leds-mt6323: Add support for WLEDs and MT6332 leds: leds-mt6323: Add support for MT6331 leds leds: leds-mt6323: Open code and drop MT6323_CAL_HW_DUTY macro leds: leds-mt6323: Drop MT6323_ prefix from macros and defines leds: leds-mt6323: Specify registers and specs in platform data dt-bindings: leds: leds-mt6323: Document mt6332 compatible dt-bindings: leds: leds-mt6323: Document mt6331 compatible leds: simatic-ipc-leds-gpio: Introduce more Kconfig switches leds: simatic-ipc-leds-gpio: Split up into multiple drivers leds: simatic-ipc-leds-gpio: Move two extra gpio pins into another table leds: simatic-ipc-leds-gpio: Add terminating entries to gpio tables leds: flash: leds-qcom-flash: Fix an unsigned comparison which can never be negative leds: cht-wcove: Remove unneeded semicolon leds: cht-wcove: Fix an unsigned comparison which can never be negative ... commit b8ec70ab66b09ee9e081a38b8625b5accb388176 Merge: 99bdeae21d254 b05740d71bd2f Author: Linus Torvalds Date: Mon Jul 3 10:55:04 2023 -0700 Merge tag 'mfd-next-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Drivers: - Add support for TI TPS6594/TPS6593/LP8764 PMICs - Add support for Samsung RT5033 Battery Charger - Add support for Analog Devices MAX77540 and MAX77541 PMICs New Device Support: - Add support for SPI to Rockchip RK808 (and friends) - Add support for AXP192 PMIC to X-Powers AXP20X - Add support for AXP313a PMIC to X-Powers AXP20X - Add support for RK806 to Rockchip RK8XX Removed Device Support: - Removed MFD support for Richtek RT5033 Battery Fix-ups: - Remove superfluous code - Switch I2C drivers from .probe_new() to .probe() - Convert over to managed resources (devm_*(), etc) - Use dev_err_probe() for returning errors from .probe() - Add lots of Device Tree bindings / support - Improve cache efficiency by switching to Maple - Use own exported namespaces (NS) - Include missing and remove superfluous headers - Start using / convert to the new shutdown sys-off API - Trivial: variable / define renaming - Make use of of_property_read_reg() when requesting DT 'reg's Bug Fixes: - Fix chip revision readout due to incorrect data masking - Amend incorrect register and mask values used for charger state - Hide unused functionality at compile time - Fix resource leaks following error handling routines - Return correct error values and fix error handling in general - Repair incorrect device names - used for device matching - Remedy broken module auto-loading" * tag 'mfd-next-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (51 commits) dt-bindings: mfd: max77541: Add ADI MAX77541/MAX77540 iio: adc: max77541: Add ADI MAX77541 ADC Support regulator: max77541: Add ADI MAX77541/MAX77540 Regulator Support dt-bindings: regulator: max77541: Add ADI MAX77541/MAX77540 Regulator mfd: Switch two more drivers back to use struct i2c_driver::probe dt-bindings: mfd: samsung,s5m8767: Simplify excluding properties mfd: stmpe: Only disable the regulators if they are enabled mfd: max77541: Add ADI MAX77541/MAX77540 PMIC Support dt-bindings: mfd: gateworks-gsc: Remove unnecessary fan-controller nodes mfd: core: Use of_property_read_reg() to parse "reg" mfd: stmfx: Nullify stmfx->vdd in case of error mfd: stmfx: Fix error path in stmfx_chip_init mfd: intel-lpss: Add missing check for platform_get_resource mfd: stpmic1: Add PMIC poweroff via sys-off handler mfd: stpmic1: Fixup main control register and bits naming dt-bindings: mfd: qcom,tcsr: Add the compatible for IPQ8074 mfd: tps65219: Add support for soft shutdown via sys-off API mfd: pm8008: Drop bogus i2c module alias mfd: pm8008: Fix module autoloading mfd: tps65219: Add GPIO cell instance ... commit 99bdeae21d254056a1072cb6de19e6f9b7f52496 Merge: b349de4c91e6a 1b712f18c461b Author: Linus Torvalds Date: Mon Jul 3 10:47:21 2023 -0700 Merge tag 'mailbox-v6.5' of git://git.linaro.org/landing-teams/working/fujitsu/integration Pull mailbox updates from Jassi Brar: - tegra: support for Tegra264 - broadcom: convert bcm2835 bindings from txt to yaml bcm2835 - qcom: support for IPQ5018 - ti: always zero TX data fields * tag 'mailbox-v6.5' of git://git.linaro.org/landing-teams/working/fujitsu/integration: mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 mailbox: tegra: add support for Tegra264 dt-bindings: mailbox: tegra: Document Tegra264 HSP dt-bindings: mailbox: convert bcm2835-mbox bindings to YAML dt-bindings: mailbox: qcom: Add IPQ5018 APCS compatible commit b349de4c91e6ad761c2beecc796615bcb64b36e6 Merge: a74195876b95f 1b733a9ebc3d8 Author: Linus Torvalds Date: Mon Jul 3 10:43:10 2023 -0700 Merge tag 'rtc-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "The isl1208 dirver was reworked tobe able to work as part of an MFD. All the Loongson chips are now supported through a new driver, the old one is removed. Summary: Subsystem: - Switch i2c drivers back to use .probe() - Constify pointers to hwmon_channel_info New driver: - Loongson on chip RTC, replacing the Loongson 1 only driver Drivers: - isl1208: cleanup and support for RAA215300 - st-lpc: cleanups - stm32: fix wakeup" * tag 'rtc-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (21 commits) rtc: Add rtc driver for the Loongson family chips rtc: Remove the Loongson-1 RTC driver dt-bindings: rtc: Split loongson,ls2x-rtc into SoC-based compatibles rtc: rv3028: make rv3028 probeable from userspace rtc: isl1208: Add support for the built-in RTC on the PMIC RAA215300 rtc: isl1208: Add isl1208_set_xtoscb() rtc: isl1208: Drop enum isl1208_id and split isl1208_configs[] rtc: isl1208: Make similar I2C and DT-based matching table rtc: isl1208: Drop name variable dt-bindings: rtc: isil,isl1208: Document clock and clock-names properties dt-bindings: rtc: isl1208: Convert to json-schema rtc: st-lpc: Simplify clk handling in st_rtc_probe() rtc: st-lpc: Release some resources in st_rtc_probe() in case of error rtc: stm32: remove dedicated wakeup management dt-bindings: rtc: restrict node name suffixes rtc: add HAS_IOPORT dependencies rtc: Switch i2c drivers back to use .probe() rtc: rv3032: constify pointers to hwmon_channel_info rtc: isl12022: constify pointers to hwmon_channel_info rtc: ds3232: constify pointers to hwmon_channel_info ... commit a74195876b95fce5f1c5b051b8c3b01e1b18a83b Merge: ae80b40419843 49b472ebc61de Author: Linus Torvalds Date: Mon Jul 3 10:33:23 2023 -0700 Merge tag 'i3c/for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: - svc: fix suspend/resume on some platforms, fix locking issues * tag 'i3c/for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: i3c: master: svc: add NACK check after start byte sent i3c: master: svc: fix cpu schedule in spin lock i3c: master: svc: fix i3c suspend/resume issue commit ae80b404198434e49e903dc3b1ba83e2c7bb3ee2 Author: Linus Torvalds Date: Mon Jul 3 10:08:50 2023 -0700 mm: validate the mm before dropping the mmap lock Commit 408579cd627a ("mm: Update do_vmi_align_munmap() return semantics") made the return value and locking semantics of do_vmi_align_munmap() more straightforward, but in the process it ended up unlocking the mmap lock just a tad too early: the debug code doing the mmap layout validation still needs to run with the lock held, or things might change under it while it's trying to validate things. So just move the unlocking to after the validate_mm() call. Reported-by: kernel test robot Link: https://lore.kernel.org/lkml/ZKIsoMOT71uwCIZX@xsang-OptiPlex-9020/ Fixes: 408579cd627a ("mm: Update do_vmi_align_munmap() return semantics") Signed-off-by: Linus Torvalds commit f8a473bf5db7a6abaa7cad40303e395dff702819 Author: Helge Deller Date: Mon Jul 3 18:43:13 2023 +0200 parisc: syscalls: Avoid compiler warnings with W=1 We do not want to add prototypes for all parisc specific syscalls, so simply drop such warnings when building the kernel. Signed-off-by: Helge Deller commit de53f3f7a9ffb8a24c3382aa41e24666c28f0368 Author: Helge Deller Date: Mon Jul 3 18:38:02 2023 +0200 parisc: math-emu: Avoid compiler warnings with W=1 The math-emu code is a snapshot from the HP-UX kernel. They've been modified as little as possible. See arch/parisc/math-emu/README. Signed-off-by: Helge Deller commit 28e113f89f33e0f1566045d2adc017e16a9bffb4 Author: Helge Deller Date: Mon Jul 3 16:02:04 2023 +0200 parisc: Raise minimal GCC version to 12.0.0 Raise the minimum gcc version for parisc64 to 12.0.0 (for __int128 type) and keep 5.1.0 as minimum for 32-bit parisc target. Fixes: 8664645ade97 ("parisc: Raise minimal GCC version") Signed-off-by: Helge Deller commit 6414b30b39f9d21fcd485aab6e20b7c65f4013d8 Author: Helge Deller Date: Mon Jul 3 18:23:39 2023 +0200 parisc: unwind: Avoid missing prototype warning for handle_interruption() Signed-off-by: Helge Deller commit f66066bc5136f25e36a2daff4896c768f18c211e Author: Linus Torvalds Date: Sun Jul 2 23:20:17 2023 -0700 execve: always mark stack as growing down during early stack setup While our user stacks can grow either down (all common architectures) or up (parisc and the ia64 register stack), the initial stack setup when we copy the argument and environment strings to the new stack at execve() time is always done by extending the stack downwards. But it turns out that in commit 8d7071af8907 ("mm: always expand the stack with the mmap write lock held"), as part of making the stack growing code more robust, 'expand_downwards()' was now made to actually check the vma flags: if (!(vma->vm_flags & VM_GROWSDOWN)) return -EFAULT; and that meant that this execve-time stack expansion started failing on parisc, because on that architecture, the stack flags do not contain the VM_GROWSDOWN bit. At the same time the new check in expand_downwards() is clearly correct, and simplified the callers, so let's not remove it. The solution is instead to just codify the fact that yes, during execve(), the stack grows down. This not only matches reality, it ends up being particularly simple: we already have special execve-time flags for the stack (VM_STACK_INCOMPLETE_SETUP) and use those flags to avoid page migration during this setup time (see vma_is_temporary_stack() and invalid_migration_vma()). So just add VM_GROWSDOWN to that set of temporary flags, and now our stack flags automatically match reality, and the parisc stack expansion works again. Note that the VM_STACK_INCOMPLETE_SETUP bits will be cleared when the stack is finalized, so we only add the extra VM_GROWSDOWN bit on CONFIG_STACK_GROWSUP architectures (ie parisc) rather than adding it in general. Link: https://lore.kernel.org/all/612eaa53-6904-6e16-67fc-394f4faa0e16@bell.net/ Link: https://lore.kernel.org/all/5fd98a09-4792-1433-752d-029ae3545168@gmx.de/ Fixes: 8d7071af8907 ("mm: always expand the stack with the mmap write lock held") Reported-by: John David Anglin Reported-and-tested-by: Helge Deller Reported-and-tested-by: Guenter Roeck Signed-off-by: Linus Torvalds commit 34acceaa8818a0ff4943ec5f2f8831cfa9d3fe7e Author: Yang Li Date: Mon Jul 3 09:38:50 2023 -0700 xfs: Remove unneeded semicolon ./fs/xfs/xfs_extfree_item.c:723:3-4: Unneeded semicolon Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=5728 Signed-off-by: Yang Li Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 2d7d1e7ea321b0b2810eb00183e21332ee9c4b6f Author: Darrick J. Wong Date: Thu Jun 29 10:15:45 2023 -0700 xfs: AGI length should be bounds checked Similar to the recent patch strengthening the AGF agf_length verification, the AGI verifier does not check that the AGI length field is within known good bounds. This isn't currently checked by runtime kernel code, yet we assume in many places that it is correct and verify other metadata against it. Add length verification to the AGI verifier. Just like the AGF length checking, the length of the AGI must be equal to the size of the AG specified in the superblock, unless it is the last AG in the filesystem. In that case, it must be less than or equal to sb->sb_agblocks and greater than XFS_MIN_AG_BLOCKS, which is the smallest AG a growfs operation will allow to exist. There's only one place in the filesystem that actually uses agi_length, but let's not leave it vulnerable to the same weird nonsense that generates syzbot bugs, eh? Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit 3de4d22cc9ac7c9f38e10edcf54f9a8891a9c2aa Author: SeongJae Park Date: Sat Jul 1 17:14:47 2023 +0000 bpf, btf: Warn but return no error for NULL btf from __register_btf_kfunc_id_set() __register_btf_kfunc_id_set() assumes .BTF to be part of the module's .ko file if CONFIG_DEBUG_INFO_BTF is enabled. If that's not the case, the function prints an error message and return an error. As a result, such modules cannot be loaded. However, the section could be stripped out during a build process. It would be better to let the modules loaded, because their basic functionalities have no problem [0], though the BTF functionalities will not be supported. Make the function to lower the level of the message from error to warn, and return no error. [0] https://lore.kernel.org/bpf/20220219082037.ow2kbq5brktf4f2u@apollo.legion Fixes: c446fdacb10d ("bpf: fix register_btf_kfunc_id_set for !CONFIG_DEBUG_INFO_BTF") Reported-by: Alexander Egorenkov Suggested-by: Kumar Kartikeya Dwivedi Signed-off-by: SeongJae Park Signed-off-by: Daniel Borkmann Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/87y228q66f.fsf@oc8242746057.ibm.com Link: https://lore.kernel.org/bpf/20220219082037.ow2kbq5brktf4f2u@apollo.legion Link: https://lore.kernel.org/bpf/20230701171447.56464-1-sj@kernel.org commit 147e17e297563bce7c3acc82b41e24463d9d6a64 Author: Helge Deller Date: Mon Jul 3 18:14:39 2023 +0200 parisc: smp: Add declaration for start_cpu_itimer() Avoid gcc warning about missing prototype for start_cpu_itimer(). Signed-off-by: Helge Deller commit 954b41be640223c694b2fb163f511a372ff0c602 Author: Helge Deller Date: Mon Jul 3 18:09:24 2023 +0200 parisc: pdt: Get prototype for arch_report_meminfo() Include linux/proc_fs.h to avoid compiler warning about missing prototype for 'arch_report_meminfo' Signed-off-by: Helge Deller commit 9e396a2f434f829fb3b98a24bb8db5429320589d Author: Xianting Tian Date: Wed Jun 21 17:38:35 2023 +0800 vhost: Make parameter name match of vhost_get_vq_desc() The parameter name in the function declaration and definition should be the same. drivers/vhost/vhost.h, int vhost_get_vq_desc(..., unsigned int iov_count,...); drivers/vhost/vhost.c, int vhost_get_vq_desc(..., unsigned int iov_size,...) Signed-off-by: Xianting Tian Message-Id: <20230621093835.36878-1-xianting.tian@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit f06cf1e1a503169280467d12d2ec89bf2c30ace7 Author: Maxime Coquelin Date: Thu Jun 22 22:48:51 2023 +0200 vduse: fix NULL pointer dereference vduse_vdpa_set_vq_affinity callback can be called with NULL value as cpu_mask when deleting the vduse device. This patch resets virtqueue's IRQ affinity mask value to set all CPUs instead of dereferencing NULL cpu_mask. [ 4760.952149] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 4760.959110] #PF: supervisor read access in kernel mode [ 4760.964247] #PF: error_code(0x0000) - not-present page [ 4760.969385] PGD 0 P4D 0 [ 4760.971927] Oops: 0000 [#1] PREEMPT SMP PTI [ 4760.976112] CPU: 13 PID: 2346 Comm: vdpa Not tainted 6.4.0-rc6+ #4 [ 4760.982291] Hardware name: Dell Inc. PowerEdge R640/0W23H8, BIOS 2.8.1 06/26/2020 [ 4760.989769] RIP: 0010:memcpy_orig+0xc5/0x130 [ 4760.994049] Code: 16 f8 4c 89 07 4c 89 4f 08 4c 89 54 17 f0 4c 89 5c 17 f8 c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 fa 08 72 1b <4c> 8b 06 4c 8b 4c 16 f8 4c 89 07 4c 89 4c 17 f8 c3 cc cc cc cc 66 [ 4761.012793] RSP: 0018:ffffb1d565abb830 EFLAGS: 00010246 [ 4761.018020] RAX: ffff9f4bf6b27898 RBX: ffff9f4be23969c0 RCX: ffff9f4bcadf6400 [ 4761.025152] RDX: 0000000000000008 RSI: 0000000000000000 RDI: ffff9f4bf6b27898 [ 4761.032286] RBP: 0000000000000000 R08: 0000000000000008 R09: 0000000000000000 [ 4761.039416] R10: 0000000000000000 R11: 0000000000000600 R12: 0000000000000000 [ 4761.046549] R13: 0000000000000000 R14: 0000000000000080 R15: ffffb1d565abbb10 [ 4761.053680] FS: 00007f64c2ec2740(0000) GS:ffff9f635f980000(0000) knlGS:0000000000000000 [ 4761.061765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4761.067513] CR2: 0000000000000000 CR3: 0000001875270006 CR4: 00000000007706e0 [ 4761.074645] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4761.081775] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 4761.088909] PKRU: 55555554 [ 4761.091620] Call Trace: [ 4761.094074] [ 4761.096180] ? __die+0x1f/0x70 [ 4761.099238] ? page_fault_oops+0x171/0x4f0 [ 4761.103340] ? exc_page_fault+0x7b/0x180 [ 4761.107265] ? asm_exc_page_fault+0x22/0x30 [ 4761.111460] ? memcpy_orig+0xc5/0x130 [ 4761.115126] vduse_vdpa_set_vq_affinity+0x3e/0x50 [vduse] [ 4761.120533] virtnet_clean_affinity.part.0+0x3d/0x90 [virtio_net] [ 4761.126635] remove_vq_common+0x1a4/0x250 [virtio_net] [ 4761.131781] virtnet_remove+0x5d/0x70 [virtio_net] [ 4761.136580] virtio_dev_remove+0x3a/0x90 [ 4761.140509] device_release_driver_internal+0x19b/0x200 [ 4761.145742] bus_remove_device+0xc2/0x130 [ 4761.149755] device_del+0x158/0x3e0 [ 4761.153245] ? kernfs_find_ns+0x35/0xc0 [ 4761.157086] device_unregister+0x13/0x60 [ 4761.161010] unregister_virtio_device+0x11/0x20 [ 4761.165543] device_release_driver_internal+0x19b/0x200 [ 4761.170770] bus_remove_device+0xc2/0x130 [ 4761.174782] device_del+0x158/0x3e0 [ 4761.178276] ? __pfx_vdpa_name_match+0x10/0x10 [vdpa] [ 4761.183336] device_unregister+0x13/0x60 [ 4761.187260] vdpa_nl_cmd_dev_del_set_doit+0x63/0xe0 [vdpa] Fixes: 28f6288eb63d ("vduse: Support set_vq_affinity callback") Cc: xieyongji@bytedance.com Signed-off-by: Maxime Coquelin Message-Id: <20230622204851.318125-1-maxime.coquelin@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Reviewed-by: Xie Yongji commit 228a27cf78afc63a18f744a56740d26570ecaec0 Author: Mike Christie Date: Mon Jun 26 18:23:07 2023 -0500 vhost: Allow worker switching while work is queueing This patch drops the requirement that we can only switch workers if work has not been queued by using RCU for the vq based queueing paths and a mutex for the device wide flush. We can also use this to support SIGKILL properly in the future where we should exit almost immediately after getting that signal. With this patch, when get_signal returns true, we can set the vq->worker to NULL and do a synchronize_rcu to prevent new work from being queued to the vhost_task that has been killed. Signed-off-by: Mike Christie Message-Id: <20230626232307.97930-18-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit d74b55e6550225ad0a28f0faa590cc9f780ba392 Author: Mike Christie Date: Mon Jun 26 18:23:06 2023 -0500 vhost_scsi: add support for worker ioctls This has vhost-scsi support the worker ioctls by calling the vhost_worker_ioctl helper. With a single worker, the single thread becomes a bottlneck when trying to use 3 or more virtqueues like: fio --filename=/dev/sdb --direct=1 --rw=randrw --bs=4k \ --ioengine=libaio --iodepth=128 --numjobs=3 With the patches and doing a worker per vq, we can scale to at least 16 vCPUs/vqs (that's my system limit) with the same command fio command above with numjobs=16: fio --filename=/dev/sdb --direct=1 --rw=randrw --bs=4k \ --ioengine=libaio --iodepth=64 --numjobs=16 which gives around 2002K IOPs. Note that for testing I dropped depth to 64 above because the vhost/virt layer supports only 1024 total commands per device. And the only tuning I did was set LIO's emulate_pr to 0 to avoid LIO's PR lock in the main IO path which becomes an issue at around 12 jobs/virtqueues. Signed-off-by: Mike Christie Message-Id: <20230626232307.97930-17-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit c1ecd8e9500797748ae4f79657971955d452d69d Author: Mike Christie Date: Mon Jun 26 18:23:05 2023 -0500 vhost: allow userspace to create workers For vhost-scsi with 3 vqs or more and a workload that tries to use them in parallel like: fio --filename=/dev/sdb --direct=1 --rw=randrw --bs=4k \ --ioengine=libaio --iodepth=128 --numjobs=3 the single vhost worker thread will become a bottlneck and we are stuck at around 500K IOPs no matter how many jobs, virtqueues, and CPUs are used. To better utilize virtqueues and available CPUs, this patch allows userspace to create workers and bind them to vqs. You can have N workers per dev and also share N workers with M vqs on that dev. This patch adds the interface related code and the next patch will hook vhost-scsi into it. The patches do not try to hook net and vsock into the interface because: 1. multiple workers don't seem to help vsock. The problem is that with only 2 virtqueues we never fully use the existing worker when doing bidirectional tests. This seems to match vhost-scsi where we don't see the worker as a bottleneck until 3 virtqueues are used. 2. net already has a way to use multiple workers. Signed-off-by: Mike Christie Message-Id: <20230626232307.97930-16-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 1cdaafa1b8b4ef6052869c86ba2b41c0cff05957 Author: Mike Christie Date: Mon Jun 26 18:23:04 2023 -0500 vhost: replace single worker pointer with xarray The next patch allows userspace to create multiple workers per device, so this patch replaces the vhost_worker pointer with an xarray so we can store mupltiple workers and look them up. Signed-off-by: Mike Christie Message-Id: <20230626232307.97930-15-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit cef25866f41c45a01a933adb032b0dcfb25b847a Author: Mike Christie Date: Mon Jun 26 18:23:03 2023 -0500 vhost: add helper to parse userspace vring state/file The next patches add new vhost worker ioctls which will need to get a vhost_virtqueue from a userspace struct which specifies the vq's index. This moves the vhost_vring_ioctl code to do this to a helper so it can be shared. Signed-off-by: Mike Christie Message-Id: <20230626232307.97930-14-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 27eca189114235fde84980b8ee044f42c1d59519 Author: Mike Christie Date: Mon Jun 26 18:23:02 2023 -0500 vhost: remove vhost_work_queue vhost_work_queue is no longer used. Each driver is using the poll or vq based queueing, so remove vhost_work_queue. Signed-off-by: Mike Christie Message-Id: <20230626232307.97930-13-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 0a3eac5239d2ddcfef8cc5b0c40095981536db90 Author: Mike Christie Date: Mon Jun 26 18:23:01 2023 -0500 vhost_scsi: flush IO vqs then send TMF rsp With one worker we will always send the scsi cmd responses then send the TMF rsp, because LIO will always complete the scsi cmds first then call into us to send the TMF response. With multiple workers, the IO vq workers could be running while the TMF/ctl vq worker is running so this has us do a flush before completing the TMF to make sure cmds are completed when it's work is later queued and run. Signed-off-by: Mike Christie Message-Id: <20230626232307.97930-12-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 78af31cc4e147ddb8a7b0db800837ad5db3e2a58 Author: Mike Christie Date: Mon Jun 26 18:23:00 2023 -0500 vhost_scsi: convert to vhost_vq_work_queue Convert from vhost_work_queue to vhost_vq_work_queue so we can remove vhost_work_queue. Signed-off-by: Mike Christie Message-Id: <20230626232307.97930-11-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 48ae70dd4d9c448d1d628b4ccbdd1d912cc24215 Author: Mike Christie Date: Mon Jun 26 18:22:59 2023 -0500 vhost_scsi: make SCSI cmd completion per vq This patch separates the scsi cmd completion code paths so we can complete cmds based on their vq instead of having all cmds complete on the same worker/CPU. This will be useful with the next patches that allow us to create mulitple worker threads and bind them to different vqs, and we can have completions running on different threads/CPUs. Signed-off-by: Mike Christie Reviewed-by: Stefan Hajnoczi Message-Id: <20230626232307.97930-10-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 9e09d0ec2b8da6f776a1c8bc7adf6d5501d43a37 Author: Mike Christie Date: Mon Jun 26 18:22:58 2023 -0500 vhost_sock: convert to vhost_vq_work_queue Convert from vhost_work_queue to vhost_vq_work_queue, so we can drop vhost_work_queue. Signed-off-by: Mike Christie Message-Id: <20230626232307.97930-9-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 493b94bf5ae0f6d67bd3728e8c723800d99a13ad Author: Mike Christie Date: Mon Jun 26 18:22:57 2023 -0500 vhost: convert poll work to be vq based This has the drivers pass in their poll to vq mapping and then converts the core poll code to use the vq based helpers. In the next patches we will allow vqs to be handled by different workers, so to allow drivers to execute operations like queue, stop, flush, etc on specific polls/vqs we need to know the mappings. Signed-off-by: Mike Christie Message-Id: <20230626232307.97930-8-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit a6fc04739be7cd8a744658fd2734906a6a0eb400 Author: Mike Christie Date: Mon Jun 26 18:22:56 2023 -0500 vhost: take worker or vq for flushing This patch has the core work flush function take a worker. When we support multiple workers we can then flush each worker during device removal, stoppage, etc. It also adds a helper to flush specific virtqueues, so vhost-scsi can flush IO vqs from it's ctl vq. Signed-off-by: Mike Christie Message-Id: <20230626232307.97930-7-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 0921dddcb5898030f0951816ed685a958acfbde2 Author: Mike Christie Date: Mon Jun 26 18:22:55 2023 -0500 vhost: take worker or vq instead of dev for queueing This patch has the core work queueing function take a worker for when we support multiple workers. It also adds a helper that takes a vq during queueing so modules can control which vq/worker to queue work on. This temp leaves vhost_work_queue. It will be removed when the drivers are converted in the next patches. Signed-off-by: Mike Christie Message-Id: <20230626232307.97930-6-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 9784df151a601fa1d6d146f8a7f35a2d875e2976 Author: Mike Christie Date: Mon Jun 26 18:22:54 2023 -0500 vhost, vhost_net: add helper to check if vq has work In the next patches each vq might have different workers so one could have work but others do not. For net, we only want to check specific vqs, so this adds a helper to check if a vq has work pending and converts vhost-net to use it. Signed-off-by: Mike Christie Acked-by: Jason Wang Message-Id: <20230626232307.97930-5-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 737bdb643c4f488defd6c226eb40de2c8f6e3f75 Author: Mike Christie Date: Mon Jun 26 18:22:53 2023 -0500 vhost: add vhost_worker pointer to vhost_virtqueue This patchset allows userspace to map vqs to different workers. This patch adds a worker pointer to the vq so in later patches in this set we can queue/flush specific vqs and their workers. Signed-off-by: Mike Christie Message-Id: <20230626232307.97930-4-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit c011bb669ddc22b0374d747d90467d1b2f80bc05 Author: Mike Christie Date: Mon Jun 26 18:22:52 2023 -0500 vhost: dynamically allocate vhost_worker This patchset allows us to allocate multiple workers, so this has us move from the vhost_worker that's embedded in the vhost_dev to dynamically allocating it. Signed-off-by: Mike Christie Message-Id: <20230626232307.97930-3-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 3e11c6eb6ab07de36cde49594e16fed044bf276e Author: Mike Christie Date: Mon Jun 26 18:22:51 2023 -0500 vhost: create worker at end of vhost_dev_set_owner vsock can start queueing work after VHOST_VSOCK_SET_GUEST_CID, so after we have called vhost_worker_create it can be calling vhost_work_queue and trying to access the vhost worker/task. If vhost_dev_alloc_iovecs fails, then vhost_worker_free could free the worker/task from under vsock. This moves vhost_worker_create to the end of vhost_dev_set_owner where we know we can no longer fail in that path. If it fails after the VHOST_SET_OWNER and userspace closes the device, then the normal vsock release handling will do the right thing. Signed-off-by: Mike Christie Message-Id: <20230626232307.97930-2-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 3845308fc8b0bc6a9345df4f69ef56f9adc52218 Author: Xianting Tian Date: Fri Jun 9 21:18:17 2023 +0800 virtio_bt: call scheduler when we free unused buffs For virtio-net we were getting CPU stall warnings, and fixed it by calling the scheduler: see f8bb51043945 ("virtio_net: suppress cpu stall when free_unused_bufs"). This driver is similar so theoretically the same logic applies. Signed-off-by: Xianting Tian Message-Id: <20230609131817.712867-4-xianting.tian@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 56b5e65efe0001fb5f95e412ee4167363debfc46 Author: Xianting Tian Date: Fri Jun 9 21:18:16 2023 +0800 virtio-console: call scheduler when we free unused buffs For virtio-net we were getting CPU stall warnings, and fixed it by calling the scheduler: see f8bb51043945 ("virtio_net: suppress cpu stall when free_unused_bufs"). This driver is similar so theoretically the same logic applies. Signed-off-by: Xianting Tian Message-Id: <20230609131817.712867-3-xianting.tian@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 7a5103b81a9628b6b66fc710d9ccdd2f2d27a58c Author: Xianting Tian Date: Fri Jun 9 21:18:15 2023 +0800 virtio-crypto: call scheduler when we free unused buffs For virtio-net we were getting CPU stall warnings, and fixed it by calling the scheduler: see f8bb51043945 ("virtio_net: suppress cpu stall when free_unused_bufs"). This driver is similar so theoretically the same logic applies. Signed-off-by: Xianting Tian Message-Id: <20230609131817.712867-2-xianting.tian@linux.alibaba.com> Signed-off-by: Michael S. Tsirkin commit 4cf8b6d051d955ff044ae61552ab0f7f91aad6b9 Author: Zhu Lingshan Date: Mon Jun 12 23:14:20 2023 +0800 vDPA/ifcvf: implement new accessors for vq_state This commit implements a better layout of the live migration bar, therefore the accessors for virtqueue state have been refactored. This commit also add a comment to the probing-ids list, indicating this driver drives F2000X-PL virtio-net Signed-off-by: Zhu Lingshan Message-Id: <20230612151420.1019504-4-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit ae904d9ce2cf8fec34cee72a67fcbee7640dd70f Author: Zhu Lingshan Date: Mon Jun 12 23:14:19 2023 +0800 vDPA/ifcvf: detect and report max allowed vq size Rather than a hardcode, this commit detects and reports the max value of allowed size of the virtqueues Signed-off-by: Zhu Lingshan Message-Id: <20230612151420.1019504-3-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit 7712832201eadb871c15ed96be1ec60d1e3ecacf Author: Zhu Lingshan Date: Mon Jun 12 23:14:18 2023 +0800 vDPA/ifcvf: dynamic allocate vq data stores This commit dynamically allocates the data stores for the virtqueues based on virtio_pci_common_cfg.num_queues. Signed-off-by: Zhu Lingshan Message-Id: <20230612151420.1019504-2-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit b45d8f3871574999002b79d551cac51a20bcfae6 Author: Jakub Kicinski Date: Fri Jun 30 10:15:50 2023 -0700 docs: remove the tips on how to submit patches from MAINTAINERS Having "how to submit patches" in MAINTAINTERS seems out of place. We have a whole section of documentation about it, duplication is harmful and a lot of the text looks really out of date. Sections 1, 2 and 4 look really, really old and not applicable to the modern process. Section 3 is obvious but also we have build bots now. Section 5 is a bit outdated (diff -u?!). But I like the part about factoring out shared code, so add that to process docs. Section 6 is unnecessary? Section 7 is covered by more appropriate docs. Signed-off-by: Jakub Kicinski Reviewed-by: Randy Dunlap Reviewed-by: Dan Williams Reviewed-by: Kees Cook Signed-off-by: Jonathan Corbet Message-ID: <20230630171550.128296-1-kuba@kernel.org> commit c398488dab7d731f942da9f34981b536fe187e3f Author: Xueshi Hu Date: Mon Jul 3 18:20:44 2023 +0800 docs: fix typo in zh_TW and zh_CN translation In zh_TW and zh_CN translation, "http://lwn.net/Articles" is incorrectly written as "http://lwn.net/Articles". This patch is generated by the following script: rg -l "lwn.net/Articles" | xargs sed -i 's/lwn.net\/articles/lwn.net\/Articles/g' Signed-off-by: Xueshi Hu Signed-off-by: Jonathan Corbet Message-ID: commit 531b3d1195d096f14e030c4b01ec3a53b80276bf Author: Huacai Chen Date: Wed Jun 28 19:08:47 2023 +0800 MIPS: Loongson: Fix build error when make modules_install After commit 0e96ea5c3eb5904e5dc2f ("MIPS: Loongson64: Clean up use of cc-ifversion") we get a build error when make modules_install: cc1: error: '-mloongson-mmi' must be used with '-mhard-float' The reason is when make modules_install, 'call cc-option' doesn't work in $(KBUILD_CFLAGS) of 'CHECKFLAGS'. Then there is no -mno-loongson-mmi applied and -march=loongson3a enable MMI instructions. To be detail, the error message comes from the CHECKFLAGS invocation of $(CC) but it has no impact on the final result of make modules_install, it is purely a cosmetic issue. The error occurs because cc-option is defined in scripts/Makefile.compiler, which is not included in Makefile when running 'make modules_install', as install targets are not supposed to require the compiler; see commit 805b2e1d427aab4b ("kbuild: include Makefile.compiler only when compiler is needed"). As a result, the call to check for '-mno-loongson-mmi' just never happens. Fix this by partially reverting to the old logic, use 'call cc-option' to conditionally apply -march=loongson3a and -march=mips64r2. By the way, Loongson-2E/2F is also broken in commit 13ceb48bc19c563e05f4 ("MIPS: Loongson2ef: Remove unnecessary {as,cc}-option calls") so fix it together. Fixes: 13ceb48bc19c563e05f4 ("MIPS: Loongson2ef: Remove unnecessary {as,cc}-option calls") Fixes: 0e96ea5c3eb5904e5dc2 ("MIPS: Loongson64: Clean up use of cc-ifversion") Cc: stable@vger.kernel.org Cc: Feiyang Chen Cc: Nathan Chancellor Cc: Nick Desaulniers Signed-off-by: Huacai Chen Reviewed-by: Nathan Chancellor Signed-off-by: Thomas Bogendoerfer commit e4de2057698636c0ee709e545d19b169d2069fa3 Author: Huacai Chen Date: Wed Jun 28 19:08:17 2023 +0800 MIPS: KVM: Fix NULL pointer dereference After commit 45c7e8af4a5e3f0bea4ac209 ("MIPS: Remove KVM_TE support") we get a NULL pointer dereference when creating a KVM guest: [ 146.243409] Starting KVM with MIPS VZ extensions [ 149.849151] CPU 3 Unable to handle kernel paging request at virtual address 0000000000000300, epc == ffffffffc06356ec, ra == ffffffffc063568c [ 149.849177] Oops[#1]: [ 149.849182] CPU: 3 PID: 2265 Comm: qemu-system-mip Not tainted 6.4.0-rc3+ #1671 [ 149.849188] Hardware name: THTF CX TL630 Series/THTF-LS3A4000-7A1000-ML4A, BIOS KL4.1F.TF.D.166.201225.R 12/25/2020 [ 149.849192] $ 0 : 0000000000000000 000000007400cce0 0000000000400004 ffffffff8119c740 [ 149.849209] $ 4 : 000000007400cce1 000000007400cce1 0000000000000000 0000000000000000 [ 149.849221] $ 8 : 000000240058bb36 ffffffff81421ac0 0000000000000000 0000000000400dc0 [ 149.849233] $12 : 9800000102a07cc8 ffffffff80e40e38 0000000000000001 0000000000400dc0 [ 149.849245] $16 : 0000000000000000 9800000106cd0000 9800000106cd0000 9800000100cce000 [ 149.849257] $20 : ffffffffc0632b28 ffffffffc05b31b0 9800000100ccca00 0000000000400000 [ 149.849269] $24 : 9800000106cd09ce ffffffff802f69d0 [ 149.849281] $28 : 9800000102a04000 9800000102a07cd0 98000001106a8000 ffffffffc063568c [ 149.849293] Hi : 00000335b2111e66 [ 149.849295] Lo : 6668d90061ae0ae9 [ 149.849298] epc : ffffffffc06356ec kvm_vz_vcpu_setup+0xc4/0x328 [kvm] [ 149.849324] ra : ffffffffc063568c kvm_vz_vcpu_setup+0x64/0x328 [kvm] [ 149.849336] Status: 7400cce3 KX SX UX KERNEL EXL IE [ 149.849351] Cause : 1000000c (ExcCode 03) [ 149.849354] BadVA : 0000000000000300 [ 149.849357] PrId : 0014c004 (ICT Loongson-3) [ 149.849360] Modules linked in: kvm nfnetlink_queue nfnetlink_log nfnetlink fuse sha256_generic libsha256 cfg80211 rfkill binfmt_misc vfat fat snd_hda_codec_hdmi input_leds led_class snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_pcm snd_timer snd serio_raw xhci_pci radeon drm_suballoc_helper drm_display_helper xhci_hcd ip_tables x_tables [ 149.849432] Process qemu-system-mip (pid: 2265, threadinfo=00000000ae2982d2, task=0000000038e09ad4, tls=000000ffeba16030) [ 149.849439] Stack : 9800000000000003 9800000100ccca00 9800000100ccc000 ffffffffc062cef4 [ 149.849453] 9800000102a07d18 c89b63a7ab338e00 0000000000000000 ffffffff811a0000 [ 149.849465] 0000000000000000 9800000106cd0000 ffffffff80e59938 98000001106a8920 [ 149.849476] ffffffff80e57f30 ffffffffc062854c ffffffff811a0000 9800000102bf4240 [ 149.849488] ffffffffc05b0000 ffffffff80e3a798 000000ff78000000 000000ff78000010 [ 149.849500] 0000000000000255 98000001021f7de0 98000001023f0078 ffffffff81434000 [ 149.849511] 0000000000000000 0000000000000000 9800000102ae0000 980000025e92ae28 [ 149.849523] 0000000000000000 c89b63a7ab338e00 0000000000000001 ffffffff8119dce0 [ 149.849535] 000000ff78000010 ffffffff804f3d3c 9800000102a07eb0 0000000000000255 [ 149.849546] 0000000000000000 ffffffff8049460c 000000ff78000010 0000000000000255 [ 149.849558] ... [ 149.849565] Call Trace: [ 149.849567] [] kvm_vz_vcpu_setup+0xc4/0x328 [kvm] [ 149.849586] [] kvm_arch_vcpu_create+0x184/0x228 [kvm] [ 149.849605] [] kvm_vm_ioctl+0x64c/0xf28 [kvm] [ 149.849623] [] sys_ioctl+0xc8/0x118 [ 149.849631] [] syscall_common+0x34/0x58 The root cause is the deletion of kvm_mips_commpage_init() leaves vcpu ->arch.cop0 NULL. So fix it by making cop0 from a pointer to an embedded object. Fixes: 45c7e8af4a5e3f0bea4ac209 ("MIPS: Remove KVM_TE support") Cc: stable@vger.kernel.org Reported-by: Yu Zhao Suggested-by: Thomas Bogendoerfer Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Huacai Chen Signed-off-by: Thomas Bogendoerfer commit 65fee014dc41a774bcd94896f3fb380bc39d8dda Author: Huacai Chen Date: Mon Jun 26 15:50:14 2023 +0800 MIPS: Loongson: Fix cpu_probe_loongson() again Commit 7db5e9e9e5e6c10d7d ("MIPS: loongson64: fix FTLB configuration") move decode_configs() from the beginning of cpu_probe_loongson() to the end in order to fix FTLB configuration. However, it breaks the CPUCFG decoding because decode_configs() use "c->options = xxxx" rather than "c->options |= xxxx", all information get from CPUCFG by decode_cpucfg() is lost. This causes error when creating a KVM guest on Loongson-3A4000: Exception Code: 4 not handled @ PC: 0000000087ad5981, inst: 0xcb7a1898 BadVaddr: 0x0 Status: 0x0 Fix this by moving the c->cputype setting to the beginning and moving decode_configs() after that. Fixes: 7db5e9e9e5e6c10d7d ("MIPS: loongson64: fix FTLB configuration") Cc: stable@vger.kernel.org Cc: Huang Pei Signed-off-by: Huacai Chen Signed-off-by: Thomas Bogendoerfer commit 7fb7998b599a2e1f3744fbd34a3e7145da841ed1 Author: Christian Brauner Date: Mon Jun 26 12:23:36 2023 +0200 ovl: move all parameter handling into params.{c,h} While initially I thought that we couldn't move all new mount api handling into params.{c,h} it turns out it is possible. So this just moves a good chunk of code out of super.c and into params.{c,h}. Signed-off-by: Christian Brauner Signed-off-by: Amir Goldstein commit bd55842ed998a622ba6611fe59b3358c9f76773d Author: Takashi Iwai Date: Mon Jul 3 13:24:30 2023 +0200 ALSA: pcm: Fix potential data race at PCM memory allocation helpers The PCM memory allocation helpers have a sanity check against too many buffer allocations. However, the check is performed without a proper lock and the allocation isn't serialized; this allows user to allocate more memories than predefined max size. Practically seen, this isn't really a big problem, as it's more or less some "soft limit" as a sanity check, and it's not possible to allocate unlimitedly. But it's still better to address this for more consistent behavior. The patch covers the size check in do_alloc_pages() with the card->memory_mutex, and increases the allocated size there for preventing the further overflow. When the actual allocation fails, the size is decreased accordingly. Reported-by: BassCheck Reported-by: Tuo Li Link: https://lore.kernel.org/r/CADm8Tek6t0WedK+3Y6rbE5YEt19tML8BUL45N2ji4ZAz1KcN_A@mail.gmail.com Reviewed-by: Jaroslav Kysela Cc: Link: https://lore.kernel.org/r/20230703112430.30634-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit e1ef683c86d248e785499779156d9885fd4e85fc Author: Geert Uytterhoeven Date: Mon Jul 3 11:05:30 2023 +0200 spi: rzv2m-csi: Fix SoC product name The SoC product name is "RZ/V2M". Signed-off-by: Geert Uytterhoeven Reviewed-by: Fabrizio Castro Link: https://lore.kernel.org/r/89e9870a2c510387e4d7a863025f4d3639d4a261.1688375020.git.geert+renesas@glider.be Signed-off-by: Mark Brown commit 6f49256897083848ce9a59651f6b53fc80462397 Author: Johan Hovold Date: Sat Jul 1 11:47:23 2023 +0200 ASoC: codecs: wcd938x: fix soundwire initialisation race Make sure that the soundwire device used for register accesses has been enumerated and initialised before trying to read the codec variant during component probe. This specifically avoids interpreting (a masked and shifted) -EBUSY errno as the variant: wcd938x_codec audio-codec: ASoC: error at soc_component_read_no_lock on audio-codec for register: [0x000034b0] -16 in case the soundwire device has not yet been initialised, which in turn prevents some headphone controls from being registered. Fixes: 8d78602aa87a ("ASoC: codecs: wcd938x: add basic driver") Cc: stable@vger.kernel.org # 5.14 Cc: Srinivas Kandagatla Reported-by: Steev Klimaszewski Signed-off-by: Johan Hovold Tested-by: Steev Klimaszewski Link: https://lore.kernel.org/r/20230701094723.29379-1-johan+linaro@kernel.org Signed-off-by: Mark Brown commit f781f661e8c99b0cb34129f2e374234d61864e77 Author: Christian König Date: Tue Jun 13 10:09:20 2023 +0200 dma-buf: keep the signaling time of merged fences v3 Some Android CTS is testing if the signaling time keeps consistent during merges. v2: use the current time if the fence is still in the signaling path and the timestamp not yet available. v3: improve comment, fix one more case to use the correct timestamp Signed-off-by: Christian König Reviewed-by: Luben Tuikov Link: https://patchwork.freedesktop.org/patch/msgid/20230630120041.109216-1-christian.koenig@amd.com commit efccd4e0f3ab6d97dcb097d1ae4cf022b6487aa3 Author: Sven Schnelle Date: Thu Jun 29 08:59:43 2023 +0200 s390/entry: remove mcck clock In the past machine checks where accounted as irq time. With the conversion to generic entry, it was decided to account machine checks to the current context. The stckf at the beginning of the machine check handler and the lowcore member is no longer required, therefore remove it. Signed-off-by: Sven Schnelle Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit cada938a01586fc144902919e133354b1459db04 Author: Heiko Carstens Date: Wed Jun 28 16:23:20 2023 +0200 s390: fix various typos Fix various typos found with codespell. Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 2b70a11955366b0732fbb63562458c316e01384a Author: Harald Freudenberger Date: Wed Jun 21 16:40:41 2023 +0200 s390/zcrypt: remove ZCRYPT_MULTIDEVNODES kernel config option Remove ZCRYPT_MULTIDEVNODES kernel config option and make the dependent code always build. The last years showed, that this option is enabled on all distros and exploited by some features (for example CEX plugin for kubernetes). So remove this choice as it was never used to switch off the multiple devices support for the zcrypt device driver. Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Signed-off-by: Alexander Gordeev commit af40322e90d4e0093569eceb7d3a28ab635f3e75 Author: Harald Freudenberger Date: Mon Jun 12 11:13:39 2023 +0200 s390/zcrypt: do not retry administrative requests All kind of administrative requests should not been retried. Some card firmware detects this and assumes a replay attack. This patch checks on failure if the low level functions indicate a retry (EAGAIN) and checks for the ADMIN flag set on the request message. If this both are true, the response code for this message is changed to EIO to make sure the zcrypt API layer does not attempt to retry the request. As of now the ADMIN flag is set for a request message when - for EP11 the field 'flags' of the EP11 CPRB struct has the leftmost bit set. - for CCA when the CPRB minor version is 'T3', 'T5', 'T6' or 'T7'. Please note that the do-not-retry only applies to a request which has been sent to the card (= has been successfully enqueued) but the reply indicates some kind of failure and by default it would be replied. It is totally fine to retry a request if a previous attempt to enqueue the msg into the firmware queue had some kind of failure and thus the card has never seen this request. Reported-by: Frank Uhlig Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Cc: stable@vger.kernel.org Signed-off-by: Alexander Gordeev commit 0fdcc88bb93f8200386d5d3015115b747d3391ae Author: Harald Freudenberger Date: Mon Jun 19 16:55:07 2023 +0200 s390/zcrypt: cleanup some debug code This patch removes most of the debug code which is build in when CONFIG_ZCRYPT_DEBUG is enabled. There is no real exploiter for this code any more and at least one ioctl fails with this code enabled. The CONFIG_ZCRYPT_DEBUG kernel config option still makes sense as some debug sysfs entries can get enabled with this and maybe long term a new better designed debug and error injection way will get introduced. This patch only removes code surrounded by the named kernel config option. This option should by default always be off anyway. The structs and defines removed by the patch have been used only by code surrounded by a CONFIG_ZCRYPT_DEBUG ifdef and thus can be removed also. In the end this patch removes all the failure-injection possibilities which had been available when the kernel had been build with CONFIG_ZCRYPT_DEBUG. It has never been used that much and was too unflexible anyway. Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Signed-off-by: Alexander Gordeev commit edbe28989847308406101256e10fdfb567ca9eb1 Author: Alexander Gordeev Date: Tue Apr 18 17:40:37 2023 +0200 s390/entry: rework entering DAT-on mode on CPU restart Instead of enforcing PSW_MASK_DAT bit on previously stored in lowcore restart_psw.mask use the PSW_KERNEL_BITS mask (which contains PSW_MASK_DAT) directly. As result, the PSW mask stored in lowcore is only used to enter the CPU restart routine, while PSW_KERNEL_BITS is used to enter the kernel code - similarily to commit 64ea2977add2 ("s390/mm: start kernel with DAT enabled"). Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit b492425c7073c308503eea9a1eec4b03d6e42ef0 Author: Alexander Gordeev Date: Thu Oct 29 15:29:23 2020 +0100 s390/mm: fence off VM macros from asm and linker Prevent assembler and linker scripts compilation errors by fencing it off with __ASSEMBLY__ define. Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit b378a982614360686f45c3e6b63fd5d1acd02d08 Author: Heiko Carstens Date: Thu Jun 22 10:46:32 2023 +0200 s390: include linux/io.h instead of asm/io.h Include linux/io.h instead of asm/io.h everywhere. linux/io.h includes asm/io.h, so this shouldn't cause any problems. Instead this might help for some randconfig build errors which were reported due to some undefined io related functions. Also move the changed include so it stays grouped together with other includes from the same directory. For ctcm_mpc.c also remove not needed comments (actually questions). Acked-by: Christian Borntraeger Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit b8af5999779d1225c82fcc960223625b279f5f0d Author: Heiko Carstens Date: Wed Jun 21 13:35:43 2023 +0200 s390/ptrace: make all psw related defines also available for asm Use the _AC() macro to make all psw related defines also available for assembler files. Acked-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 6376402841e1fa6f1c5b7604abc9c746a84c715a Author: Heiko Carstens Date: Wed Jun 21 13:35:42 2023 +0200 s390/ptrace: remove PSW_DEFAULT_KEY from uapi Move PSW_DEFAULT_KEY from uapi/asm/ptrace.h to asm/ptrace.h. This is possible, since it depends on PAGE_DEFAULT_ACC which is not part of uapi. Or in other words: this define cannot be used without error. Therefore remove it from uapi. Acked-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit d1e0e61d617ba17aa516db707aa871387566bbf7 Author: Lin Ma Date: Fri Jun 30 16:19:11 2023 +0800 net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure According to all consumers code of attrs[XFRMA_SEC_CTX], like * verify_sec_ctx_len(), convert to xfrm_user_sec_ctx* * xfrm_state_construct(), call security_xfrm_state_alloc whose prototype is int security_xfrm_state_alloc(.., struct xfrm_user_sec_ctx *sec_ctx); * copy_from_user_sec_ctx(), convert to xfrm_user_sec_ctx * ... It seems that the expected parsing result for XFRMA_SEC_CTX should be structure xfrm_user_sec_ctx, and the current xfrm_sec_ctx is confusing and misleading (Luckily, they happen to have same size 8 bytes). This commit amend the policy structure to xfrm_user_sec_ctx to avoid ambiguity. Fixes: cf5cb79f6946 ("[XFRM] netlink: Establish an attribute policy") Signed-off-by: Lin Ma Signed-off-by: Steffen Klassert commit b6464883f45ae6412de33e53587974fd86ba811e Author: Daniel Thompson Date: Fri Jun 30 21:12:06 2023 +0100 kdb: move kdb_send_sig() declaration to a better header file kdb_send_sig() is defined in the signal code and called from kdb, but the declaration is part of the kdb internal code. Move the declaration to the shared header to avoid the warning: kernel/signal.c:4789:6: error: no previous prototype for 'kdb_send_sig' [-Werror=missing-prototypes] Reported-by: Arnd Bergmann Closes: https://lore.kernel.org/lkml/20230517125423.930967-1-arnd@kernel.org/ Signed-off-by: Daniel Thompson Link: https://lore.kernel.org/r/20230630201206.2396930-1-daniel.thompson@linaro.org commit acd9755894c96c27078b52e0bfd894e48b0b1508 Author: Subash Abhinov Kasiviswanathan Date: Fri Jun 30 01:20:20 2023 -0600 Documentation: ABI: sysfs-class-net-qmi: pass_through contact update Switch to the quicinc.com id. Fixes: bd1af6b5fffd ("Documentation: ABI: sysfs-class-net-qmi: document pass-through file") Signed-off-by: Subash Abhinov Kasiviswanathan Signed-off-by: David S. Miller commit 998127cdb4699b9d470a9348ffe9f1154346be5f Author: Eric Dumazet Date: Thu Jun 29 16:41:50 2023 +0000 tcp: annotate data races in __tcp_oow_rate_limited() request sockets are lockless, __tcp_oow_rate_limited() could be called on the same object from different cpus. This is harmless. Add READ_ONCE()/WRITE_ONCE() annotations to avoid a KCSAN report. Fixes: 4ce7e93cb3fe ("tcp: rate limit ACK sent by SYN_RECV request sockets") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller commit c94683ed35ec33775e982af45a54723b7ab05851 Merge: a27ac53909220 326534e837c73 Author: David S. Miller Date: Mon Jul 3 09:17:52 2023 +0100 Merge branch 'wireguard-fixes' Jason A. Donenfeld says: ==================== wireguard fixes for 6.4.2/6.5-rc1 Sorry to send these patches during the merge window, but they're net fixes, not netdev enhancements, and while I'd ordinarily wait anyway, I just got a first bug report for one of these fixes, which I originally had thought was mostly unlikely. So please apply the following three patches to net: 1) Make proper use of nr_cpu_ids with cpumask_next(), rather than awkwardly using modulo, to handle dynamic CPU topology changes. Linus noticed this a while ago and pointed it out, and today a user actually got hit by it. 2) Respect persistent keepalive and other staged packets when setting the private key after the interface is already up. 3) Use timer_delete_sync() instead of del_timer_sync(), per the documentation. ==================== Signed-off-by: David S. Miller commit 326534e837c731496bdf0e02a8a61e987eb3bed0 Author: Jason A. Donenfeld Date: Mon Jul 3 03:27:06 2023 +0200 wireguard: timers: move to using timer_delete_sync The documentation says that del_timer_sync is obsolete, and code should use the equivalent timer_delete_sync instead, so switch to it. Signed-off-by: Jason A. Donenfeld Signed-off-by: David S. Miller commit f58d0a9b4c6a7a5199c3af967e43cc8b654604d4 Author: Jason A. Donenfeld Date: Mon Jul 3 03:27:05 2023 +0200 wireguard: netlink: send staged packets when setting initial private key Packets bound for peers can queue up prior to the device private key being set. For example, if persistent keepalive is set, a packet is queued up to be sent as soon as the device comes up. However, if the private key hasn't been set yet, the handshake message never sends, and no timer is armed to retry, since that would be pointless. But, if a user later sets a private key, the expectation is that those queued packets, such as a persistent keepalive, are actually sent. So adjust the configuration logic to account for this edge case, and add a test case to make sure this works. Maxim noticed this with a wg-quick(8) config to the tune of: [Interface] PostUp = wg set %i private-key somefile [Peer] PublicKey = ... Endpoint = ... PersistentKeepalive = 25 Here, the private key gets set after the device comes up using a PostUp script, triggering the bug. Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Cc: stable@vger.kernel.org Reported-by: Maxim Cournoyer Tested-by: Maxim Cournoyer Link: https://lore.kernel.org/wireguard/87fs7xtqrv.fsf@gmail.com/ Signed-off-by: Jason A. Donenfeld Signed-off-by: David S. Miller commit 7387943fa35516f6f8017a3b0e9ce48a3bef9faa Author: Jason A. Donenfeld Date: Mon Jul 3 03:27:04 2023 +0200 wireguard: queueing: use saner cpu selection wrapping Using `% nr_cpumask_bits` is slow and complicated, and not totally robust toward dynamic changes to CPU topologies. Rather than storing the next CPU in the round-robin, just store the last one, and also return that value. This simplifies the loop drastically into a much more common pattern. Fixes: e7096c131e51 ("net: WireGuard secure network tunnel") Cc: stable@vger.kernel.org Reported-by: Linus Torvalds Tested-by: Manuel Leiner Signed-off-by: Jason A. Donenfeld Signed-off-by: David S. Miller commit a27ac5390922059867f645eefd978e533d7af902 Author: J.J. Martzki Date: Sat Jul 1 22:37:37 2023 +0800 samples: pktgen: fix append mode failed issue Each sample script sources functions.sh before parameters.sh which makes $APPEND undefined when trapping EXIT no matter in append mode or not. Due to this when sample scripts finished they always do "pgctrl reset" which resets pktgen config. So move trap to each script after sourcing parameters.sh and trap EXIT explicitly. Signed-off-by: J.J. Martzki Signed-off-by: David S. Miller commit f56d1eeaeabf3aa613157b26aa07215fcd2c5719 Author: Daniel Díaz Date: Fri Jun 30 22:41:03 2023 -0600 selftests/net: Add xt_policy config for xfrm_policy test When running Kselftests with the current selftests/net/config the following problem can be seen with the net:xfrm_policy.sh selftest: # selftests: net: xfrm_policy.sh [ 41.076721] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 41.094787] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 41.107635] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready # modprobe: FATAL: Module ip_tables not found in directory /lib/modules/6.1.36 # iptables v1.8.7 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?) # Perhaps iptables or your kernel needs to be upgraded. # modprobe: FATAL: Module ip_tables not found in directory /lib/modules/6.1.36 # iptables v1.8.7 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?) # Perhaps iptables or your kernel needs to be upgraded. # SKIP: Could not insert iptables rule ok 1 selftests: net: xfrm_policy.sh # SKIP This is because IPsec "policy" match support is not available to the kernel. This patch adds CONFIG_NETFILTER_XT_MATCH_POLICY as a module to the selftests/net/config file, so that `make kselftest-merge` can take this into consideration. Signed-off-by: Daniel Díaz Signed-off-by: David S. Miller commit f88fcb1d7d961b4b402d675109726f94db87571c Author: Eric Dumazet Date: Sat Jul 1 02:48:24 2023 +0000 net: fix net_dev_start_xmit trace event vs skb_transport_offset() After blamed commit, we must be more careful about using skb_transport_offset(), as reminded us by syzbot: WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868 skb_transport_offset include/linux/skbuff.h:2977 [inline] WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868 perf_trace_net_dev_start_xmit+0x89a/0xce0 include/trace/events/net.h:14 Modules linked in: CPU: 0 PID: 10 Comm: kworker/u4:1 Not tainted 6.1.30-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet RIP: 0010:skb_transport_header include/linux/skbuff.h:2868 [inline] RIP: 0010:skb_transport_offset include/linux/skbuff.h:2977 [inline] RIP: 0010:perf_trace_net_dev_start_xmit+0x89a/0xce0 include/trace/events/net.h:14 Code: 8b 04 25 28 00 00 00 48 3b 84 24 c0 00 00 00 0f 85 4e 04 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc e8 56 22 01 fd <0f> 0b e9 f6 fc ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 86 f9 ff RSP: 0018:ffffc900002bf700 EFLAGS: 00010293 RAX: ffffffff8485d8ca RBX: 000000000000ffff RCX: ffff888100914280 RDX: 0000000000000000 RSI: 000000000000ffff RDI: 000000000000ffff RBP: ffffc900002bf818 R08: ffffffff8485d5b6 R09: fffffbfff0f8fb5e R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff110217d8f67 R13: ffff88810bec7b3a R14: dffffc0000000000 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8881f6a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f96cf6d52f0 CR3: 000000012224c000 CR4: 0000000000350ef0 Call Trace: [] trace_net_dev_start_xmit include/trace/events/net.h:14 [inline] [] xmit_one net/core/dev.c:3643 [inline] [] dev_hard_start_xmit+0x705/0x980 net/core/dev.c:3660 [] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [] dev_queue_xmit include/linux/netdevice.h:3030 [inline] [] batadv_send_skb_packet+0x3f3/0x680 net/batman-adv/send.c:108 [] batadv_send_broadcast_skb+0x24/0x30 net/batman-adv/send.c:127 [] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:393 [inline] [] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:421 [inline] [] batadv_iv_send_outstanding_bat_ogm_packet+0x69a/0x840 net/batman-adv/bat_iv_ogm.c:1701 [] process_one_work+0x8ac/0x1170 kernel/workqueue.c:2289 [] worker_thread+0xaa8/0x12d0 kernel/workqueue.c:2436 Fixes: 66e4c8d95008 ("net: warn if transport header was not set") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller commit a398b9ea0c3b791b7a0f4c6029a62cf628f97f22 Author: Vladimir Oltean Date: Sat Jul 1 01:20:10 2023 +0300 net: dsa: tag_sja1105: fix source port decoding in vlan_filtering=0 bridge mode There was a regression introduced by the blamed commit, where pinging to a VLAN-unaware bridge would fail with the repeated message "Couldn't decode source port" coming from the tagging protocol driver. When receiving packets with a bridge_vid as determined by dsa_tag_8021q_bridge_join(), dsa_8021q_rcv() will decode: - source_port = 0 (which isn't really valid, more like "don't know") - switch_id = 0 (which isn't really valid, more like "don't know") - vbid = value in range 1-7 Since the blamed patch has reversed the order of the checks, we are now going to believe that source_port != -1 and switch_id != -1, so they're valid, but they aren't. The minimal solution to the problem is to only populate source_port and switch_id with what dsa_8021q_rcv() came up with, if the vbid is zero, i.e. the source port information is trustworthy. Fixes: c1ae02d87689 ("net: dsa: tag_sja1105: always prefer source port information from INCL_SRCPT") Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 6ca3c005d0604e8d2b439366e3923ea58db99641 Author: Vladimir Oltean Date: Fri Jun 30 19:41:18 2023 +0300 net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode According to the synchronization rules for .ndo_get_stats() as seen in Documentation/networking/netdevices.rst, acquiring a plain spin_lock() should not be illegal, but the bridge driver implementation makes it so. After running these commands, I am being faced with the following lockdep splat: $ ip link add link swp0 name macsec0 type macsec encrypt on && ip link set swp0 up $ ip link add dev br0 type bridge vlan_filtering 1 && ip link set br0 up $ ip link set macsec0 master br0 && ip link set macsec0 up ======================================================== WARNING: possible irq lock inversion dependency detected 6.4.0-04295-g31b577b4bd4a #603 Not tainted -------------------------------------------------------- swapper/1/0 just changed the state of lock: ffff6bd348724cd8 (&br->lock){+.-.}-{3:3}, at: br_forward_delay_timer_expired+0x34/0x198 but this lock took another, SOFTIRQ-unsafe lock in the past: (&ocelot->stats_lock){+.+.}-{3:3} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Chain exists of: &br->lock --> &br->hash_lock --> &ocelot->stats_lock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&ocelot->stats_lock); local_irq_disable(); lock(&br->lock); lock(&br->hash_lock); lock(&br->lock); *** DEADLOCK *** (details about the 3 locks skipped) swp0 is instantiated by drivers/net/dsa/ocelot/felix.c, and this only matters to the extent that its .ndo_get_stats64() method calls spin_lock(&ocelot->stats_lock). Documentation/locking/lockdep-design.rst says: | A lock is irq-safe means it was ever used in an irq context, while a lock | is irq-unsafe means it was ever acquired with irq enabled. (...) | Furthermore, the following usage based lock dependencies are not allowed | between any two lock-classes:: | | -> | -> Lockdep marks br->hash_lock as softirq-safe, because it is sometimes taken in softirq context (for example br_fdb_update() which runs in NET_RX softirq), and when it's not in softirq context it blocks softirqs by using spin_lock_bh(). Lockdep marks ocelot->stats_lock as softirq-unsafe, because it never blocks softirqs from running, and it is never taken from softirq context. So it can always be interrupted by softirqs. There is a call path through which a function that holds br->hash_lock: fdb_add_hw_addr() will call a function that acquires ocelot->stats_lock: ocelot_port_get_stats64(). This can be seen below: ocelot_port_get_stats64+0x3c/0x1e0 felix_get_stats64+0x20/0x38 dsa_slave_get_stats64+0x3c/0x60 dev_get_stats+0x74/0x2c8 rtnl_fill_stats+0x4c/0x150 rtnl_fill_ifinfo+0x5cc/0x7b8 rtmsg_ifinfo_build_skb+0xe4/0x150 rtmsg_ifinfo+0x5c/0xb0 __dev_notify_flags+0x58/0x200 __dev_set_promiscuity+0xa0/0x1f8 dev_set_promiscuity+0x30/0x70 macsec_dev_change_rx_flags+0x68/0x88 __dev_set_promiscuity+0x1a8/0x1f8 __dev_set_rx_mode+0x74/0xa8 dev_uc_add+0x74/0xa0 fdb_add_hw_addr+0x68/0xd8 fdb_add_local+0xc4/0x110 br_fdb_add_local+0x54/0x88 br_add_if+0x338/0x4a0 br_add_slave+0x20/0x38 do_setlink+0x3a4/0xcb8 rtnl_newlink+0x758/0x9d0 rtnetlink_rcv_msg+0x2f0/0x550 netlink_rcv_skb+0x128/0x148 rtnetlink_rcv+0x24/0x38 the plain English explanation for it is: The macsec0 bridge port is created without p->flags & BR_PROMISC, because it is what br_manage_promisc() decides for a VLAN filtering bridge with a single auto port. As part of the br_add_if() procedure, br_fdb_add_local() is called for the MAC address of the device, and this results in a call to dev_uc_add() for macsec0 while the softirq-safe br->hash_lock is taken. Because macsec0 does not have IFF_UNICAST_FLT, dev_uc_add() ends up calling __dev_set_promiscuity() for macsec0, which is propagated by its implementation, macsec_dev_change_rx_flags(), to the lower device: swp0. This triggers the call path: dev_set_promiscuity(swp0) -> rtmsg_ifinfo() -> dev_get_stats() -> ocelot_port_get_stats64() with a calling context that lockdep doesn't like (br->hash_lock held). Normally we don't see this, because even though many drivers that can be bridge ports don't support IFF_UNICAST_FLT, we need a driver that (a) doesn't support IFF_UNICAST_FLT, *and* (b) it forwards the IFF_PROMISC flag to another driver, and (c) *that* driver implements ndo_get_stats64() using a softirq-unsafe spinlock. Condition (b) is necessary because the first __dev_set_rx_mode() calls __dev_set_promiscuity() with "bool notify=false", and thus, the rtmsg_ifinfo() code path won't be entered. The same criteria also hold true for DSA switches which don't report IFF_UNICAST_FLT. When the DSA master uses a spin_lock() in its ndo_get_stats64() method, the same lockdep splat can be seen. I think the deadlock possibility is real, even though I didn't reproduce it, and I'm thinking of the following situation to support that claim: fdb_add_hw_addr() runs on a CPU A, in a context with softirqs locally disabled and br->hash_lock held, and may end up attempting to acquire ocelot->stats_lock. In parallel, ocelot->stats_lock is currently held by a thread B (say, ocelot_check_stats_work()), which is interrupted while holding it by a softirq which attempts to lock br->hash_lock. Thread B cannot make progress because br->hash_lock is held by A. Whereas thread A cannot make progress because ocelot->stats_lock is held by B. When taking the issue at face value, the bridge can avoid that problem by simply making the ports promiscuous from a code path with a saner calling context (br->hash_lock not held). A bridge port without IFF_UNICAST_FLT is going to become promiscuous as soon as we call dev_uc_add() on it (which we do unconditionally), so why not be preemptive and make it promiscuous right from the beginning, so as to not be taken by surprise. With this, we've broken the links between code that holds br->hash_lock or br->lock and code that calls into the ndo_change_rx_flags() or ndo_get_stats64() ops of the bridge port. Fixes: 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.") Signed-off-by: Vladimir Oltean Reviewed-by: Ido Schimmel Signed-off-by: David S. Miller commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 Author: Tuo Li Date: Mon Jul 3 11:10:16 2023 +0800 ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync(): if (codec->regmap) In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync(): map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync(). [ Note: the lack of the regmap_lock itself is harmless for the current codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ] Reported-by: BassCheck Signed-off-by: Tuo Li Link: https://lore.kernel.org/r/20230703031016.1184711-1-islituo@gmail.com Signed-off-by: Takashi Iwai commit 73f1c75d5e6bd8ce2a887ef493a66ad1b16ed704 Author: dengxiang Date: Mon Jul 3 10:17:51 2023 +0800 ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 These models use NSIWAY amplifiers for internal speaker, but cannot put sound outside from these amplifiers. So eapd verbs are needed to initialize the amplifiers. They can be added during boot to get working sound out of internal speaker. Signed-off-by: dengxiang Link: https://lore.kernel.org/r/20230703021751.2945750-1-dengxiang@nfschina.com Signed-off-by: Takashi Iwai commit abaa02fc944f2f9f2c2e1925ddaceaf35c48528c Author: Pali Rohár Date: Fri May 5 19:28:18 2023 +0200 powerpc: dts: turris1x.dts: Fix PCIe MEM size for pci2 node Freescale PCIe controllers on their PCIe Root Ports do not have any mappable PCI BAR allocate from PCIe MEM. Information about 1MB window on BAR0 of PCIe Root Port was misleading because Freescale PCIe controllers have at BAR0 position different register PEXCSRBAR, and kernel correctly skipts BAR0 for these Freescale PCIe Root Ports. So update comment about P2020 PCIe Root Port and decrease PCIe MEM size required for PCIe controller (pci2 node) on which is on-board xHCI controller. lspci confirms that on P2020 PCIe Root Port is no PCI BAR and /proc/iomem sees that only c0000000-c000ffff and c0010000-c0011fff ranges are used. Fixes: 54c15ec3b738 ("powerpc: dts: Add DTS file for CZ.NIC Turris 1.x routers") Signed-off-by: Pali Rohár Signed-off-by: Michael Ellerman Link: https://msgid.link/20230505172818.18416-1-pali@kernel.org commit 6cb44bef35ac11724ef22c5ae4f1bc607e2ef3d8 Author: Douglas Anderson Date: Thu Jun 29 12:45:06 2023 -0700 powerpc: Include asm/nmi.c in mobility.c for watchdog_hardlockup_set_timeout_pct() The powerpc/platforms/pseries/mobility.c calls watchdog_hardlockup_set_timeout_pct(), which is declared in . We used to automatically get included, but that changed as of commit 7ca8fe94aa92 ("watchdog/hardlockup: define HARDLOCKUP_DETECTOR_ARCH"). Let's add the explicit include. Reported-by: Randy Dunlap Closes: https://lore.kernel.org/r/af19b76d-aa4b-6c88-9cac-eae4b2072497@infradead.org Fixes: 7ca8fe94aa92 ("watchdog/hardlockup: define HARDLOCKUP_DETECTOR_ARCH") Signed-off-by: Douglas Anderson Tested-by: Randy Dunlap # build-tested Reviewed-by: Petr Mladek Reviewed-by: Randy Dunlap Signed-off-by: Michael Ellerman Link: https://msgid.link/20230629124500.1.I55e2f4e7903d686c4484cb23c033c6a9e1a9d4c4@changeid commit 39f49684036d24af800ff194c33c7b2653c591d7 Author: Randy Dunlap Date: Fri Jun 30 22:47:12 2023 -0700 powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y In a randconfig with CONFIG_SERIAL_CPM=m and CONFIG_PPC_EARLY_DEBUG_CPM=y, there is a build error: ERROR: modpost: "udbg_putc" [drivers/tty/serial/cpm_uart/cpm_uart.ko] undefined! Prevent the build error by allowing PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y. Fixes: c374e00e17f1 ("[POWERPC] Add early debug console for CPM serial ports.") Signed-off-by: Randy Dunlap Reviewed-by: Pali Rohár Reviewed-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://msgid.link/20230701054714.30512-1-rdunlap@infradead.org commit 3fbff91afbf0148e937b8718ed865b073c587d9f Merge: 44f10dbefd5e4 a901a3568fd26 Author: Andrew Morton Date: Sun Jul 2 18:53:03 2023 -0700 Merge branch 'master' into mm-hotfixes-stable commit 44b4494d5c5971dc8f531c8783d90a637e862880 Author: Konstantin Komarov Date: Fri Jun 30 15:23:07 2023 +0400 fs/ntfs3: Correct mode for label entry inside /proc/fs/ntfs3/ Suggested-by: Dan Carpenter Signed-off-by: Konstantin Komarov commit 7832e123490ac39f85ab5befc2ceee7b25b03acb Author: Konstantin Komarov Date: Mon May 8 13:39:45 2023 +0400 fs/ntfs3: Add support /proc/fs/ntfs3//volinfo and /proc/fs/ntfs3//label Metafile /proc/fs/ntfs3//label allows to read/write current ntfs label. Signed-off-by: Konstantin Komarov commit d5ca77335846944d77d1e67ed841044074550943 Author: Konstantin Komarov Date: Mon May 8 13:41:24 2023 +0400 fs/ntfs3: Fix endian problem Signed-off-by: Konstantin Komarov commit 33e70701ed313fa4aca78cde89ef09c794584a9b Author: Konstantin Komarov Date: Mon May 8 13:37:22 2023 +0400 fs/ntfs3: Add ability to format new mft records with bigger/smaller header Just define in ntfs.h #define MFTRECORD_FIXUP_OFFSET MFTRECORD_FIXUP_OFFSET_1 or #define MFTRECORD_FIXUP_OFFSET MFTRECORD_FIXUP_OFFSET_3 Signed-off-by: Konstantin Komarov commit a81f47c4406e372ce47aff140f3876babac5f01e Author: Konstantin Komarov Date: Mon May 8 12:59:06 2023 +0400 fs/ntfs3: Code refactoring Check functions arguments. Use u8 instead of size_t for ntfs names, more consts and other. Signed-off-by: Konstantin Komarov commit f037776165b0643199f50fb105be1c3dcf8e8726 Author: Konstantin Komarov Date: Mon May 8 12:22:05 2023 +0400 fs/ntfs3: Code formatting clang-format-15 was used to format code according kernel's .clang-format. Signed-off-by: Konstantin Komarov commit f1d325b8c75e90487b1691fee0199669ea94fff1 Author: Konstantin Komarov Date: Mon May 8 12:09:10 2023 +0400 fs/ntfs3: Do not update primary boot in ntfs_init_from_boot() 'cause it may be faked boot. Let ntfs to be mounted and update boot later. Signed-off-by: Konstantin Komarov commit 6a4cd3ea7d771be17177d95ff67d22cfa2a38b50 Author: Konstantin Komarov Date: Mon May 8 11:56:13 2023 +0400 fs/ntfs3: Alternative boot if primary boot is corrupted Some code refactoring added also. Signed-off-by: Konstantin Komarov commit e0f363a98830e8d7d70fbaf91c07ae0b7c57aafe Author: Konstantin Komarov Date: Mon May 8 11:36:28 2023 +0400 fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted Signed-off-by: Konstantin Komarov commit d6cd7cecfd5e4a189db97876c317d96ebca075fa Author: Konstantin Komarov Date: Mon May 8 11:26:45 2023 +0400 fs/ntfs3: Fix ntfs_atomic_open This fixes xfstest 633/696. Signed-off-by: Konstantin Komarov commit 14f527d44de632c8d1d65b42ca1bee26bc426455 Author: Konstantin Komarov Date: Mon May 8 13:32:10 2023 +0400 fs/ntfs3: Correct checking while generating attr_list Correct slightly previous commit: Enhance sanity check while generating attr_list Signed-off-by: Konstantin Komarov commit ea303f72d70ce2f0b0aa94ab127085289768c5a6 Author: Tetsuo Handa Date: Tue Mar 28 20:05:16 2023 +0900 fs/ntfs3: Use __GFP_NOWARN allocation at ntfs_load_attr_list() syzbot is reporting too large allocation at ntfs_load_attr_list(), for a crafted filesystem can have huge data_size. Reported-by: syzbot Link: https://syzkaller.appspot.com/bug?extid=89dbb3a789a5b9711793 Signed-off-by: Tetsuo Handa Signed-off-by: Konstantin Komarov commit 97498cd610c0d030a7bd49a7efad974790661162 Author: Jia-Ju Bai Date: Tue Mar 21 21:22:11 2023 +0800 fs: ntfs3: Fix possible null-pointer dereferences in mi_read() In a previous commit 2681631c2973 ("fs/ntfs3: Add null pointer check to attr_load_runs_vcn"), ni can be NULL in attr_load_runs_vcn(), and thus it should be checked before being used. However, in the call stack of this commit, mft_ni in mi_read() is aliased with ni in attr_load_runs_vcn(), and it is also used in mi_read() at two places: mi_read() rw_lock = &mft_ni->file.run_lock -> No check attr_load_runs_vcn(mft_ni, ...) ni (namely mft_ni) is checked in the previous commit attr_load_runs_vcn(..., &mft_ni->file.run) -> No check Thus, to avoid possible null-pointer dereferences, the related checks should be added. These bugs are reported by a static analysis tool implemented by myself, and they are found by extending a known bug fixed in the previous commit. Thus, they could be theoretical bugs. Signed-off-by: Jia-Ju Bai Signed-off-by: Konstantin Komarov commit c9db0ff04649aa0b45f497183c957fe260f229f6 Author: Edward Lo Date: Fri Mar 17 18:23:03 2023 +0800 fs/ntfs3: Return error for inconsistent extended attributes ntfs_read_ea is called when we want to read extended attributes. There are some sanity checks for the validity of the EAs. However, it fails to return a proper error code for the inconsistent attributes, which might lead to unpredicted memory accesses after return. [ 138.916927] BUG: KASAN: use-after-free in ntfs_set_ea+0x453/0xbf0 [ 138.923876] Write of size 4 at addr ffff88800205cfac by task poc/199 [ 138.931132] [ 138.933016] CPU: 0 PID: 199 Comm: poc Not tainted 6.2.0-rc1+ #4 [ 138.938070] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 138.947327] Call Trace: [ 138.949557] [ 138.951539] dump_stack_lvl+0x4d/0x67 [ 138.956834] print_report+0x16f/0x4a6 [ 138.960798] ? ntfs_set_ea+0x453/0xbf0 [ 138.964437] ? kasan_complete_mode_report_info+0x7d/0x200 [ 138.969793] ? ntfs_set_ea+0x453/0xbf0 [ 138.973523] kasan_report+0xb8/0x140 [ 138.976740] ? ntfs_set_ea+0x453/0xbf0 [ 138.980578] __asan_store4+0x76/0xa0 [ 138.984669] ntfs_set_ea+0x453/0xbf0 [ 138.988115] ? __pfx_ntfs_set_ea+0x10/0x10 [ 138.993390] ? kernel_text_address+0xd3/0xe0 [ 138.998270] ? __kernel_text_address+0x16/0x50 [ 139.002121] ? unwind_get_return_address+0x3e/0x60 [ 139.005659] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 139.010177] ? arch_stack_walk+0xa2/0x100 [ 139.013657] ? filter_irq_stacks+0x27/0x80 [ 139.017018] ntfs_setxattr+0x405/0x440 [ 139.022151] ? __pfx_ntfs_setxattr+0x10/0x10 [ 139.026569] ? kvmalloc_node+0x2d/0x120 [ 139.030329] ? kasan_save_stack+0x41/0x60 [ 139.033883] ? kasan_save_stack+0x2a/0x60 [ 139.037338] ? kasan_set_track+0x29/0x40 [ 139.040163] ? kasan_save_alloc_info+0x1f/0x30 [ 139.043588] ? __kasan_kmalloc+0x8b/0xa0 [ 139.047255] ? __kmalloc_node+0x68/0x150 [ 139.051264] ? kvmalloc_node+0x2d/0x120 [ 139.055301] ? vmemdup_user+0x2b/0xa0 [ 139.058584] __vfs_setxattr+0x121/0x170 [ 139.062617] ? __pfx___vfs_setxattr+0x10/0x10 [ 139.066282] __vfs_setxattr_noperm+0x97/0x300 [ 139.070061] __vfs_setxattr_locked+0x145/0x170 [ 139.073580] vfs_setxattr+0x137/0x2a0 [ 139.076641] ? __pfx_vfs_setxattr+0x10/0x10 [ 139.080223] ? __kasan_check_write+0x18/0x20 [ 139.084234] do_setxattr+0xce/0x150 [ 139.087768] setxattr+0x126/0x140 [ 139.091250] ? __pfx_setxattr+0x10/0x10 [ 139.094948] ? __virt_addr_valid+0xcb/0x140 [ 139.097838] ? __call_rcu_common.constprop.0+0x1c7/0x330 [ 139.102688] ? debug_smp_processor_id+0x1b/0x30 [ 139.105985] ? kasan_quarantine_put+0x5b/0x190 [ 139.109980] ? putname+0x84/0xa0 [ 139.113886] ? __kasan_slab_free+0x11e/0x1b0 [ 139.117961] ? putname+0x84/0xa0 [ 139.121316] ? preempt_count_sub+0x1c/0xd0 [ 139.124427] ? __mnt_want_write+0xae/0x100 [ 139.127836] ? mnt_want_write+0x8f/0x150 [ 139.130954] path_setxattr+0x164/0x180 [ 139.133998] ? __pfx_path_setxattr+0x10/0x10 [ 139.137853] ? __pfx_ksys_pwrite64+0x10/0x10 [ 139.141299] ? debug_smp_processor_id+0x1b/0x30 [ 139.145714] ? fpregs_assert_state_consistent+0x6b/0x80 [ 139.150796] __x64_sys_setxattr+0x71/0x90 [ 139.155407] do_syscall_64+0x3f/0x90 [ 139.159035] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 139.163843] RIP: 0033:0x7f108cae4469 [ 139.166481] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 088 [ 139.183764] RSP: 002b:00007fff87588388 EFLAGS: 00000286 ORIG_RAX: 00000000000000bc [ 139.190657] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f108cae4469 [ 139.196586] RDX: 00007fff875883b0 RSI: 00007fff875883d1 RDI: 00007fff875883b6 [ 139.201716] RBP: 00007fff8758c530 R08: 0000000000000001 R09: 00007fff8758c618 [ 139.207940] R10: 0000000000000006 R11: 0000000000000286 R12: 00000000004004c0 [ 139.214007] R13: 00007fff8758c610 R14: 0000000000000000 R15: 0000000000000000 Signed-off-by: Edward Lo Signed-off-by: Konstantin Komarov commit fdec309c7672cbee4dc0229ee4cbb33c948a1bdd Author: Edward Lo Date: Thu Mar 16 10:56:55 2023 +0800 fs/ntfs3: Enhance sanity check while generating attr_list ni_create_attr_list uses WARN_ON to catch error cases while generating attribute list, which only prints out stack trace and may not be enough. This repalces them with more proper error handling flow. [ 59.666332] BUG: kernel NULL pointer dereference, address: 000000000000000e [ 59.673268] #PF: supervisor read access in kernel mode [ 59.678354] #PF: error_code(0x0000) - not-present page [ 59.682831] PGD 8000000005ff1067 P4D 8000000005ff1067 PUD 7dee067 PMD 0 [ 59.688556] Oops: 0000 [#1] PREEMPT SMP KASAN PTI [ 59.692642] CPU: 0 PID: 198 Comm: poc Tainted: G B W 6.2.0-rc1+ #4 [ 59.698868] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 59.708795] RIP: 0010:ni_create_attr_list+0x505/0x860 [ 59.713657] Code: 7e 10 e8 5e d0 d0 ff 45 0f b7 76 10 48 8d 7b 16 e8 00 d1 d0 ff 66 44 89 73 16 4d 8d 75 0e 4c 89 f7 e8 3f d0 d0 ff 4c 8d8 [ 59.731559] RSP: 0018:ffff88800a56f1e0 EFLAGS: 00010282 [ 59.735691] RAX: 0000000000000001 RBX: ffff88800b7b5088 RCX: ffffffffb83079fe [ 59.741792] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffffbb7f9fc0 [ 59.748423] RBP: ffff88800a56f3a8 R08: ffff88800b7b50a0 R09: fffffbfff76ff3f9 [ 59.754654] R10: ffffffffbb7f9fc7 R11: fffffbfff76ff3f8 R12: ffff88800b756180 [ 59.761552] R13: 0000000000000000 R14: 000000000000000e R15: 0000000000000050 [ 59.768323] FS: 00007feaa8c96440(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000 [ 59.776027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 59.781395] CR2: 00007f3a2e0b1000 CR3: 000000000a5bc000 CR4: 00000000000006f0 [ 59.787607] Call Trace: [ 59.790271] [ 59.792488] ? __pfx_ni_create_attr_list+0x10/0x10 [ 59.797235] ? kernel_text_address+0xd3/0xe0 [ 59.800856] ? unwind_get_return_address+0x3e/0x60 [ 59.805101] ? __kasan_check_write+0x18/0x20 [ 59.809296] ? preempt_count_sub+0x1c/0xd0 [ 59.813421] ni_ins_attr_ext+0x52c/0x5c0 [ 59.817034] ? __pfx_ni_ins_attr_ext+0x10/0x10 [ 59.821926] ? __vfs_setxattr+0x121/0x170 [ 59.825718] ? __vfs_setxattr_noperm+0x97/0x300 [ 59.829562] ? __vfs_setxattr_locked+0x145/0x170 [ 59.833987] ? vfs_setxattr+0x137/0x2a0 [ 59.836732] ? do_setxattr+0xce/0x150 [ 59.839807] ? setxattr+0x126/0x140 [ 59.842353] ? path_setxattr+0x164/0x180 [ 59.845275] ? __x64_sys_setxattr+0x71/0x90 [ 59.848838] ? do_syscall_64+0x3f/0x90 [ 59.851898] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 59.857046] ? stack_depot_save+0x17/0x20 [ 59.860299] ni_insert_attr+0x1ba/0x420 [ 59.863104] ? __pfx_ni_insert_attr+0x10/0x10 [ 59.867069] ? preempt_count_sub+0x1c/0xd0 [ 59.869897] ? _raw_spin_unlock_irqrestore+0x2b/0x50 [ 59.874088] ? __create_object+0x3ae/0x5d0 [ 59.877865] ni_insert_resident+0xc4/0x1c0 [ 59.881430] ? __pfx_ni_insert_resident+0x10/0x10 [ 59.886355] ? kasan_save_alloc_info+0x1f/0x30 [ 59.891117] ? __kasan_kmalloc+0x8b/0xa0 [ 59.894383] ntfs_set_ea+0x90d/0xbf0 [ 59.897703] ? __pfx_ntfs_set_ea+0x10/0x10 [ 59.901011] ? kernel_text_address+0xd3/0xe0 [ 59.905308] ? __kernel_text_address+0x16/0x50 [ 59.909811] ? unwind_get_return_address+0x3e/0x60 [ 59.914898] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 59.920250] ? arch_stack_walk+0xa2/0x100 [ 59.924560] ? filter_irq_stacks+0x27/0x80 [ 59.928722] ntfs_setxattr+0x405/0x440 [ 59.932512] ? __pfx_ntfs_setxattr+0x10/0x10 [ 59.936634] ? kvmalloc_node+0x2d/0x120 [ 59.940378] ? kasan_save_stack+0x41/0x60 [ 59.943870] ? kasan_save_stack+0x2a/0x60 [ 59.947719] ? kasan_set_track+0x29/0x40 [ 59.951417] ? kasan_save_alloc_info+0x1f/0x30 [ 59.955733] ? __kasan_kmalloc+0x8b/0xa0 [ 59.959598] ? __kmalloc_node+0x68/0x150 [ 59.963163] ? kvmalloc_node+0x2d/0x120 [ 59.966490] ? vmemdup_user+0x2b/0xa0 [ 59.969060] __vfs_setxattr+0x121/0x170 [ 59.972456] ? __pfx___vfs_setxattr+0x10/0x10 [ 59.976008] __vfs_setxattr_noperm+0x97/0x300 [ 59.981562] __vfs_setxattr_locked+0x145/0x170 [ 59.986100] vfs_setxattr+0x137/0x2a0 [ 59.989964] ? __pfx_vfs_setxattr+0x10/0x10 [ 59.993616] ? __kasan_check_write+0x18/0x20 [ 59.997425] do_setxattr+0xce/0x150 [ 60.000304] setxattr+0x126/0x140 [ 60.002967] ? __pfx_setxattr+0x10/0x10 [ 60.006471] ? __virt_addr_valid+0xcb/0x140 [ 60.010461] ? __call_rcu_common.constprop.0+0x1c7/0x330 [ 60.016037] ? debug_smp_processor_id+0x1b/0x30 [ 60.021008] ? kasan_quarantine_put+0x5b/0x190 [ 60.025545] ? putname+0x84/0xa0 [ 60.027910] ? __kasan_slab_free+0x11e/0x1b0 [ 60.031483] ? putname+0x84/0xa0 [ 60.033986] ? preempt_count_sub+0x1c/0xd0 [ 60.036876] ? __mnt_want_write+0xae/0x100 [ 60.040738] ? mnt_want_write+0x8f/0x150 [ 60.044317] path_setxattr+0x164/0x180 [ 60.048096] ? __pfx_path_setxattr+0x10/0x10 [ 60.052096] ? strncpy_from_user+0x175/0x1c0 [ 60.056482] ? debug_smp_processor_id+0x1b/0x30 [ 60.059848] ? fpregs_assert_state_consistent+0x6b/0x80 [ 60.064557] __x64_sys_setxattr+0x71/0x90 [ 60.068892] do_syscall_64+0x3f/0x90 [ 60.072868] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 60.077523] RIP: 0033:0x7feaa86e4469 [ 60.080915] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 088 [ 60.097353] RSP: 002b:00007ffdbd8311e8 EFLAGS: 00000286 ORIG_RAX: 00000000000000bc [ 60.103386] RAX: ffffffffffffffda RBX: 9461c5e290baac00 RCX: 00007feaa86e4469 [ 60.110322] RDX: 00007ffdbd831fe0 RSI: 00007ffdbd831305 RDI: 00007ffdbd831263 [ 60.116808] RBP: 00007ffdbd836180 R08: 0000000000000001 R09: 00007ffdbd836268 [ 60.123879] R10: 000000000000007d R11: 0000000000000286 R12: 0000000000400500 [ 60.130540] R13: 00007ffdbd836260 R14: 0000000000000000 R15: 0000000000000000 [ 60.136553] [ 60.138818] Modules linked in: [ 60.141839] CR2: 000000000000000e [ 60.144831] ---[ end trace 0000000000000000 ]--- [ 60.149058] RIP: 0010:ni_create_attr_list+0x505/0x860 [ 60.153975] Code: 7e 10 e8 5e d0 d0 ff 45 0f b7 76 10 48 8d 7b 16 e8 00 d1 d0 ff 66 44 89 73 16 4d 8d 75 0e 4c 89 f7 e8 3f d0 d0 ff 4c 8d8 [ 60.172443] RSP: 0018:ffff88800a56f1e0 EFLAGS: 00010282 [ 60.176246] RAX: 0000000000000001 RBX: ffff88800b7b5088 RCX: ffffffffb83079fe [ 60.182752] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffffbb7f9fc0 [ 60.189949] RBP: ffff88800a56f3a8 R08: ffff88800b7b50a0 R09: fffffbfff76ff3f9 [ 60.196950] R10: ffffffffbb7f9fc7 R11: fffffbfff76ff3f8 R12: ffff88800b756180 [ 60.203671] R13: 0000000000000000 R14: 000000000000000e R15: 0000000000000050 [ 60.209595] FS: 00007feaa8c96440(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000 [ 60.216299] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 60.222276] CR2: 00007f3a2e0b1000 CR3: 000000000a5bc000 CR4: 00000000000006f0 Signed-off-by: Edward Lo Signed-off-by: Konstantin Komarov commit f39244e2f21ee63dc26e57b2c909d9484924e24b Author: Yangtao Li Date: Fri Mar 10 11:08:19 2023 +0800 fs/ntfs3: Use wrapper i_blocksize() in ntfs_zero_range() Convert to use i_blocksize() for readability. Signed-off-by: Yangtao Li [almaz.alexandrovich@paragon-software.com: the patch has been partially accepted for performance reasons] Signed-off-by: Konstantin Komarov commit 3c675ddffb17a8b1e32efad5c983254af18b12c2 Author: Zeng Heng Date: Thu Dec 8 00:28:07 2022 +0800 ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() Here is a BUG report from syzbot: BUG: KASAN: slab-out-of-bounds in ntfs_list_ea fs/ntfs3/xattr.c:191 [inline] BUG: KASAN: slab-out-of-bounds in ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710 Read of size 1 at addr ffff888021acaf3d by task syz-executor128/3632 Call Trace: ntfs_list_ea fs/ntfs3/xattr.c:191 [inline] ntfs_listxattr+0x401/0x570 fs/ntfs3/xattr.c:710 vfs_listxattr fs/xattr.c:457 [inline] listxattr+0x293/0x2d0 fs/xattr.c:804 Fix the logic of ea_all iteration. When the ea->name_len is 0, return immediately, or Add2Ptr() would visit invalid memory in the next loop. Fixes: be71b5cba2e6 ("fs/ntfs3: Add attrib operations") Reported-by: syzbot+9fcea5ef6dc4dc72d334@syzkaller.appspotmail.com Signed-off-by: Zeng Heng [almaz.alexandrovich@paragon-software.com: lines of the patch have changed] Signed-off-by: Konstantin Komarov commit a901a3568fd26ca9c4a82d8bc5ed5b3ed844d451 Merge: 28c7980fa14a3 447a0bc108e4b Author: Linus Torvalds Date: Sun Jul 2 11:14:54 2023 -0700 Merge tag 'iomap-6.5-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap updates from Darrick Wong: - Fix a type signature mismatch - Drop Christoph as maintainer * tag 'iomap-6.5-merge-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: drop me [hch] from MAINTAINERS for iomap fs: iomap: Change the type of blocksize from 'int' to 'unsigned int' in iomap_file_buffered_write_punch_delalloc commit 28c7980fa14a3fbd8926686cfffb89b9542b0da1 Merge: 5def00ca25fa5 dff745c1221a4 Author: Linus Torvalds Date: Sun Jul 2 11:10:22 2023 -0700 Merge tag 'v6.5/vfs.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fix from Christian Brauner: "A fix for the backing file work from this cycle. When init_file() failed it would call file_free_rcu() on the file allocated by the caller of init_file(). It naively assumed that the correct cleanup operation would be called depending on whether it is a regular file or a backing file. However, that presupposes that the FMODE_BACKING flag would already be set which it won't be as that is done in the caller of init_file(). Fix that bug by moving the cleanup of the allocated file into the caller where it belongs in the first place. There's no good reason for init_file() to consume resources it didn't allocate. This is a mainline only fix and was reported by syzbot. The fix was validated by syzbot against the provided reproducer" * tag 'v6.5/vfs.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: move cleanup from init_file() into its callers commit 5def00ca25fa5697cfe352e675dc7c03116b2403 Merge: ed77ac92a17c5 6fb605c41d731 Author: Linus Torvalds Date: Sun Jul 2 10:22:38 2023 -0700 Merge tag 'i2c-for-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: - I2C has now a co-maintainer taking care of the host drivers. Welcome Andi Shyti and have fun! - platform remove callback converted to return void in drivers - simplify drivers by using devm_clk_get_enabled() - introduce i2c_get_match_data() to avoid more boilerplate code (especially since the core stopped delivering an i2c_device_id) - and the usual bunch of driver updates * tag 'i2c-for-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (38 commits) i2c: uniphier: Use devm_clk_get_enabled() i2c: uniphier-f: Use devm_clk_get_enabled() i2c: owl: Use devm_clk_get_enabled() i2c: lpc2k: Use devm_clk_get_enabled() i2c: hix5hd2: Use devm_clk_get_enabled() i2c: sun6i-p2wi: Use devm_clk_get_enabled() i2c: pasemi-platform: Use devm_clk_get_enabled() i2c: mt7621: Use devm_clk_get_enabled() i2c: xiic: Use devm_clk_get_enabled() i2c: davinci: Use platform table macro over module_alias i2c: ocores: use devm_ managed clks i2c: nomadik: Use dev_err_probe() whenever possible i2c: nomadik: Use devm_clk_get_enabled() i2c: nomadik: Remove unnecessary goto label usb: typec: ucsi: Mark dGPUs as DEVICE scope i2c: wmt: Use devm_platform_get_and_ioremap_resource() i2c: versatile: Use devm_platform_get_and_ioremap_resource() i2c: hix5hd2: Add I2C_M_STOP flag support for i2c-hix5hd2 driver. i2c: mpc: Use of_property_read_reg() to parse "reg" i2c: imx-lpi2c: Don't open-code DIV_ROUND_UP ... commit ed77ac92a17c5138c5b5d792ab226c3188217053 Merge: 995b406c7e972 4ad1218bed3d1 Author: Linus Torvalds Date: Sun Jul 2 10:02:35 2023 -0700 Merge tag 'parisc-for-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: - Add missing cacheflush() syscall - Fix STI console on 64-bit-only machines - Move kernel debug options to Kconfig.debug - Lots of warning fixes in arch/parisc/ and drivers/parisc/ when compiled with W=1 - Enable some more graphics drivers in refreshed defconfigs * tag 'parisc-for-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: (29 commits) parisc: Refresh defconfigs parisc: irq: Add irq-related function declarations parisc: Move init function declarations into header file parisc: dino: Make dino_init() returning void parisc: lba_pci: Mark two variables __maybe_unused parisc: unaligned: Include header file to avoid missing prototype warnings parisc: signal: Mark do_notify_resume() and sys_rt_sigreturn() asmlinkage parisc: unwind: Mark start and stop variables __maybe_unused parisc: init: Drop unused variable end_paddr parisc: traps: Mark functions static parisc: processor: Fix kdoc for init_cpu_profiler() parisc: sys_parisc: parisc_personality() is called from asm code parisc: ccio-dma: Fix kdoc and compiler warnings parisc: pdc_stable: Fix kdoc and compiler warnings parisc: pci-dma: Make pcxl_alloc_range() static parisc: Mark image_size __maybe_unused in perf_write() parisc: module: Mark symindex __maybe_unused parisc: pdc_chassis: Fix kdoc warnings parisc: firmware: Fix kdoc warnings parisc: drivers: Fix kdoc warnings ... commit 5cf32f63b0f4c520460c1a5dd915dc4f09085f29 Author: Shiyang Ruan Date: Thu Jun 29 17:40:30 2023 -0700 xfs: fix the calculation for "end" and "length" The value of "end" should be "start + length - 1". Signed-off-by: Shiyang Ruan Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 75dc0345312221971903b2e28279b7e24b7dbb1b Author: Darrick J. Wong Date: Thu Jun 29 17:39:46 2023 -0700 xfs: fix xfs_btree_query_range callers to initialize btree rec fully Use struct initializers to ensure that the xfs_btree_irecs passed into the query_range function are completely initialized. No functional changes, just closing some sloppy hygiene. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit 3ee9351e74907fe3acb0721c315af25b05dc87da Author: Darrick J. Wong Date: Thu Jun 29 17:39:45 2023 -0700 xfs: validate fsmap offsets specified in the query keys Improve the validation of the fsmap offset fields in the query keys and move the validation to the top of the function now that we have pushed the low key adjustment code downwards. Also fix some indenting issues that aren't worth a separate patch. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit a949a1c2a198e048630a8b0741a99b85a5d88136 Author: Darrick J. Wong Date: Thu Jun 29 17:39:45 2023 -0700 xfs: fix logdev fsmap query result filtering The external log device fsmap backend doesn't have an rmapbt to query, so it's wasteful to spend time initializing the rmap_irec objects. Worse yet, the log could (someday) be longer than 2^32 fsblocks, so using the rmap irec structure will result in integer overflows. Fix this mess by computing the start address that we want from keys[0] directly, and use the daddr-based record filtering algorithm that we also use for rtbitmap queries. Fixes: e89c041338ed ("xfs: implement the GETFSMAP ioctl") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit f045dd00328d78f25d64913285f4547f772d13e2 Author: Darrick J. Wong Date: Thu Jun 29 17:39:44 2023 -0700 xfs: clean up the rtbitmap fsmap backend The rtbitmap fsmap backend doesn't query the rmapbt, so it's wasteful to spend time initializing the rmap_irec objects. Worse yet, the logic to query the rtbitmap is spread across three separate functions, which is unnecessarily difficult to follow. Compute the start rtextent that we want from keys[0] directly and combine the functions to avoid passing parameters around everywhere, and consolidate all the logic into a single function. At one point many years ago I intended to use __xfs_getfsmap_rtdev as the launching point for realtime rmapbt queries, but this hasn't been the case for a long time. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit d898137d789cac9ebe5eed9957e4cf25122ca524 Author: Darrick J. Wong Date: Thu Jun 29 17:39:44 2023 -0700 xfs: fix getfsmap reporting past the last rt extent The realtime section ends at the last rt extent. If the user configures the rt geometry with an extent size that is not an integer factor of the number of rt blocks, it's possible for there to be rt blocks past the end of the last rt extent. These tail blocks cannot ever be allocated and will cause corruption reports if the last extent coincides with the end of an rt bitmap block, so do not report consider them for the GETFSMAP output. Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit 7975aba19cba4eba7ff60410f9294c90edc96dcf Author: Darrick J. Wong Date: Thu Jun 29 17:39:43 2023 -0700 xfs: fix integer overflows in the fsmap rtbitmap and logdev backends It's not correct to use the rmap irec structure to hold query key information to query the rtbitmap because the realtime volume can be longer than 2^32 fsblocks in length. Because the rt volume doesn't have allocation groups, introduce a daddr-based record filtering algorithm and compute the rtextent values using 64-bit variables. The same problem exists in the external log device fsmap implementation, so use the same solution to fix it too. After this patch, all the code that touches info->low and info->high under xfs_getfsmap_logdev and __xfs_getfsmap_rtdev are unnecessary. Cleaning this up will be done in subsequent patches. Fixes: 4c934c7dd60c ("xfs: report realtime space information via the rtbitmap") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit 63ef7a35912dd743cabd65d5bb95891625c0dd46 Author: Darrick J. Wong Date: Thu Jun 29 17:39:43 2023 -0700 xfs: fix interval filtering in multi-step fsmap queries I noticed a bug in ranged GETFSMAP queries: # xfs_io -c 'fsmap -vvvv' /opt EXT: DEV BLOCK-RANGE OWNER FILE-OFFSET AG AG-OFFSET TOTAL 0: 8:80 [0..7]: static fs metadata 0 (0..7) 8 9: 8:80 [192..223]: 137 0..31 0 (192..223) 32 # xfs_io -c 'fsmap -vvvv -d 208 208' /opt # That's not right -- we asked what block maps block 208, and we should've received a mapping for inode 137 offset 16. Instead, we get nothing. The root cause of this problem is a mis-interaction between the fsmap code and how btree ranged queries work. xfs_btree_query_range returns any btree record that overlaps with the query interval, even if the record starts before or ends after the interval. Similarly, GETFSMAP is supposed to return a recordset containing all records that overlap the range queried. However, it's possible that the recordset is larger than the buffer that the caller provided to convey mappings to userspace. In /that/ case, userspace is supposed to copy the last record returned to fmh_keys[0] and call GETFSMAP again. In this case, we do not want to return mappings that we have already supplied to the caller. The call to xfs_btree_query_range is the same, but now we ignore any records that start before fmh_keys[0]. Unfortunately, we didn't implement the filtering predicate correctly. The predicate should only be called when we're calling back for more records. Accomplish this by setting info->low.rm_blockcount to a nonzero value and ensuring that it is cleared as necessary. As a result, we no longer want to adjust dkeys[0] in the main setup function because that's confusing. This patch doesn't touch the logdev/rtbitmap backends because they have bigger problems that will be addressed by subsequent patches. Found via xfs/556 with parent pointers enabled. Fixes: e89c041338ed ("xfs: implement the GETFSMAP ioctl") Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner commit 1cbc11aaa01f80577b67ae02c73ee781112125fd Author: Benjamin Coddington Date: Fri Jun 30 09:18:13 2023 -0400 NFSv4: Fix dropped lock for racing OPEN and delegation return Commmit f5ea16137a3f ("NFSv4: Retry LOCK on OLD_STATEID during delegation return") attempted to solve this problem by using nfs4's generic async error handling, but introduced a regression where v4.0 lock recovery would hang. The additional complexity introduced by overloading that error handling is not necessary for this case. This patch expects that commit to be reverted. The problem as originally explained in the above commit is: There's a small window where a LOCK sent during a delegation return can race with another OPEN on client, but the open stateid has not yet been updated. In this case, the client doesn't handle the OLD_STATEID error from the server and will lose this lock, emitting: "NFS: nfs4_handle_delegation_recall_error: unhandled error -10024". Fix this by using the old_stateid refresh helpers if the server replies with OLD_STATEID. Suggested-by: Trond Myklebust Signed-off-by: Benjamin Coddington Signed-off-by: Trond Myklebust commit 97791d3c6d0a501109968cae769dc6256c2829e1 Merge: c97d3fb9e0e71 2e3e94c2f5dc9 Author: David S. Miller Date: Sun Jul 2 15:47:19 2023 +0100 Merge branch 'octeontx2-af-fixes' Hariprasad Kelam says: ==================== octeontx2-af: MAC block fixes for CN10KB This patch set contains fixes for the issues encountered in testing CN10KB MAC block RPM_USX. Patch1: firmware to kernel communication is not working due to wrong interrupt configuration. CSR addresses are corrected. Patch2: NIX to RVU PF mapping errors encountered due to wrong firmware config. Corrects this mapping error. Patch3: Driver is trying to access non exist cgx/lmac which is resulting in kernel panic. Address this issue by adding proper checks. Patch4: MAC features are not getting reset on FLR. Fix the issue by resetting the stale config. ==================== Signed-off-by: David S. Miller commit 2e3e94c2f5dc98a8a0e93850407064bc5389c306 Author: Hariprasad Kelam Date: Fri Jun 30 11:58:45 2023 +0530 octeontx2-af: Reset MAC features in FLR AF driver configures MAC features like internal loopback and PFC upon receiving the request from PF and its VF netdev. But these features are not getting reset in FLR. This patch fixes the issue by resetting the same. Fixes: 23999b30ae67 ("octeontx2-af: Enable or disable CGX internal loopback") Fixes: 1121f6b02e7a ("octeontx2-af: Priority flow control configuration support") Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller commit 79ebb53772c95d3a6ae51b3c65f9985fdd430df6 Author: Hariprasad Kelam Date: Fri Jun 30 11:58:44 2023 +0530 octeontx2-af: Add validation before accessing cgx and lmac with the addition of new MAC blocks like CN10K RPM and CN10KB RPM_USX, LMACs are noncontiguous and CGX blocks are also noncontiguous. But during RVU driver initialization, the driver is assuming they are contiguous and trying to access cgx or lmac with their id which is resulting in kernel panic. This patch fixes the issue by adding proper checks. [ 23.219150] pc : cgx_lmac_read+0x38/0x70 [ 23.219154] lr : rvu_program_channels+0x3f0/0x498 [ 23.223852] sp : ffff000100d6fc80 [ 23.227158] x29: ffff000100d6fc80 x28: ffff00010009f880 x27: 000000000000005a [ 23.234288] x26: ffff000102586768 x25: 0000000000002500 x24: fffffffffff0f000 Fixes: 91c6945ea1f9 ("octeontx2-af: cn10k: Add RPM MAC support") Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Goutham Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 2e7bc57b976bb016c6569a54d95c1b8d88f9450a Author: Hariprasad Kelam Date: Fri Jun 30 11:58:43 2023 +0530 octeontx2-af: Fix mapping for NIX block from CGX connection Firmware configures NIX block mapping for all MAC blocks. The current implementation reads the configuration and creates the mapping between RVU PF and NIX blocks. But this configuration is only valid for silicons that support multiple blocks. For all other silicons, all MAC blocks map to NIX0. This patch corrects the mapping by adding a check for the same. Fixes: c5a73b632b90 ("octeontx2-af: Map NIX block from CGX connection") Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Goutham Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 4c5a331cacda995e995a7857f0e44e8937d98d2c Author: Hariprasad Kelam Date: Fri Jun 30 11:58:42 2023 +0530 octeontx2-af: cn10kb: fix interrupt csr addresses The current design is that, for asynchronous events like link_up and link_down firmware raises the interrupt to kernel. The previous patch which added RPM_USX driver has a bug where it uses old csr addresses for configuring interrupts. Which is resulting in losing interrupts from source firmware. This patch fixes the issue by correcting csr addresses. Fixes: b9d0fedc6234 ("octeontx2-af: cn10kb: Add RPM_USX MAC support") Signed-off-by: Hariprasad Kelam Signed-off-by: Sunil Goutham Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit c97d3fb9e0e716b77d5c0d3051d46e2f41dc6fe4 Author: David Howells Date: Thu Jun 29 22:47:53 2023 +0100 nvme-tcp: Fix comma-related oops Fix a comma that should be a semicolon. The comma is at the end of an if-body and thus makes the statement after (a bvec_set_page()) conditional too, resulting in an oops because we didn't fill out the bio_vec[]: BUG: kernel NULL pointer dereference, address: 0000000000000008 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page ... Workqueue: nvme_tcp_wq nvme_tcp_io_work [nvme_tcp] RIP: 0010:skb_splice_from_iter+0xf1/0x370 ... Call Trace: tcp_sendmsg_locked+0x3a6/0xdd0 tcp_sendmsg+0x31/0x50 inet_sendmsg+0x47/0x80 sock_sendmsg+0x99/0xb0 nvme_tcp_try_send_data+0x149/0x490 [nvme_tcp] nvme_tcp_try_send+0x1b7/0x300 [nvme_tcp] nvme_tcp_io_work+0x40/0xc0 [nvme_tcp] process_one_work+0x21c/0x430 worker_thread+0x54/0x3e0 kthread+0xf8/0x130 Fixes: 7769887817c3 ("nvme-tcp: Use sendmsg(MSG_SPLICE_PAGES) rather then sendpage") Reported-by: Aurelien Aptel Link: https://lore.kernel.org/r/253mt0il43o.fsf@mtr-vdi-124.i-did-not-set--mail-host-address--so-tickle-me/ Signed-off-by: David Howells cc: Sagi Grimberg cc: Willem de Bruijn cc: Keith Busch cc: Jens Axboe cc: Christoph Hellwig cc: Chaitanya Kulkarni cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: Paolo Abeni cc: Jens Axboe cc: Jens Axboe cc: Matthew Wilcox cc: linux-nvme@lists.infradead.org cc: netdev@vger.kernel.org Reviewed-by: Chaitanya Kulkarni Signed-off-by: David S. Miller commit dff745c1221a402b4921d54f292288373cff500c Author: Amir Goldstein Date: Sat Jul 1 20:11:34 2023 +0300 fs: move cleanup from init_file() into its callers The use of file_free_rcu() in init_file() to free the struct that was allocated by the caller was hacky and we got what we deserved. Let init_file() and its callers take care of cleaning up each after their own allocated resources on error. Fixes: 62d53c4a1dfe ("fs: use backing_file container for internal files with "fake" f_path") # mainline only Reported-and-tested-by: syzbot+ada42aab05cf51b00e98@syzkaller.appspotmail.com Signed-off-by: Amir Goldstein Message-Id: <20230701171134.239409-1-amir73il@gmail.com> Signed-off-by: Christian Brauner commit 995b406c7e972fab181a4bb57f3b95e59b8e5bf3 Merge: dfab92f27c600 dd64621a2a977 Author: Linus Torvalds Date: Sat Jul 1 21:12:32 2023 -0700 Merge tag 'csky-for-linus-6.5' of https://github.com/c-sky/csky-linux Pull arch/csky update from Guo Ren: - Correct thread.trap_no restore of uprobe * tag 'csky-for-linus-6.5' of https://github.com/c-sky/csky-linux: csky: uprobes: Restore thread.trap_no commit b2ad9549bfd0c1f74287492a9d9a31a03c97f088 Author: Ravi Bangoria Date: Fri Jun 30 14:22:30 2023 +0530 perf evsel amd: Fix IBS error message AMD IBS can do per-process profiling[1] and is no longer restricted to per-cpu or systemwide only. Remove stale error message. Also, checking just exclude_kernel is not sufficient since IBS does not support any privilege filters. So include all exclude_* checks. And finally, move these checks under tools/perf/arch/x86/ from generic code. Before: $ sudo ./perf record -e ibs_op//k -C 0 Error: AMD IBS may only be available in system-wide/per-cpu mode. Try using -a, or -C and workload affinity After: $ sudo ./perf record -e ibs_op//k -C 0 Error: AMD IBS doesn't support privilege filtering. Try again without the privilege modifiers (like 'k') at the end. [1] https://git.kernel.org/torvalds/c/30093056f7b2 Signed-off-by: Ravi Bangoria Acked-by: Namhyung Kim Cc: ananth.narayan@amd.com Cc: sandipan.das@amd.com Cc: santosh.shukla@amd.com Cc: irogers@google.com Cc: peterz@infradead.org Cc: adrian.hunter@intel.com Cc: acme@kernel.org Cc: jolsa@kernel.org Link: https://lore.kernel.org/r/20230630085230.437-1-ravi.bangoria@amd.com Signed-off-by: Namhyung Kim commit dfab92f27c600fea3cadc6e2cb39f092024e1fef Merge: f8566aa4f1766 5b4a82a0724af Author: Linus Torvalds Date: Sat Jul 1 14:38:25 2023 -0700 Merge tag 'nfs-for-6.5-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client updates from Trond Myklebust: "Stable fixes and other bugfixes: - nfs: don't report STATX_BTIME in ->getattr - Revert 'NFSv4: Retry LOCK on OLD_STATEID during delegation return' since it breaks NFSv4 state recovery. - NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION - Fix the NFSv4.2 xattr cache shrinker_id - Force a ctime update after a NFSv4.2 SETXATTR call Features and cleanups: - NFS and RPC over TLS client code from Chuck Lever - Support for use of abstract unix socket addresses with the rpcbind daemon - Sysfs API to allow shutdown of the kernel RPC client and prevent umount() hangs if the server is known to be permanently down - XDR cleanups from Anna" * tag 'nfs-for-6.5-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (33 commits) Revert "NFSv4: Retry LOCK on OLD_STATEID during delegation return" NFS: Don't cleanup sysfs superblock entry if uninitialized nfs: don't report STATX_BTIME in ->getattr NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION NFSv4.2: fix wrong shrinker_id NFSv4: Clean up some shutdown loops NFS: Cancel all existing RPC tasks when shutdown NFS: add sysfs shutdown knob NFS: add a sysfs link to the acl rpc_client NFS: add a sysfs link to the lockd rpc_client NFS: Add sysfs links to sunrpc clients for nfs_clients NFS: add superblock sysfs entries NFS: Make all of /sys/fs/nfs network-namespace unique NFS: Open-code the nfs_kset kset_create_and_add() NFS: rename nfs_client_kobj to nfs_net_kobj NFS: rename nfs_client_kset to nfs_kset NFS: Add an "xprtsec=" NFS mount option NFS: Have struct nfs_client carry a TLS policy field SUNRPC: Add a TCP-with-TLS RPC transport class SUNRPC: Capture CMSG metadata on client-side receive ... commit f8566aa4f1766bb0267b7a0ed89c1d2c4a82ee1a Merge: ad2885979ea66 0303c9729afc4 Author: Linus Torvalds Date: Sat Jul 1 11:40:01 2023 -0700 Merge tag 'x86-urgent-2023-07-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Thomas Gleixner: "A single regression fix for x86: Moving the invocation of arch_cpu_finalize_init() earlier in the boot process caused a boot regression on IBT enabled system. The root cause is not the move of arch_cpu_finalize_init() itself. The system fails to boot because the subsequent efi_enter_virtual_mode() code has a non-IBT safe EFI call inside. This was not noticed before because IBT was enabled after the EFI initialization. Switching the EFI call to use the IBT safe wrapper cures the problem" * tag 'x86-urgent-2023-07-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/efi: Make efi_set_virtual_address_map IBT safe commit 5f06267b6e6a10dd0cac4eb248fcc51f18c260cc Author: Vincent Whitchurch Date: Fri Jun 30 11:11:48 2023 +0200 perf: unwind: Fix symfs with libdw Pass the full path including the symfs (if any) to libdw. Without this unwinding fails with errors like this when a symfs is used: unwind: failed with 'No such file or directory'" Signed-off-by: Vincent Whitchurch Acked-by: Namhyung Kim Cc: Mark Rutland Cc: kernel@axis.com Cc: Ian Rogers Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Alexander Shishkin Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230630-perf-libdw-symfs-v2-1-469760dd4d5b@axis.com Signed-off-by: Namhyung Kim commit 78a175c4623f66722709494295a0f6754b46f858 Author: James Clark Date: Fri Jun 30 16:38:39 2023 +0100 perf symbol: Fix uninitialized return value in symbols__find_by_name() found_idx and s aren't initialized, so if no symbol is found then the assert at the end will index off the end of the array causing a segfault. The function also doesn't return NULL when the symbol isn't found even if the assert passes. Fix it by initializing the values and only setting them when something is found. Fixes the following test failure: $ perf test 1 1: vmlinux symtab matches kallsyms : FAILED! Fixes: 259dce914e93 ("perf symbol: Remove symbol_name_rb_node") Signed-off-by: James Clark Acked-by: Ian Rogers Cc: Mark Rutland Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Alexander Shishkin Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230630153840.858668-1-james.clark@arm.com Signed-off-by: Namhyung Kim commit 2aefb4cc904f17aad03acc3e05f44cef7801c497 Author: Namhyung Kim Date: Wed Jun 28 13:01:41 2023 -0700 perf test: Test perf lock contention CSV output To verify CSV output, just check the number of separators (",") using the tr and wc commands like this. grep -v "^#" ${result} | tr -d -c | wc -c Now it expects 6 columns (and 5 separators) in the output, but it may be changed later so count the field in the header first and compare it to the actual output lines. $ cat ${result} # output: contended, total wait, max wait, avg wait, type, caller 1, 28787, 28787, 28787, spinlock, raw_spin_rq_lock_nested+0x1b The test looks like below now: $ sudo ./perf test -v contention 86: kernel lock contention analysis test : --- start --- test child forked, pid 2705822 Testing perf lock record and perf lock contention Testing perf lock contention --use-bpf Testing perf lock record and perf lock contention at the same time Testing perf lock contention --threads Testing perf lock contention --lock-addr Testing perf lock contention --type-filter (w/ spinlock) Testing perf lock contention --lock-filter (w/ tasklist_lock) Testing perf lock contention --callstack-filter (w/ unix_stream) Testing perf lock contention --callstack-filter with task aggregation Testing perf lock contention CSV output test child finished with 0 ---- end ---- kernel lock contention analysis test: Ok Acked-by: Ian Rogers Cc: Hao Luo Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Ingo Molnar Cc: Song Liu Link: https://lore.kernel.org/r/20230628200141.2739587-5-namhyung@kernel.org Signed-off-by: Namhyung Kim commit f6027053f82c9b533bb306bff64e4e8c8f92e9e4 Author: Namhyung Kim Date: Wed Jun 28 13:01:40 2023 -0700 perf lock contention: Add --output option To avoid formatting failures for example in CSV output due to debug messages, add --output option to put the result in a file. Unfortunately the short -o option was taken by the --owner already. $ sudo ./perf lock con -ab --output lock-out.txt -v sleep 1 Looking at the vmlinux_path (8 entries long) symsrc__init: cannot get elf header. Using /proc/kcore for kernel data Using /proc/kallsyms for symbols $ head lock-out.txt contended total wait max wait avg wait type caller 3 76.79 us 26.89 us 25.60 us rwlock:R ep_poll_callback+0x2d 0xffffffff9a23f4b5 _raw_read_lock_irqsave+0x45 0xffffffff99bbd4dd ep_poll_callback+0x2d 0xffffffff999029f3 __wake_up_common+0x73 0xffffffff99902b82 __wake_up_common_lock+0x82 0xffffffff99fa5b1c sock_def_readable+0x3c 0xffffffff9a11521d unix_stream_sendmsg+0x18d 0xffffffff99f9fc9c sock_sendmsg+0x5c Suggested-by: Ian Rogers Acked-by: Ian Rogers Cc: Hao Luo Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Ingo Molnar Cc: Song Liu Link: https://lore.kernel.org/r/20230628200141.2739587-4-namhyung@kernel.org Signed-off-by: Namhyung Kim commit 69c5c9930d722dee4312a7427f89733bfb4bf984 Author: Namhyung Kim Date: Wed Jun 28 13:01:39 2023 -0700 perf lock contention: Add -x option for CSV style output Sometimes we want to process the output by external programs. Let's add the -x option to specify the field separator like perf stat. $ sudo ./perf lock con -ab -x, sleep 1 # output: contended, total wait, max wait, avg wait, type, caller 19, 194232, 21415, 10222, spinlock, process_one_work+0x1f0 15, 162748, 23843, 10849, rwsem:R, do_user_addr_fault+0x40e 4, 86740, 23415, 21685, rwlock:R, ep_poll_callback+0x2d 1, 84281, 84281, 84281, mutex, iwl_mvm_async_handlers_wk+0x135 8, 67608, 27404, 8451, spinlock, __queue_work+0x174 3, 58616, 31125, 19538, rwsem:W, do_mprotect_pkey+0xff 3, 52953, 21172, 17651, rwlock:W, do_epoll_wait+0x248 2, 30324, 19704, 15162, rwsem:R, do_madvise+0x3ad 1, 24619, 24619, 24619, spinlock, rcu_core+0xd4 The first line is a comment that shows the output format. Each line is separated by the given string ("," in this case). The time is printed in nsec without the unit so that it can be parsed easily. The characters can be used in the output like (":", "+" and ".") are not allowed for the -x option. $ ./perf lock con -x: Cannot use the separator that is already used Usage: perf lock contention [] -x, --field-separator print result in CSV format with custom separator The stacktraces are printed in the same line separated by ":". The header is updated to show the stacktrace. Also the debug output is added at the end as a comment. $ sudo ./perf lock con -abv -x, -F wait_total sleep 1 Looking at the vmlinux_path (8 entries long) symsrc__init: cannot get elf header. Using /proc/kcore for kernel data Using /proc/kallsyms for symbols # output: total wait, type, caller, stacktrace 37134, spinlock, rcu_core+0xd4, 0xffffffff9d0401e4 _raw_spin_lock_irqsave+0x44: 0xffffffff9c738114 rcu_core+0xd4: ... 21213, spinlock, raw_spin_rq_lock_nested+0x1b, 0xffffffff9d0407c0 _raw_spin_lock+0x30: 0xffffffff9c6d9cfb raw_spin_rq_lock_nested+0x1b: ... 20506, rwlock:W, ep_done_scan+0x2d, 0xffffffff9c9bc4dd ep_done_scan+0x2d: 0xffffffff9c9bd5f1 do_epoll_wait+0x6d1: ... 18044, rwlock:R, ep_poll_callback+0x2d, 0xffffffff9d040555 _raw_read_lock_irqsave+0x45: 0xffffffff9c9bc81d ep_poll_callback+0x2d: ... 17890, rwlock:W, do_epoll_wait+0x47b, 0xffffffff9c9bd39b do_epoll_wait+0x47b: 0xffffffff9c9be9ef __x64_sys_epoll_wait+0x6d1: ... 12114, spinlock, futex_wait_queue+0x60, 0xffffffff9d0407c0 _raw_spin_lock+0x30: 0xffffffff9d037cae __schedule+0xbe: ... # debug: total=7, bad=0, bad_task=0, bad_stack=0, bad_time=0, bad_data=0 Also note that some field (like lock symbols) can be empty. $ sudo ./perf lock con -abl -x, -E 10 sleep 1 # output: contended, total wait, max wait, avg wait, address, symbol, type 6, 275025, 61764, 45837, ffff9dcc9f7d60d0, , spinlock 18, 87716, 11196, 4873, ffff9dc540059000, , spinlock 2, 6472, 5499, 3236, ffff9dcc7f730e00, rq_lock, spinlock 3, 4429, 2341, 1476, ffff9dcc7f7b0e00, rq_lock, spinlock 3, 3974, 1635, 1324, ffff9dcc7f7f0e00, rq_lock, spinlock 4, 3290, 1326, 822, ffff9dc5f4e2cde0, , rwlock 3, 2894, 1023, 964, ffffffff9e0d7700, rcu_state, spinlock 1, 2567, 2567, 2567, ffff9dcc7f6b0e00, rq_lock, spinlock 4, 1259, 596, 314, ffff9dc69c2adde0, , rwlock 1, 934, 934, 934, ffff9dcc7f670e00, rq_lock, spinlock Acked-by: Ian Rogers Cc: Hao Luo Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Ingo Molnar Cc: Song Liu Link: https://lore.kernel.org/r/20230628200141.2739587-3-namhyung@kernel.org Signed-off-by: Namhyung Kim commit 7b83d597c8cab98caf18e2a3e2198c33068fcbad Author: Namhyung Kim Date: Wed Jun 28 13:01:38 2023 -0700 perf lock: Remove stale comments The comment was for symbol_conf.sort_by_name which was deleted already. Let's get rid of the stale comments as well. Acked-by: Ian Rogers Cc: Hao Luo Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Ingo Molnar Cc: Song Liu Link: https://lore.kernel.org/r/20230628200141.2739587-2-namhyung@kernel.org Signed-off-by: Namhyung Kim commit ad2885979ea6657fa8d3da51a301ec0e998ad8e7 Merge: e3c2b10d6f156 f5983dab0ead9 Author: Linus Torvalds Date: Sat Jul 1 09:24:31 2023 -0700 Merge tag 'kbuild-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - Remove the deprecated rule to build *.dtbo from *.dts - Refactor section mismatch detection in modpost - Fix bogus ARM section mismatch detections - Fix error of 'make gtags' with O= option - Add Clang's target triple to KBUILD_CPPFLAGS to fix a build error with the latest LLVM version - Rebuild the built-in initrd when KBUILD_BUILD_TIMESTAMP is changed - Ignore more compiler-generated symbols for kallsyms - Fix 'make local*config' to handle the ${CONFIG_FOO} form in Makefiles - Enable more kernel-doc warnings with W=2 - Refactor by generating KSYMTAB data by modpost - Deprecate and - Remove the EXPORT_DATA_SYMBOL macro - Move the check for static EXPORT_SYMBOL back to modpost, which makes the build faster - Re-implement CONFIG_TRIM_UNUSED_KSYMS with one-pass algorithm - Warn missing MODULE_DESCRIPTION when building modules with W=1 - Make 'make clean' robust against too long argument error - Exclude more objects from GCOV to fix CFI failures with GCOV - Allow 'make modules_install' to install modules.builtin and modules.builtin.modinfo even when CONFIG_MODULES is disabled - Include modules.builtin and modules.builtin.modinfo in the linux-image Debian package even when CONFIG_MODULES is disabled - Revive "Entering directory" logging for the latest Make version * tag 'kbuild-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (72 commits) modpost: define more R_ARM_* for old distributions kbuild: revive "Entering directory" for Make >= 4.4.1 kbuild: set correct abs_srctree and abs_objtree for package builds scripts/mksysmap: Ignore prefixed KCFI symbols kbuild: deb-pkg: remove the CONFIG_MODULES check in buildeb kbuild: builddeb: always make modules_install, to install modules.builtin* modpost: continue even with unknown relocation type modpost: factor out Elf_Sym pointer calculation to section_rel() modpost: factor out inst location calculation to section_rel() kbuild: Disable GCOV for *.mod.o kbuild: Fix CFI failures with GCOV kbuild: make clean rule robust against too long argument error script: modpost: emit a warning when the description is missing kbuild: make modules_install copy modules.builtin(.modinfo) linux/export.h: rename 'sec' argument to 'license' modpost: show offset from symbol for section mismatch warnings modpost: merge two similar section mismatch warnings kbuild: implement CONFIG_TRIM_UNUSED_KSYMS without recursion modpost: use null string instead of NULL pointer for default namespace modpost: squash sym_update_namespace() into sym_add_exported() ... commit e3c2b10d6f15640407bef3098accf10faa4ecf1b Merge: d25f002575146 893b24181b4c4 Author: Linus Torvalds Date: Sat Jul 1 09:18:25 2023 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fix from Catalin Marinas: "Fix memory corruption (overwriting the kmalloc redzone) when saving the SVE state while in SVE streaming mode" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: sme: Use STR P to clear FFR context field in streaming SVE mode commit d25f002575146d67b5ebea541e6db3696c957c25 Merge: 0a1c979c6b7df fe77cc2e5a6a7 Author: Linus Torvalds Date: Sat Jul 1 08:58:41 2023 -0700 Merge tag 'cxl-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull CXL updates from Dan Williams: "The highlights in terms of new functionality are support for the standard CXL Performance Monitor definition that appeared in CXL 3.0, support for device sanitization (wiping all data from a device), secure-erase (re-keying encryption of user data), and support for firmware update. The firmware update support is notable as it reuses the simple sysfs_upload interface to just cat(1) a blob to a sysfs file and pipe that to the device. Additionally there are a substantial number of cleanups and reorganizations to get ready for RCH error handling (RCH == Restricted CXL Host == current shipping hardware generation / pre CXL-2.0 topologies) and type-2 (accelerator / vendor specific) devices. For vendor specific devices they implement a subset of what the generic type-3 (generic memory expander) driver expects. As a result the rework decouples optional infrastructure from the core driver context. For RCH topologies, where the specification working group did not want to confuse pre-CXL-aware operating systems, many of the standard registers are hidden which makes support standard bus features like AER (PCIe Advanced Error Reporting) difficult. The rework arranges for the driver to help the PCI-AER core. Bjorn is on board with this direction but a late regression disocvery means the completion of this functionality needs to cook a bit longer, so it is code reorganizations only for now. Summary: - Add infrastructure for supporting background commands along with support for device sanitization and firmware update - Introduce a CXL performance monitoring unit driver based on the common definition in the specification. - Land some preparatory cleanup and refactoring for the anticipated arrival of CXL type-2 (accelerator devices) and CXL RCH (CXL-v1.1 topology) error handling. - Rework CPU cache management with respect to region configuration (device hotplug or other dynamic changes to memory interleaving) - Fix region reconfiguration vs CXL decoder ordering rules" * tag 'cxl-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (51 commits) cxl: Fix one kernel-doc comment cxl/pci: Use correct flag for sanitize polling docs: perf: Minimal introduction the the CXL PMU device and driver perf: CXL Performance Monitoring Unit driver tools/testing/cxl: add firmware update emulation to CXL memdevs tools/testing/cxl: Use named effects for the Command Effect Log tools/testing/cxl: Fix command effects for inject/clear poison cxl: add a firmware update mechanism using the sysfs firmware loader cxl/test: Add Secure Erase opcode support cxl/mem: Support Secure Erase cxl/test: Add Sanitize opcode support cxl/mem: Wire up Sanitization support cxl/mbox: Add sanitization handling machinery cxl/mem: Introduce security state sysfs file cxl/mbox: Allow for IRQ_NONE case in the isr Revert "cxl/port: Enable the HDM decoder capability for switch ports" cxl/memdev: Formalize endpoint port linkage cxl/pci: Unconditionally unmask 256B Flit errors cxl/region: Manage decoder target_type at decoder-attach time cxl/hdm: Default CXL_DEVTYPE_DEVMEM decoders to CXL_DECODER_DEVMEM ... commit 0a1c979c6b7dfe5b6c105d0f0f9f068b5eb07e25 Merge: be21a73edd5de 1ea7ca1b09014 Author: Linus Torvalds Date: Sat Jul 1 08:48:02 2023 -0700 Merge tag 'libnvdimm-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull nvdimm and DAX updates from Vishal Verma: "This is mostly small cleanups and fixes, with the biggest change being the change to the DAX fault handler allowing it to return VM_FAULT_HWPOISON. Summary: - DAX fixes and cleanups including a use after free, extra references, and device unregistration, and a redundant variable. - Allow the DAX fault handler to return VM_FAULT_HWPOISON - A few libnvdimm cleanups such as making some functions and variables static where sufficient. - Add a few missing prototypes for wrapped functions in tools/testing/nvdimm" * tag 'libnvdimm-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: dax: enable dax fault handler to report VM_FAULT_HWPOISON nvdimm: make security_show static nvdimm: make nd_class variable static dax/kmem: Pass valid argument to memory_group_register_static fsdax: remove redundant variable 'error' dax: Cleanup extra dax_region references dax: Introduce alloc_dev_dax_id() dax: Use device_unregister() in unregister_dax_mapping() dax: Fix dax_mapping_release() use after free tools/testing/nvdimm: Drop empty platform remove function libnvdimm: mark 'security_show' static again testing: nvdimm: add missing prototypes for wrapped functions dax: fix missing-prototype warnings commit be21a73edd5ded67524eabb9dad42799b42c0585 Merge: 170ab6c51a42a 7fffbc71075dc Author: Linus Torvalds Date: Sat Jul 1 08:40:56 2023 -0700 Merge tag 'sysctl-fixes-v2-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull another sysctl fix from Luis Chamberlain: "Just one minor nit I forgot to merge" * tag 'sysctl-fixes-v2-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: sysctl: set variable sysctl_mount_point storage-class-specifier to static commit 170ab6c51a42a8a1c1a7ce09367b578db6f2f383 Merge: dd546618ba704 40ca06d71d606 Author: Linus Torvalds Date: Sat Jul 1 08:31:07 2023 -0700 Merge tag 'flex-array-transformations-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux Pull flexible-array update from Gustavo Silva: "Transform a zero-length array into a C99 flexible-array member. This addresses a build failure with Clang by fixing multiple '-Warray-bounds' warnings in drivers/staging/ks7010/ks_wlan_net.c" * tag 'flex-array-transformations-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: uapi: wireless: Replace zero-length array with flexible-array member commit dd546618ba704be4f3724a11e5a194052c551f08 Author: Christian Brauner Date: Sat Jul 1 08:44:44 2023 +0200 pid: use struct_size_t() helper Before commit d67790ddf021 ("overflow: Add struct_size_t() helper") only struct_size() existed, which expects a valid pointer instance containing the flexible array. However, when we determine the default struct pid allocation size for the associated kmem cache of a pid namespace we need to take the nesting depth of the pid namespace into account without an variable instance necessarily being available. In commit b69f0aeb0689 ("pid: Replace struct pid 1-element array with flex-array") we used to handle this the old fashioned way and cast NULL to a struct pid pointer type. However, we do apparently have a dedicated struct_size_t() helper for exactly this case. So switch to that. Suggested-by: Kees Cook Suggested-by: Linus Torvalds Signed-off-by: Christian Brauner Signed-off-by: Linus Torvalds commit 408579cd627a15bd703fe3eeb8485fd02726e9d3 Author: Liam R. Howlett Date: Thu Jun 29 22:28:16 2023 -0400 mm: Update do_vmi_align_munmap() return semantics Since do_vmi_align_munmap() will always honor the downgrade request on the success, the callers no longer have to deal with confusing return codes. Since all callers that request downgrade actually want the lock to be dropped, change the downgrade to an unlock request. Note that the lock still needs to be held in read mode during the page table clean up to avoid races with a map request. Update do_vmi_align_munmap() to return 0 for success. Clean up the callers and comments to always expect the unlock to be honored on the success path. The error path will always leave the lock untouched. As part of the cleanup, the wrapper function do_vmi_munmap() and callers to the wrapper are also updated. Suggested-by: Linus Torvalds Link: https://lore.kernel.org/linux-mm/20230629191414.1215929-1-willy@infradead.org/ Signed-off-by: Liam R. Howlett Signed-off-by: Linus Torvalds commit e4bd84c069f212c01258e405f86e91f327888e41 Author: Matthew Wilcox (Oracle) Date: Thu Jun 29 20:14:14 2023 +0100 mm: Always downgrade mmap_lock if requested Now that stack growth must always hold the mmap_lock for write, we can always downgrade the mmap_lock to read and safely unmap pages from the page table, even if we're next to a stack. Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Linus Torvalds commit 03f889378f33aa9a9d8e5f49ba94134cf6158090 Author: Max Filippov Date: Sat Jul 1 03:31:55 2023 -0700 xtensa: fix lock_mm_and_find_vma in case VMA not found MMU version of lock_mm_and_find_vma releases the mm lock before returning when VMA is not found. Do the same in noMMU version. This fixes hang on an attempt to handle protection fault. Fixes: d85a143b69ab ("xtensa: fix NOMMU build with lock_mm_and_find_vma() conversion") Signed-off-by: Max Filippov Signed-off-by: Linus Torvalds commit 5c93c4c72fbc69f0f1cdf43c9402b923314e67c8 Author: Andy Chiu Date: Tue Jun 27 01:55:55 2023 +0000 selftests: Test RISC-V Vector's first-use handler This add a test to check if the kernel zero-initializes all V registers after the first-use trap handler returns. If V registers are not zero-initialized, then the test should fail one out of several runs: ``` root@sifive-fpga:~# ./v_initval_nolibc # vl = 256 not ok 1 detect stale values on v-regesters 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4c 41 4e 47 3d 43 0 50 41 54 48 3d 2f 75 73 72 2f 6c 6f 63 61 6c 2f 73 62 69 6e 3a 2f 75 73 72 2f 6c 6f 63 61 6c 2f 62 69 6e 3a 2f 75 73 72 ff ff 81 0 0 0 0 0 0 0 0 0 0 0 0 0 ``` Otherwise, the test passes without errors each run. Signed-off-by: Andy Chiu Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20230627015556.12329-3-andy.chiu@sifive.com Signed-off-by: Palmer Dabbelt commit 75b59f2a90aa7ccac62e3dcb680dfb967b341431 Author: Andy Chiu Date: Tue Jun 27 01:55:54 2023 +0000 riscv: vector: clear V-reg in the first-use trap If there is no context switch happens after we enable V for a process, then we return to user space with whatever left on the CPU's V registers accessible to the process. The leaked data could belong to another process's V-context saved from last context switch, impacting process's confidentiality on the system. To prevent this from happening, we clear V registers by restoring zero'd V context after turining on V. Fixes: cd054837243b ("riscv: Allocate user's vector context in the first-use trap") Signed-off-by: Andy Chiu Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20230627015556.12329-2-andy.chiu@sifive.com Signed-off-by: Palmer Dabbelt commit 26c38cd802c947401cfbcc285b7d841256b5f17f Author: Andy Chiu Date: Sun Jun 25 15:54:15 2023 +0000 riscv: vector: only enable interrupts in the first-use trap The function irqentry_exit_to_user_mode() must be called with interrupt disabled. The caller of do_trap_insn_illegal() also assumes running without interrupts. So, we should turn off interrupts after riscv_v_first_use_handler() returns. Fixes: cd054837243b ("riscv: Allocate user's vector context in the first-use trap") Signed-off-by: Andy Chiu Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20230625155416.18629-1-andy.chiu@sifive.com Signed-off-by: Palmer Dabbelt commit 782aefb177e8932c558ae55f64206ded7fe1292f Merge: e50db34efdc8c f7584322e4fef Author: Palmer Dabbelt Date: Sun Jun 25 16:24:06 2023 -0700 Merge patch series "riscv: enable HAVE_LD_DEAD_CODE_DATA_ELIMINATION" Jisheng Zhang says: When trying to run linux with various opensource riscv core on resource limited FPGA platforms, for example, those FPGAs with less than 16MB SDRAM, I want to save mem as much as possible. One of the major technologies is kernel size optimizations, I found that riscv does not currently support HAVE_LD_DEAD_CODE_DATA_ELIMINATION, which passes -fdata-sections, -ffunction-sections to CFLAGS and passes the --gc-sections flag to the linker. This not only benefits my case on FPGA but also benefits defconfigs. Here are some notable improvements from enabling this with defconfigs: nommu_k210_defconfig: text data bss dec hex 1112009 410288 59837 1582134 182436 before 962838 376656 51285 1390779 1538bb after rv32_defconfig: text data bss dec hex 8804455 2816544 290577 11911576 b5c198 before 8692295 2779872 288977 11761144 b375f8 after defconfig: text data bss dec hex 9438267 3391332 485333 13314932 cb2b74 before 9285914 3350052 483349 13119315 c82f53 after patch1 and patch2 are clean ups. patch3 fixes a typo. patch4 finally enable HAVE_LD_DEAD_CODE_DATA_ELIMINATION for riscv. * b4-shazam-merge: riscv: disable HAVE_LD_DEAD_CODE_DATA_ELIMINATION for LLD riscv: enable HAVE_LD_DEAD_CODE_DATA_ELIMINATION vmlinux.lds.h: use correct .init.data.* section name riscv: vmlinux-xip.lds.S: remove .alternative section riscv: move options to keep entries sorted riscv: Fix orphan section warnings caused by kernel/pi Link: https://lore.kernel.org/r/20230523165502.2592-1-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit e50db34efdc8cac2f17b8f5d32fddd7b58914ce6 Author: Palmer Dabbelt Date: Mon Jun 19 10:21:01 2023 -0700 RISC-V: Fix up some vector state related build failures I get a few build failures along the lines of ./arch/riscv/include/uapi/asm/sigcontext.h:19:36: error: field ‘v_state’ has incomplete type 19 | struct __riscv_v_ext_state v_state; | ^~~~~~~ ./arch/riscv/include/uapi/asm/sigcontext.h:32:49: error: field ‘sc_extdesc’ has incomplete type 32 | struct __riscv_extra_ext_header sc_extdesc; The V structures in question are defined for !assembly, so let's just do so for the others. Fixes: 8ee0b41898fa ("riscv: signal: Add sigcontext save/restore for vector") Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230619172101.18692-1-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit bcc8790057c1f02d20654f68d107973405c1f823 Author: Palmer Dabbelt Date: Mon Jun 19 12:01:43 2023 -0700 RISC-V: Document that V registers are clobbered on syscalls This is included in the ISA manual, but it's pretty common for bits of the ISA manual that are actually ABI to change. So let's document it explicitly. Reviewed-by: Björn Töpel Link: https://lore.kernel.org/r/20230619190142.26498-1-palmer@rivosinc.com Signed-off-by: Palmer Dabbelt commit 26b32974ad2e82811706fd19c33c4ad6b9953663 Author: Subash Abhinov Kasiviswanathan Date: Fri Jun 30 10:26:17 2023 -0600 docs: networking: Update codeaurora references for rmnet source.codeaurora.org is no longer accessible and so the reference link in the documentation is not useful. Use iproute2 instead as it has a rmnet module for configuration. Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation") Signed-off-by: Sean Tranchetti Signed-off-by: Subash Abhinov Kasiviswanathan Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit d5dc39459bdafd18ff1e93e1a86eb3e814ff9f94 Author: Jakub Kicinski Date: Fri Jun 30 09:00:25 2023 -0700 docs: netdev: broaden mailbot to all MAINTAINERS Reword slightly now that all MAINTAINERS have access to the commands. Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 1b0fce8c8e69485e49a7d34aac3d4c2a2aa15d62 Author: Davide Tronchin Date: Thu Jun 29 12:37:36 2023 +0200 net: usb: cdc_ether: add u-blox 0x1313 composition. Add CDC-ECM support for LARA-R6 01B. The new LARA-R6 product variant identified by the "01B" string can be configured (by AT interface) in three different USB modes: * Default mode (Vendor ID: 0x1546 Product ID: 0x1311) with 4 serial interfaces * RmNet mode (Vendor ID: 0x1546 Product ID: 0x1312) with 4 serial interfaces and 1 RmNet virtual network interface * CDC-ECM mode (Vendor ID: 0x1546 Product ID: 0x1313) with 4 serial interface and 1 CDC-ECM virtual network interface The first 4 interfaces of all the 3 configurations (default, RmNet, ECM) are the same. In CDC-ECM mode LARA-R6 01B exposes the following interfaces: If 0: Diagnostic If 1: AT parser If 2: AT parser If 3: AT parset/alternative functions If 4: CDC-ECM interface Signed-off-by: Davide Tronchin Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 255006adb3da71bb75c334453786df781b415f54 Merge: 24975ce8b2f86 0a3869e14d4a5 Author: Paolo Bonzini Date: Sat Jul 1 07:20:04 2023 -0400 Merge tag 'kvm-x86-vmx-6.5' of https://github.com/kvm-x86/linux into HEAD KVM VMX changes for 6.5: - Fix missing/incorrect #GP checks on ENCLS - Use standard mmu_notifier hooks for handling APIC access page - Misc cleanups commit 24975ce8b2f863547d0b79a5a4552d5ea3522a3c Merge: bb05b0ef627f1 106ed2cad9f7b Author: Paolo Bonzini Date: Sat Jul 1 07:19:42 2023 -0400 Merge tag 'kvm-x86-svm-6.5' of https://github.com/kvm-x86/linux into HEAD KVM SVM changes for 6.5: - Drop manual TR/TSS load after VM-Exit now that KVM uses VMLOAD for host state - Fix a not-yet-problematic missing call to trace_kvm_exit() for VM-Exits that are handled in the fastpath - Print more descriptive information about the status of SEV and SEV-ES during module load - Assert that misc_cg_set_capacity() doesn't fail to avoid should-be-impossible memory leaks commit bb05b0ef627f1d43122cdd2f172f5fb789f77a99 Merge: 751d77fefaf46 5ed19528db8dd Author: Paolo Bonzini Date: Sat Jul 1 07:19:09 2023 -0400 Merge tag 'kvm-x86-selftests-6.5' of https://github.com/kvm-x86/linux into HEAD KVM selftests changes for 6.5: - Add a test for splitting and reconstituting hugepages during and after dirty logging - Add support for CPU pinning in demand paging test - Generate dependency files so that partial rebuilds work as expected - Misc cleanups and fixes commit 751d77fefaf46af17b5d9ce41d21e0e93cdd7d6e Merge: 88de4b94801aa 94cdeebd82111 Author: Paolo Bonzini Date: Sat Jul 1 07:18:51 2023 -0400 Merge tag 'kvm-x86-pmu-6.5' of https://github.com/kvm-x86/linux into HEAD KVM x86/pmu changes for 6.5: - Add support for AMD PerfMonV2, with a variety of cleanups and minor fixes included along the way commit 88de4b94801aa8d3a82fd89148330155acb904af Merge: 36b68d360a7a8 0b210faf33731 Author: Paolo Bonzini Date: Sat Jul 1 07:18:30 2023 -0400 Merge tag 'kvm-x86-mmu-6.5' of https://github.com/kvm-x86/linux into HEAD KVM x86/mmu changes for 6.5: - Add back a comment about the subtle side effect of try_cmpxchg64() in tdp_mmu_set_spte_atomic() - Add an assertion in __kvm_mmu_invalidate_addr() to verify that the target KVM MMU is the current MMU - Add a "never" option to effectively avoid creating NX hugepage recovery threads commit 36b68d360a7a893ba126d6ea6c1799e0b0726362 Merge: d74669ebaeb6e 63e2f55cabedf Author: Paolo Bonzini Date: Sat Jul 1 07:08:59 2023 -0400 Merge tag 'kvm-x86-misc-6.5' of https://github.com/kvm-x86/linux into HEAD KVM x86 changes for 6.5: * Move handling of PAT out of MTRR code and dedup SVM+VMX code * Fix output of PIC poll command emulation when there's an interrupt * Add a maintainer's handbook to document KVM x86 processes, preferred coding style, testing expectations, etc. * Misc cleanups commit d74669ebaeb6e5c786b939dc8c48cf7db9d44c84 Merge: cc744042d9080 cc77b95acf3c7 Author: Paolo Bonzini Date: Sat Jul 1 07:07:55 2023 -0400 Merge tag 'kvm-x86-generic-6.5' of https://github.com/kvm-x86/linux into HEAD Common KVM changes for 6.5: - Fix unprotected vcpu->pid dereference via debugfs - Fix KVM_BUG() and KVM_BUG_ON() macros with 64-bit conditionals - Refactor failure path in kvm_io_bus_unregister_dev() to simplify the code - Misc cleanups commit cc744042d90809ccb7cac7f9fb773f5c9cb9f835 Merge: b5396271eab4e 192df2aa0113d Author: Paolo Bonzini Date: Sat Jul 1 07:04:29 2023 -0400 Merge tag 'kvmarm-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 updates for 6.5 - Eager page splitting optimization for dirty logging, optionally allowing for a VM to avoid the cost of block splitting in the stage-2 fault path. - Arm FF-A proxy for pKVM, allowing a pKVM host to safely interact with services that live in the Secure world. pKVM intervenes on FF-A calls to guarantee the host doesn't misuse memory donated to the hyp or a pKVM guest. - Support for running the split hypervisor with VHE enabled, known as 'hVHE' mode. This is extremely useful for testing the split hypervisor on VHE-only systems, and paves the way for new use cases that depend on having two TTBRs available at EL2. - Generalized framework for configurable ID registers from userspace. KVM/arm64 currently prevents arbitrary CPU feature set configuration from userspace, but the intent is to relax this limitation and allow userspace to select a feature set consistent with the CPU. - Enable the use of Branch Target Identification (FEAT_BTI) in the hypervisor. - Use a separate set of pointer authentication keys for the hypervisor when running in protected mode, as the host is untrusted at runtime. - Ensure timer IRQs are consistently released in the init failure paths. - Avoid trapping CTR_EL0 on systems with Enhanced Virtualization Traps (FEAT_EVT), as it is a register commonly read from userspace. - Erratum workaround for the upcoming AmpereOne part, which has broken hardware A/D state management. As a consequence of the hVHE series reworking the arm64 software features framework, the for-next/module-alloc branch from the arm64 tree comes along for the ride. commit b5396271eab4ec28f0d27ff48e1b151b7b824295 Merge: a443e2609c014 07f225b584242 Author: Paolo Bonzini Date: Sat Jul 1 07:02:41 2023 -0400 Merge tag 'kvm-riscv-6.5-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv changes for 6.5 - Redirect AMO load/store misaligned traps to KVM guest - Trap-n-emulate AIA in-kernel irqchip for KVM guest - Svnapot support for KVM Guest commit a443e2609c01479c7c0c3367059d7b9f2e8a6697 Merge: 6995e2de6891c db54dfc9f71cd Author: Paolo Bonzini Date: Sat Jul 1 07:00:11 2023 -0400 Merge tag 'kvm-s390-next-6.5-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD * New uvdevice secret API * New CMM selftest * cmm fix * diag 9c racy access of target cpu fix commit dfbf0ee092a5d7a9301c81e815b5e50b7c0aeeda Author: Colin Ian King Date: Fri Jun 30 12:33:37 2023 +0100 smb: client: remove redundant pointer 'server' The pointer 'server' is assigned but never read, the pointer is redundant and can be removed. Cleans up clang scan build warning: fs/smb/client/dfs.c:217:3: warning: Value stored to 'server' is never read [deadcode.DeadStores] Signed-off-by: Colin Ian King Signed-off-by: Steve French commit ff7d80a9f2711bf3d9fe1cfb70b3fd15c50584b7 Author: Winston Wen Date: Mon Jun 26 11:42:55 2023 +0800 cifs: fix session state transition to avoid use-after-free issue We switch session state to SES_EXITING without cifs_tcp_ses_lock now, it may lead to potential use-after-free issue. Consider the following execution processes: Thread 1: __cifs_put_smb_ses() spin_lock(&cifs_tcp_ses_lock) if (--ses->ses_count > 0) spin_unlock(&cifs_tcp_ses_lock) return spin_unlock(&cifs_tcp_ses_lock) ---> **GAP** spin_lock(&ses->ses_lock) if (ses->ses_status == SES_GOOD) ses->ses_status = SES_EXITING spin_unlock(&ses->ses_lock) Thread 2: cifs_find_smb_ses() spin_lock(&cifs_tcp_ses_lock) list_for_each_entry(ses, ...) spin_lock(&ses->ses_lock) if (ses->ses_status == SES_EXITING) spin_unlock(&ses->ses_lock) continue ... spin_unlock(&ses->ses_lock) if (ret) cifs_smb_ses_inc_refcount(ret) spin_unlock(&cifs_tcp_ses_lock) If thread 1 is preempted in the gap and thread 2 start executing, thread 2 will get the session, and soon thread 1 will switch the session state to SES_EXITING and start releasing it, even though thread 1 had increased the session's refcount and still uses it. So switch session state under cifs_tcp_ses_lock to eliminate this gap. Signed-off-by: Winston Wen Signed-off-by: Steve French commit a507db1d8fdc39802415e4d2ef6d1aecd67927fa Merge: 8976e9d003957 61986a58bc6ab Author: Linus Torvalds Date: Fri Jun 30 22:00:28 2023 -0700 Merge tag '6.5-rc-smb3-client-fixes-part1' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client updates from Steve French: - Deferred close fix - Debugging improvements: display missing mount option, dump rc on invalidate inode failures, print client_guid in DebugData, log session id when matching session not found in reconnect, new dynamic tracepoint for session not found - Mount fixes including: potential null dereference, and possible memory leak and path name parsing when double slashes - Fix potential use after free in compounding - Two crediting (flow control) fixes: fix for crediting leak (stress scenario with excess lease credits) and better locking around updating credits - Three cleanups from issues pointed out by the kernel test robot - Session state check improvements (including for potential use after free) - DFS fixes: Fix for getattr on link when DFS disabled, fix for DFS mounts to same share with different prefix paths, DFS mount error checking improvement * tag '6.5-rc-smb3-client-fixes-part1' of git://git.samba.org/sfrench/cifs-2.6: cifs: new dynamic tracepoint to track ses not found errors cifs: log session id when a matching ses is not found smb: client: improve DFS mount check smb: client: fix shared DFS root mounts with different prefixes smb: client: fix parsing of source mount option smb: client: fix broken file attrs with nodfs mounts cifs: print client_guid in DebugData cifs: fix session state check in smb2_find_smb_ses cifs: fix session state check in reconnect to avoid use-after-free issue cifs: do all necessary checks for credits within or before locking cifs: prevent use-after-free by freeing the cfile later smb: client: fix warning in generic_ip_connect() smb: client: fix warning in CIFSFindNext() smb: client: fix warning in CIFSFindFirst() smb3: do not reserve too many oplock credits cifs: print more detail when invalidate_inode_mapping fails smb: client: fix warning in cifs_smb3_do_mount() smb: client: fix warning in cifs_match_super() cifs: print nosharesock value while dumping mount options SMB3: Do not send lease break acknowledgment if all file handles have been closed commit 8976e9d0039574b2336044fa5e3adb717f3ba54b Merge: ee152be17ade1 9cedc58bdbe9f Author: Linus Torvalds Date: Fri Jun 30 21:53:33 2023 -0700 Merge tag '6.5-rc-ksmbd-server-fixes-part1' of git://git.samba.org/ksmbd Pull ksmbd server updates from Steve French: - two fixes for compounding bugs (make sure no out of bound reads with less common combinations of commands in the compound) - eight minor cleanup patches (e.g. simplifying return values, replace one element array, use of kzalloc where simpler) - fix for clang warning on possible overflow in filename conversion * tag '6.5-rc-ksmbd-server-fixes-part1' of git://git.samba.org/ksmbd: ksmbd: avoid field overflow warning ksmbd: Replace one-element array with flexible-array member ksmbd: Use struct_size() helper in ksmbd_negotiate_smb_dialect() ksmbd: add missing compound request handing in some commands ksmbd: fix out of bounds read in smb2_sess_setup ksmbd: Replace the ternary conditional operator with min() ksmbd: use kvzalloc instead of kvmalloc ksmbd: Change the return value of ksmbd_vfs_query_maximal_access to void ksmbd: return a literal instead of 'err' in ksmbd_vfs_kern_path_locked() ksmbd: use kzalloc() instead of __GFP_ZERO ksmbd: remove unused ksmbd_tree_conn_share function commit ee152be17ade10e8667ffa02de828bb955c40813 Merge: f4ce392b03722 d7dbed457c2ef Author: Linus Torvalds Date: Fri Jun 30 21:48:44 2023 -0700 Merge tag 'nfsd-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fix from Chuck Lever: - Fix ordering of attributes in NFSv4 GETATTR replies * tag 'nfsd-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: Fix creation time serialization order commit f4ce392b03722b62804909aadbce6ff4f9c50b91 Merge: 937d96d2d567f 42cffe980ce38 Author: Linus Torvalds Date: Fri Jun 30 21:40:44 2023 -0700 Merge tag 'livepatching-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching Pull livepatching update from Petr Mladek: - Make a variable static to fix a sparse warning * tag 'livepatching-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching: livepatch: Make 'klp_stack_entries' static commit 937d96d2d567fe0d86a2f39a7f988bf31c66d3e6 Merge: 5d95ff84e62be 2e28a798c3092 Author: Linus Torvalds Date: Fri Jun 30 21:35:52 2023 -0700 Merge tag 'efi-next-for-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: "Although some more stuff is brewing, the EFI changes that are ready for mainline are few this cycle: - improve the PCI DMA paranoia logic in the EFI stub - some constification changes - add statfs support to efivarfs - allow user space to enumerate updatable firmware resources without CAP_SYS_ADMIN" * tag 'efi-next-for-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi/libstub: Disable PCI DMA before grabbing the EFI memory map efi/esrt: Allow ESRT access without CAP_SYS_ADMIN efivarfs: expose used and total size efi: make kobj_type structure constant efi: x86: make kobj_type structure constant commit 5d95ff84e62be914b4a4dabfa814e4096b05b1b0 Merge: d85a143b69abb 486bfb05913ac Author: Linus Torvalds Date: Fri Jun 30 21:27:13 2023 -0700 Merge tag 'v6.5-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "API: - Add linear akcipher/sig API - Add tfm cloning (hmac, cmac) - Add statesize to crypto_ahash Algorithms: - Allow only odd e and restrict value in FIPS mode for RSA - Replace LFSR with SHA3-256 in jitter - Add interface for gathering of raw entropy in jitter Drivers: - Fix race on data_avail and actual data in hwrng/virtio - Add hash and HMAC support in starfive - Add RSA algo support in starfive - Add support for PCI device 0x156E in ccp" * tag 'v6.5-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (85 commits) crypto: akcipher - Do not copy dst if it is NULL crypto: sig - Fix verify call crypto: akcipher - Set request tfm on sync path crypto: sm2 - Provide sm2_compute_z_digest when sm2 is disabled hwrng: imx-rngc - switch to DEFINE_SIMPLE_DEV_PM_OPS hwrng: st - keep clock enabled while hwrng is registered hwrng: st - support compile-testing hwrng: imx-rngc - fix the timeout for init and self check KEYS: asymmetric: Use new crypto interface without scatterlists KEYS: asymmetric: Move sm2 code into x509_public_key KEYS: Add forward declaration in asymmetric-parser.h crypto: sig - Add interface for sign/verify crypto: akcipher - Add sync interface without SG lists crypto: cipher - On clone do crypto_mod_get() crypto: api - Add __crypto_alloc_tfmgfp crypto: api - Remove crypto_init_ops() crypto: rsa - allow only odd e and restrict value in FIPS mode crypto: geniv - Split geniv out of AEAD Kconfig option crypto: algboss - Add missing dependency on RNG2 crypto: starfive - Add RSA algo support ... commit d85a143b69abb4d7544227e26d12c4c7735ab27d Author: Linus Torvalds Date: Fri Jun 30 18:24:49 2023 -0700 xtensa: fix NOMMU build with lock_mm_and_find_vma() conversion It turns out that xtensa has a really odd configuration situation: you can do a no-MMU config, but still have the page fault code enabled. Which doesn't sound all that sensible, but it turns out that xtensa can have protection faults even without the MMU, and we have this: config PFAULT bool "Handle protection faults" if EXPERT && !MMU default y help Handle protection faults. MMU configurations must enable it. noMMU configurations may disable it if used memory map never generates protection faults or faults are always fatal. If unsure, say Y. which completely violated my expectations of the page fault handling. End result: Guenter reports that the xtensa no-MMU builds all fail with arch/xtensa/mm/fault.c: In function ‘do_page_fault’: arch/xtensa/mm/fault.c:133:8: error: implicit declaration of function ‘lock_mm_and_find_vma’ because I never exposed the new lock_mm_and_find_vma() function for the no-MMU case. Doing so is simple enough, and fixes the problem. Reported-and-tested-by: Guenter Roeck Fixes: a050ba1e7422 ("mm/fault: convert remaining simple cases to lock_mm_and_find_vma()") Signed-off-by: Linus Torvalds commit 3c2f765c81be1c85782ba09f492800a99f765a2c Merge: 6e34e784e7213 e836007089ba8 Author: Jens Axboe Date: Fri Jun 30 20:11:24 2023 -0600 Merge tag 'md-fixes-20230630' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into block-6.5 Pull MD fix from Song: "This patch fixes data corruption caused by discard on raid0 array with original layout." * tag 'md-fixes-20230630' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: md/raid0: add discard support for the 'original' layout commit a6ec83786ab9f13f25fb18166dee908845713a95 Author: Chao Yu Date: Thu Jun 29 19:11:44 2023 +0800 f2fs: fix to do sanity check on direct node in truncate_dnode() syzbot reports below bug: BUG: KASAN: slab-use-after-free in f2fs_truncate_data_blocks_range+0x122a/0x14c0 fs/f2fs/file.c:574 Read of size 4 at addr ffff88802a25c000 by task syz-executor148/5000 CPU: 1 PID: 5000 Comm: syz-executor148 Not tainted 6.4.0-rc7-syzkaller-00041-ge660abd551f1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351 print_report mm/kasan/report.c:462 [inline] kasan_report+0x11c/0x130 mm/kasan/report.c:572 f2fs_truncate_data_blocks_range+0x122a/0x14c0 fs/f2fs/file.c:574 truncate_dnode+0x229/0x2e0 fs/f2fs/node.c:944 f2fs_truncate_inode_blocks+0x64b/0xde0 fs/f2fs/node.c:1154 f2fs_do_truncate_blocks+0x4ac/0xf30 fs/f2fs/file.c:721 f2fs_truncate_blocks+0x7b/0x300 fs/f2fs/file.c:749 f2fs_truncate.part.0+0x4a5/0x630 fs/f2fs/file.c:799 f2fs_truncate include/linux/fs.h:825 [inline] f2fs_setattr+0x1738/0x2090 fs/f2fs/file.c:1006 notify_change+0xb2c/0x1180 fs/attr.c:483 do_truncate+0x143/0x200 fs/open.c:66 handle_truncate fs/namei.c:3295 [inline] do_open fs/namei.c:3640 [inline] path_openat+0x2083/0x2750 fs/namei.c:3791 do_filp_open+0x1ba/0x410 fs/namei.c:3818 do_sys_openat2+0x16d/0x4c0 fs/open.c:1356 do_sys_open fs/open.c:1372 [inline] __do_sys_creat fs/open.c:1448 [inline] __se_sys_creat fs/open.c:1442 [inline] __x64_sys_creat+0xcd/0x120 fs/open.c:1442 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The root cause is, inodeA references inodeB via inodeB's ino, once inodeA is truncated, it calls truncate_dnode() to truncate data blocks in inodeB's node page, it traverse mapping data from node->i.i_addr[0] to node->i.i_addr[ADDRS_PER_BLOCK() - 1], result in out-of-boundary access. This patch fixes to add sanity check on dnode page in truncate_dnode(), so that, it can help to avoid triggering such issue, and once it encounters such issue, it will record newly introduced ERROR_INVALID_NODE_REFERENCE error into superblock, later fsck can detect such issue and try repairing. Also, it removes f2fs_truncate_data_blocks() for cleanup due to the function has only one caller, and uses f2fs_truncate_data_blocks_range() instead. Reported-and-tested-by: syzbot+12cb4425b22169b52036@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/000000000000f3038a05fef867f8@google.com Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 87a91a155902f2b652e272ad3ba4de3486af9229 Author: Sheng Yong Date: Tue Jun 27 20:21:53 2023 +0800 f2fs: only set release for file that has compressed data If a file is not comprssed yet or does not have compressed data, for example, its data has a very low compression ratio, do not set FI_COMPRESS_RELEASED flag. Signed-off-by: Sheng Yong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit c31e49615762a5fa0d14ffcfd5e2f1c206213a14 Author: Chao Yu Date: Thu Jun 29 09:41:34 2023 +0800 f2fs: fix compile warning in f2fs_destroy_node_manager() fs/f2fs/node.c: In function ‘f2fs_destroy_node_manager’: fs/f2fs/node.c:3390:1: warning: the frame size of 1048 bytes is larger than 1024 bytes [-Wframe-larger-than=] 3390 | } Merging below pointer arrays into common one, and reuse it by cast type. struct nat_entry *natvec[NATVEC_SIZE]; struct nat_entry_set *setvec[SETVEC_SIZE]; Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 0135c482fa97e2fd8245cb462784112a00ed1211 Author: Chao Yu Date: Thu Jun 29 09:41:02 2023 +0800 f2fs: fix error path handling in truncate_dnode() If truncate_node() fails in truncate_dnode(), it missed to call f2fs_put_page(), fix it. Fixes: 7735730d39d7 ("f2fs: fix to propagate error from __get_meta_page()") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 5eda1ad1aaffdfebdecf7a164e586060a210f74f Author: Jaegeuk Kim Date: Wed Jun 28 01:00:56 2023 -0700 f2fs: fix deadlock in i_xattr_sem and inode page lock Thread #1: [122554.641906][ T92] f2fs_getxattr+0xd4/0x5fc -> waiting for f2fs_down_read(&F2FS_I(inode)->i_xattr_sem); [122554.641927][ T92] __f2fs_get_acl+0x50/0x284 [122554.641948][ T92] f2fs_init_acl+0x84/0x54c [122554.641969][ T92] f2fs_init_inode_metadata+0x460/0x5f0 [122554.641990][ T92] f2fs_add_inline_entry+0x11c/0x350 -> Locked dir->inode_page by f2fs_get_node_page() [122554.642009][ T92] f2fs_do_add_link+0x100/0x1e4 [122554.642025][ T92] f2fs_create+0xf4/0x22c [122554.642047][ T92] vfs_create+0x130/0x1f4 Thread #2: [123996.386358][ T92] __get_node_page+0x8c/0x504 -> waiting for dir->inode_page lock [123996.386383][ T92] read_all_xattrs+0x11c/0x1f4 [123996.386405][ T92] __f2fs_setxattr+0xcc/0x528 [123996.386424][ T92] f2fs_setxattr+0x158/0x1f4 -> f2fs_down_write(&F2FS_I(inode)->i_xattr_sem); [123996.386443][ T92] __f2fs_set_acl+0x328/0x430 [123996.386618][ T92] f2fs_set_acl+0x38/0x50 [123996.386642][ T92] posix_acl_chmod+0xc8/0x1c8 [123996.386669][ T92] f2fs_setattr+0x5e0/0x6bc [123996.386689][ T92] notify_change+0x4d8/0x580 [123996.386717][ T92] chmod_common+0xd8/0x184 [123996.386748][ T92] do_fchmodat+0x60/0x124 [123996.386766][ T92] __arm64_sys_fchmodat+0x28/0x3c Cc: Fixes: 27161f13e3c3 "f2fs: avoid race in between read xattr & write xattr" Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7fffbc71075dcb733068d711c2593127cdce86f0 Author: Tom Rix Date: Fri Jun 30 16:19:47 2023 -0700 sysctl: set variable sysctl_mount_point storage-class-specifier to static smatch reports fs/proc/proc_sysctl.c:32:18: warning: symbol 'sysctl_mount_point' was not declared. Should it be static? This variable is only used in its defining file, so it should be static. Signed-off-by: Tom Rix Reviewed-by: Kees Cook Signed-off-by: Luis Chamberlain commit e836007089ba8fdf24e636ef2b007651fb4582e6 Author: Jason Baron Date: Fri Jun 23 14:05:23 2023 -0400 md/raid0: add discard support for the 'original' layout We've found that using raid0 with the 'original' layout and discard enabled with different disk sizes (such that at least two zones are created) can result in data corruption. This is due to the fact that the discard handling in 'raid0_handle_discard()' assumes the 'alternate' layout. We've seen this corruption using ext4 but other filesystems are likely susceptible as well. More specifically, while multiple zones are necessary to create the corruption, the corruption may not occur with multiple zones if they layout in such a way the layout matches what the 'alternate' layout would have produced. Thus, not all raid0 devices with the 'original' layout, different size disks and discard enabled will encounter this corruption. The 3.14 kernel inadvertently changed the raid0 disk layout for different size disks. Thus, running a pre-3.14 kernel and post-3.14 kernel on the same raid0 array could corrupt data. This lead to the creation of the 'original' layout (to match the pre-3.14 layout) and the 'alternate' layout (to match the post 3.14 layout) in the 5.4 kernel time frame and an option to tell the kernel which layout to use (since it couldn't be autodetected). However, when the 'original' layout was added back to 5.4 discard support for the 'original' layout was not added leading this issue. I've been able to reliably reproduce the corruption with the following test case: 1. create raid0 array with different size disks using original layout 2. mkfs 3. mount -o discard 4. create lots of files 5. remove 1/2 the files 6. fstrim -a (or just the mount point for the raid0 array) 7. umount 8. fsck -fn /dev/md0 (spews all sorts of corruptions) Let's fix this by adding proper discard support to the 'original' layout. The fix 'maps' the 'original' layout disks to the order in which they are read/written such that we can compare the disks in the same way that the current 'alternate' layout does. A 'disk_shift' field is added to 'struct strip_zone'. This could be computed on the fly in raid0_handle_discard() but by adding this field, we save some computation in the discard path. Note we could also potentially fix this by re-ordering the disks in the zones that follow the first one, and then always read/writing them using the 'alternate' layout. However, that is seen as a more substantial change, and we are attempting the least invasive fix at this time to remedy the corruption. I've verified the change using the reproducer mentioned above. Typically, the corruption is seen after less than 3 iterations, while the patch has run 500+ iterations. Cc: NeilBrown Cc: Song Liu Fixes: c84a1372df92 ("md/raid0: avoid RAID0 data corruption due to layout confusion.") Cc: stable@vger.kernel.org Signed-off-by: Jason Baron Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20230623180523.1901230-1-jbaron@akamai.com commit 1b712f18c461bd75f018033a15cf381e712806b5 Author: Nishanth Menon Date: Tue Jun 20 20:00:22 2023 -0500 mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 Sec proxy/message manager data buffer is 60 bytes with the last of the registers indicating transmission completion. This however poses a bit of a challenge. The backing memory for sec_proxy / message manager is regular memory, and all sec proxy does is to trigger a burst of all 60 bytes of data over to the target thread backing ring accelerator. It doesn't do a memory scrub when it moves data out in the burst. When we transmit multiple messages, remnants of previous message is also transmitted which results in some random data being set in TISCI fields of messages that have been expanded forward. The entire concept of backward compatibility hinges on the fact that the unused message fields remain 0x0 allowing for 0x0 value to be specially considered when backward compatibility of message extension is done. So, instead of just writing the completion register, we continue to fill the message buffer up with 0x0 (note: for partial message involving completion, we already do this). This allows us to scale and introduce ABI changes back also work with other boot stages that may have left data in the internal memory. While at this, be consistent and explicit with the data_reg pointer increment. Fixes: aace66b170ce ("mailbox: Introduce TI message manager driver") Signed-off-by: Nishanth Menon Signed-off-by: Jassi Brar commit 602dbbacc3ef9b0a8102202bbde9a5f253677cf0 Author: Stefan Kristiansson Date: Mon May 29 16:50:45 2023 +0300 mailbox: tegra: add support for Tegra264 Tegra264 has a slightly different doorbell register layout than previous chips. Acked-by: Thierry Reding Signed-off-by: Stefan Kristiansson Signed-off-by: Peter De Schrijver Signed-off-by: Jassi Brar commit af9dbbbb4d30c4601a14c920c6ec9ae5cf0fdd22 Author: Peter De Schrijver Date: Mon May 29 16:50:43 2023 +0300 dt-bindings: mailbox: tegra: Document Tegra264 HSP Add the compatible string for the HSP block found on the Tegra264 SoC. The HSP block in Tegra264 is not register compatible with the one in Tegra194 or Tegra234 hence there is no fallback compatibility string. Acked-by: Krzysztof Kozlowski Acked-by: Thierry Reding Signed-off-by: Peter De Schrijver Signed-off-by: Jassi Brar commit ebb0130dad751e88c28ab94c71e46e8ee65427c9 Author: Stefan Wahren Date: Sat Jun 17 15:36:19 2023 +0200 dt-bindings: mailbox: convert bcm2835-mbox bindings to YAML Convert the DT binding document for bcm2835-mbox from .txt to YAML. Signed-off-by: Stefan Wahren Reviewed-by: Rob Herring Signed-off-by: Jassi Brar commit 13ad4b7ce612f215437a479e6efc74aac2d20c25 Author: Manikanta Mylavarapu Date: Mon May 22 03:58:41 2023 +0530 dt-bindings: mailbox: qcom: Add IPQ5018 APCS compatible Add compatible for the Qualcomm IPQ5018 APCS block. Signed-off-by: Manikanta Mylavarapu Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jassi Brar commit b25f62ccb490680a8cee755ac4528909395e0711 Merge: 9070577ae9d60 ff598081e5b9d Author: Linus Torvalds Date: Fri Jun 30 15:22:09 2023 -0700 Merge tag 'vfio-v6.5-rc1' of https://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Adjust log levels for common messages (Oleksandr Natalenko, Alex Williamson) - Support for dynamic MSI-X allocation (Reinette Chatre) - Enable and report PCIe AtomicOp Completer capabilities (Alex Williamson) - Cleanup Kconfigs for vfio bus drivers (Alex Williamson) - Add support for CDX bus based devices (Nipun Gupta) - Fix race with concurrent mdev initialization (Eric Farman) * tag 'vfio-v6.5-rc1' of https://github.com/awilliam/linux-vfio: vfio/mdev: Move the compat_class initialization to module init vfio/cdx: add support for CDX bus vfio/fsl: Create Kconfig sub-menu vfio/platform: Cleanup Kconfig vfio/pci: Cleanup Kconfig vfio/pci-core: Add capability for AtomicOp completer support vfio/pci: Also demote hiding standard cap messages vfio/pci: Clear VFIO_IRQ_INFO_NORESIZE for MSI-X vfio/pci: Support dynamic MSI-X vfio/pci: Probe and store ability to support dynamic MSI-X vfio/pci: Use bitfield for struct vfio_pci_core_device flags vfio/pci: Update stale comment vfio/pci: Remove interrupt context counter vfio/pci: Use xarray for interrupt context storage vfio/pci: Move to single error path vfio/pci: Prepare for dynamic interrupt context storage vfio/pci: Remove negative check on unsigned vector vfio/pci: Consolidate irq cleanup on MSI/MSI-X disable vfio/pci: demote hiding ecap messages to debug level commit 9070577ae9d6065e447d422bdf85a09f89eaa9e8 Merge: 28968f384be3c 6ecac465eee88 Author: Linus Torvalds Date: Fri Jun 30 15:06:45 2023 -0700 Merge tag 'pci-v6.5-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci updates from Bjorn Helgaas: "Enumeration: - Export pcie_retrain_link() for use outside ASPM - Add Data Link Layer Link Active Reporting as another way for pcie_retrain_link() to determine the link is up - Work around link training failures (especially on the ASMedia ASM2824 switch) by training first at 2.5GT/s and then attempting higher rates Resource management: - When we coalesce host bridge windows, remove invalidated resources from the resource tree so future allocations work correctly Hotplug: - Cancel bringup sequence if card is not present, to keep from blinking Power Indicator indefinitely - Reassign bridge resources if necessary for ACPI hotplug Driver binding: - Convert platform_device .remove() callbacks to return void instead of a mostly useless int Power management: - Reduce wait time for secondary bus to be ready to speed up resume - Avoid putting EloPOS E2/S2/H2 (as well as Elo i2) PCIe Ports in D3cold - Call _REG when transitioning D-states so AML that uses the PCI config space OpRegion works, which fixes some ASMedia GPIO controllers after resume Virtualization: - Delay extra 250ms after FLR of Solidigm P44 Pro NVMe to avoid KVM hang when guest is rebooted - Add function 1 DMA alias quirk for Marvell 88SE9235 Error handling: - Unexport pci_save_aer_state() since it's only used in drivers/pci/ - Drop recommendation for drivers to configure AER Capability, since the PCI core does this for all devices ASPM: - Disable ASPM on MFD function removal to avoid use-after-free - Tighten up pci_enable_link_state() and pci_disable_link_state() interfaces so they don't enable/disable states the driver didn't specify - Avoid link retraining race that can happen if ASPM sets link control parameters while the link is in the midst of training for some other reason Endpoint framework: - Change "PCI Endpoint Virtual NTB driver" Kconfig prompt to be different from "PCI Endpoint NTB driver" - Automatically create a function specific attributes group for endpoint drivers to avoid reference counting issues - Fix many EPC test issues - Return pci_epf_type_add_cfs() error if EPF has no driver - Add kernel-doc for pci_epc_raise_irq() and pci_epc_map_msi_irq() MSI vector parameters - Pass EPF device ID to driver probe functions - Return -EALREADY if EPC has already been started/stopped - Add linkdown notifier support and use it in qcom-ep - Add Bus Master Enable event support and use it in qcom-ep - Add Qualcomm Modem Host Interface (MHI) endpoint driver - Add Layerscape PME interrupt handling to manage link-up notification Cadence PCIe controller driver: - Wait for link retrain to complete when working around the J721E i2085 erratum with Gen2 mode Faraday FTPC100 PCI controller driver: - Release clock resources on error paths Freescale i.MX6 PCIe controller driver: - Save and restore Root Port MSI control to work around hardware defect Intel VMD host bridge driver: - Reset VMD config register between soft reboots - Capture pci_reset_bus() return value instead of printing junk when it fails Qualcomm PCIe controller driver: - Add SDX65 endpoint compatible string to DT binding - Disable register write access after init for IP v2.3.3, v2.9.0 - Use DWC helpers for enabling/disabling writes to DBI registers - Hide slot hotplug capability for IP v1.0.0, v1.9.0, v2.1.0, v2.3.2, v2.3.3, v2.7.0, v2.9.0 - Reuse v2.3.2 post-init sequence for v2.4.0 Renesas R-Car PCIe controller driver: - Remove unused static pcie_base and pcie_dev Rockchip PCIe controller driver: - Remove writes to unused registers - Write endpoint Device ID using correct register - Assert PCI Configuration Enable bit after probe so endpoint responds instead of generating Request Retry Status messages - Poll waiting for PHY PLLs to lock - Update RK3399 example DT binding to be valid - Use RK3399 PCIE_CLIENT_LEGACY_INT_CTRL to generate INTx instead of manually generating PCIe message - Use multiple windows to avoid address translation conflicts - Use u32 (not u16) when accessing 32-bit registers - Hide MSI-X Capability, since RK3399 can't generate MSI-X - Set endpoint controller required alignment to 256 Synopsys DesignWare PCIe controller driver: - Wait for link to come up only if we've initiated link training Miscellaneous: - Add pci_clear_master() stub for non-CONFIG_PCI" * tag 'pci-v6.5-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (116 commits) Documentation: PCI: correct spelling PCI: vmd: Fix uninitialized variable usage in vmd_enable_domain() PCI: xgene-msi: Convert to platform remove callback returning void PCI: tegra: Convert to platform remove callback returning void PCI: rockchip-host: Convert to platform remove callback returning void PCI: mvebu: Convert to platform remove callback returning void PCI: mt7621: Convert to platform remove callback returning void PCI: mediatek-gen3: Convert to platform remove callback returning void PCI: mediatek: Convert to platform remove callback returning void PCI: iproc: Convert to platform remove callback returning void PCI: hisi-error: Convert to platform remove callback returning void PCI: dwc: Convert to platform remove callback returning void PCI: j721e: Convert to platform remove callback returning void PCI: brcmstb: Convert to platform remove callback returning void PCI: altera-msi: Convert to platform remove callback returning void PCI: altera: Convert to platform remove callback returning void PCI: aardvark: Convert to platform remove callback returning void PCI: rcar: Use correct product family name for Renesas R-Car PCI: layerscape: Add the endpoint linkup notifier support PCI: endpoint: pci-epf-vntb: Fix typo in comments ... commit 28968f384be3c064d66954aac4c534a5e76bf973 Merge: 9c3255a8f3946 9f0648f13e34a Author: Linus Torvalds Date: Fri Jun 30 14:57:19 2023 -0700 Merge tag 'pinctrl-v6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "No core changes this time New drivers: - Tegra234 support - Qualcomm IPQ5018 support - Intel Meteor Lake-S support - Qualcomm SDX75 subdriver - Qualcomm SPMI-based PM8953 support Improvements: - Fix up support for GPIO3 on the AXP209 - Push-pull drive configuration support for the AT91 PIO4 - Fix misc non-urgent bugs in the AMD driver - Misc non-urgent improved error handling - Misc janitorial and minor improvements" * tag 'pinctrl-v6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (75 commits) pinctrl: cherryview: Drop goto label pinctrl: baytrail: invert if condition pinctrl: baytrail: add warning for BYT_VAL_REG retrieval failure pinctrl: baytrail: reduce scope of spinlock in ->dbg_show() hook pinctrl: tegra: avoid duplicate field initializers dt-bindings: pinctrl: qcom,sdx65-tlmm: add pcie_clkreq function pinctrl: mlxbf3: remove broken Kconfig 'select' pinctrl: spear: Remove unused of_gpio.h inclusion pinctrl: lantiq: Remove unused of_gpio.h inclusion pinctrl: at91-pio4: check return value of devm_kasprintf() pinctrl: microchip-sgpio: check return value of devm_kasprintf() pinctrl: freescale: Fix a memory out of bounds when num_configs is 1 pinctrl: intel: refine ->irq_set_type() hook pinctrl: intel: refine ->set_mux() hook pinctrl: baytrail: Use str_hi_lo() helper lib/string_choices: Add str_high_low() helper lib/string_helpers: Split out string_choices.h lib/string_helpers: Add missing header files to MAINTAINERS database pinctrl: npcm7xx: Add missing check for ioremap pinctrl:sunplus: Add check for kmalloc ... commit 9c3255a8f3946a4c8844f1e2e093313f3b71cb30 Merge: 6cdbb0907a3c5 d2a7bd3690990 Author: Linus Torvalds Date: Fri Jun 30 14:50:00 2023 -0700 Merge tag 'platform-drivers-x86-v6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver updates from Hans de Goede: "AMD PMC and PMF drivers: - Various bugfixes - Improved debugging support Intel PMC: - Refactor to support hw with multiple PMCs - Various other improvements / new hw support Intel Speed Select Technology (ISST): - TPMI Uncore Frequency + Cluster Level Power Controls - Various bugfixes - tools/intel-speed-select: Misc improvements Dell-DDV: Add documentation INT3472 ACPI camera sensor glue code: - Evaluate device's _DSM method to control imaging clock - Drop the need to have a table with per sensor-model info Lenovo Yogabook: - Refactor / rework to also support Android models Think-LMI: - Multiple improvements and fixes WMI: - Add proper API documentation for the WMI bus x86-android-tablets: - Misc new hw support Miscellaneous other cleanups / fixes" * tag 'platform-drivers-x86-v6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (91 commits) platform/x86:intel/pmc: Add Meteor Lake IOE-M PMC related maps platform/x86:intel/pmc: Add Meteor Lake IOE-P PMC related maps platform/x86:intel/pmc: Use SSRAM to discover pwrm base address of primary PMC platform/x86:intel/pmc: Discover PMC devices platform/x86:intel/pmc: Enable debugfs multiple PMC support platform/x86:intel/pmc: Add support to handle multiple PMCs platform/x86:intel/pmc: Combine core_init() and core_configure() platform/x86:intel/pmc: Update maps for Meteor Lake P/M platforms platform/x86/intel: tpmi: Remove hardcoded unit and offset platform/x86: int3472: discrete: Log a warning if the pin-numbers don't match platform/x86: int3472: discrete: Use FIELD_GET() on the GPIO _DSM return value platform/x86: int3472: discrete: Add alternative "AVDD" regulator supply name platform/x86: int3472: discrete: Add support for 1 GPIO regulator shared between 2 sensors platform/x86: int3472: discrete: Remove sensor_config-s platform/x86: int3472: discrete: Drop GPIO remapping support platform/x86: apple-gmux: don't use be32_to_cpu and cpu_to_be32 platform/x86/dell/dell-rbtn: Fix resources leaking on error path platform/x86: ISST: Fix usage counter platform/x86: ISST: Reset default callback on unregister platform/x86: int3472: Switch back to use struct i2c_driver's .probe() ... commit 6e34e784e72132c91b03d4f2f85bd4725b1ad9e5 Merge: a587b046ce921 4e69d4dabd237 Author: Jens Axboe Date: Fri Jun 30 14:04:08 2023 -0600 Merge tag 'nvme-6.5-2023-06-30' of git://git.infradead.org/nvme into block-6.5 Pull NVMe fixes from Keith: "nvme fixes for Linux 6.5 - Reduce spamming kernel logs on repeated controller updates (Breno) - Improved struct packing (Christophe JAILLET) - Misspelled command name in error logging (Damien) - Failover fix for temporary frozen queue (Sagi) - Reset error handling fixes (Keith)" * tag 'nvme-6.5-2023-06-30' of git://git.infradead.org/nvme: nvme: disable controller on reset state failure nvme: sync timeout work on failed reset nvme: ensure unquiesce on teardown nvme-mpath: fix I/O failure with EAGAIN when failing over I/O nvme: host: fix command name spelling nvmet: Reorder fields in 'struct nvmet_ns' nvme: Print capabilities changes just once commit 6cdbb0907a3c562723455e351c940037bdec9b7a Merge: ca7ce08d6a063 e2c789cab60a4 Author: Linus Torvalds Date: Fri Jun 30 12:16:00 2023 -0700 Merge tag 'for-6.5/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mike Snitzer: - Update DM crypt to allocate compound pages if possible - Fix DM crypt target's crypt_ctr_cipher_new return value on invalid AEAD cipher - Fix DM flakey testing target's write bio corruption feature to corrupt the data of a cloned bio instead of the original - Add random_read_corrupt and random_write_corrupt features to DM flakey target - Fix ABBA deadlock in DM thin metadata by resetting associated bufio client rather than destroying and recreating it - A couple other small DM thinp cleanups - Update DM core to support disabling block core IO stats accounting and optimize away code that isn't needed if stats are disabled - Other small DM core cleanups - Improve DM integrity target to not require so much memory on 32 bit systems. Also only allocate the recalculate buffer as needed (and increasingly reduce its size on allocation failure) - Update DM integrity to use %*ph for printing hexdump of a small buffer. Also update DM integrity documentation - Various DM core ioctl interface hardening. Now more careful about alignment of structures and processing of input passed to the kernel from userspace. Also disallow the creation of DM devices named "control", "." or ".." - Eliminate GFP_NOIO workarounds for __vmalloc and kvmalloc in DM core's ioctl and bufio code * tag 'for-6.5/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (28 commits) dm: get rid of GFP_NOIO workarounds for __vmalloc and kvmalloc dm integrity: scale down the recalculate buffer if memory allocation fails dm integrity: only allocate recalculate buffer when needed dm integrity: reduce vmalloc space footprint on 32-bit architectures dm ioctl: Refuse to create device named "." or ".." dm ioctl: Refuse to create device named "control" dm ioctl: Avoid double-fetch of version dm ioctl: structs and parameter strings must not overlap dm ioctl: Avoid pointer arithmetic overflow dm ioctl: Check dm_target_spec is sufficiently aligned Documentation: dm-integrity: Document an example of how the tunables relate. Documentation: dm-integrity: Document default values. Documentation: dm-integrity: Document the meaning of "buffer". Documentation: dm-integrity: Fix minor grammatical error. dm integrity: Use %*ph for printing hexdump of a small buffer dm thin: disable discards for thin-pool if no_discard_passdown dm: remove stale/redundant dm_internal_{suspend,resume} prototypes in dm.h dm: skip dm-stats work in alloc_io() unless needed dm: avoid needless dm_io access if all IO accounting is disabled dm: support turning off block-core's io stats accounting ... commit ca7ce08d6a063e0ccb91dc57f9bc213120d0d1a7 Merge: 1546cd4bfda49 af92c02fb2090 Author: Linus Torvalds Date: Fri Jun 30 11:57:07 2023 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Updates to the usual drivers (ufs, pm80xx, libata-scsi, smartpqi, lpfc, qla2xxx). We have a couple of major core changes impacting other systems: - Command Duration Limits, which spills into block and ATA - block level Persistent Reservation Operations, which touches block, nvme, target and dm Both of these are added with merge commits containing a cover letter explaining what's going on" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (187 commits) scsi: core: Improve warning message in scsi_device_block() scsi: core: Replace scsi_target_block() with scsi_block_targets() scsi: core: Don't wait for quiesce in scsi_device_block() scsi: core: Don't wait for quiesce in scsi_stop_queue() scsi: core: Merge scsi_internal_device_block() and device_block() scsi: sg: Increase number of devices scsi: bsg: Increase number of devices scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue scsi: ufs: ufs-pci: Add support for Intel Arrow Lake scsi: sd: sd_zbc: Use PAGE_SECTORS_SHIFT scsi: ufs: wb: Add explicit flush_threshold sysfs attribute scsi: ufs: ufs-qcom: Switch to the new ICE API scsi: ufs: dt-bindings: qcom: Add ICE phandle scsi: ufs: ufs-mediatek: Set UFSHCD_QUIRK_MCQ_BROKEN_RTC quirk scsi: ufs: ufs-mediatek: Set UFSHCD_QUIRK_MCQ_BROKEN_INTR quirk scsi: ufs: core: Add host quirk UFSHCD_QUIRK_MCQ_BROKEN_RTC scsi: ufs: core: Add host quirk UFSHCD_QUIRK_MCQ_BROKEN_INTR scsi: ufs: core: Remove dedicated hwq for dev command scsi: ufs: core: mcq: Fix the incorrect OCS value for the device command scsi: ufs: dt-bindings: samsung,exynos: Drop unneeded quotes ... commit 1546cd4bfda49fd6faad47eb30f4e744e2d79a8f Merge: b30d7a77c53ec fd3ac6e804979 Author: Linus Torvalds Date: Fri Jun 30 11:48:16 2023 -0700 Merge tag 'ata-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata Pull ata updates from Damien Le Moal: - Add support for the .remove_new callback to the ata_platform code to simplify device removal interface (Uwe) - Code simplification in ata_dev_revalidate() (Yahu) - Fix code indentation and coding style in the pata_parport protocol modules to avoid warnings from static code analyzers (me) - Clarify ata_eh_qc_retry() behavior with better comments (Niklas) - Simplify and improve ata_change_queue_depth() behavior to have a consistent behavior between libsas managed devices and libata managed devices (e.g. AHCI connected devices) (me) - Cleanup libata-scsi and libata-eh code to use the ata_ncq_enabled() and ata_ncq_supported() helpers instead of open coding flags tests (me) - Cleanup ahci_reset_controller() code (me) - Change the pata_octeon_cf and sata_svw drivers to use of_property_read_reg() to simplify the code (Rob, me) - Remove unnecessary include files from ahci_octeon driver (me) - Modify the DesignWare ahci dt bindings to add support for the Rockchip RK3588 AHCI (Sebastian) * tag 'ata-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/libata: (29 commits) dt-bindings: phy: rockchip: rk3588 has two reset lines dt-bindings: ata: dwc-ahci: add Rockchip RK3588 dt-bindings: ata: dwc-ahci: add PHY clocks ata: ahci_octeon: Remove unnecessary include ata: pata_octeon_cf: Add missing header include ata: ahci: Cleanup ahci_reset_controller() ata: Use of_property_read_reg() to parse "reg" ata: libata-scsi: Use ata_ncq_supported in ata_scsi_dev_config() ata: libata-eh: Use ata_ncq_enabled() in ata_eh_speed_down() ata: libata-sata: Improve ata_change_queue_depth() ata: libata-sata: Simplify ata_change_queue_depth() ata: libata-eh: Clarify ata_eh_qc_retry() behavior at call site ata: pata_parport: Fix on26 module code indentation and style ata: pata_parport: Fix on20 module code indentation and style ata: pata_parport: Fix ktti module code indentation and style ata: pata_parport: Fix kbic module code indentation and style ata: pata_parport: Fix friq module code indentation and style ata: pata_parport: Fix fit3 module code indentation and style ata: pata_parport: Fix fit2 module code indentation and style ata: pata_parport: Fix epia module code indentation and style ... commit b30d7a77c53ec04a6d94683d7680ec406b7f3ac8 Merge: d2a6fd45c5c4a 4d60e83dfcee7 Author: Linus Torvalds Date: Fri Jun 30 11:35:41 2023 -0700 Merge tag 'perf-tools-for-v6.5-1-2023-06-28' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next Pull perf tools updates from Namhyung Kim: "Internal cleanup: - Refactor PMU data management to handle hybrid systems in a generic way. Do more work in the lexer so that legacy event types parse more easily. A side-effect of this is that if a PMU is specified, scanning sysfs is avoided improving start-up time. - Fix hybrid metrics, for example, the TopdownL1 works for both performance and efficiency cores on Intel machines. To support this, sort and regroup events after parsing. - Add reference count checking for the 'thread' data structure. - Lots of fixes for memory leaks in various places thanks to the ASAN and Ian's refcount checker. - Reduce the binary size by replacing static variables with local or dynamically allocated memory. - Introduce shared_mutex for annotate data to reduce memory footprint. - Make filesystem access library functions more thread safe. Test: - Organize cpu_map tests into a single suite. - Add metric value validation test to check if the values are within correct value ranges. - Add perf stat stdio output test to check if event and metric names match. - Add perf data converter JSON output test. - Fix a lot of issues reported by shellcheck(1). This is a preparation to enable shellcheck by default. - Make the large x86 new instructions test optional at build time using EXTRA_TESTS=1. - Add a test for libpfm4 events. perf script: - Add 'dsoff' outpuf field to display offset from the DSO. $ perf script -F comm,pid,event,ip,dsoff ls 2695501 cycles: 152cc73ef4b5 (/usr/lib/x86_64-linux-gnu/ld-2.31.so+0x1c4b5) ls 2695501 cycles: ffffffff99045b3e ([kernel.kallsyms]) ls 2695501 cycles: ffffffff9968e107 ([kernel.kallsyms]) ls 2695501 cycles: ffffffffc1f54afb ([kernel.kallsyms]) ls 2695501 cycles: ffffffff9968382f ([kernel.kallsyms]) ls 2695501 cycles: ffffffff99e00094 ([kernel.kallsyms]) ls 2695501 cycles: 152cc718a8d0 (/usr/lib/x86_64-linux-gnu/libselinux.so.1+0x68d0) ls 2695501 cycles: ffffffff992a6db0 ([kernel.kallsyms]) - Adjust width for large PID/TID values. perf report: - Robustify reading addr2line output for srcline by checking sentinel output before the actual data and by using timeout of 1 second. - Allow config terms (like 'name=ABC') with breakpoint events. $ perf record -e mem:0x55feb98dd169:x/name=breakpoint/ -p 19646 -- sleep 1 perf annotate: - Handle x86 instruction suffix like 'l' in 'movl' generally. - Parse instruction operands properly even with a whitespace. This is needed for llvm-objdump output. - Support RISC-V binutils lookup using the triplet prefixes. - Add '<' and '>' key to navigate to prev/next symbols in TUI. - Fix instruction association and parsing for LoongArch. perf stat: - Add --per-cache aggregation option, optionally specify a cache level like `--per-cache=L2`. $ sudo perf stat --per-cache -a -e ls_dmnd_fills_from_sys.ext_cache_remote --\ taskset -c 0-15,64-79,128-143,192-207\ perf bench sched messaging -p -t -l 100000 -g 8 # Running 'sched/messaging' benchmark: # 20 sender and receiver threads per group # 8 groups == 320 threads run Total time: 7.648 [sec] Performance counter stats for 'system wide': S0-D0-L3-ID0 16 17,145,912 ls_dmnd_fills_from_sys.ext_cache_remote S0-D0-L3-ID8 16 14,977,628 ls_dmnd_fills_from_sys.ext_cache_remote S0-D0-L3-ID16 16 262,539 ls_dmnd_fills_from_sys.ext_cache_remote S0-D0-L3-ID24 16 3,140 ls_dmnd_fills_from_sys.ext_cache_remote S0-D0-L3-ID32 16 27,403 ls_dmnd_fills_from_sys.ext_cache_remote S0-D0-L3-ID40 16 17,026 ls_dmnd_fills_from_sys.ext_cache_remote S0-D0-L3-ID48 16 7,292 ls_dmnd_fills_from_sys.ext_cache_remote S0-D0-L3-ID56 16 2,464 ls_dmnd_fills_from_sys.ext_cache_remote S1-D1-L3-ID64 16 22,489,306 ls_dmnd_fills_from_sys.ext_cache_remote S1-D1-L3-ID72 16 21,455,257 ls_dmnd_fills_from_sys.ext_cache_remote S1-D1-L3-ID80 16 11,619 ls_dmnd_fills_from_sys.ext_cache_remote S1-D1-L3-ID88 16 30,978 ls_dmnd_fills_from_sys.ext_cache_remote S1-D1-L3-ID96 16 37,628 ls_dmnd_fills_from_sys.ext_cache_remote S1-D1-L3-ID104 16 13,594 ls_dmnd_fills_from_sys.ext_cache_remote S1-D1-L3-ID112 16 10,164 ls_dmnd_fills_from_sys.ext_cache_remote S1-D1-L3-ID120 16 11,259 ls_dmnd_fills_from_sys.ext_cache_remote 7.779171484 seconds time elapsed - Change default (no event/metric) formatting for default metrics so that events are hidden and the metric and group appear. Performance counter stats for 'ls /': 1.85 msec task-clock # 0.594 CPUs utilized 0 context-switches # 0.000 /sec 0 cpu-migrations # 0.000 /sec 97 page-faults # 52.517 K/sec 2,187,173 cycles # 1.184 GHz 2,474,459 instructions # 1.13 insn per cycle 531,584 branches # 287.805 M/sec 13,626 branch-misses # 2.56% of all branches TopdownL1 # 23.5 % tma_backend_bound # 11.5 % tma_bad_speculation # 39.1 % tma_frontend_bound # 25.9 % tma_retiring - Allow --cputype option to have any PMU name (not just hybrid). - Fix output value not to added when it runs multiple times with -r option. perf list: - Show metricgroup description from JSON file called metricgroups.json. - Allow 'pfm' argument to list only libpfm4 events and check each event is supported before showing it. JSON vendor events: - Avoid event grouping using "NO_GROUP_EVENTS" constraints. The topdown events are correctly grouped even if no group exists. - Add "Default" metric group to print it in the default output. And use "DefaultMetricgroupName" to indicate the real metric group name. - Add AmpereOne core PMU events. Misc: - Define man page date correctly. - Track exception level properly on ARM CoreSight ETM. - Allow anonymous struct, union or enum when retrieving type names from DWARF. - Fix incorrect filename when calling `perf inject --jit`. - Handle PLT size correctly on LoongArch" * tag 'perf-tools-for-v6.5-1-2023-06-28' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next: (269 commits) perf test: Skip metrics w/o event name in stat STD output linter perf test: Reorder event name checks in stat STD output linter perf pmu: Remove a hard coded cpu PMU assumption perf pmus: Add notion of default PMU for JSON events perf unwind: Fix map reference counts perf test: Set PERF_EXEC_PATH for script execution perf script: Initialize buffer for regs_map() perf tests: Fix test_arm_callgraph_fp variable expansion perf symbol: Add LoongArch case in get_plt_sizes() perf test: Remove x permission from lib/stat_output.sh perf test: Rerun failed metrics with longer workload perf test: Add skip list for metrics known would fail perf test: Add metric value validation test perf jit: Fix incorrect file name in DWARF line table perf annotate: Fix instruction association and parsing for LoongArch perf annotation: Switch lock from a mutex to a sharded_mutex perf sharded_mutex: Introduce sharded_mutex tools: Fix incorrect calculation of object size by sizeof perf subcmd: Fix missing check for return value of malloc() in add_cmdname() perf parse-events: Remove unneeded semicolon ... commit 055509cdfd018cc6cd793593df916f1cf4f83d84 Merge: ac192c1a54f95 c93723ada378a Author: Mark Brown Date: Fri Jun 30 19:18:53 2023 +0100 ASoC: codecs: wcd938x/wcd934x: loglevel fix and Merge series from Johan Hovold : When investigating a race in the wcd938x driver I noticed that the MBHC impedance measurements where printed at error loglevel which is clearly wrong. Fix that, and clean up the logging somewhat by using dev_printk() and addressing some style issues. Included are also two patches that drop the bogus inline keywords from the functions involved. commit 4e69d4dabd2379af57b0b8fb9b0d62c23f9cd3b8 Author: Keith Busch Date: Wed Jun 28 07:51:02 2023 -0700 nvme: disable controller on reset state failure If the controller is not in a RESETTING state at the point of reset work, we have to conclude the controller is being deleted. Go to the cleanup on this condition to ensure proper pairing of request_queue quiesce state. Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit a2b5d5443fa7a0e9f26b31598bcc38c2b66300d9 Author: Keith Busch Date: Wed Jun 28 07:48:15 2023 -0700 nvme: sync timeout work on failed reset Timeouts during reset will set the controller for failure, preventing the state change to LIVE. Ensure all timeout work is synced after the controller disabling completes to ensure we don't have any other tasks messing with any namespace request_queue's. Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 2ab4e5f44a869eaf61d7520ad6296b91f67efeed Author: Keith Busch Date: Wed Jun 28 07:46:56 2023 -0700 nvme: ensure unquiesce on teardown The reset work is called on quiesced IO queues, so ensure these are unquiesced after a failed reset to flush out any pending requests. Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit d2a6fd45c5c4a5c5fdfe6c57f74f630e61d8d9a0 Merge: cccf0c2ee52d3 53431798f4bb6 Author: Linus Torvalds Date: Fri Jun 30 10:44:53 2023 -0700 Merge tag 'probes-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes updates from Masami Hiramatsu: - fprobe: Pass return address to the fprobe entry/exit callbacks so that the callbacks don't need to analyze pt_regs/stack to find the function return address. - kprobe events: cleanup usage of TPARG_FL_FENTRY and TPARG_FL_RETURN flags so that those are not set at once. - fprobe events: - Add a new fprobe events for tracing arbitrary function entry and exit as a trace event. - Add a new tracepoint events for tracing raw tracepoint as a trace event. This allows user to trace non user-exposed tracepoints. - Move eprobe's event parser code into probe event common file. - Introduce BTF (BPF type format) support to kernel probe (kprobe, fprobe and tracepoint probe) events so that user can specify traced function arguments by name. This also applies the type of argument when fetching the argument. - Introduce '$arg*' wildcard support if BTF is available. This expands the '$arg*' meta argument to all function argument automatically. - Check the return value types by BTF. If the function returns 'void', '$retval' is rejected. - Add some selftest script for fprobe events, tracepoint events and BTF support. - Update documentation about the fprobe events. - Some fixes for above features, document and selftests. - selftests for ftrace (in addition to the new fprobe events): - Add a test case for multiple consecutive probes in a function which checks if ftrace based kprobe, optimized kprobe and normal kprobe can be defined in the same target function. - Add a test case for optimized probe, which checks whether kprobe can be optimized or not. * tag 'probes-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/probes: Fix tracepoint event with $arg* to fetch correct argument Documentation: Fix typo of reference file name tracing/probes: Fix to return NULL and keep using current argc selftests/ftrace: Add new test case which checks for optimized probes selftests/ftrace: Add new test case which adds multiple consecutive probes in a function Documentation: tracing/probes: Add fprobe event tracing document selftests/ftrace: Add BTF arguments test cases selftests/ftrace: Add tracepoint probe test case tracing/probes: Add BTF retval type support tracing/probes: Add $arg* meta argument for all function args tracing/probes: Support function parameters if BTF is available tracing/probes: Move event parameter fetching code to common parser tracing/probes: Add tracepoint support on fprobe_events selftests/ftrace: Add fprobe related testcases tracing/probes: Add fprobe events for tracing function entry and exit. tracing/probes: Avoid setting TPARG_FL_FENTRY and TPARG_FL_RETURN fprobe: Pass return address to the handlers commit f0ac3504960616c973e65c0a4e5488ad8de60d1c Author: Krzysztof Kozlowski Date: Tue May 30 16:48:50 2023 +0200 dt-bindings: timestamp: restrict node name suffixes Make the pattern matching node names a bit stricter to improve DTS consistency. The pattern is restricted to -N suffixes to decimal numbers. Suggested-by: Rob Herring Signed-off-by: Krzysztof Kozlowski Reviewed-by: Tony Lindgren Acked-by: Rob Herring Acked-by: Uwe Kleine-König Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230530144851.92059-7-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit fee34f7b6d379e8b9ad2081e7113b99edf445c17 Author: Krzysztof Kozlowski Date: Tue May 30 16:48:48 2023 +0200 dt-bindings: slimbus: restrict node name suffixes Make the pattern matching node names a bit stricter to improve DTS consistency. The pattern is restricted to: 1. Only one unit address or one -N suffix, 2. -N suffixes to decimal numbers. Suggested-by: Rob Herring Signed-off-by: Krzysztof Kozlowski Reviewed-by: Tony Lindgren Acked-by: Rob Herring Acked-by: Uwe Kleine-König Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230530144851.92059-5-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 6cca6cf3f5ab2c6f7ce48e2d958151580079a6d4 Author: Krzysztof Kozlowski Date: Tue May 30 16:48:51 2023 +0200 dt-bindings: watchdog: restrict node name suffixes Make the pattern matching node names a bit stricter to improve DTS consistency. The pattern is restricted to -N suffixes to decimal numbers. Suggested-by: Rob Herring Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Reviewed-by: Guenter Roeck Reviewed-by: Tony Lindgren Acked-by: Uwe Kleine-König Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230530144851.92059-8-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit cccf0c2ee52d3bd710be3a3f865df1b869a68f11 Merge: 533925cb76043 fc30ace06f250 Author: Linus Torvalds Date: Fri Jun 30 10:33:17 2023 -0700 Merge tag 'trace-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: - Add new feature to have function graph tracer record the return value. Adds a new option: funcgraph-retval ; when set, will show the return value of a function in the function graph tracer. - Also add the option: funcgraph-retval-hex where if it is not set, and the return value is an error code, then it will return the decimal of the error code, otherwise it still reports the hex value. - Add the file /sys/kernel/tracing/osnoise/per_cpu/cpu/timerlat_fd That when a application opens it, it becomes the task that the timer lat tracer traces. The application can also read this file to find out how it's being interrupted. - Add the file /sys/kernel/tracing/available_filter_functions_addrs that works just the same as available_filter_functions but also shows the addresses of the functions like kallsyms, except that it gives the address of where the fentry/mcount jump/nop is. This is used by BPF to make it easier to attach BPF programs to ftrace hooks. - Replace strlcpy with strscpy in the tracing boot code. * tag 'trace-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Fix warnings when building htmldocs for function graph retval riscv: ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL tracing/boot: Replace strlcpy with strscpy tracing/timerlat: Add user-space interface tracing/osnoise: Skip running osnoise if all instances are off tracing/osnoise: Switch from PF_NO_SETAFFINITY to migrate_disable ftrace: Show all functions with addresses in available_filter_functions_addrs selftests/ftrace: Add funcgraph-retval test case LoongArch: ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL x86/ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL arm64: ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL tracing: Add documentation for funcgraph-retval and funcgraph-retval-hex function_graph: Support recording and printing the return value of function fgraph: Add declaration of "struct fgraph_ret_regs" commit c51251083ad6e9d2cc0fdf209de17b3009e6eccb Author: Nikita Bondarenko Date: Tue Apr 18 19:03:41 2023 +0200 dt-bindings: watchdog: brcm,kona-wdt: convert txt file to yaml Converted txt file to yaml. No additional changes. Signed-off-by: Nikita Bondarenko Link: https://lore.kernel.org/r/20230418170341.28805-1-n2h9z4@gmail.com Signed-off-by: Rob Herring commit 2e54154b9f27262efd0cb4f903cc7d5ad1fe9628 Author: shanzhulig Date: Tue Jun 27 18:10:47 2023 -0700 drm/amdgpu: Fix potential fence use-after-free v2 fence Decrements the reference count before exiting. Avoid Race Vulnerabilities for fence use-after-free. v2 (chk): actually fix the use after free and not just move it. Signed-off-by: shanzhulig Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit b75efe88b20c2be28b67e2821a794cc183e32374 Author: Evan Quan Date: Thu May 4 17:09:39 2023 +0800 drm/amd/pm: avoid unintentional shutdown due to temperature momentary fluctuation An intentional delay is added on soft ctf triggered. Then there will be a double check for the GPU temperature before taking further action. This can avoid unintended shutdown due to temperature momentary fluctuation. Signed-off-by: Evan Quan Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 064329c595da56eff6d7a7e7760660c726433139 Author: Evan Quan Date: Thu May 25 10:30:39 2023 +0800 drm/amd/pm: expose swctf threshold setting for legacy powerplay Preparation for coming optimization which eliminates the influence of GPU temperature momentary fluctuation. Signed-off-by: Evan Quan Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit b877934e5efc1ffd4f8098bb245853b3738e103f Author: Aric Cyr Date: Mon Jun 19 01:11:09 2023 -0400 drm/amd/display: 3.2.241 This version brings along the following: - Improve debugging mechanism for Gaming FAMS - Add monitor specific edid quirks - Fixes for Phantom pipe - Fixes for Shapper LUT - Clean up asserts Acked-by: Rodrigo Siqueira Signed-off-by: Aric Cyr Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit c85c2c849ce776d5039a77d56936a216f9a07b57 Author: Alvin Lee Date: Mon Jun 19 11:55:57 2023 -0400 drm/amd/display: Take full update path if number of planes changed [Description] - A full update is required if the number of planes for a given stream changes - The new fast update path only checked for stream and plane updates, but there could be a plane addition or removal without one of the stream and plane updates triggering a full update - Add an explicit check for number of planes changing for a full update Reviewed-by: Samson Tam Acked-by: Rodrigo Siqueira Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d5b5d6cb1d5ea7e2cf804aac40c23a860a2c28c3 Author: Gianna Binder Date: Sat Jun 17 17:17:40 2023 -0400 drm/amd/display: Create debugging mechanism for Gaming FAMS [WHY] To enable FAMS even during gaming sessions. [HOW] By leveraging a new dc.debug parameter. Reviewed-by: Felipe Clark Acked-by: Rodrigo Siqueira Signed-off-by: Gianna Binder Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 613a7956deb3b1ffa2810c6d4c90ee9c3d743dbb Author: Aurabindo Pillai Date: Mon Jun 12 12:44:00 2023 -0400 drm/amd/display: Add monitor specific edid quirk Disable FAMS on a Samsung Odyssey G9 monitor. Experiments show that this monitor does not work well under some use cases, and is likely implementation specific bug on the monitor's firmware. Cc: stable@vger.kernel.org Reviewed-by: Rodrigo Siqueira Signed-off-by: Aurabindo Pillai Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit f2c58529eca6edecf9dc1cab41ab367a83bfba7a Author: Alvin Lee Date: Thu Jun 15 17:44:20 2023 -0400 drm/amd/display: For new fast update path, loop through each surface [Description] - Previous implementation didn't consider multiple surfaces in a flip - Loop through each surface in each flip to ensure the update path is correct Reviewed-by: Samson Tam Acked-by: Rodrigo Siqueira Signed-off-by: Alvin Lee Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 1966bbfdfe476d271b338336254854c5edd5a907 Author: Austin Zheng Date: Thu Jun 15 16:41:08 2023 -0400 drm/amd/display: Remove Phantom Pipe Check When Calculating K1 and K2 [Why] K1 and K2 not being setting properly when subVP is active. [How] Have phantom pipes use the same programing as the main pipes without checking the paired stream Cc: stable@vger.kernel.org Tested-by: Daniel Wheeler Reviewed-by: Alvin Lee Acked-by: Rodrigo Siqueira Signed-off-by: Austin Zheng Signed-off-by: Alex Deucher commit 1a3148b5f21b771c0ed362960fc97c92c6f9fc26 Author: Alvin Lee Date: Thu Jun 15 14:26:46 2023 -0400 drm/amd/display: Limit new fast update path to addr and gamma / color [Description] - We want to limit the new fast update path to address and gamma updates only. - Add a check in dc_update_planes_and_stream to only take the new fast update path if we only have the specific fast updates defined. Tested-by: Daniel Wheeler Reviewed-by: Jun Lei Acked-by: Rodrigo Siqueira Signed-off-by: Alvin Lee Signed-off-by: Alex Deucher commit 27fc10d1095f7a7de7c917638d7134033a190dd8 Author: Harry Wentland Date: Thu Apr 6 18:06:27 2023 -0400 drm/amd/display: Fix the delta clamping for shaper LUT The shaper LUT requires a 10-bit value of the delta between segments. We were using dc_fixpt_clamp_u0d10() to do that but it doesn't do what we want it to do. It will preserve 10-bit precision after the decimal point, but that's not quite what we want. We want 14-bit precision and discard the 4 most-significant bytes. To do that we'll do dc_fixpt_clamp_u0d14() & 0x3ff instead. Tested-by: Daniel Wheeler Reviewed-by: Krunoslav Kovac Acked-by: Rodrigo Siqueira Signed-off-by: Harry Wentland Signed-off-by: Alex Deucher commit a28eb4871acd4132a39a3e93b1e4f4bf500ffb41 Author: Lijo Lazar Date: Thu Jun 22 11:35:10 2023 +0530 drm/amdgpu: Keep non-psp path for partition switch When PSP block is not present, use direct programming. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Acked-by: Mangesh Gadre Tested-by: Mangesh Gadre Signed-off-by: Alex Deucher commit 2dc84508f8c692d455b991a2feee85aa5d647568 Author: Melissa Wen Date: Tue May 23 21:15:16 2023 -0100 drm/amd/display: program DPP shaper and 3D LUT if updated If shaper and 3D LUT data updates, lut_3d bit in update_flag is updated and we need to call set_input_transfer_func to program DPP shaper and 3D LUTs. Small cleanup of code style in the related if-condition. Tested-by: Daniel Wheeler Reviewed-by: Krunoslav Kovac Acked-by: Rodrigo Siqueira Signed-off-by: Melissa Wen Signed-off-by: Alex Deucher commit d6149086b45e150c170beaa4546495fd1880724c Author: Hersen Wu Date: Mon Jun 26 13:40:58 2023 -0400 Revert "drm/amd/display: edp do not add non-edid timings" This change causes regression when eDP and external display in mirror mode. When external display supports low resolution than eDP, use eDP timing to driver external display may cause corruption on external display. This reverts commit e749dd10e5f292061ad63d2b030194bf7d7d452c. Cc: stable@vger.kernel.org Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2655 Signed-off-by: Hersen Wu Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher commit 150c213139fe122c941e3990af7fbe9bd60c5ae3 Author: James Zhu Date: Thu Jun 22 09:58:09 2023 -0400 drm/amdgpu: share drm device for pci amdgpu device with 1st partition device To save render node resoure, share drm device setting for pci amdgpu device with 1st XCP partition device. Signed-off-by: James Zhu Reviewed-by: Christian König Signed-off-by: Alex Deucher commit baf65745aad33812fe151d5c9a77cf360775bca4 Author: Lijo Lazar Date: Wed Jun 21 18:45:37 2023 +0530 drm/amd/pm: Add GFX v9.4.3 unique id to sysfs Expose unique id of GFX v9.4.3 ASICs as device attribute. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit fc8e84a2408fd7bea6265e51545a8bfab1f4592d Author: Lijo Lazar Date: Mon Jun 26 17:37:47 2023 +0530 drm/amd/pm: Enable pp_feature attribute on APUs with GFX v9.4.3 Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 803f31814f017de50f285efe90fecbb1668391a7 Author: Emily Deng Date: Mon Jun 19 16:09:07 2023 +0800 drm/amdgpu/vcn: Need to unpause dpg before stop dpg Need to unpause dpg first, or it will hit follow error during stop dpg: "[drm] Register(1) [regUVD_POWER_STATUS] failed to reach value 0x00000001 != 0x00000000n" Signed-off-by: Emily Deng Reviewed-by: Leo Liu Signed-off-by: Alex Deucher commit 67af691626425187822afe862614aefa304d3ff2 Author: Le Ma Date: Tue Jun 27 11:53:34 2023 +0800 drm/amdgpu: remove duplicated doorbell range init for sdma v4.4.2 Handled in earlier phase Signed-off-by: Le Ma Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 2c7cd280e5c4a626690315a6fbb70b49124d8354 Author: YiPeng Chai Date: Sun Jun 25 10:18:32 2023 +0800 drm/amdgpu: gpu recovers from fatal error in poison mode Fatal error occurs in ras poison mode, mode1 reset is used to recover gpu. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 50a7c8765ca69543ffdbf855de0fd69aea769ccf Author: Alex Deucher Date: Fri Jun 16 17:07:53 2023 -0400 drm/amdgpu: enable mcbp by default on gfx9 It's required for high priority queues. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2535 Reviewed-and-tested-by: Jiadong Zhu Signed-off-by: Alex Deucher commit 02ff519e99fc90f6c9aed50def1b6d65e20c1875 Author: Alex Deucher Date: Fri Jun 16 16:49:04 2023 -0400 drm/amdgpu: make mcbp a per device setting So we can selectively enable it on certain devices. No intended functional change. Reviewed-and-tested-by: Jiadong Zhu Signed-off-by: Alex Deucher commit 5efe0f3eed4f6eeb2a75285b48aee0a75399e6d8 Author: Mario Limonciello Date: Mon Jun 26 10:04:03 2023 -0500 drm/amd: Don't initialize PSP twice for Navi3x PSP functions are already set by psp_early_init() so initializing them a second time is unnecessary. No intended functional changes. Signed-off-by: Mario Limonciello Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 1e66a17ce546eabad753178bbd4175cb52bafca8 Author: Mario Limonciello Date: Fri Jun 23 10:05:22 2023 -0500 Revert "drm/amd: Disable PSR-SU on Parade 0803 TCON" This reverts commit 072030b1783056b5de8b0fac5303a5e9dbc6cfde. This is no longer necessary when using newer DMUB F/W. Cc: stable@vger.kernel.org Cc: Sean Wang Cc: Marc Rossi Cc: Hamza Mahfooz Cc: Tsung-hua (Ryan) Lin Reviewed-by: Leo Li Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit cd2e31a9ab93d13c412a36c6e26811e0f830985b Author: Mario Limonciello Date: Fri Jun 23 10:05:21 2023 -0500 drm/amd/display: Set minimum requirement for using PSR-SU on Phoenix The same parade TCON issue can potentially happen on Phoenix, and the same PSR resilience changes have been ported into the DMUB firmware. Don't allow running PSR-SU unless on the newer firmware. Cc: stable@vger.kernel.org Cc: Sean Wang Cc: Marc Rossi Cc: Hamza Mahfooz Cc: Tsung-hua (Ryan) Lin Signed-off-by: Mario Limonciello Reviewed-by: Leo Li Signed-off-by: Alex Deucher commit c35b6ea8f2ecfa9d775530b70d4e727869099a9c Author: Mario Limonciello Date: Fri Jun 23 10:05:20 2023 -0500 drm/amd/display: Set minimum requirement for using PSR-SU on Rembrandt A number of parade TCONs are causing system hangs when utilized with older DMUB firmware and PSR-SU. Some changes have been introduced into DMUB firmware to add resilience against these failures. Don't allow running PSR-SU unless on the newer firmware. Cc: stable@vger.kernel.org Cc: Sean Wang Cc: Marc Rossi Cc: Hamza Mahfooz Cc: Tsung-hua (Ryan) Lin Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2443 Signed-off-by: Mario Limonciello Reviewed-by: Leo Li Signed-off-by: Alex Deucher commit 274d205cb59f43815542e04b42a9e6d0b9b95eff Author: Mario Limonciello Date: Fri Jun 23 10:05:19 2023 -0500 drm/amd/display: Correct `DMUB_FW_VERSION` macro The `DMUB_FW_VERSION` macro has a mistake in that the revision field is off by one byte. The last byte is typically used for other purposes and not a revision. Cc: stable@vger.kernel.org Cc: Sean Wang Cc: Marc Rossi Cc: Hamza Mahfooz Cc: Tsung-hua (Ryan) Lin Reviewed-by: Leo Li Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit cfc7d8314b7e8fd6bcafa31deaa21ac9ad19494f Author: Evan Quan Date: Wed Jun 21 07:55:45 2023 +0800 drm/amd/pm: fulfill the missing enablement for vega12/vega20 L2H and H2L interrupts The feature mask bit was not correctly cleared. Without that, the L2H and H2L interrupts cannot be enabled. Signed-off-by: Evan Quan Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 2aafcdd6a68f30c85ba6a9600e8a7447c0228e51 Author: Hong-lu Cheng Date: Mon Jun 12 13:48:53 2023 -0400 drm/amd/display: Remove asserts [why] Endless assert caused by LinesInDETChroma=0. [how] Don't floor for LinesInDETChroma=0 Tested-by: Daniel Wheeler Reviewed-by: Jun Lei Acked-by: Rodrigo Siqueira Signed-off-by: Hong-lu Cheng Signed-off-by: Alex Deucher commit 2faa3653d6657aedf357ca74c4e58c5768899269 Author: Ilya Bakoulin Date: Fri Jun 2 17:01:23 2023 -0400 drm/amd/display: Work around bad DPCD state on link loss [Why] This display doesn't properly indicate link loss through DPCD bits such as CR_DONE / CHANNEL_EQ_DONE / SYMBOL_LOCKED / INTERLANE_ALIGN_DONE, which all remain set. In addition, DPCD200Eh doesn't match the value of DPCD204h in all cases. For these reasons, we can miss re-training the link, since we don't properly detect link loss with this display. [Why] Add display-specific workaround to read DPCD204h, so that we can detect link loss based on 128b132b-specific status bits in this register. Tested-by: Daniel Wheeler Reviewed-by: Wenjing Liu Acked-by: Rodrigo Siqueira Signed-off-by: Ilya Bakoulin Signed-off-by: Alex Deucher commit 2036b34d4af9e09ed07f79c4e3f27952463e6f4e Author: Zhigang Luo Date: Thu May 18 16:10:00 2023 -0400 drm/amdgpu: port SRIOV VF missed changes port SRIOV VF missed changes from gfx_v9_0 to gfx_v9_4_3. Reviewed-by: Alex Deucher Signed-off-by: Zhigang Luo Signed-off-by: Alex Deucher commit 5c6d52ff4b61e5267b25be714eb5a9ba2a338199 Author: Mario Limonciello Date: Thu Jun 22 22:18:39 2023 -0500 drm/amd: Don't try to enable secure display TA multiple times If the securedisplay TA failed to load the first time, it's unlikely to work again after a suspend/resume cycle or reset cycle and it appears to be causing problems in futher attempts. Fixes: e42dfa66d592 ("drm/amdgpu: Add secure display TA load for Renoir") Reported-by: Filip Hejsek Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2633 Signed-off-by: Mario Limonciello Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit d4300362a66f2dacbf258e4ea233b79449821c24 Author: Mukul Joshi Date: Thu Jun 22 15:24:32 2023 -0400 drm/amdkfd: Update interrupt handling for GFX 9.4.3 For GFX 9.4.3, interrupt handling needs to be updated for: - Interrupt cookie will have a NodeId field. Each KFD node needs to check the NodeId before processing the interrupt. - For CPX mode, there are additional checks of client ID needed to process the interrupt. - Add NodeId to the process drain interrupt. Signed-off-by: Mukul Joshi Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 570b295248b00c3cf4cf59e397de5cb2361e10c2 Author: Christian König Date: Tue Jun 20 13:18:13 2023 +0200 drm/amdgpu: fix number of fence calculations Since adding gang submit we need to take the gang size into account while reserving fences. Signed-off-by: Christian König Fixes: 4624459c84d7 ("drm/amdgpu: add gang submit frontend v6") Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit af22d6a869cc26b519bfdcd54293c53f2e491870 Author: Hamza Mahfooz Date: Wed Jun 21 15:19:05 2023 -0400 drm/amd/display: perform a bounds check before filling dirty rectangles Currently, it is possible for us to access memory that we shouldn't. Since, we acquire (possibly dangling) pointers to dirty rectangles before doing a bounds check to make sure we can actually accommodate the number of dirty rectangles userspace has requested to fill. This issue is especially evident if a compositor requests both MPO and damage clips at the same time, in which case I have observed a soft-hang. So, to avoid this issue, perform the bounds check before filling a single dirty rectangle and WARN() about it, if it is ever attempted in fill_dc_dirty_rect(). Cc: stable@vger.kernel.org # 6.1+ Fixes: 30ebe41582d1 ("drm/amd/display: add FB_DAMAGE_CLIPS support") Reviewed-by: Leo Li Signed-off-by: Hamza Mahfooz Signed-off-by: Alex Deucher commit 8ef84c1a68a83440b62f78a24f64ab100f6bff7a Author: Lijo Lazar Date: Mon Jun 19 18:04:30 2023 +0530 drm/amd/pm: Provide energy data in 15.625mJ units Publish energy data in 15.625mJ unit for SMU v13.0.6. The same unit is used in Aldebaran also. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit b579ea632fcab97986f60d55a161c3e8e94a61cb Author: Lijo Lazar Date: Thu Jun 15 16:23:07 2023 +0530 drm/amdgpu: Modify for_each_inst macro Modify it such that it doesn't change the instance mask parameter. Signed-off-by: Lijo Lazar Acked-by: Victor Skvortsov Signed-off-by: Alex Deucher commit 7f03b1d14d51371fcbb8acba2f8bf037cd8807fa Author: Mangesh Gadre Date: Wed Jun 21 16:55:05 2023 +0800 drm/amdgpu:Remove sdma halt/unhalt during frontdoor load sdma halt/unhalt is performed by psp when frontdoor loading used,so this can be skipped. v2: Instead of removing halt/unhalt completely, driver will do it only during backdoor load. Signed-off-by: Mangesh Gadre Reviewed-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 4ff96bcc0d40b66bf3ddd6010830e9a4f9b85d53 Author: Tao Zhou Date: Wed Jun 21 10:30:43 2023 +0800 drm/amdgpu: check RAS irq existence for VCN/JPEG No RAS irq is allowed. Signed-off-by: Tao Zhou Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 2da0036ea99bccb27f7fe3cf2aa2900860e9be46 Author: Kenneth Feng Date: Tue Jun 20 11:41:40 2023 +0800 drm/amd/pm: add abnormal fan detection for smu 13.0.0 add abnormal fan detection for smu 13.0.0 Signed-off-by: Kenneth Feng Reviewed-by: Evan Quan Signed-off-by: Alex Deucher commit 1d7776cc148b9f2f3ebaf1181662ba695a29f639 Author: Xiaogang Chen Date: Mon Jun 19 16:17:02 2023 -0500 drm/amdgpu: remove vm sanity check from amdgpu_vm_make_compute Since we allow kfd and graphic operate on same GPU VM to have interoperation between them GPU VM may have been used by graphic vm operations before kfd turns a GPU VM into a compute VM. Remove vm clean checking at amdgpu_vm_make_compute. Signed-off-by: Xiaogang Chen Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 072030b1783056b5de8b0fac5303a5e9dbc6cfde Author: Mario Limonciello Date: Mon Jun 19 15:04:24 2023 -0500 drm/amd: Disable PSR-SU on Parade 0803 TCON A number of users have reported that there are random hangs occurring caused by PSR-SU specifically on panels that contain the parade 0803 TCON. Users have been able to work around the issue by disabling PSR entirely. To avoid these hangs, disable PSR-SU when this TCON is found. Cc: stable@vger.kernel.org Cc: Sean Wang Cc: Marc Rossi Cc: Hamza Mahfooz Suggested-by: Tsung-hua (Ryan) Lin Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2443 Signed-off-by: Mario Limonciello Reviewed-by: Hamza Mahfooz Signed-off-by: Alex Deucher commit fc133acc43728ad9777d2c4cc43f0cafcb92a461 Author: Mukul Joshi Date: Thu Jun 15 14:43:36 2023 -0400 drm/amdkfd: Enable GWS on GFX9.4.3 Enable GWS capable queue creation for forward progress gaurantee on GFX 9.4.3. Signed-off-by: Mukul Joshi Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 6592d29393e3201053d659248055f7f6e51a9f3c Author: Srinivas Neeli Date: Thu Jun 1 10:52:37 2023 +0530 dt-bindings: watchdog: cdns,wdt-r1p2: Convert cadence watchdog to yaml Convert cadence watchdog bindings to DT schema format using json-schema. Signed-off-by: Srinivas Neeli Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230601052237.2604997-1-srinivas.neeli@amd.com Signed-off-by: Rob Herring commit 533925cb760431cb496a8c965cfd765a1a21d37e Merge: d8b0bd57c2d68 488833ccdcac1 Author: Linus Torvalds Date: Fri Jun 30 09:37:26 2023 -0700 Merge tag 'riscv-for-linus-6.5-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Palmer Dabbelt: - Support for ACPI - Various cleanups to the ISA string parsing, including making them case-insensitive - Support for the vector extension - Support for independent irq/softirq stacks - Our CPU DT binding now has "unevaluatedProperties: false" * tag 'riscv-for-linus-6.5-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (78 commits) riscv: hibernate: remove WARN_ON in save_processor_state dt-bindings: riscv: cpus: switch to unevaluatedProperties: false dt-bindings: riscv: cpus: add a ref the common cpu schema riscv: stack: Add config of thread stack size riscv: stack: Support HAVE_SOFTIRQ_ON_OWN_STACK riscv: stack: Support HAVE_IRQ_EXIT_ON_IRQ_STACK RISC-V: always report presence of extensions formerly part of the base ISA dt-bindings: riscv: explicitly mention assumption of Zicntr & Zihpm support RISC-V: remove decrement/increment dance in ISA string parser RISC-V: rework comments in ISA string parser RISC-V: validate riscv,isa at boot, not during ISA string parsing RISC-V: split early & late of_node to hartid mapping RISC-V: simplify register width check in ISA string parsing perf: RISC-V: Limit the number of counters returned from SBI riscv: replace deprecated scall with ecall riscv: uprobes: Restore thread.bad_cause riscv: mm: try VMA lock-based page fault handling first riscv: mm: Pre-allocate PGD entries for vmalloc/modules area RISC-V: hwprobe: Expose Zba, Zbb, and Zbs RISC-V: Track ISA extensions per hart ... commit d8b0bd57c2d68eb500f356f0f9228e6183da94ae Merge: b69f0aeb06898 54a11654de163 Author: Linus Torvalds Date: Fri Jun 30 09:20:08 2023 -0700 Merge tag 'powerpc-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: - Extend KCSAN support to 32-bit and BookE. Add some KCSAN annotations - Make ELFv2 ABI the default for 64-bit big-endian kernel builds, and use the -mprofile-kernel option (kernel specific ftrace ABI) for big endian ELFv2 kernels - Add initial Dynamic Execution Control Register (DEXCR) support, and allow the ROP protection instructions to be used on Power 10 - Various other small features and fixes Thanks to Aditya Gupta, Aneesh Kumar K.V, Benjamin Gray, Brian King, Christophe Leroy, Colin Ian King, Dmitry Torokhov, Gaurav Batra, Jean Delvare, Joel Stanley, Marco Elver, Masahiro Yamada, Nageswara R Sastry, Nathan Chancellor, Naveen N Rao, Nayna Jain, Nicholas Piggin, Paul Gortmaker, Randy Dunlap, Rob Herring, Rohan McLure, Russell Currey, Sachin Sant, Timothy Pearson, Tom Rix, and Uwe Kleine-König. * tag 'powerpc-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (76 commits) powerpc: remove checks for binutils older than 2.25 powerpc: Fail build if using recordmcount with binutils v2.37 powerpc/iommu: TCEs are incorrectly manipulated with DLPAR add/remove of memory powerpc/iommu: Only build sPAPR access functions on pSeries powerpc: powernv: Annotate data races in opal events powerpc: Mark writes registering ipi to host cpu through kvm and polling powerpc: Annotate accesses to ipi message flags powerpc: powernv: Fix KCSAN datarace warnings on idle_state contention powerpc: Mark [h]ssr_valid accesses in check_return_regs_valid powerpc: qspinlock: Enforce qnode writes prior to publishing to queue powerpc: qspinlock: Mark accesses to qnode lock checks powerpc/powernv/pci: Remove last IODA1 defines powerpc/powernv/pci: Remove MVE code powerpc/powernv/pci: Remove ioda1 support powerpc: 52xx: Make immr_id DT match tables static powerpc: mpc512x: Remove open coded "ranges" parsing powerpc: fsl_soc: Use of_range_to_resource() for "ranges" parsing powerpc: fsl: Use of_property_read_reg() to parse "reg" powerpc: fsl_rio: Use of_range_to_resource() for "ranges" parsing macintosh: Use of_property_read_reg() to parse "reg" ... commit b69f0aeb068980af983d399deafc7477cec8bc04 Author: Kees Cook Date: Fri Jun 30 09:46:17 2023 +0200 pid: Replace struct pid 1-element array with flex-array For pid namespaces, struct pid uses a dynamically sized array member, "numbers". This was implemented using the ancient 1-element fake flexible array, which has been deprecated for decades. Replace it with a C99 flexible array, refactor the array size calculations to use struct_size(), and address elements via indexes. Note that the static initializer (which defines a single element) works as-is, and requires no special handling. Without this, CONFIG_UBSAN_BOUNDS (and potentially CONFIG_FORTIFY_SOURCE) will trigger bounds checks: https://lore.kernel.org/lkml/20230517-bushaltestelle-super-e223978c1ba6@brauner Cc: Christian Brauner Cc: Jan Kara Cc: Jeff Xu Cc: Andreas Gruenbacher Cc: Daniel Verkamp Cc: "Paul E. McKenney" Cc: Jeff Xu Cc: Andrew Morton Cc: Boqun Feng Cc: Luis Chamberlain Cc: Frederic Weisbecker Reported-by: syzbot+ac3b41786a2d0565b6d5@syzkaller.appspotmail.com [brauner: dropped unrelated changes and remove 0 with NULL cast] Signed-off-by: Kees Cook Signed-off-by: Christian Brauner Signed-off-by: Linus Torvalds commit c93723ada378a63929b3135b4f30483383e88e05 Author: Johan Hovold Date: Fri Jun 30 16:27:17 2023 +0200 ASoC: codecs: wcd934x: drop inline keywords The compiler is generally better at deciding what functions should be inlined than driver authors are. Drop the bogus inline keyword from two functions that were neither very small or used in a single place. Signed-off-by: Johan Hovold Reviewed-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230630142717.5314-6-johan+linaro@kernel.org Signed-off-by: Mark Brown commit cb7d60ab98cfe12fdd6052142176d42682f78540 Author: Johan Hovold Date: Fri Jun 30 16:27:16 2023 +0200 ASoC: codecs: wcd934x: demote impedance printk Demote the MBHC impedance measurement printk, which is only needed for development and debugging, to debug level. While at it, fix the capitalisation of "ohm" and add the missing space before the opening parenthesis. Signed-off-by: Johan Hovold Reviewed-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230630142717.5314-5-johan+linaro@kernel.org Signed-off-by: Mark Brown commit 17d59d9ed832742f9572fe5e77ed3a66f5ae404d Author: Johan Hovold Date: Fri Jun 30 16:27:15 2023 +0200 ASoC: codecs: wcd938x: use dev_printk() for impedance logging Pass the component structure also to the wcd938x_mbhc_get_result_params() helper so that the component device can be used for logging consistently. Signed-off-by: Johan Hovold Reviewed-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230630142717.5314-4-johan+linaro@kernel.org Signed-off-by: Mark Brown commit 5db9fe9562aaefca3c972401a9e3d6454707b1d5 Author: Johan Hovold Date: Fri Jun 30 16:27:14 2023 +0200 ASoC: codecs: wcd938x: drop inline keywords The compiler is generally better at deciding what functions should be inlined than driver authors are. Drop the bogus inline keyword from two functions that were neither very small or used in a single place. Signed-off-by: Johan Hovold Reviewed-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230630142717.5314-3-johan+linaro@kernel.org Signed-off-by: Mark Brown commit e5ce198bd5c6923b6a51e1493b1401f84c24b26d Author: Johan Hovold Date: Fri Jun 30 16:27:13 2023 +0200 ASoC: codecs: wcd938x: fix mbhc impedance loglevel Demote the MBHC impedance measurement printk, which is not an error message, from error to debug level. While at it, fix the capitalisation of "ohm" and add the missing space before the opening parenthesis. Fixes: bcee7ed09b8e ("ASoC: codecs: wcd938x: add Multi Button Headset Control support") Signed-off-by: Johan Hovold Reviewed-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230630142717.5314-2-johan+linaro@kernel.org Signed-off-by: Mark Brown commit 112e7e21519422b6f2bb0fa8061f5685e9757170 Merge: e55e5df193d24 5ee35c769663c Author: Linus Torvalds Date: Fri Jun 30 08:52:28 2023 -0700 Merge tag 'loongarch-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - preliminary ClangBuiltLinux enablement - add support to clone a time namespace - add vector extensions support - add SMT (Simultaneous Multi-Threading) support - support dbar with different hints - introduce hardware page table walker - add jump-label implementation - add rethook and uprobes support - some bug fixes and other small changes * tag 'loongarch-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: (28 commits) LoongArch: Remove five DIE_* definitions in kdebug.h LoongArch: Add uprobes support LoongArch: Use larch_insn_gen_break() for kprobes LoongArch: Add larch_insn_gen_break() to generate break insns LoongArch: Check for AMO instructions in insns_not_supported() LoongArch: Move three functions from kprobes.c to inst.c LoongArch: Replace kretprobe with rethook LoongArch: Add jump-label implementation LoongArch: Select HAVE_DEBUG_KMEMLEAK to support kmemleak LoongArch: Export some arch-specific pm interfaces LoongArch: Introduce hardware page table walker LoongArch: Support dbar with different hints LoongArch: Add SMT (Simultaneous Multi-Threading) support LoongArch: Add vector extensions support LoongArch: Add support to clone a time namespace Makefile: Add loongarch target flag for Clang compilation LoongArch: Mark Clang LTO as working LoongArch: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation LoongArch: vDSO: Use CLANG_FLAGS instead of filtering out '--target=' LoongArch: Tweak CFLAGS for Clang compatibility ... commit 1ed0555850cdaa3113a32891d273f7a859565264 Author: Douglas Anderson Date: Wed Jun 28 12:56:17 2023 -0700 kdb: Handle LF in the command parser The main kdb command parser only handles CR (ASCII 13 AKA '\r') today, but not LF (ASCII 10 AKA '\n'). That means that the kdb command parser can handle terminals that send just CR or that send CR+LF but can't handle terminals that send just LF. The fact that kdb didn't handle LF in the command parser tripped up a tool I tried to use with it. Specifically, I was trying to send a command to my device to resume it from kdb using a ChromeOS tool like: dut-control cpu_uart_cmd:"g" That tool only terminates lines with LF, not CR+LF. Arguably the ChromeOS tool should be fixed. After all, officially kdb seems to be designed such that CR+LF is the official line ending transmitted over the wire and that internally a line ending is just '\n' (LF). Some evidence: * uart_poll_put_char(), which is used by kdb, notices a '\n' and converts it to '\r\n'. * kdb functions specifically use '\r' to get a carriage return without a newline. You can see this in the pager where kdb will write a '\r' and then write over the pager prompt. However, all that being said there's no real harm in accepting LF as a command terminator in the kdb parser and doing so seems like it would improve compatibility. After this, I'd expect that things would work OK-ish with a remote terminal that used any of CR, CR+LF, or LF as a line ending. Someone using CR as a line ending might get some ugliness where kdb wasn't able to overwrite the last line, but basic commands would work. Someone using just LF as a line ending would probably also work OK. A few other notes: - It can be noted that "bash" running on an "agetty" handles LF as a line termination with no complaints. - Historically, kdb's "pager" actually handled either CR or LF fine. A very quick inspection would make one think that kdb's pager actually could have paged down two lines instead of one for anyone using CR+LF, but this is generally avoided because of kdb_input_flush(). - Conceivably one could argue that some of this special case logic belongs in uart_poll_get_char() since uart_poll_put_char() handles the '\n' => '\r\n' conversion. I would argue that perhaps we should eventually do the opposite and move the '\n' => '\r\n' out of uart_poll_put_char(). Having that conversion at such a low level could interfere if we ever want to transfer binary data. In addition, if we truly made uart_poll_get_char() the inverse of uart_poll_put_char() it would convert back to '\n' and (ironically) kdb's parser currently only looks for '\r' to find the end of a command. Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20230628125612.1.I5cc6c3d916195f5bcfdf5b75d823f2037707f5dc@changeid Signed-off-by: Daniel Thompson commit 44f10dbefd5e41b3385af91f855a57aa2afaf40e Merge: 0a30901b0732a e55e5df193d24 Author: Andrew Morton Date: Fri Jun 30 08:41:39 2023 -0700 Merge branch 'master' into mm-hotfixes-stable commit 0a30901b0732a59e038088d3de3e5611db1870d3 Merge: 814bc1de03ea4 6995e2de6891c Author: Andrew Morton Date: Fri Jun 30 08:37:44 2023 -0700 Merge branch 'master' into mm-hotfixes-stable commit 4ad1218bed3d1ea4c5fd28588f8628b92df30ad7 Author: Helge Deller Date: Sun Jun 25 16:06:12 2023 +0200 parisc: Refresh defconfigs Refresh defconfigs and enable some more graphic cards. Signed-off-by: Helge Deller commit bcfaf17f18f2ae956ec4ba831a9c68859e57cf72 Author: Helge Deller Date: Fri Jun 30 16:21:38 2023 +0200 parisc: irq: Add irq-related function declarations Move function declarations for do_cpu_irq_mask(), timer_interrupt() and ipi_interrupt() to header file. Signed-off-by: Helge Deller commit f310f8dd1414d284566ffe47fb8b4379a0d74a64 Author: Helge Deller Date: Fri Jun 30 13:31:48 2023 +0200 parisc: Move init function declarations into header file Clean up the code to not have external function declarations inside the C source files. Reduces warnings when compiled with W=1. Signed-off-by: Helge Deller commit c8080024e0f7654c162fc39d33d5c69e5205960f Author: Helge Deller Date: Fri Jun 30 13:12:58 2023 +0200 parisc: dino: Make dino_init() returning void Signed-off-by: Helge Deller commit 1d72e83d63c792b484ef14901385e06b06d5eda4 Author: Helge Deller Date: Fri Jun 30 13:11:12 2023 +0200 parisc: lba_pci: Mark two variables __maybe_unused Signed-off-by: Helge Deller commit 646d07461513b061fa4aacde47827fb6922db3fb Author: Helge Deller Date: Fri Jun 30 13:08:00 2023 +0200 parisc: unaligned: Include header file to avoid missing prototype warnings Signed-off-by: Helge Deller commit cfb25b82572e4d874eeda59e0d42126a3284c9a4 Author: Helge Deller Date: Fri Jun 30 12:50:26 2023 +0200 parisc: signal: Mark do_notify_resume() and sys_rt_sigreturn() asmlinkage Signed-off-by: Helge Deller commit a7fde0bf938d5839df6d89b39eb7f5d834c703ec Author: Helge Deller Date: Fri Jun 30 12:44:33 2023 +0200 parisc: unwind: Mark start and stop variables __maybe_unused Signed-off-by: Helge Deller commit b62b37d6c15ea785dc88f9c43949628230eba776 Author: Helge Deller Date: Fri Jun 30 12:42:36 2023 +0200 parisc: init: Drop unused variable end_paddr Signed-off-by: Helge Deller commit 7def4239e5eb17c7dee73f42f09b76d9b5f44e3f Author: Helge Deller Date: Fri Jun 30 12:39:03 2023 +0200 parisc: traps: Mark functions static Signed-off-by: Helge Deller commit 5f0c791dcd3c7d324f2fa14f228bdcd156730015 Author: Helge Deller Date: Fri Jun 30 12:37:50 2023 +0200 parisc: processor: Fix kdoc for init_cpu_profiler() Signed-off-by: Helge Deller commit b5d89408b9fb21258f7c371d6d48a674f60f7181 Author: Helge Deller Date: Fri Jun 30 12:36:09 2023 +0200 parisc: sys_parisc: parisc_personality() is called from asm code Signed-off-by: Helge Deller commit 8829428c1680c1ed7313be43b248d99d7123ed48 Author: Helge Deller Date: Fri Jun 30 12:34:25 2023 +0200 parisc: ccio-dma: Fix kdoc and compiler warnings Signed-off-by: Helge Deller commit f28a98779de97e24d5e6fde8fca1273056a14f80 Author: Helge Deller Date: Fri Jun 30 12:33:09 2023 +0200 parisc: pdc_stable: Fix kdoc and compiler warnings Signed-off-by: Helge Deller commit 658e10571231f2ee21fb40deed8a6e48d0220110 Author: Helge Deller Date: Fri Jun 30 12:31:56 2023 +0200 parisc: pci-dma: Make pcxl_alloc_range() static Signed-off-by: Helge Deller commit 9e142b728605dbfad337ed91c0ba374f232a1e04 Author: Helge Deller Date: Fri Jun 30 12:31:14 2023 +0200 parisc: Mark image_size __maybe_unused in perf_write() Signed-off-by: Helge Deller commit 0e466703d96a86d8bc9b6a02bee22a11332431ed Author: Helge Deller Date: Fri Jun 30 12:30:19 2023 +0200 parisc: module: Mark symindex __maybe_unused Signed-off-by: Helge Deller commit 9872fb13022788b7832616dea52a1feb3bcb4bf2 Author: Helge Deller Date: Fri Jun 30 12:28:40 2023 +0200 parisc: pdc_chassis: Fix kdoc warnings Signed-off-by: Helge Deller commit 427585224a866bf4cb3b3857d89d5de5f3518aca Author: Helge Deller Date: Fri Jun 30 12:26:53 2023 +0200 parisc: firmware: Fix kdoc warnings Signed-off-by: Helge Deller commit ac9fb7d2b71d8353603534a5e5cc92f54fd7e219 Author: Helge Deller Date: Fri Jun 30 12:24:37 2023 +0200 parisc: drivers: Fix kdoc warnings Signed-off-by: Helge Deller commit 7d653ad4ce6afd8dacca9deb43a9a9ea9d665444 Author: Helge Deller Date: Fri Jun 30 12:18:45 2023 +0200 parisc: Fold 32-bit compat code into audit_classify_syscall() No need to keep an extra 32-bit audit_classify_syscall() function. Signed-off-by: Helge Deller commit 226b8ab875e18375567fec4e1065a339b7b77c8e Author: Helge Deller Date: Fri Jun 30 12:15:06 2023 +0200 parisc: sba_iommu: Fix kdoc warnings Signed-off-by: Helge Deller commit 99ef0c67bc85e2ea547e2c6c9ed29480cd361446 Author: Helge Deller Date: Wed May 10 22:17:27 2023 +0200 sticon/parisc: Fix STI console on 64-bit only machines Fix the STI console to be able to execute either the 64-bit STI ROM code or the 32-bit STI ROM code. This is necessary on 64-bit only machines (e.g. C8000 workstation) which otherwise won't show the STI text console with HP graphic cards like Visualize-FX5/FX10/FXe. Note that when calling 32-bit code from a 64-bit kernel one needs to copy contents on the CPU stack from high memory down below the 4GB limit. Tested-by: John David Anglin Signed-off-by: Helge Deller commit ededd9d27834ad1f300436c1b78e58ad4fcf5dd7 Author: Helge Deller Date: Sun May 14 13:23:06 2023 +0200 sticon/parisc: Allow 64-bit STI calls in PDC firmware abstration Some 64-bit machines require us to call the STI ROM in 64-bit mode, e.g. with the VisFXe graphic card. This patch allows drivers to use such 64-bit calling conventions. Tested-by: John David Anglin Signed-off-by: Helge Deller commit c9cc4542e1db5a0402b6b95afb65182fd20f6455 Author: Helge Deller Date: Fri Jun 23 08:07:47 2023 +0200 parisc: Default to 8 CPUs for 64-bit kernel I've now seen a 6-way SMP rp4440 machine, so increase minimum number of CPUs to 8 for 64-bit kernels. Signed-off-by: Helge Deller commit c4551d1bddceb76aaaa5aefc236e10c91abfe197 Author: Helge Deller Date: Mon Jun 19 06:32:19 2023 +0200 parisc: Fix missing prototype warning for arch_report_meminfo() Signed-off-by: Helge Deller Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306122223.HHER4zOo-lkp@intel.com/ commit c6d96328fecdda16e12f3b3c33f3677f4bcef89f Author: Helge Deller Date: Fri May 26 10:59:15 2023 +0200 parisc: Add cacheflush() syscall Signed-off-by: Helge Deller commit 40c9c62c85a8b7e58350f2d00649f9e0060150b7 Author: Helge Deller Date: Fri May 26 08:33:02 2023 +0200 parisc: Check if IRQs are disabled when calling arch_local_irq_restore() A trivial check to check if IRQs are on although they should be off. Signed-off-by: Helge Deller commit 2255234460f0575603a171afd878e6a6083b23f1 Author: Helge Deller Date: Fri May 26 08:27:18 2023 +0200 parisc: Move TLB_PTLOCK option to Kconfig.debug Move this debug option to the Kconfig.debug file. Signed-off-by: Helge Deller commit 7c1f23ad34fcdace50275a6aa1e1969b41c6233f Author: Jonas Gorski Date: Thu Jun 29 15:43:05 2023 +0200 spi: bcm-qspi: return error if neither hif_mspi nor mspi is available If neither a "hif_mspi" nor "mspi" resource is present, the driver will just early exit in probe but still return success. Apart from not doing anything meaningful, this would then also lead to a null pointer access on removal, as platform_get_drvdata() would return NULL, which it would then try to dereference when trying to unregister the spi master. Fix this by unconditionally calling devm_ioremap_resource(), as it can handle a NULL res and will then return a viable ERR_PTR() if we get one. The "return 0;" was previously a "goto qspi_resource_err;" where then ret was returned, but since ret was still initialized to 0 at this place this was a valid conversion in 63c5395bb7a9 ("spi: bcm-qspi: Fix use-after-free on unbind"). The issue was not introduced by this commit, only made more obvious. Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver") Signed-off-by: Jonas Gorski Reviewed-by: Kamal Dasu Link: https://lore.kernel.org/r/20230629134306.95823-1-jonas.gorski@gmail.com Signed-off-by: Mark Brown commit ac192c1a54f9562efe6bac910e6e7aae7b5fbea3 Author: Srinivas Kandagatla Date: Wed Jun 28 10:24:04 2023 +0100 ASoC: qdsp6: q6apm: use dai link pcm id as pcm device number For some reason we ended up with a setup without this flag. This resulted in inconsistent sound card devices numbers which are also not starting as expected at dai_link->id. (Ex: MultiMedia1 pcm ended up with device number 4 instead of 0) With this patch patch now the MultiMedia1 PCM ends up with device number 0 as expected. [This is causing unstable numbering in userspace as other changes go in, which in turn gets noticed by some userspace. There's been multiple values so we can't simply pick one and revert to it. Do not backport since it will introduce a change. -- broonie] Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20230628092404.13927-1-srinivas.kandagatla@linaro.org Signed-off-by: Mark Brown commit 85a61b1ce461a3f62f1019e5e6423c393c542bff Author: Johan Hovold Date: Fri Jun 30 14:03:18 2023 +0200 ASoC: codecs: wcd938x: fix codec initialisation race Make sure to resume the codec and soundwire device before trying to read the codec variant and configure the device during component probe. This specifically avoids interpreting (a masked and shifted) -EBUSY errno as the variant: wcd938x_codec audio-codec: ASoC: error at soc_component_read_no_lock on audio-codec for register: [0x000034b0] -16 when the soundwire device happens to be suspended, which in turn prevents some headphone controls from being registered. Fixes: 8d78602aa87a ("ASoC: codecs: wcd938x: add basic driver") Cc: stable@vger.kernel.org # 5.14 Cc: Srinivas Kandagatla Reported-by: Steev Klimaszewski Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20230630120318.6571-1-johan+linaro@kernel.org Signed-off-by: Mark Brown commit b1db244c716fe300e36428aeb0874913d2e0a91d Author: Mastan Katragadda Date: Fri Jun 30 12:35:42 2023 +0530 ASoC: SOF: amd: add revision check for sending sha dma completion command ACP driver should send SHA DMA completion command to PSP module for RN platform only. Add a revision check for RN platform. Signed-off-by: Mastan Katragadda Link: https://lore.kernel.org/r/20230630070544.2167421-1-Mastan.Katragadda@amd.com Signed-off-by: Mark Brown commit 0303c9729afc4094ef53e552b7b8cff7436028d6 Author: Thomas Gleixner Date: Thu Jun 29 21:35:19 2023 +0200 x86/efi: Make efi_set_virtual_address_map IBT safe Niklāvs reported a boot regression on an Alderlake machine and bisected it to commit 9df9d2f0471b ("init: Invoke arch_cpu_finalize_init() earlier"). By moving the invocation of arch_cpu_finalize_init() further down he identified that efi_enter_virtual_mode() is the function which causes the boot hang. The main difference of the earlier invocation is that the boot CPU is already fully initialized and mitigations and alternatives are applied. But the only really interesting change turned out to be IBT, which is now enabled before efi_enter_virtual_mode(). "ibt=off" on the kernel command line cured the problem. Inspection of the involved calls in efi_enter_virtual_mode() unearthed that efi_set_virtual_address_map() is the only place in the kernel which invokes an EFI call without the IBT safe wrapper. This went obviously unnoticed so far as IBT was enabled later. Use arch_efi_call_virt() instead of efi_call() to cure that. Fixes: fe379fa4d199 ("x86/ibt: Disable IBT around firmware") Fixes: 9df9d2f0471b ("init: Invoke arch_cpu_finalize_init() earlier") Reported-by: Niklāvs Koļesņikovs Signed-off-by: Thomas Gleixner Reviewed-by: Ard Biesheuvel Link: https://bugzilla.kernel.org/show_bug.cgi?id=217602 Link: https://lore.kernel.org/r/87jzvm12q0.ffs@tglx commit fa700d73494abbd343c47c6f54837c9874c61bbe Author: Ulf Hansson Date: Fri Jun 30 14:00:15 2023 +0200 mmc: Revert "mmc: core: Allow mmc_start_host() synchronously detect a card" It has turned out that some mmc host drivers were not ready to deal with this change. Let's fix those host drivers first, then we can give this a new try. Fixes: 2cc83bf7d411 (mmc: core: Allow mmc_start_host() synchronously detect a card) Cc: Dennis Zhou Reported-by: Geert Uytterhoeven Reported-by: Biju Das Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20230630120015.363982-1-ulf.hansson@linaro.org commit 257e6172ab36ebbe295a6c9ee9a9dd0fe54c1dc2 Author: Xiubo Li Date: Wed Jun 28 07:57:09 2023 +0800 ceph: don't let check_caps skip sending responses for revoke msgs If a client sends out a cap update dropping caps with the prior 'seq' just before an incoming cap revoke request, then the client may drop the revoke because it believes it's already released the requested capabilities. This causes the MDS to wait indefinitely for the client to respond to the revoke. It's therefore always a good idea to ack the cap revoke request with the bumped up 'seq'. Cc: stable@vger.kernel.org Link: https://tracker.ceph.com/issues/61782 Signed-off-by: Xiubo Li Reviewed-by: Milind Changire Reviewed-by: Patrick Donnelly Signed-off-by: Ilya Dryomov commit ce72d4e0f179340cece90d5b826eb63bbf9fefc0 Author: Xiubo Li Date: Tue Jun 13 12:49:59 2023 +0800 ceph: issue a cap release immediately if no cap exists In case: mds client - Releases cap and put Inode - Increase cap->seq and sends revokes req to the client - Receives release req and - Receives & drops the revoke req skip removing the cap and then eval the CInode and issue or revoke caps again. - Receives & drops the caps update or revoke req - Health warning for client isn't responding to mclientcaps(revoke) All the IMPORT/REVOKE/GRANT cap ops will increase the session seq in MDS side and then the client need to issue a cap release to unblock MDS to remove the corresponding cap to unblock possible waiters. Link: https://tracker.ceph.com/issues/61332 Signed-off-by: Xiubo Li Reviewed-by: Milind Changire Signed-off-by: Ilya Dryomov commit 2d12ad950b0c2a89d82f5d258309ad23aa70fc38 Author: Xiubo Li Date: Thu May 11 13:19:45 2023 +0800 ceph: trigger to flush the buffer when making snapshot The 'i_wr_ref' is used to track the 'Fb' caps, while whenever the 'Fb' caps is took the kclient will always take the 'Fw' caps at the same time. That means it will always be a false check in __ceph_finish_cap_snap(). When writing to buffer the kclient will take both 'Fb|Fw' caps and then write the contents to the buffer pages by increasing the 'i_wrbuffer_ref' and then just release both 'Fb|Fw'. This is different with the user space libcephfs, which will keep the 'Fb' being took and use 'i_wr_ref' instead of 'i_wrbuffer_ref' to track this until the buffer is flushed to Rados. We need to defer flushing the capsnap until the corresponding buffer pages are all flushed to Rados, and at the same time just trigger to flush the buffer pages immediately. Link: https://tracker.ceph.com/issues/48640 Link: https://tracker.ceph.com/issues/59343 Signed-off-by: Xiubo Li Reviewed-by: Milind Changire Signed-off-by: Ilya Dryomov commit dc94bb8f271c079f69583d0f12a489aaf5202751 Author: Xiubo Li Date: Thu May 4 19:00:42 2023 +0800 ceph: fix blindly expanding the readahead windows Blindly expanding the readahead windows will cause unneccessary pagecache thrashing and also will introduce the network workload. We should disable expanding the windows if the readahead is disabled and also shouldn't expand the windows too much. Expanding forward firstly instead of expanding backward for possible sequential reads. Bound `rreq->len` to the actual file size to restore the previous page cache usage. The posix_fadvise may change the maximum size of a file readahead. Cc: stable@vger.kernel.org Fixes: 49870056005c ("ceph: convert ceph_readpages to ceph_readahead") Link: https://lore.kernel.org/ceph-devel/20230504082510.247-1-sehuww@mail.scut.edu.cn Link: https://www.spinics.net/lists/ceph-users/msg76183.html Signed-off-by: Xiubo Li Reviewed-and-tested-by: Hu Weiwen Reviewed-by: Milind Changire Signed-off-by: Ilya Dryomov commit 23ee27dce30e7d3091d6c3143b79f48dab6f9a3e Author: Xiubo Li Date: Wed May 10 19:55:46 2023 +0800 ceph: add a dedicated private data for netfs rreq We need to save the 'f_ra.ra_pages' to expand the readahead window later. Cc: stable@vger.kernel.org Fixes: 49870056005c ("ceph: convert ceph_readpages to ceph_readahead") Link: https://lore.kernel.org/ceph-devel/20230504082510.247-1-sehuww@mail.scut.edu.cn Link: https://www.spinics.net/lists/ceph-users/msg76183.html Signed-off-by: Xiubo Li Reviewed-and-tested-by: Hu Weiwen Reviewed-by: Milind Changire Signed-off-by: Ilya Dryomov commit d9d00f71ab5a2b5a47b228f678a8817e8687387f Author: Xiubo Li Date: Mon Jun 5 14:58:18 2023 +0800 ceph: voluntarily drop Xx caps for requests those touch parent mtime For write requests the parent's mtime will be updated correspondingly. And if the 'Xx' caps is issued and when releasing other caps together with the write requests the MDS Locker will try to eval the xattr lock, which need to change the locker state excl --> sync and need to do Xx caps revocation. Just voluntarily dropping CEPH_CAP_XATTR_EXCL caps to avoid a cap revoke message, which could cause the mtime will be overwrote by stale one. [ idryomov: break unnecessarily long lines ] Link: https://tracker.ceph.com/issues/61584 Signed-off-by: Xiubo Li Reviewed-by: Milind Changire Signed-off-by: Ilya Dryomov commit 8b0da5c549ae63ba1debd92a350f90773cb4bfe7 Author: Xiubo Li Date: Thu May 18 09:40:14 2023 +0800 ceph: try to dump the msgs when decoding fails When the msgs are corrupted we need to dump them and then it will be easier to dig what has happened and where the issue is. Signed-off-by: Xiubo Li Reviewed-by: Milind Changire Signed-off-by: Ilya Dryomov commit f7c2f4f6ce16fb58f7d024f3e1b40023c4b43ff9 Author: Xiubo Li Date: Wed May 31 16:06:55 2023 +0800 ceph: only send metrics when the MDS rank is ready When the MDS rank is in clientreplay state, the metrics requests will be discarded directly. Also, when there are a lot of known client requests to recover from, the metrics requests will slow down the MDS rank from getting to the active state sooner. With this patch, we will send the metrics requests only when the MDS rank is in active state. Link: https://tracker.ceph.com/issues/61524 Signed-off-by: Xiubo Li Reviewed-by: Milind Changire Signed-off-by: Ilya Dryomov commit 1c519980aced3da1fae37c1339cf43b24eccdee7 Author: Marek Vasut Date: Thu Jun 15 22:16:02 2023 +0200 drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags Add missing drm_display_mode DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC flags. Those are used by various bridges in the pipeline to correctly configure its sync signals polarity. Fixes: d69de69f2be1 ("drm/panel: simple: Add Powertip PH800480T013 panel") Signed-off-by: Marek Vasut Reviewed-by: Sam Ravnborg Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20230615201602.565948-1-marex@denx.de commit 67a4e1a3bf7c68ed3fbefc4213648165d912cabb Author: Andy Shevchenko Date: Wed Jun 28 18:02:51 2023 +0300 irqdomain: Use return value of strreplace() Since strreplace() returns the pointer to the string itself, use it directly. Signed-off-by: Andy Shevchenko Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20230628150251.17832-1-andriy.shevchenko@linux.intel.com commit 0fcfc9e51990246a9813475716746ff5eb98c6aa Author: Srinivas Pandruvada Date: Thu Jun 29 12:45:09 2023 -0700 cpufreq: intel_pstate: Fix scaling for hybrid-capable systems with disabled E-cores Some system BIOS configuration may provide option to disable E-cores. As part of this change, CPUID feature for hybrid (Leaf 7 sub leaf 0, EDX[15] = 0) may not be set. But HWP performance limits will still be using a scaling factor like any other hybrid enabled system. The current check for applying scaling factor will fail when hybrid CPUID feature is not set and the only way to make sure that scaling should be applied by checking CPPC nominal frequency and nominal performance. First, or systems predating Alder Lake, the CPPC nominal frequency and nominal performance are 0, which can be used to distinguish those systems from hybrid systems with disabled E-cores. Second, if the CPPC nominal frequency and nominal performance are defined, which indicates the need to use a special scaling factor, and the nominal performance value multiplied by 100 is not equal to the nominal frequency one, use hybrid scaling factor. This can be done for all HWP systems without additional CPU model check. Signed-off-by: Srinivas Pandruvada [ rjw: Subject and changelog edits, removal of unneeded parens, comment edits ] Signed-off-by: Rafael J. Wysocki commit 0b76cc3e9081216918d5e7e907cf9efc7a5fa7db Author: Viresh Kumar Date: Fri Jun 30 11:35:41 2023 +0530 cpufreq: Make CONFIG_CPUFREQ_DT_PLATDEV depend on OF The cpufreq-dt-platform.c driver requires CONFIG_OF to be selected. Mark it as a dependency. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306250025.savpMM8L-lkp@intel.com/ Signed-off-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki commit e55e5df193d247a38a5e1ac65a5316a0adcc22fa Author: Linus Torvalds Date: Thu Jun 29 23:34:29 2023 -0700 csky: fix up lock_mm_and_find_vma() conversion As already mentioned in my merge message for the 'expand-stack' branch, we have something like 24 different versions of the page fault path for all our different architectures, all just _slightly_ different due to various historical reasons (usually related to exactly when they branched off the original i386 version, and the details of the other architectures they had in their history). And a few of them had some silly mistake in the conversion. Most of the architectures call the faulting address 'address' in the fault path. But not all. Some just call it 'addr'. And if you end up doing a bit too much copy-and-paste, you end up with the wrong version in the places that do it differently. In this case it was csky. Fixes: a050ba1e7422 ("mm/fault: convert remaining simple cases to lock_mm_and_find_vma()") Reported-by: Guenter Roeck Signed-off-by: Linus Torvalds commit 075e333591e6aee7b0008dd6c14c361bb1509821 Merge: ea3f8272876f2 de649e7f5edb2 Author: Linus Torvalds Date: Thu Jun 29 23:21:20 2023 -0700 Merge tag 'memblock-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock updates from Mike Rapoport: - add test for memblock_alloc_node() - minor coding style fixes - add flags and nid info in memblock debugfs * tag 'memblock-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock: Update nid info in memblock debugfs memblock: Add flags and nid info in memblock debugfs Fix some coding style errors in memblock.c Add tests for memblock_alloc_node() commit ea3f8272876f2958463992f6736ab690fde7fa9c Author: Linus Torvalds Date: Thu Jun 29 23:04:57 2023 -0700 parisc: fix expand_stack() conversion In commit 8d7071af8907 ("mm: always expand the stack with the mmap write lock held") I tried to deal with the remaining odd page fault handling cases. The oddest one is ia64, which has stacks that grow both up and down. And because ia64 was _so_ odd, I asked people to verify the end result. But a close second oddity is parisc, which is the only one that has a main stack growing up (our "CONFIG_STACK_GROWSUP" config option). But it looked obvious enough that I didn't worry about it. I should have worried a bit more. Not because it was particularly complex, but because I just used the wrong variable name. The previous vma isn't called "prev", it's called "prev_vma". Blush. Fixes: 8d7071af8907 ("mm: always expand the stack with the mmap write lock held") Signed-off-by: Linus Torvalds commit 887e845f8c1ce5b031dbad95d22e56f2e61bb35c Author: Ian Rogers Date: Fri Jun 23 08:10:16 2023 -0700 perf vendor events intel: Update tigerlake to 1.13 Updates were released in: https://github.com/intel/perfmon/commit/9a3cd5ad68aee46078c663fe0cd9484e3956fd88 Adds the events ICACHE_DATA.STALLS, ICACHE_TAG.STALLS and DECODE.LCP. Descriptions are also updated. Signed-off-by: Ian Rogers Tested-by: Namhyung Kim Cc: Mark Rutland Cc: Eduard Zingerman Cc: Sohom Datta Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Caleb Biggers Cc: Edward Baker Cc: Perry Taylor Cc: Samantha Alt Cc: Weilin Wang Cc: Arnaldo Carvalho de Melo Cc: Andrii Nakryiko Cc: Jiri Olsa Cc: Jing Zhang Cc: Kajol Jain Cc: Alexander Shishkin Cc: Kan Liang Cc: Zhengjun Xing Cc: John Garry Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230623151016.4193660-13-irogers@google.com Signed-off-by: Namhyung Kim commit b5d2644da65cfc249e4caf820943dfbfb559bce1 Author: Ian Rogers Date: Fri Jun 23 08:10:15 2023 -0700 perf vendor events intel: Update skylakex to 1.31 Updates were released in: https://github.com/intel/perfmon/commit/cdaa69afe7a48a217b1d89320a27efc6e650cec3 Adds the events IDQ.DSB_CYCLES_OK, IDQ.DSB_CYCLES_ANY, ICACHE_TAG.STALLS, DECODE.LCP, LSD.CYCLES_OK. Descriptions are also updated. Signed-off-by: Ian Rogers Cc: Mark Rutland Cc: Eduard Zingerman Cc: Sohom Datta Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Caleb Biggers Cc: Edward Baker Cc: Perry Taylor Cc: Samantha Alt Cc: Weilin Wang Cc: Arnaldo Carvalho de Melo Cc: Andrii Nakryiko Cc: Jiri Olsa Cc: Jing Zhang Cc: Kajol Jain Cc: Alexander Shishkin Cc: Kan Liang Cc: Zhengjun Xing Cc: John Garry Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230623151016.4193660-12-irogers@google.com Signed-off-by: Namhyung Kim commit ea3eafa08aa73800a095f974ee4bc230ee055083 Author: Ian Rogers Date: Fri Jun 23 08:10:14 2023 -0700 perf vendor events intel: Update skylake to 57 Updates were released in: https://github.com/intel/perfmon/commit/1c3042c13bbfea05abe1ebb6910ae58b2172e9ef Adds the events IDQ.DSB_CYCLES_OK, IDQ.DSB_CYCLES_ANY, ICACHE_TAG.STALLS, DECODE.LCP, LSD.CYCLES_OK. Descriptions are also updated. Signed-off-by: Ian Rogers Cc: Mark Rutland Cc: Eduard Zingerman Cc: Sohom Datta Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Caleb Biggers Cc: Edward Baker Cc: Perry Taylor Cc: Samantha Alt Cc: Weilin Wang Cc: Arnaldo Carvalho de Melo Cc: Andrii Nakryiko Cc: Jiri Olsa Cc: Jing Zhang Cc: Kajol Jain Cc: Alexander Shishkin Cc: Kan Liang Cc: Zhengjun Xing Cc: John Garry Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230623151016.4193660-11-irogers@google.com Signed-off-by: Namhyung Kim commit 938e4ad3101160481e5502186f95c7469d6bbcbc Author: Ian Rogers Date: Fri Jun 23 08:10:13 2023 -0700 perf vendor events intel: Update sapphirerapids to 1.14 Updates were released in: https://github.com/intel/perfmon/commit/a84850f1fec633002c35838ed34e51e1f0d6a2dd Adds a large number of CXL events like UNC_CHA_TOR_OCCUPANCY.IA_MISS_RFO_CXL_ACC, UNC_CHA_TOR_OCCUPANCY.IA_MISS_DRD_CXL_ACC, UNC_CHA_TOR_INSERTS.IA_MISS_DRD_CXL_ACC, UNC_CHA_TOR_INSERTS.IA_MISS_RFO_CXL_ACC, UNC_CHA_TOR_INSERTS.IA_MISS_LLCPREFRFO_CXL_ACC, UNC_CHA_TOR_INSERTS.IA_MISS_RFO_PREF_CXL_ACC, UNC_CHA_TOR_INSERTS.IA_MISS_DRD_PREF_CXL_ACC, UNC_CHA_TOR_INSERTS.IA_MISS_LLCPREFDATA_CXL_ACC, UNC_CHA_TOR_OCCUPANCY.IA_MISS_DRD_PREF_CXL_ACC, UNC_CHA_TOR_OCCUPANCY.IA_MISS_LLCPREFDATA_CXL_ACC, UNC_CHA_TOR_OCCUPANCY.IA_MISS_LLCPREFRFO_CXL_ACC, UNC_CHA_TOR_OCCUPANCY.IA_MISS_RFO_PREF_CXL_ACC, UNC_CHA_TOR_INSERTS.IA_MISS_CXL_ACC, UNC_CHA_TOR_INSERTS.IA_HIT_CXL_ACC, UNC_CHA_TOR_OCCUPANCY.IA_MISS_CXL_ACC, UNC_CHA_TOR_OCCUPANCY.IA_HIT_CXL_ACC. Signed-off-by: Ian Rogers Cc: Mark Rutland Cc: Eduard Zingerman Cc: Sohom Datta Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Caleb Biggers Cc: Edward Baker Cc: Perry Taylor Cc: Samantha Alt Cc: Weilin Wang Cc: Arnaldo Carvalho de Melo Cc: Andrii Nakryiko Cc: Jiri Olsa Cc: Jing Zhang Cc: Kajol Jain Cc: Alexander Shishkin Cc: Kan Liang Cc: Zhengjun Xing Cc: John Garry Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230623151016.4193660-10-irogers@google.com Signed-off-by: Namhyung Kim commit 663655c91ce195f912957157d7aaa3e8c06e8b14 Author: Ian Rogers Date: Fri Jun 23 08:10:12 2023 -0700 perf vendor events intel: Update icelakex to 1.21 Updates were released in: https://github.com/intel/perfmon/commit/78d47cbbae48a0297a507ae4fea234ff37ff9960 Adds the events ICACHE_DATA.STALLS, ICACHE_TAG.STALLS and DECODE.LCP. Descriptions are also updated. Signed-off-by: Ian Rogers Cc: Mark Rutland Cc: Eduard Zingerman Cc: Sohom Datta Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Caleb Biggers Cc: Edward Baker Cc: Perry Taylor Cc: Samantha Alt Cc: Weilin Wang Cc: Arnaldo Carvalho de Melo Cc: Andrii Nakryiko Cc: Jiri Olsa Cc: Jing Zhang Cc: Kajol Jain Cc: Alexander Shishkin Cc: Kan Liang Cc: Zhengjun Xing Cc: John Garry Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230623151016.4193660-9-irogers@google.com Signed-off-by: Namhyung Kim commit d1363b9454a32cf615d1a4df920e88cb73763af9 Author: Ian Rogers Date: Fri Jun 23 08:10:11 2023 -0700 perf vendor events intel: Update icelake to 1.19 Updates were released in: https://github.com/intel/perfmon/commit/f3d841189f8964bc240c86301f4c849845630b5b A number of events are deprecated and event descriptions updated. Adds events ICACHE_DATA.STALLS, ICACHE_TAG.STALLS and DECODE.LCP. Signed-off-by: Ian Rogers Cc: Mark Rutland Cc: Eduard Zingerman Cc: Sohom Datta Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Caleb Biggers Cc: Edward Baker Cc: Perry Taylor Cc: Samantha Alt Cc: Weilin Wang Cc: Arnaldo Carvalho de Melo Cc: Andrii Nakryiko Cc: Jiri Olsa Cc: Namhyung Kim Cc: Jing Zhang Cc: Kajol Jain Cc: Alexander Shishkin Cc: Kan Liang Cc: Zhengjun Xing Cc: John Garry Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230623151016.4193660-8-irogers@google.com Signed-off-by: Namhyung Kim commit 0c9e39421cd00258f7cd17b25ee5fe177a3088dd Author: Ian Rogers Date: Fri Jun 23 08:10:10 2023 -0700 perf vendor events intel: Update cascadelakex to 1.19 Updates were released in: https://github.com/intel/perfmon/commit/e4f83534f23a69e6da55c672c4d929919688c9b6 Adds the events IDQ.DSB_CYCLES_OK, IDQ.DSB_CYCLES_ANY, ICACHE_TAG.STALLS, DECODE.LCP, LSD.CYCLES_OK. Descriptions are also updated. Signed-off-by: Ian Rogers Cc: Mark Rutland Cc: Eduard Zingerman Cc: Sohom Datta Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Caleb Biggers Cc: Edward Baker Cc: Perry Taylor Cc: Samantha Alt Cc: Weilin Wang Cc: Arnaldo Carvalho de Melo Cc: Andrii Nakryiko Cc: Jiri Olsa Cc: Jing Zhang Cc: Kajol Jain Cc: Alexander Shishkin Cc: Kan Liang Cc: Zhengjun Xing Cc: John Garry Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230623151016.4193660-7-irogers@google.com Signed-off-by: Namhyung Kim commit dfc83cc8776917fbb8452328b56bb2192421a809 Author: Ian Rogers Date: Fri Jun 23 08:10:09 2023 -0700 perf vendor events intel: Update meteorlake to 1.03 1.03 events were released in: https://github.com/intel/perfmon/commit/501a29e88b57e8b01d610168d0101d6181b15e28 It added a lot of events and all uncore events. Signed-off-by: Ian Rogers Cc: Mark Rutland Cc: Eduard Zingerman Cc: Sohom Datta Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Caleb Biggers Cc: Edward Baker Cc: Perry Taylor Cc: Samantha Alt Cc: Weilin Wang Cc: Arnaldo Carvalho de Melo Cc: Andrii Nakryiko Cc: Jiri Olsa Cc: Namhyung Kim Cc: Jing Zhang Cc: Kajol Jain Cc: Alexander Shishkin Cc: Kan Liang Cc: Zhengjun Xing Cc: John Garry Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230623151016.4193660-6-irogers@google.com Signed-off-by: Namhyung Kim commit 7e74ece31af7f701d2cf8c3529633e3620a61c70 Author: Ian Rogers Date: Fri Jun 23 08:10:08 2023 -0700 perf vendor events intel: Add rocketlake events/metrics Add RocketLake events added to Intel perfmon in: https://github.com/intel/perfmon/commit/f5f47dc938d81d5cc491cf8ac1f90bee18e238cf mapfile.csv is updated accordingly with the CPUID matching one previously associated with icelake. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20230623151016.4193660-5-irogers@google.com Cc: Mark Rutland Cc: Eduard Zingerman Cc: Sohom Datta Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Caleb Biggers Cc: Edward Baker Cc: Perry Taylor Cc: Samantha Alt Cc: Weilin Wang Cc: Arnaldo Carvalho de Melo Cc: Andrii Nakryiko Cc: Jiri Olsa Cc: Jing Zhang Cc: Kajol Jain Cc: Alexander Shishkin Cc: Kan Liang Cc: Zhengjun Xing Cc: John Garry Cc: Ingo Molnar Signed-off-by: Namhyung Kim commit 8076dc8c6818eebbb5029bd77eea9848a3c32f3c Author: Ian Rogers Date: Fri Jun 23 08:10:07 2023 -0700 perf vendor metrics intel: Make transaction metrics conditional Make the transaction metrics conditional on the cycles-tx event being present. This event may not be present when TSX extensions have been disabled. Signed-off-by: Ian Rogers Tested-by: Namhyung Kim Cc: Mark Rutland Cc: Eduard Zingerman Cc: Sohom Datta Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Caleb Biggers Cc: Edward Baker Cc: Perry Taylor Cc: Samantha Alt Cc: Weilin Wang Cc: Arnaldo Carvalho de Melo Cc: Andrii Nakryiko Cc: Jiri Olsa Cc: Jing Zhang Cc: Kajol Jain Cc: Alexander Shishkin Cc: Kan Liang Cc: Zhengjun Xing Cc: John Garry Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230623151016.4193660-4-irogers@google.com Signed-off-by: Namhyung Kim commit eadc0040a9ebfa2ad6debe6df087c549e6e49bd4 Author: Ian Rogers Date: Fri Jun 23 08:10:06 2023 -0700 perf jevents: Support for has_event function Support for the new has_event function in metrics. Signed-off-by: Ian Rogers Tested-by: Namhyung Kim Cc: Mark Rutland Cc: Eduard Zingerman Cc: Sohom Datta Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Caleb Biggers Cc: Edward Baker Cc: Perry Taylor Cc: Samantha Alt Cc: Weilin Wang Cc: Arnaldo Carvalho de Melo Cc: Andrii Nakryiko Cc: Jiri Olsa Cc: Jing Zhang Cc: Kajol Jain Cc: Alexander Shishkin Cc: Kan Liang Cc: Zhengjun Xing Cc: John Garry Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230623151016.4193660-3-irogers@google.com Signed-off-by: Namhyung Kim commit 4a4a9bf9075fbc753ab20f05347fd1482d4801e4 Author: Ian Rogers Date: Fri Jun 23 08:10:05 2023 -0700 perf expr: Add has_event function Some events are dependent on firmware/kernel enablement. Allow such events to be detected when the metric is parsed so that the metric's event parsing doesn't fail. Signed-off-by: Ian Rogers Tested-by: Namhyung Kim Cc: Mark Rutland Cc: Eduard Zingerman Cc: Sohom Datta Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Caleb Biggers Cc: Edward Baker Cc: Perry Taylor Cc: Samantha Alt Cc: Weilin Wang Cc: Arnaldo Carvalho de Melo Cc: Andrii Nakryiko Cc: Jiri Olsa Cc: Jing Zhang Cc: Kajol Jain Cc: Alexander Shishkin Cc: Kan Liang Cc: Zhengjun Xing Cc: John Garry Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230623151016.4193660-2-irogers@google.com Signed-off-by: Namhyung Kim commit 36cee69f572c72610da2681a358318d0dc9740b0 Author: Namhyung Kim Date: Mon Jun 26 17:02:27 2023 -0700 perf tools: Do not remove addr_location.thread in thread__find_map() The thread__find_map() is to find a map for a given address in the given thread's address space. It searches maps based on the cpu mode and fills various information in the addr_location data structure. It might change al->maps and al->map, but not al->thread. Then I think no reason to not set the al->thread at the beginning. Also get rid of the duplicate 'al->map = NULL' part. Fixes: 0dd5041c9a0ea ("perf addr_location: Add init/exit/copy functions") Acked-by: Ian Rogers Acked-by: James Clark Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Arnaldo Carvalho de Melo Cc: Mark Rutland Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Adrian Hunter Cc: Suzuki K Poulose Cc: Mike Leach Cc: Leo Yan Cc: John Garry Cc: Will Deacon Signed-off-by: Namhyung Kim commit 1e6d5dea34325df8dc204575cd0726cd5f2b864f Merge: 7ede5f78a0d74 0a2f6372a43ff Author: Linus Torvalds Date: Thu Jun 29 21:12:20 2023 -0700 Merge tag 'dma-mapping-6.5-2023-06-28' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping updates from Christoph Hellwig: - swiotlb cleanups (Petr Tesarik) - use kvmalloc_array (gaoxu) - a small step towards removing is_swiotlb_active (Christoph Hellwig) - fix a Kconfig typo Sui Jingfeng) * tag 'dma-mapping-6.5-2023-06-28' of git://git.infradead.org/users/hch/dma-mapping: drm/nouveau: stop using is_swiotlb_active swiotlb: use the atomic counter of total used slabs if available swiotlb: remove unused field "used" from struct io_tlb_mem dma-remap: use kvmalloc_array/kvfree for larger dma memory remap dma-mapping: fix a Kconfig typo commit 7ede5f78a0d74b574791c7eb0e2ca6e54b80c93c Merge: 31929ae00890d 5f004bcaee4cb Author: Linus Torvalds Date: Thu Jun 29 21:01:17 2023 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "This cycle saw a focus on rxe and bnxt_re drivers: - Code cleanups for irdma, rxe, rtrs, hns, vmw_pvrdma - rxe uses workqueues instead of tasklets - rxe has better compliance around access checks for MRs and rereg_mr - mana supportst he 'v2' FW interface for RX coalescing - hfi1 bug fix for stale cache entries in its MR cache - mlx5 buf fix to handle FW failures when destroying QPs - erdma HW has a new doorbell allocation mechanism for uverbs that is secure - Lots of small cleanups and rework in bnxt_re: - Use the common mmap functions - Support disassociation - Improve FW command flow - support for 'low latency push'" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (71 commits) RDMA/bnxt_re: Fix an IS_ERR() vs NULL check RDMA/bnxt_re: Fix spelling mistake "priviledged" -> "privileged" RDMA/bnxt_re: Remove duplicated include in bnxt_re/main.c RDMA/bnxt_re: Refactor code around bnxt_qplib_map_rc() RDMA/bnxt_re: Remove incorrect return check from slow path RDMA/bnxt_re: Enable low latency push RDMA/bnxt_re: Reorg the bar mapping RDMA/bnxt_re: Move the interface version to chip context structure RDMA/bnxt_re: Query function capabilities from firmware RDMA/bnxt_re: Optimize the bnxt_re_init_hwrm_hdr usage RDMA/bnxt_re: Add disassociate ucontext support RDMA/bnxt_re: Use the common mmap helper functions RDMA/bnxt_re: Initialize opcode while sending message RDMA/cma: Remove NULL check before dev_{put, hold} RDMA/rxe: Simplify cq->notify code RDMA/rxe: Fixes mr access supported list RDMA/bnxt_re: optimize the parameters passed to helper functions RDMA/bnxt_re: remove redundant cmdq_bitmap RDMA/bnxt_re: use firmware provided max request timeout RDMA/bnxt_re: cancel all control path command waiters upon error ... commit 31929ae00890d921618b0b449722dcdf4a4416cc Merge: d35ac6ac0e80e dbe245cdf5189 Author: Linus Torvalds Date: Thu Jun 29 20:57:27 2023 -0700 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd updates from Jason Gunthorpe: "Just two syzkaller fixes, both for the same basic issue: using the area pointer during an access forced unmap while the locks protecting it were let go" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Call iopt_area_contig_done() under the lock iommufd: Do not access the area pointer after unlocking commit d35ac6ac0e80e55bcea79af18d935f19a3e8554c Merge: 0b26eadbf200a a7a334076dd72 Author: Linus Torvalds Date: Thu Jun 29 20:51:03 2023 -0700 Merge tag 'iommu-updates-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull iommu updates from Joerg Roedel: "Core changes: - iova_magazine_alloc() optimization - Make flush-queue an IOMMU driver capability - Consolidate the error handling around device attachment AMD IOMMU changes: - AVIC Interrupt Remapping Improvements - Some minor fixes and cleanups Intel VT-d changes from Lu Baolu: - Small and misc cleanups ARM-SMMU changes from Will Deacon: - Device-tree binding updates: - Add missing clocks for SC8280XP and SA8775 Adreno SMMUs - Add two new Qualcomm SMMUs in SDX75 and SM6375 - Workarounds for Arm MMU-700 errata: - 1076982: Avoid use of SEV-based cmdq wakeup - 2812531: Terminate command batches with a CMD_SYNC - Enforce single-stage translation to avoid nesting-related errata - Set the correct level hint for range TLB invalidation on teardown .. and some other minor fixes and cleanups (including Freescale PAMU and virtio-iommu changes)" * tag 'iommu-updates-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (50 commits) iommu/vt-d: Remove commented-out code iommu/vt-d: Remove two WARN_ON in domain_context_mapping_one() iommu/vt-d: Handle the failure case of dmar_reenable_qi() iommu/vt-d: Remove unnecessary (void*) conversions iommu/amd: Remove extern from function prototypes iommu/amd: Use BIT/BIT_ULL macro to define bit fields iommu/amd: Fix DTE_IRQ_PHYS_ADDR_MASK macro iommu/amd: Fix compile error for unused function iommu/amd: Improving Interrupt Remapping Table Invalidation iommu/amd: Do not Invalidate IRT when IRTE caching is disabled iommu/amd: Introduce Disable IRTE Caching Support iommu/amd: Remove the unused struct amd_ir_data.ref iommu/amd: Switch amd_iommu_update_ga() to use modify_irte_ga() iommu/arm-smmu-v3: Set TTL invalidation hint better iommu/arm-smmu-v3: Document nesting-related errata iommu/arm-smmu-v3: Add explicit feature for nesting iommu/arm-smmu-v3: Document MMU-700 erratum 2812531 iommu/arm-smmu-v3: Work around MMU-600 erratum 1076982 dt-bindings: arm-smmu: Add SDX75 SMMU compatible dt-bindings: arm-smmu: Add SM6375 GPU SMMU ... commit 0b26eadbf200abf6c97c6d870286c73219cdac65 Author: Linus Torvalds Date: Thu Jun 29 20:41:24 2023 -0700 sparc32: fix lock_mm_and_find_vma() conversion The sparc32 conversion to lock_mm_and_find_vma() in commit a050ba1e7422 ("mm/fault: convert remaining simple cases to lock_mm_and_find_vma()") missed the fact that we didn't actually have a 'regs' pointer available in the 'force_user_fault()' case. It's there in the regular page fault path ("do_sparc_fault()"), but not the window underflow/overflow paths. Which is all fine - we can just pass in a NULL pointer. The register state is only used to avoid deadlock with kernel faults, which is not the case for any of these register window faults. Reported-by: Stephen Rothwell Fixes: a050ba1e7422 ("mm/fault: convert remaining simple cases to lock_mm_and_find_vma()") Signed-off-by: Linus Torvalds commit 08fc75735fda3be97194bfbf3c899c87abb3d0fe Author: Zhengchao Shao Date: Fri Jun 30 09:26:47 2023 +0800 mlxsw: minimal: fix potential memory leak in mlxsw_m_linecards_init The line cards array is not freed in the error path of mlxsw_m_linecards_init(), which can lead to a memory leak. Fix by freeing the array in the error path, thereby making the error path identical to mlxsw_m_linecards_fini(). Fixes: 01328e23a476 ("mlxsw: minimal: Extend module to port mapping with slot index") Signed-off-by: Zhengchao Shao Reviewed-by: Petr Machata Reviewed-by: Ido Schimmel Link: https://lore.kernel.org/r/20230630012647.1078002-1-shaozhengchao@huawei.com Signed-off-by: Jakub Kicinski commit 82a2a51055895f419a3aaba15ffad419063191f0 Merge: 43ec8a620b382 554588e8e932e Author: Linus Torvalds Date: Thu Jun 29 17:44:56 2023 -0700 Merge tag 'sysctl-6.5-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull sysctl fix from Luis Chamberlain: "A missed minor fix which Matthieu Baerts noted I had not picked up" * tag 'sysctl-6.5-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: sysctl: fix unused proc_cap_handler() function warning commit 43ec8a620b38291c959afb47816cf2de6207125a Merge: 3ad7b12c72ae6 6c26bd4384da2 Author: Linus Torvalds Date: Thu Jun 29 17:38:54 2023 -0700 Merge tag 'unmap-fix-20230629' of git://git.infradead.org/users/dwmw2/linux Pull mm fix from David Woodhouse: "Fix error return from do_vmi_align_munmap()" * tag 'unmap-fix-20230629' of git://git.infradead.org/users/dwmw2/linux: mm/mmap: Fix error return in do_vmi_align_munmap() commit 3ad7b12c72ae6ba34d452e88a60c37c9fb368fbb Merge: 2eb15b42482bb d34a271accf8f Author: Linus Torvalds Date: Thu Jun 29 17:36:00 2023 -0700 Merge tag 'trace-v6.4-rc7-v3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fix from Steven Rostedt: "Fix user event write on buffer disabled. The user events write currently returns the size of what was supposed to be written when tracing is disabled and nothing was written. Instead, behave like trace_marker and return -EBADF, as that is what is returned if a file is opened for read only, and a write is performed on it. Writing to the buffer that is disabled is like trying to write to a file opened for read only, as the buffer still can be read, but just not written to. This also includes test cases for this use case" * tag 'trace-v6.4-rc7-v3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: selftests/user_events: Add test cases when event is disabled selftests/user_events: Enable the event before write_fault test in ftrace self-test tracing/user_events: Fix incorrect return value for writing operation when events are disabled commit 59bba51ec2a50e3dc5c3ee80f0a23207346303ff Author: Cong Yang Date: Tue Jun 27 13:01:48 2023 +0800 drm/panel: Fine tune Starry-ili9882t panel HFP and HBP Because the setting of hporch is too small, there will be warning in kernel log[1]. After fine tune the HFP and HBP, this warning can be solved. The actual measurement frame rate is 60.1Hz. [1]: WARNING kernel:[drm] HFP + HBP less than d-phy, FPS will under 60Hz Fixes: 8716a6473e6c ("drm/panel: Support for Starry-ili9882t TDDI MIPI-DSI panel") Signed-off-by: Cong Yang Reviewed-by: Neil Armstrong Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20230627050148.2045691-1-yangcong5@huaqin.corp-partner.google.com commit 3cf62c8177adb0db9e15c8b898c44f997acf3ebf Author: Pawel Dembicki Date: Wed Jun 28 21:43:27 2023 +0200 net: dsa: vsc73xx: fix MTU configuration Switch in MAXLEN register stores the maximum size of a data frame. The MTU size is 18 bytes smaller than the frame size. The current settings are causing problems with packet forwarding. This patch fixes the MTU settings to proper values. Fixes: fb77ffc6ec86 ("net: dsa: vsc73xx: make the MTU configurable") Reviewed-by: Linus Walleij Signed-off-by: Pawel Dembicki Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20230628194327.1765644-1-paweldembicki@gmail.com Signed-off-by: Jakub Kicinski commit 2eb15b42482bbbaa0fd611741e687c2feee21f2c Merge: 06697ca69bcaa b5539eb5ee702 Author: Linus Torvalds Date: Thu Jun 29 17:32:59 2023 -0700 Merge tag 'acpi-6.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "Fix suspend-to-idle breakage on multiple systems introduced by one of the recent commits that may cause the affected systems to overheat while suspended" * tag 'acpi-6.5-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: EC: Fix acpi_ec_dispatch_gpe() commit 06697ca69bcaa76046be14684f513a89d2c7a240 Author: Ingo Molnar Date: Wed Jun 28 11:16:03 2023 +0200 objtool: Remove btrfs_assertfail() from the noreturn exceptions list The objtool merge in commit 6f612579be9d ("Merge tag 'objtool-core ...") generated a semantic conflict that was not resolved. The btrfs_assertfail() entry was removed from the noreturn list in commit b831306b3b7d ("btrfs: print assertion failure report and stack trace from the same line") because btrfs_assertfail() was changed from a noreturn function into a macro. The noreturn list was then moved from check.c to noreturns.h in commit 6245ce4ab670 ("objtool: Move noreturn function list to separate file"), and should be removed from that post-merge as well. Do it explicitly. Cc: David Sterba Cc: Josh Poimboeuf Cc: Peter Zijlstra Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar Signed-off-by: Linus Torvalds commit 632f54b4d60bfe0701f43d0bc387928de6e3dcfb Merge: bf1fa6f15553d 7bc162d5cc4de Author: Linus Torvalds Date: Thu Jun 29 16:34:12 2023 -0700 Merge tag 'slab-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: - SLAB deprecation: Following the discussion at LSF/MM 2023 [1] and no objections, the SLAB allocator is deprecated by renaming the config option (to make its users notice) to CONFIG_SLAB_DEPRECATED with updated help text. SLUB should be used instead. Existing defconfigs with CONFIG_SLAB are also updated. - SLAB_NO_MERGE kmem_cache flag (Jesper Dangaard Brouer): There are (very limited) cases where kmem_cache merging is undesirable, and existing ways to prevent it are hacky. Introduce a new flag to do that cleanly and convert the existing hacky users. Btrfs plans to use this for debug kernel builds (that use case is always fine), networking for performance reasons (that should be very rare). - Replace the usage of weak PRNGs (David Keisar Schmidt): In addition to using stronger RNGs for the security related features, the code is a bit cleaner. - Misc code cleanups (SeongJae Parki, Xiongwei Song, Zhen Lei, and zhaoxinchao) Link: https://lwn.net/Articles/932201/ [1] * tag 'slab-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slab_common: use SLAB_NO_MERGE instead of negative refcount mm/slab: break up RCU readers on SLAB_TYPESAFE_BY_RCU example code mm/slab: add a missing semicolon on SLAB_TYPESAFE_BY_RCU example code mm/slab_common: reduce an if statement in create_cache() mm/slab: introduce kmem_cache flag SLAB_NO_MERGE mm/slab: rename CONFIG_SLAB to CONFIG_SLAB_DEPRECATED mm/slab: remove HAVE_HARDENED_USERCOPY_ALLOCATOR mm/slab_common: Replace invocation of weak PRNG mm/slab: Replace invocation of weak PRNG slub: Don't read nr_slabs and total_objects directly slub: Remove slabs_node() function slub: Remove CONFIG_SMP defined check slub: Put objects_show() into CONFIG_SLUB_DEBUG enabled block slub: Correct the error code when slab_kset is NULL mm/slab: correct return values in comment for _kmem_cache_create() commit fe77cc2e5a6a7c85f5c6ef8a39d7694ffc7f41c9 Author: Yang Li Date: Thu Jun 29 10:11:18 2023 +0800 cxl: Fix one kernel-doc comment Fix a merge error that updated the argument to cxl_mem_get_fw_info() but not the kernel-doc. drivers/cxl/core/memdev.c:678: warning: Function parameter or member 'mds' not described in 'cxl_mem_get_fw_info' drivers/cxl/core/memdev.c:678: warning: Excess function parameter 'cxlds' description in 'cxl_mem_get_fw_info' Signed-off-by: Yang Li Link: https://lore.kernel.org/r/20230629021118.102744-1-yang.lee@linux.alibaba.com Signed-off-by: Dan Williams commit bf1fa6f15553df04f2bdd06190ccd5f388ab0777 Merge: 0873694a33982 c1d57ee6eb996 Author: Linus Torvalds Date: Thu Jun 29 15:28:33 2023 -0700 Merge tag 'soc-arm-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC updates from Arnd Bergmann: "These are mostly minor cleanups and bugfixes that address harmless problems. The largest branch is a conversion of the omap platform to use GPIO descriptors throughout the tree, for any devices that are not fully converted to devicetree. The Samsung Exynos platform gains back support for the Exynos4212 chip that was previously unused and removed but is now used for the Samsung Galaxy Tab3" * tag 'soc-arm-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (24 commits) ARM: omap2: Fix copy/paste bug MAINTAINERS: Replace my email address Input: ads7846 - fix pointer cast warning Input: ads7846 - Fix usage of match data ARM: omap2: Fix checkpatch issues arm: omap1: replace printk() with pr_err macro ARM: omap: Fix checkpatch issues ARM: s3c: Switch i2c drivers back to use .probe() ARM: versatile: mark mmc_status() static ARM: spear: include "pl080.h" for pl080_get_signal() prototype ARM: sa1100: address missing prototype warnings ARM: pxa: fix missing-prototypes warnings ARM: orion5x: fix d2net gpio initialization ARM: omap2: fix missing tick_broadcast() prototype ARM: omap1: add missing include ARM: lpc32xx: add missing include ARM: imx: add missing include ARM: highbank: add missing include ARM: ep93xx: fix missing-prototype warnings ARM: davinci: fix davinci_cpufreq_init() declaration ... commit 0873694a339821277d9f2cae7ef981a1283b44f5 Merge: e4c8d01865118 2b24391767ae6 Author: Linus Torvalds Date: Thu Jun 29 15:26:45 2023 -0700 Merge tag 'soc-defconfig-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC defconfig updates from Arnd Bergmann: "The arm64 defconfig file gets the usual updates to enable addition device drivers as well as the sparx5 and realtek SoC platforms. For arm32, there are only a couple of cleanup patches for imx, renesas and rockchips" * tag 'soc-defconfig-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (23 commits) arm64: defconfig: Enable Rockchip I2S TDM and ES8316 drivers arm64: defconfig: update RK8XX MFD config ARM: multi_v7_defconfig: update MFD_RK808 name arm64: defconfig: Enable UBIFS arm64: defconfig: enable drivers for Verdin AM62 arm64: defconfig: Build SM6115 display and GPU clock controller drivers arm64: defconfig: Build display clock controller driver for QCM2290 arm64: defconfig: Build interconnect driver for QCM2290 arm64: defconfig: Build Global Clock Controller driver for QCM2290 arm64: defconfig: Build MSM power manager driver arm64: defconfig: Enable sc828x0xp lpasscc clock controller arm64: defconfig: Enable the TI SN65DSI83 driver arm64: defconfig: Enable Renesas MTU3a counter config arm64: defconfig: enable Mediatek PMIC key arm64: defconfig: enable MT6357 regulator ARM: imx_v6_v7_defconfig: Remove KERNEL_LZO config arm64: defconfig: Enable ipq6018 apss clock and PLL controller arm64: defconfig: Enable ARCH_SPARX5 and ARCH_REALTEK arm64: defconfig: enable FSA4480 driver as module ARM: shmobile: defconfig: Refresh for v6.4-rc1 ... commit e4c8d01865118ab148f77bdb54ec9c0c181d90a3 Merge: a9025a5f16ed6 356fa4975950d Author: Linus Torvalds Date: Thu Jun 29 15:22:19 2023 -0700 Merge tag 'soc-drivers-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC driver updates from Arnd Bergmann: "Nothing surprising in the SoC specific drivers, with the usual updates: - Added or improved SoC driver support for Tegra234, Exynos4121, RK3588, as well as multiple Mediatek and Qualcomm chips - SCMI firmware gains support for multiple SMC/HVC transport and version 3.2 of the protocol - Cleanups amd minor changes for the reset controller, memory controller, firmware and sram drivers - Minor changes to amd/xilinx, samsung, tegra, nxp, ti, qualcomm, amlogic and renesas SoC specific drivers" * tag 'soc-drivers-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (118 commits) dt-bindings: interrupt-controller: Convert Amlogic Meson GPIO interrupt controller binding MAINTAINERS: add PHY-related files to Amlogic SoC file list drivers: meson: secure-pwrc: always enable DMA domain tee: optee: Use kmemdup() to replace kmalloc + memcpy soc: qcom: geni-se: Do not bother about enable/disable of interrupts in secondary sequencer dt-bindings: sram: qcom,imem: document qdu1000 soc: qcom: icc-bwmon: Fix MSM8998 count unit dt-bindings: soc: qcom,rpmh-rsc: Require power-domains soc: qcom: socinfo: Add Soc ID for IPQ5300 dt-bindings: arm: qcom,ids: add SoC ID for IPQ5300 soc: qcom: Fix a IS_ERR() vs NULL bug in probe soc: qcom: socinfo: Add support for new fields in revision 19 soc: qcom: socinfo: Add support for new fields in revision 18 dt-bindings: firmware: scm: Add compatible for SDX75 soc: qcom: mdt_loader: Fix split image detection dt-bindings: memory-controllers: drop unneeded quotes soc: rockchip: dtpm: use C99 array init syntax firmware: tegra: bpmp: Add support for DRAM MRQ GSCs soc/tegra: pmc: Use devm_clk_notifier_register() soc/tegra: pmc: Simplify debugfs initialization ... commit 554588e8e932e7a0fac7d3ae2132f2b727d9acfe Author: Arnd Bergmann Date: Wed Jun 7 14:08:54 2023 +0200 sysctl: fix unused proc_cap_handler() function warning Since usermodehelper_table() is marked static now, we get a warning about it being unused when SYSCTL is disabled: kernel/umh.c:497:12: error: 'proc_cap_handler' defined but not used [-Werror=unused-function] Just move it inside of the same #ifdef. Signed-off-by: Arnd Bergmann Tested-by: Matthieu Baerts Fixes: 861dc0b46432 ("sysctl: move umh sysctl registration to its own file") Acked-by: Randy Dunlap Tested-by: Randy Dunlap # build-tested [mcgrof: adjust new commit ID for Fixes tag] Signed-off-by: Luis Chamberlain commit a9025a5f16ed610ea28a188cb0946cb71fafff17 Merge: 6c1561fb90052 f50a000b42195 Author: Linus Torvalds Date: Thu Jun 29 15:11:17 2023 -0700 Merge tag 'soc-newsoc-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull new ARM SoC support from Arnd Bergmann: "There are two new SoC families this time, and both appear fairly similar: The Nuvoton MA35D1 and the STMicroelectronics STM32MP2 are both dual-core Cortex-A35 based chips for the low-power industrial embedded market, and they mark the first 64-bit product in a widely used family of 32-bit Arm MCUs and SoCs. The way into the kernel is completely different here: The team at ST has a long history of working upstream with their STM32MP1 and other SoCs, and they produced a complete port to arm64 together with the initial announcement. Nuvoton also has multiple SoC product lines with current or previous upstream support, but those are maintained by third parties and are unrelated. The patch series from Nuvoton's Jacky Huang had to go through many revisisions to get to this point and is still missing a few drivers including the serial port for the moment. The branch contains the devicetree files as well as all the code changes, in order to have something that can be tested standalone" * tag 'soc-newsoc-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (25 commits) clk: nuvoton: Use clk_parent_data instead of string for parent clock clk: nuvoton: Update all constant hex values to lowercase clk: nuvoton: Add clk-ma35d1.h for driver extern functions remoteproc: stm32: use correct format strings on 64-bit MAINTAINERS: add entry for ARM/STM32 ARCHITECTURE arm64: defconfig: enable ARCH_STM32 and STM32 serial driver arm64: dts: st: add stm32mp257f-ev1 board support dt-bindings: stm32: document stm32mp257f-ev1 board arm64: dts: st: introduce stm32mp25 pinctrl files arm64: dts: st: introduce stm32mp25 SoCs family arm64: introduce STM32 family on Armv8 architecture dt-bindings: stm32: add st,stm32mp25-syscfg compatible for syscon pinctrl: stm32: add stm32mp257 pinctrl support dt-bindings: pinctrl: stm32: support for stm32mp257 and additional packages Documentation/process: add soc maintainer handbook reset: RESET_NUVOTON_MA35D1 should depend on ARCH_MA35 reset: Add Nuvoton ma35d1 reset driver support clk: nuvoton: Add clock driver for ma35d1 clock controller arm64: dts: nuvoton: Add initial ma35d1 device tree dt-bindings: serial: Document ma35d1 uart controller ... commit 6c1561fb900524c5bceb924071b3e9b8a67ff3da Merge: b775d6c5859af 46448b36ff8c8 Author: Linus Torvalds Date: Thu Jun 29 15:07:06 2023 -0700 Merge tag 'soc-dt-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC devicetree updates from Arnd Bergmann: "The biggest change this time is for the 32-bit devicetree files, which are all moved to a new location, using separate subdirectories for each SoC vendor, following the same scheme that is used on arm64, mips and riscv. This has been discussed for many years, but so far we never did this as there was a plan to move the files out of the kernel entirely, which has never happened. The impact of this will be that all external patches no longer apply, and anything depending on the location of the dtb files in the build directory will have to change. The installed files after 'make dtbs_install' keep the current location. There are six added SoCs here that are largely variants of previously added chips. Two other chips are added in a separate branch along with their device drivers. - The Samsung Exynos 4212 makes its return after the Samsung Galaxy Express phone is addded at last. The SoC support was originally added in 2012 but removed again in 2017 as it was unused at the time. - Amlogic C3 is a Cortex-A35 based smart IP camera chip - Qualcomm MSM8939 (Snapdragon 615) is a more featureful variant of the still common MSM8916 (Snapdragon 410) phone chip that has been supported for a long time. - Qualcomm SC8180x (Snapdragon 8cx) is one of their earlier high-end laptop chips, used in the Lenovo Flex 5G, which is added along with the reference board. - Qualcomm SDX75 is the latest generation modem chip that is used as a peripherial in phones but can also run a standalone Linux. Unlike the prior 32-bit SDX65 and SDX55, this now has a 64-bit Cortex-A55. - Alibaba T-Head TH1520 is a quad-core RISC-V chip based on the Xuantie C910 core, a step up from all previously added rv64 chips. All of the above come with reference board implementations, those included there are 39 new board files, but only five more 32-bit this time, probably a new low: - Marantec Maveo board based on dhcor imx6ull module - Endian 4i Edge 200, based on the armv5 Marvell Kirkwood chip - Epson Moverio BT-200 AR glasses based on TI OMAP4 - PHYTEC STM32MP1-3 Dev board based on STM32MP15 PHYTEC SOM - ICnova ADB4006 board based on Allwinner A20 On the 64-bit side, there are also fewer addded machines than we had in the recent releases: - Three boards based on NXP i.MX8: Emtop SoM & Baseboard, NXP i.MX8MM EVKB board and i.MX8MP based Gateworks Venice gw7905-2x device. - NVIDIA IGX Orin and Jetson Orin Nano boards, both based on tegra234 - Qualcomm gains support for 6 reference boards on various members of their IPQ networking SoC series, as well as the Sony Xperia M4 Aqua phone, the Acer Aspire 1 laptop, and the Fxtec Pro1X board on top of the various reference platforms for their new chips. - Rockchips support for several newer boards: Indiedroid Nova (rk3588), Edgeble Neural Compute Module 6B (rk3588), FriendlyARM NanoPi R2C Plus (rk3328), Anbernic RG353PS (rk3566), Lunzn Fastrhino R66S/R68S (rk3568) - TI K3/AM625 based PHYTEC phyBOARD-Lyra-AM625 board and Toradex Verdin family with AM62 COM, carrier and dev boards Other changes to existing boards contain the usual minor improvements along with - continued updates to clean up dts files based on dtc warnings and binding checks, in particular cache properties and node names - support for devicetree overlays on at91, bcm283x - significant additions to existing SoC support on mediatek, qualcomm, ti k3 family, starfive jh71xx, NXP i.MX6 and i.MX8, ST STM32MP1 As usual, a lot more detail is available in the individual merge commits" * tag 'soc-dt-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (926 commits) ARM: mvebu: fix unit address on armada-390-db flash ARM: dts: Move .dts files to vendor sub-directories kbuild: Support flat DTBs install ARM: dts: Add .dts files missing from the build ARM: dts: allwinner: Use quoted #include ARM: dts: lan966x: kontron-d10: add PHY interrupts ARM: dts: lan966x: kontron-d10: fix SPI CS ARM: dts: lan966x: kontron-d10: fix board reset ARM: dts: at91: Enable device-tree overlay support for AT91 boards arm: dts: Enable device-tree overlay support for AT91 boards arm64: dts: exynos: Remove clock from Exynos850 pmu_system_controller ARM: dts: at91: use generic name for shutdown controller ARM: dts: BCM5301X: Add cells sizes to PCIe nodes dt-bindings: firmware: brcm,kona-smc: convert to YAML riscv: dts: sort makefile entries by directory riscv: defconfig: enable T-HEAD SoC MAINTAINERS: add entry for T-HEAD RISC-V SoC riscv: dts: thead: add sipeed Lichee Pi 4A board device tree riscv: dts: add initial T-HEAD TH1520 SoC device tree riscv: Add the T-HEAD SoC family Kconfig option ... commit b775d6c5859affe00527cbe74263de05cfe6b9f9 Merge: 18f38fedfa71b e47084e116fcc Author: Linus Torvalds Date: Thu Jun 29 15:01:51 2023 -0700 Merge tag 'mips_6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: - add support for TP-Link HC220 G5 v1 - add support for Wifi/Bluetooth on CI20 - rework Ralink clock and reset handling - cleanups and fixes * tag 'mips_6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (58 commits) MIPS: Loongson64: DTS: Add RTC support to Loongson-2K1000 MIPS: Loongson64: DTS: Add RTC support to LS7A PCH MIPS: OCTEON: octeon-usb: cleanup divider calculation MIPS: OCTEON: octeon-usb: introduce dwc3_octeon_{read,write}q MIPS: OCTEON: octeon-usb: move gpio config to separate function MIPS: OCTEON: octeon-usb: use bitfields for shim register MIPS: OCTEON: octeon-usb: use bitfields for host config register MIPS: OCTEON: octeon-usb: use bitfields for control register MIPS: OCTEON: octeon-usb: add all register offsets mips: ralink: match all supported system controller compatible strings MIPS: dec: prom: Address -Warray-bounds warning MIPS: DTS: CI20: Raise VDDCORE voltage to 1.125 volts clk: ralink: mtmips: Fix uninitialized use of ret in mtmips_register_{fixed,factor}_clocks() mips: ralink: introduce commonly used remap node function mips: pci-mt7620: use dev_info() to log PCIe device detection result mips: pci-mt7620: do not print NFTS register value as error log MAINTAINERS: add Mediatek MTMIPS Clock maintainer mips: ralink: get cpu rate from new driver code mips: ralink: remove reset related code mips: ralink: mt7620: remove clock related code ... commit 18f38fedfa71b5b7e954fc8f1e31bda75d8f1d7c Merge: c6b0271053e7a ecdb004843ed9 Author: Linus Torvalds Date: Thu Jun 29 14:58:26 2023 -0700 Merge tag 'devicetree-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: "Bindings: - Add some missing type definitions to properties - Drop unneeded quotes and use absolute paths in bindings - Remove redundant "binding" or "schema" in binding titles - Add bindings for Ralink SoCs interrupt controller, QCA2066 Bluetooth, infineon,irps5401, new NXP i.MX GPT variants, shineworld lh133k MIPI SPI panel, Socionext Synquacer platforms, RK3588 PCIe, ST M95640 EEPROM, and FSL DCP crypto variants, and Arm Cortex-R52 DT core: - Improve the reserved-memory range allocation to maximize contiguous space - Use device_set_node() helper in place of open coding" * tag 'devicetree-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (40 commits) dt-bindings: interrupt-controller: add Ralink SoCs interrupt controller dt-bindings: PCI: dwc: rockchip: Update for RK3588 dt-bindings: auxdisplay: holtek: Add missing type for "linux,no-autorepeat" dt-bindings: input: mediatek,pmic-keys: Fix typo in "linux,keycodes" property name dt-bindings: pwm: drop unneeded quotes dt-bindings: crypto: drop unneeded quotes dt-bindings: arm: socionext: add Synquacer platforms dt-bindings: connector: usb: allow a single HS port dt-bindings: bus: ti-sysc: fix typo of: reserved_mem: Use stable allocation order of: reserved_mem: Try to keep range allocations contiguous dt-bindings: arm: drop unneeded quotes and use absolute /schemas path dt-bindings: firmware: arm,scmi: drop unneeded quotes and use absolute /schemas path dt-bindings: dvfs: drop unneeded quotes dt-bindings: gpu: drop unneeded quotes dt-bindings: i3c: silvaco,i3c-master: drop unneeded quotes dt-bindings: rockchip: grf: drop unneeded quotes dt-bindings: spmi: mtk,spmi-mtk-pmif: drop unneeded quotes dt-bindings: Remove last usage of "binding" or "schema" in titles dt-bindings: display: panel: mipi-dbi-spi: add spi-3wire property ... commit c6b0271053e7a5ae57511363213777f706b60489 Merge: 18c9901d7435b 028f6055c9125 Author: Linus Torvalds Date: Thu Jun 29 13:39:51 2023 -0700 Merge tag 'fs_for_v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull misc filesystem updates from Jan Kara: - Rewrite kmap_local() handling in ext2 - Convert ext2 direct IO path to iomap (with some infrastructure tweaks associated with that) - Convert two boilerplate licenses in udf to SPDX identifiers - Other small udf, ext2, and quota fixes and cleanups * tag 'fs_for_v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: Fix uninitialized array access for some pathnames ext2: Drop fragment support quota: fix warning in dqgrab() quota: Properly disable quotas when add_dquot_ref() fails fs: udf: udftime: Replace LGPL boilerplate with SPDX identifier fs: udf: Replace GPL 2.0 boilerplate license notice with SPDX identifier fs: Drop wait_unfrozen wait queue ext2_find_entry()/ext2_dotdot(): callers don't need page_addr anymore ext2_{set_link,delete_entry}(): don't bother with page_addr ext2_put_page(): accept any pointer within the page ext2_get_page(): saner type ext2: use offset_in_page() instead of open-coding it as subtraction ext2_rename(): set_link and delete_entry may fail ext2: Add direct-io trace points ext2: Move direct-io to use iomap ext2: Use generic_buffers_fsync() implementation ext4: Use generic_buffers_fsync_noflush() implementation fs/buffer.c: Add generic_buffers_fsync*() implementation ext2/dax: Fix ext2_setsize when len is page aligned commit 18c9901d7435b20b13357907bac2c0e3b0fd4cd6 Merge: 0a37714f96d57 7b8c9d7bb4570 Author: Linus Torvalds Date: Thu Jun 29 13:31:44 2023 -0700 Merge tag 'fsnotify_for_v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: - Support for fanotify events returning file handles for filesystems not exportable via NFS - Improved error handling exportfs functions - Add missing FS_OPEN events when unusual open helpers are used * tag 'fsnotify_for_v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fsnotify: move fsnotify_open() hook into do_dentry_open() exportfs: check for error return value from exportfs_encode_*() fanotify: support reporting non-decodeable file handles exportfs: allow exporting non-decodeable file handles to userspace exportfs: add explicit flag to request non-decodeable file handles exportfs: change connectable argument to bit flags commit 0a37714f96d5746268dc09bdd400a215f180ba9b Merge: 9e06150d3c04d fc4ea4229c2b2 Author: Linus Torvalds Date: Thu Jun 29 13:27:50 2023 -0700 Merge tag 'dlm-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: "The dlm posix lock handling (for gfs2) has three notable changes: - Local pids returned from GETLK are no longer negated. A previous patch negating remote pids mistakenly changed local pids also. - SETLKW operations can now be interrupted only when the process is killed, and not from other signals. General interruption was resulting in previously acquired locks being cleared, not just the in-progress lock. Handling this correctly will require extending a cancel capability to user space (a future feature.) - If multiple threads are requesting posix locks (with SETLKW), fix incorrect matching of results to the requests. The dlm networking has several minor cleanups, and one notable change: - Avoid delaying ack messages for too long (used for message reliability), resulting in a backlog of un-acked messages. These could previously be delayed as a result of either too many or too few other messages being sent. Now an upper and lower threshold is used to determine when an ack should be sent" * tag 'dlm-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: fs: dlm: remove filter local comms on close fs: dlm: add send ack threshold and append acks to msgs fs: dlm: handle sequence numbers as atomic fs: dlm: handle lkb wait count as atomic_t fs: dlm: filter ourself midcomms calls fs: dlm: warn about messages from left nodes fs: dlm: move dlm_purge_lkb_callbacks to user module fs: dlm: cleanup STOP_IO bitflag set when stop io fs: dlm: don't check othercon twice fs: dlm: unregister memory at the very last fs: dlm: fix missing pending to false fs: dlm: clear pending bit when queue was empty fs: dlm: revert check required context while close fs: dlm: fix mismatch of plock results from userspace fs: dlm: make F_SETLK use unkillable wait_event fs: dlm: interrupt posix locks only when process is killed fs: dlm: fix cleanup pending ops when interrupted fs: dlm: return positive pid value for F_GETLK dlm: Replace all non-returning strlcpy with strscpy commit 9e06150d3c04d1a5028a485263912ea892545d2f Merge: 53ea167b212f6 c3b880acadc95 Author: Linus Torvalds Date: Thu Jun 29 13:23:32 2023 -0700 Merge tag 'xfs-6.5-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Darrick Wong: "There's not much going on this cycle -- the large extent counts feature graduated, so now users can create more extremely fragmented files! :P The rest are bug fixes; and I'll be sending more next week. - Fix a problem where shrink would blow out the space reserve by declining to shrink the filesystem - Drop the EXPERIMENTAL tag for the large extent counts feature - Set FMODE_CAN_ODIRECT and get rid of an address space op - Fix an AG count overflow bug in growfs if the new device size is redonkulously large" * tag 'xfs-6.5-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix ag count overflow during growfs xfs: set FMODE_CAN_ODIRECT instead of a dummy direct_IO method xfs: drop EXPERIMENTAL tag for large extent counts xfs: don't deplete the reserve pool when trying to shrink the fs commit 53ea167b212f675e40420498e46fa31553b406ac Merge: b9d02c224d00a 2ef6c32a914b8 Author: Linus Torvalds Date: Thu Jun 29 13:18:36 2023 -0700 Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "Various cleanups and bug fixes in ext4's extent status tree, journalling, and block allocator subsystems. Also improve performance for parallel DIO overwrites" * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (55 commits) ext4: avoid updating the superblock on a r/o mount if not needed jbd2: skip reading super block if it has been verified ext4: fix to check return value of freeze_bdev() in ext4_shutdown() ext4: refactoring to use the unified helper ext4_quotas_off() ext4: turn quotas off if mount failed after enabling quotas ext4: update doc about journal superblock description ext4: add journal cycled recording support jbd2: continue to record log between each mount jbd2: remove j_format_version jbd2: factor out journal initialization from journal_get_superblock() jbd2: switch to check format version in superblock directly jbd2: remove unused feature macros ext4: ext4_put_super: Remove redundant checking for 'sbi->s_journal_bdev' ext4: Fix reusing stale buffer heads from last failed mounting ext4: allow concurrent unaligned dio overwrites ext4: clean up mballoc criteria comments ext4: make ext4_zeroout_es() return void ext4: make ext4_es_insert_extent() return void ext4: make ext4_es_insert_delayed_block() return void ext4: make ext4_es_remove_extent() return void ... commit b9d02c224d00a412d9c7fb1f92c358604038a783 Merge: be3c213150dc4 95e2b352c03b0 Author: Linus Torvalds Date: Thu Jun 29 13:10:32 2023 -0700 Merge tag 'jfs-6.5' of github.com:kleikamp/linux-shaggy Pull jfs updates from David Kleikamp: "Minor bug fixes and cleanups" * tag 'jfs-6.5' of github.com:kleikamp/linux-shaggy: FS: JFS: Check for read-only mounted filesystem in txBegin FS: JFS: Fix null-ptr-deref Read in txBegin fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev fs: jfs: (trivial) Fix typo in dbInitTree function jfs: jfs_dmap: Validate db_l2nbperpage while mounting commit be3c213150dc4370ef211a78d78457ff166eba4e Merge: eee9c708cc89b 62149a745eee0 Author: Linus Torvalds Date: Thu Jun 29 13:01:27 2023 -0700 Merge tag 'ovl-update-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs Pull overlayfs update from Amir Goldstein: - fix two NULL pointer deref bugs (Zhihao Cheng) - add support for "data-only" lower layers destined to be used by composefs - port overlayfs to the new mount api (Christian Brauner) * tag 'ovl-update-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs: (26 commits) ovl: add Amir as co-maintainer ovl: reserve ability to reconfigure mount options with new mount api ovl: modify layer parameter parsing ovl: port to new mount api ovl: factor out ovl_parse_options() helper ovl: store enum redirect_mode in config instead of a string ovl: pass ovl_fs to xino helpers ovl: clarify ovl_get_root() semantics ovl: negate the ofs->share_whiteout boolean ovl: check type and offset of struct vfsmount in ovl_entry ovl: implement lazy lookup of lowerdata in data-only layers ovl: prepare for lazy lookup of lowerdata inode ovl: prepare to store lowerdata redirect for lazy lowerdata lookup ovl: implement lookup in data-only layers ovl: introduce data-only lower layers ovl: remove unneeded goto instructions ovl: deduplicate lowerdata and lowerstack[] ovl: deduplicate lowerpath and lowerstack[] ovl: move ovl_entry into ovl_inode ovl: factor out ovl_free_entry() and ovl_stack_*() helpers ... commit eee9c708cc89b4600c6e6cdda5bc2b8b4dad96cb Author: Linus Torvalds Date: Thu Jun 29 12:36:47 2023 -0700 gup: avoid stack expansion warning for known-good case In commit a425ac5365f6 ("gup: add warning if some caller would seem to want stack expansion") I added a temporary warning to catch any strange GUP users that would be impacted by the fact that GUP no longer extends the stack. But it turns out that the warning is most easily triggered through __access_remote_vm(), that already knows to expand the stack - it just does it *after* calling GUP. So the warning is easy to trigger by just running gdb (or similar) and accessing things remotely under the stack. This just adds a temporary extra "expand stack early" to avoid the warning for the already converted case - not because the warning is bad, but because getting the warning for this known good case would then hide any subsequent warnings for any actually interesting cases. Let's try to remember to revert this change when we remove the warnings. Signed-off-by: Linus Torvalds commit 5b4a82a0724af1dfd1320826e0266117b6a57fbd Author: Benjamin Coddington Date: Tue Jun 27 14:31:49 2023 -0400 Revert "NFSv4: Retry LOCK on OLD_STATEID during delegation return" Olga Kornievskaia reports that this patch breaks NFSv4.0 state recovery. It also introduces additional complexity in the error paths for cases not related to the original problem. Let's revert it for now, and address the original problem in another manner. This reverts commit f5ea16137a3fa2858620dc9084466491c128535f. Fixes: f5ea16137a3f ("NFSv4: Retry LOCK on OLD_STATEID during delegation return") Reported-by: Kornievskaia, Olga Signed-off-by: Benjamin Coddington Signed-off-by: Trond Myklebust commit e901f17b0742e36c9d79885a912b666cc1deb210 Author: Benjamin Coddington Date: Tue Jun 27 06:12:11 2023 -0400 NFS: Don't cleanup sysfs superblock entry if uninitialized Its possible to end up in nfs_free_server() before the server's superblock sysfs entry has been initialized, in which case calling kobject_put() will emit a WARNING. Check if the kobject has been initialized before cleaning it up. Fixes: 1c7251187dc0 ("NFS: add superblock sysfs entries") Reported-by: Nathan Chancellor Tested-by: Nathan Chancellor Signed-off-by: Benjamin Coddington Signed-off-by: Trond Myklebust commit 48538ccb825b05544ec308a509e2cc9c013402db Author: Nick Child Date: Wed Jun 28 13:22:44 2023 -0500 ibmvnic: Do not reset dql stats on NON_FATAL err All ibmvnic resets, make a call to netdev_tx_reset_queue() when re-opening the device. netdev_tx_reset_queue() resets the num_queued and num_completed byte counters. These stats are used in Byte Queue Limit (BQL) algorithms. The difference between these two stats tracks the number of bytes currently sitting on the physical NIC. ibmvnic increases the number of queued bytes though calls to netdev_tx_sent_queue() in the drivers xmit function. When, VIOS reports that it is done transmitting bytes, the ibmvnic device increases the number of completed bytes through calls to netdev_tx_completed_queue(). It is important to note that the driver batches its transmit calls and num_queued is increased every time that an skb is added to the next batch, not necessarily when the batch is sent to VIOS for transmission. Unlike other reset types, a NON FATAL reset will not flush the sub crq tx buffers. Therefore, it is possible for the batched skb array to be partially full. So if there is call to netdev_tx_reset_queue() when re-opening the device, the value of num_queued (0) would not account for the skb's that are currently batched. Eventually, when the batch is sent to VIOS, the call to netdev_tx_completed_queue() would increase num_completed to a value greater than the num_queued. This causes a BUG_ON crash: ibmvnic 30000002: Firmware reports error, cause: adapter problem. Starting recovery... ibmvnic 30000002: tx error 600 ibmvnic 30000002: tx error 600 ibmvnic 30000002: tx error 600 ibmvnic 30000002: tx error 600 ------------[ cut here ]------------ kernel BUG at lib/dynamic_queue_limits.c:27! Oops: Exception in kernel mode, sig: 5 [....] NIP dql_completed+0x28/0x1c0 LR ibmvnic_complete_tx.isra.0+0x23c/0x420 [ibmvnic] Call Trace: ibmvnic_complete_tx.isra.0+0x3f8/0x420 [ibmvnic] (unreliable) ibmvnic_interrupt_tx+0x40/0x70 [ibmvnic] __handle_irq_event_percpu+0x98/0x270 ---[ end trace ]--- Therefore, do not reset the dql stats when performing a NON_FATAL reset. Fixes: 0d973388185d ("ibmvnic: Introduce xmit_more support using batched subCRQ hcalls") Signed-off-by: Nick Child Signed-off-by: Jakub Kicinski commit 915057ae79692d47f9fb3504785855be49abaea4 Author: Martin Habets Date: Wed Jun 28 13:32:20 2023 +0100 sfc: support for devlink port requires MAE access On systems without MAE permission efx->mae is not initialised, and trying to lookup an mport results in a NULL pointer dereference. Fixes: 25414b2a64ae ("sfc: add devlink port support for ef100") Signed-off-by: Martin Habets Reviewed-by: Jacob Keller Signed-off-by: Jakub Kicinski commit 1b722407a13b7f8658d2e26917791f32805980a2 Merge: f8824e151fbfa 5ff2977b19769 Author: Linus Torvalds Date: Thu Jun 29 11:00:17 2023 -0700 Merge tag 'drm-next-2023-06-29' of git://anongit.freedesktop.org/drm/drm Pull drm updates from Dave Airlie: "There is one set of patches to misc for a i915 gsc/mei proxy driver. Otherwise it's mostly amdgpu/i915/msm, lots of hw enablement and lots of refactoring. core: - replace strlcpy with strscpy - EDID changes to support further conversion to struct drm_edid - Move i915 DSC parameter code to common DRM helpers - Add Colorspace functionality aperture: - ignore framebuffers with non-primary devices fbdev: - use fbdev i/o helpers - add Kconfig options for fb_ops helpers - use new fb io helpers directly in drivers sysfs: - export DRM connector ID scheduler: - Avoid an infinite loop ttm: - store function table in .rodata - Add query for TTM mem limit - Add NUMA awareness to pools - Export ttm_pool_fini() bridge: - fsl-ldb: support i.MX6SX - lt9211, lt9611: remove blanking packets - tc358768: implement input bus formats, devm cleanups - ti-snd65dsi86: implement wait_hpd_asserted - analogix: fix endless probe loop - samsung-dsim: support swapped clock, fix enabling, support var clock - display-connector: Add support for external power supply - imx: Fix module linking - tc358762: Support reset GPIO panel: - nt36523: Support Lenovo J606F - st7703: Support Anbernic RG353V-V2 - InnoLux G070ACE-L01 support - boe-tv101wum-nl6: Improve initialization - sharp-ls043t1le001: Mode fixes - simple: BOE EV121WXM-N10-1850, S6D7AA0 - Ampire AM-800480L1TMQW-T00H - Rocktech RK043FN48H - Starry himax83102-j02 - Starry ili9882t amdgpu: - add new ctx query flag to handle reset better - add new query/set shadow buffer for rdna3 - DCN 3.2/3.1.x/3.0.x updates - Enable DC_FP on loongarch - PCIe fix for RDNA2 - improve DC FAMS/SubVP support for better power management - partition support for lots of engines - Take NUMA into account when allocating memory - Add new DRM_AMDGPU_WERROR config parameter to help with CI - Initial SMU13 overdrive support - Add support for new colorspace KMS API - W=1 fixes amdkfd: - Query TTM mem limit rather than hardcoding it - GC 9.4.3 partition support - Handle NUMA for partitions - Add debugger interface for enabling gdb - Add KFD event age tracking radeon: - Fix possible UAF i915: - new getparam for PXP support - GSC/MEI proxy driver - Meteorlake display enablement - avoid clearing preallocated framebuffers with TTM - implement framebuffer mmap support - Disable sampler indirect state in bindless heap - Enable fdinfo for GuC backends - GuC loading and firmware table handling fixes - Various refactors for multi-tile enablement - Define MOCS and PAT tables for MTL - GSC/MEI support for Meteorlake - PMU multi-tile support - Large driver kernel doc cleanup - Allow VRR toggling and arbitrary refresh rates - Support async flips on linear buffers on display ver 12+ - Expose CRTC CTM property on ILK/SNB/VLV - New debugfs for display clock frequencies - Hotplug refactoring - Display refactoring - I915_GEM_CREATE_EXT_SET_PAT for Mesa on Meteorlake - Use large rings for compute contexts - HuC loading for MTL - Allow user to set cache at BO creation - MTL powermanagement enhancements - Switch to dedicated workqueues to stop using flush_scheduled_work() - Move display runtime init under display/ - Remove 10bit gamma on desktop gen3 parts, they don't support it habanalabs: - uapi: return 0 for user queries if there was a h/w or f/w error - Add pci health check when we lose connection with the firmware. This can be used to distinguish between pci link down and firmware getting stuck. - Add more info to the error print when TPC interrupt occur. - Firmware fixes msm: - Adreno A660 bindings - SM8350 MDSS bindings fix - Added support for DPU on sm6350 and sm6375 platforms - Implemented tearcheck support to support vsync on SM150 and newer platforms - Enabled missing features (DSPP, DSC, split display) on sc8180x, sc8280xp, sm8450 - Added support for DSI and 28nm DSI PHY on MSM8226 platform - Added support for DSI on sm6350 and sm6375 platforms - Added support for display controller on MSM8226 platform - A690 GPU support - Move cmdstream dumping out of fence signaling path - a610 support - Support for a6xx devices without GMU nouveau: - NULL ptr before deref fixes armada: - implement fbdev emulation as client sun4i: - fix mipi-dsi dotclock - release clocks vc4: - rgb range toggle property - BT601 / BT2020 HDMI support vkms: - convert to drmm helpers - add reflection and rotation support - fix rgb565 conversion gma500: - fix iomem access shmobile: - support renesas soc platform - enable fbdev mxsfb: - Add support for i.MX93 LCDIF stm: - dsi: Use devm_ helper - ltdc: Fix potential invalid pointer deref renesas: - Group drivers in renesas subdirectory to prepare for new platform - Drop deprecated R-Car H3 ES1.x support meson: - Add support for MIPI DSI displays virtio: - add sync object support mediatek: - Add display binding document for MT6795" * tag 'drm-next-2023-06-29' of git://anongit.freedesktop.org/drm/drm: (1791 commits) drm/i915: Fix a NULL vs IS_ERR() bug drm/i915: make i915_drm_client_fdinfo() reference conditional again drm/i915/huc: Fix missing error code in intel_huc_init() drm/i915/gsc: take a wakeref for the proxy-init-completion check drm/msm/a6xx: Add A610 speedbin support drm/msm/a6xx: Add A619_holi speedbin support drm/msm/a6xx: Use adreno_is_aXYZ macros in speedbin matching drm/msm/a6xx: Use "else if" in GPU speedbin rev matching drm/msm/a6xx: Fix some A619 tunables drm/msm/a6xx: Add A610 support drm/msm/a6xx: Add support for A619_holi drm/msm/adreno: Disable has_cached_coherent in GMU wrapper configurations drm/msm/a6xx: Introduce GMU wrapper support drm/msm/a6xx: Move CX GMU power counter enablement to hw_init drm/msm/a6xx: Extend and explain UBWC config drm/msm/a6xx: Remove both GBIF and RBBM GBIF halt on hw init drm/msm/a6xx: Add a helper for software-resetting the GPU drm/msm/a6xx: Improve a6xx_bus_clear_pending_transactions() drm/msm/a6xx: Move a6xx_bus_clear_pending_transactions to a6xx_gpu drm/msm/a6xx: Move force keepalive vote removal to a6xx_gmu_force_off() ... commit 56f66ce1fd41c8eb063b550581d664af1e576b55 Merge: 046f753da6143 2be22f1941d5f Author: Jakub Kicinski Date: Thu Jun 29 10:49:38 2023 -0700 Merge branch 'bluetooth-fixes-from-next' Cherry-pick what looks like safe fixes from the bluetooth net-next PR. The other changes will have to wait for 6.6 Link: https://lore.kernel.org/all/20230627191004.2586540-1-luiz.dentz@gmail.com/ Signed-off-by: Jakub Kicinski commit 2be22f1941d5f661aa8043261d1bae5b6696c749 Author: Luiz Augusto von Dentz Date: Tue Jun 20 15:41:11 2023 -0700 Bluetooth: hci_event: Fix parsing of CIS Established Event The ISO Interval on CIS Established Event uses 1.25 ms slots: BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2304: Time = N * 1.25 ms In addition to that this always update the QoS settings based on CIS Established Event. Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit 5b6d345d1b65d67624349e5de22227492c637576 Author: Jiapeng Chong Date: Sun Jun 25 16:45:13 2023 +0800 Bluetooth: hci_conn: Use kmemdup() to replace kzalloc + memcpy Use kmemdup rather than duplicating its implementation. ./net/bluetooth/hci_conn.c:1880:7-14: WARNING opportunity for kmemdup. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=5597 Signed-off-by: Jiapeng Chong Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit fa01eba11f0e57c767a5eab5291c7a01407a00be Author: Matthew Anderson Date: Sat Jun 24 12:08:10 2023 -0500 Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally Adding the device ID from the Asus Ally gets the bluetooth working on the device. Signed-off-by: Matthew Anderson Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit d40d6f52d5bbbd7aa7092ba9fa793ad7dc253a35 Author: Ivan Orlov Date: Tue Jun 20 16:40:52 2023 +0200 Bluetooth: hci_sysfs: make bt_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the bt_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at load time. Cc: Marcel Holtmann Cc: Johan Hedberg Cc: Luiz Augusto von Dentz Cc: linux-bluetooth@vger.kernel.org Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Signed-off-by: Greg Kroah-Hartman Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit 14f0dceca60b2fc4f2388505b25f9e6f71785e05 Author: Luiz Augusto von Dentz Date: Thu Jun 8 11:12:18 2023 -0700 Bluetooth: ISO: Rework sync_interval to be sync_factor This rework sync_interval to be sync_factor as having sync_interval in the order of seconds is sometimes not disarable. Wit sync_factor the application can tell how many SDU intervals it wants to send an announcement with PA, the EA interval is set to 2 times that so a factor of 24 of BIG SDU interval of 10ms would look like the following: < HCI Command: LE Set Extended Advertising Parameters (0x08|0x0036) plen 25 Handle: 0x01 Properties: 0x0000 Min advertising interval: 480.000 msec (0x0300) Max advertising interval: 480.000 msec (0x0300) Channel map: 37, 38, 39 (0x07) Own address type: Random (0x01) Peer address type: Public (0x00) Peer address: 00:00:00:00:00:00 (OUI 00-00-00) Filter policy: Allow Scan Request from Any, Allow Connect Request from Any (0x00) TX power: Host has no preference (0x7f) Primary PHY: LE 1M (0x01) Secondary max skip: 0x00 Secondary PHY: LE 2M (0x02) SID: 0x00 Scan request notifications: Disabled (0x00) < HCI Command: LE Set Periodic Advertising Parameters (0x08|0x003e) plen 7 Handle: 1 Min interval: 240.00 msec (0x00c0) Max interval: 240.00 msec (0x00c0) Properties: 0x0000 Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit 73f55453ea5236a586a7f1b3d5e2ee051d655351 Author: Luiz Augusto von Dentz Date: Wed Jun 7 12:33:47 2023 -0700 Bluetooth: MGMT: Fix marking SCAN_RSP as not connectable When receiving a scan response there is no way to know if the remote device is connectable or not, so when it cannot be merged don't make any assumption and instead just mark it with a new flag defined as MGMT_DEV_FOUND_SCAN_RSP so userspace can tell it is a standalone SCAN_RSP. Link: https://lore.kernel.org/linux-bluetooth/CABBYNZ+CYMsDSPTxBn09Js3BcdC-x7vZFfyLJ3ppZGGwJKmUTw@mail.gmail.com/ Fixes: c70a7e4cc8d2 ("Bluetooth: Add support for Not Connectable flag for Device Found events") Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit db9cbcadc16e8b9f0b3ef5870f3a38ebafcbe8e0 Author: Pauli Virtanen Date: Sat Jun 3 00:28:12 2023 +0300 Bluetooth: hci_event: fix Set CIG Parameters error status handling If the event has error status, return right error code and don't show incorrect "response malformed" messages. Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit 6b9545dc9f8ff01d8bc1229103960d9cd265343f Author: Pauli Virtanen Date: Thu Jun 1 09:34:43 2023 +0300 Bluetooth: ISO: use hci_sync for setting CIG parameters When reconfiguring CIG after disconnection of the last CIS, LE Remove CIG shall be sent before LE Set CIG Parameters. Otherwise, it fails because CIG is in the inactive state and not configurable (Core v5.3 Vol 6 Part B Sec. 4.5.14.3). This ordering is currently wrong under suitable timing conditions, because LE Remove CIG is sent via the hci_sync queue and may be delayed, but Set CIG Parameters is via hci_send_cmd. Make the ordering well-defined by sending also Set CIG Parameters via hci_sync. Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections") Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit 56b7f325db139c9255b1eb1d1e741576d5f8fa34 Author: Johan Hovold Date: Fri Jun 2 10:19:12 2023 +0200 Bluetooth: hci_bcm: do not mark valid bd_addr as invalid A recent commit restored the original (and still documented) semantics for the HCI_QUIRK_USE_BDADDR_PROPERTY quirk so that the device address is considered invalid unless an address is provided by firmware. This specifically means that this flag must only be set for devices with invalid addresses, but the Broadcom driver has so far been setting this flag unconditionally. Fortunately the driver already checks for invalid addresses during setup and sets the HCI_QUIRK_INVALID_BDADDR flag. Use this flag to indicate when the address can be overridden by firmware (long term, this should probably just always be allowed). Fixes: 6945795bc81a ("Bluetooth: fix use-bdaddr-property quirk") Reported-by: Marek Szyprowski Link: https://lore.kernel.org/lkml/ecef83c8-497f-4011-607b-a63c24764867@samsung.com Signed-off-by: Johan Hovold Tested-by: Marek Szyprowski Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit 1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 Author: Sungwoo Kim Date: Wed May 31 01:39:56 2023 -0400 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb l2cap_sock_release(sk) frees sk. However, sk's children are still alive and point to the already free'd sk's address. To fix this, l2cap_sock_release(sk) also cleans sk's children. ================================================================== BUG: KASAN: use-after-free in l2cap_sock_ready_cb+0xb7/0x100 net/bluetooth/l2cap_sock.c:1650 Read of size 8 at addr ffff888104617aa8 by task kworker/u3:0/276 CPU: 0 PID: 276 Comm: kworker/u3:0 Not tainted 6.2.0-00001-gef397bd4d5fb-dirty #59 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci2 hci_rx_work Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x72/0x95 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x175/0x478 mm/kasan/report.c:417 kasan_report+0xb1/0x130 mm/kasan/report.c:517 l2cap_sock_ready_cb+0xb7/0x100 net/bluetooth/l2cap_sock.c:1650 l2cap_chan_ready+0x10e/0x1e0 net/bluetooth/l2cap_core.c:1386 l2cap_config_req+0x753/0x9f0 net/bluetooth/l2cap_core.c:4480 l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5739 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:6509 [inline] l2cap_recv_frame+0xe2e/0x43c0 net/bluetooth/l2cap_core.c:7788 l2cap_recv_acldata+0x6ed/0x7e0 net/bluetooth/l2cap_core.c:8506 hci_acldata_packet net/bluetooth/hci_core.c:3813 [inline] hci_rx_work+0x66e/0xbc0 net/bluetooth/hci_core.c:4048 process_one_work+0x4ea/0x8e0 kernel/workqueue.c:2289 worker_thread+0x364/0x8e0 kernel/workqueue.c:2436 kthread+0x1b9/0x200 kernel/kthread.c:376 ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308 Allocated by task 288: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0x82/0x90 mm/kasan/common.c:383 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slab_common.c:968 [inline] __kmalloc+0x5a/0x140 mm/slab_common.c:981 kmalloc include/linux/slab.h:584 [inline] sk_prot_alloc+0x113/0x1f0 net/core/sock.c:2040 sk_alloc+0x36/0x3c0 net/core/sock.c:2093 l2cap_sock_alloc.constprop.0+0x39/0x1c0 net/bluetooth/l2cap_sock.c:1852 l2cap_sock_create+0x10d/0x220 net/bluetooth/l2cap_sock.c:1898 bt_sock_create+0x183/0x290 net/bluetooth/af_bluetooth.c:132 __sock_create+0x226/0x380 net/socket.c:1518 sock_create net/socket.c:1569 [inline] __sys_socket_create net/socket.c:1606 [inline] __sys_socket_create net/socket.c:1591 [inline] __sys_socket+0x112/0x200 net/socket.c:1639 __do_sys_socket net/socket.c:1652 [inline] __se_sys_socket net/socket.c:1650 [inline] __x64_sys_socket+0x40/0x50 net/socket.c:1650 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 288: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:523 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free mm/kasan/common.c:200 [inline] __kasan_slab_free+0x10a/0x190 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook mm/slub.c:1807 [inline] slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0x88/0x1f0 mm/slub.c:3800 sk_prot_free net/core/sock.c:2076 [inline] __sk_destruct+0x347/0x430 net/core/sock.c:2168 sk_destruct+0x9c/0xb0 net/core/sock.c:2183 __sk_free+0x82/0x220 net/core/sock.c:2194 sk_free+0x7c/0xa0 net/core/sock.c:2205 sock_put include/net/sock.h:1991 [inline] l2cap_sock_kill+0x256/0x2b0 net/bluetooth/l2cap_sock.c:1257 l2cap_sock_release+0x1a7/0x220 net/bluetooth/l2cap_sock.c:1428 __sock_release+0x80/0x150 net/socket.c:650 sock_close+0x19/0x30 net/socket.c:1368 __fput+0x17a/0x5c0 fs/file_table.c:320 task_work_run+0x132/0x1c0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x113/0x120 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x21/0x50 kernel/entry/common.c:296 do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc The buggy address belongs to the object at ffff888104617800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 680 bytes inside of 1024-byte region [ffff888104617800, ffff888104617c00) The buggy address belongs to the physical page: page:00000000dbca6a80 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888104614000 pfn:0x104614 head:00000000dbca6a80 order:2 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0 flags: 0x200000000010200(slab|head|node=0|zone=2) raw: 0200000000010200 ffff888100041dc0 ffffea0004212c10 ffffea0004234b10 raw: ffff888104614000 0000000000080002 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888104617980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888104617a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888104617a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888104617b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888104617b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Ack: This bug is found by FuzzBT with a modified Syzkaller. Other contributors are Ruoyu Wu and Hui Peng. Signed-off-by: Sungwoo Kim Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit 6945795bc81ab7be22750ecfb365056688f2fada Author: Johan Hovold Date: Wed May 31 11:04:24 2023 +0200 Bluetooth: fix use-bdaddr-property quirk Devices that lack persistent storage for the device address can indicate this by setting the HCI_QUIRK_INVALID_BDADDR which causes the controller to be marked as unconfigured until user space has set a valid address. The related HCI_QUIRK_USE_BDADDR_PROPERTY was later added to similarly indicate that the device lacks a valid address but that one may be specified in the devicetree. As is clear from commit 7a0e5b15ca45 ("Bluetooth: Add quirk for reading BD_ADDR from fwnode property") that added and documented this quirk and commits like de79a9df1692 ("Bluetooth: btqcomsmd: use HCI_QUIRK_USE_BDADDR_PROPERTY"), the device address of controllers with this flag should be treated as invalid until user space has had a chance to configure the controller in case the devicetree property is missing. As it does not make sense to allow controllers with invalid addresses, restore the original semantics, which also makes sure that the implementation is consistent (e.g. get_missing_options() indicates that the address must be set) and matches the documentation (including comments in the code, such as, "In case any of them is set, the controller has to start up as unconfigured."). Fixes: e668eb1e1578 ("Bluetooth: hci_core: Don't stop BT if the BD address missing in dts") Signed-off-by: Johan Hovold Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit 0cb7365850bacb8c2a9975cae672d65714d8daa1 Author: Johan Hovold Date: Wed May 31 11:04:23 2023 +0200 Bluetooth: fix invalid-bdaddr quirk for non-persistent setup Devices that lack persistent storage for the device address can indicate this by setting the HCI_QUIRK_INVALID_BDADDR which causes the controller to be marked as unconfigured until user space has set a valid address. Once configured, the device address must be set on every setup for controllers with HCI_QUIRK_NON_PERSISTENT_SETUP to avoid marking the controller as unconfigured and requiring the address to be set again. Fixes: 740011cfe948 ("Bluetooth: Add new quirk for non-persistent setup settings") Signed-off-by: Johan Hovold Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit f752a0b334bb95fe9b42ecb511e0864e2768046f Author: Zhengping Jiang Date: Wed May 24 17:04:15 2023 -0700 Bluetooth: L2CAP: Fix use-after-free Fix potential use-after-free in l2cap_le_command_rej. Signed-off-by: Zhengping Jiang Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit 8153b738bc547878a017889d2b1cf8dd2de0e0c6 Author: Min-Hua Chen Date: Fri May 19 18:43:23 2023 +0800 Bluetooth: btqca: use le32_to_cpu for ver.soc_id Use le32_to_cpu for ver.soc_id to fix the following sparse warning. drivers/bluetooth/btqca.c:640:24: sparse: warning: restricted __le32 degrades to integer Signed-off-by: Min-Hua Chen Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit 022b6101c28a33fa8073b284423b88dc46b03d87 Author: Dan Gora Date: Tue May 9 12:45:24 2023 -0700 Bluetooth: btusb: Add device 6655:8771 to device tables This device is an Inspire branded BT 5.1 USB dongle with a Realtek RTL8761BU chip using the "Best Buy China" vendor ID. The device table is as follows: T: Bus=01 Lev=01 Prnt=02 Port=09 Cnt=01 Dev#= 7 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=6655 ProdID=8771 Rev=02.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00E04C239987 C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms Signed-off-by: Dan Gora Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit bb23f07cb63975968bbabe314486e2b087234fc5 Author: Dan Gora Date: Tue May 9 12:51:19 2023 -0700 Bluetooth: btrtl: Add missing MODULE_FIRMWARE declarations Add missing MODULE_FIRMWARE declarations for firmware referenced in btrtl.c. Signed-off-by: Dan Gora Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski commit f8824e151fbfa0ac0a258015d606ea6f4a10251b Merge: 86e203edf24bb d6048fdc87024 Author: Linus Torvalds Date: Thu Jun 29 10:46:47 2023 -0700 Merge tag 'sound-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "Lots of changes as usual, but the only significant stuff in ALSA core part is the MIDI 2.0 support, while ASoC core kept receiving the code refactoring. The majority of changes are seen rather in device drivers, and quite a few new drivers can be found there. Here we go, some highlights: ALSA and ASoC Core: - Support of MIDI 2.0 devices: rawmidi and sequencer API have been extended for the support of the new UMP (Universal MIDI Packet) protocol, USB audio driver got the USB MIDI 2.0 interface support - Continued refactoring around ASoC DAI links and the ordering of trigger callbacks - PCM ABI extension for better drain support ASoC Drivers: - Conversions of many drivers to use maple tree based caches - Everlasting improvement works on ASoC Intel drivers - Compressed audio support for Qualcomm - Support for AMD SoundWire, Analog Devices SSM3515, Google Chameleon, Ingenic X1000, Intel systems with various CODECs, Loongson platforms, Maxim MAX98388, Mediatek MT8188, Nuvoton NAU8825C, NXP platforms with NAU8822, Qualcomm WSA884x, StarFive JH7110, Texas Instruments TAS2781 HD-audio: - Quirks for HP and ASUS machines - CS35L41 HD-audio codec fixes - Loongson HD-audio support Misc: - A new virtual PCM test driver for kselftests - Continued refactoring and improvements on the legacy emu10k1 driver" * tag 'sound-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (556 commits) ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on EliteBook ASoC: hdmi-codec: fix channel info for compressed formats ALSA: pcm: fix ELD constraints for (E)AC3, DTS(-HD) and MLP formats ASoC: core: Always store of_node when getting DAI link component ASoC: tas2781: Fix error code in tas2781_load_calibration() ASoC: amd: update pm_runtime enable sequence ALSA: ump: Export MIDI1 / UMP conversion helpers ASoC: tas2781: fix Kconfig dependencies ASoC: amd: acp: remove acp poweroff function ASoC: amd: acp: clear pdm dma interrupt mask ASoC: codecs: max98090: Allow dsp_a mode ASoC: qcom: common: add default jack dapm pins ASoC: loongson: fix address space confusion ASoC: dt-bindings: microchip,sama7g5-pdmc: Simplify "microchip,mic-pos" constraints ASoC: tegra: Remove stale comments in AHUB ASoC: tegra: Use normal system sleep for ASRC ALSA: hda/realtek: Add quirks for ROG ALLY CS35l41 audio ASoC: fsl-asoc-card: Allow passing the number of slots in use ASoC: codecs: wsa884x: Add WSA884x family of speakers ASoC: dt-bindings: qcom,wsa8840: Add WSA884x family of speakers ... commit 86e203edf24bb327ce8fcd3c5c8c6bf530a846df Merge: 0e382fa72bbf0 bf4ed21778f29 Author: Linus Torvalds Date: Thu Jun 29 10:29:46 2023 -0700 Merge tag 'input-for-v6.5-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - improvements to PS/2 handling for case when EC has already latched a scancode in the data register, but the kernel expects to receive an ACK to a command it sent to a device (such as keyboard LED toggle) - input drivers for devices connected over I2C bus have been switched back to using [new] .probe() - uinput allows userspace to inject timestamps for input events - support for capacitive keys in Atmel touch controller driver - assorted fixes to drv260x, pwm-vibra, ili210x, adxl34x, and other drivers * tag 'input-for-v6.5-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (40 commits) Input: pm8941-powerkey - fix debounce on gen2+ PMICs MAINTAINERS: Adjust Qualcomm driver globbing Input: gameport - provide default trigger() and read() Input: tps65219-pwrbutton - use regmap_set_bits() Input: tps65219-pwrbutton - convert to .remove_new() Input: tests - add test to cover all input_grab_device() function Input: gpio-keys - use input_report_key() Input: xpad - spelling fixes for "Xbox" Input: add HAS_IOPORT dependencies Input: libps2 - do not discard non-ack bytes when controlling LEDs Input: libps2 - introduce common interrupt handler Input: libps2 - fix aborting PS/2 commands Input: libps2 - fix NAK handling Input: libps2 - rework handling of command response Input: libps2 - remove special handling of ACK for command byte Input: libps2 - attach ps2dev instances as serio port's drvdata Input: Switch i2c drivers back to use .probe() dt-bindings: input: cypress,cyapa: convert to dtschema Input: adxl34x - do not hardcode interrupt trigger type Input: pwm-vibra - add support for enable GPIO ... commit 0e382fa72bbf0610be40af9af9b03b0cd149df82 Merge: 675285ad81929 b571809ec3b0a Author: Linus Torvalds Date: Thu Jun 29 10:24:40 2023 -0700 Merge tag 'for-linus-2023062701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - more bullet-proof handling of devres-managed resources in HID core (Dmitry Torokhov) - conversion of hid-wacom to use ktime_t (Jason Gerecke) - touch selftests for hid-wacom (Joshua Dickens) - support for nVidia Thunderstrike (SHIELD 2017) controller (Rahul Rameshbabu) - power management reset-during-suspend fix for goodix Chromebook devices (Fei Shao) - assorted device ID additions, device-specific quirks and code cleanups * tag 'for-linus-2023062701' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (27 commits) HID: wacom: Use ktime_t rather than int when dealing with timestamps HID: hidraw: fix data race on device refcount HID: intel-ish-hid: ipc: Add Arrow Lake PCI device ID HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651. HID: add quirk for 03f0:464a HP Elite Presenter Mouse HID: nvidia-shield: Support LED functionality for Thunderstrike HID: nvidia-shield: Add mappings for consumer HID USAGE buttons HID: nvidia-shield: Initial driver implementation with Thunderstrike support HID: apple: Option to swap only left side mod keys HID: uclogic: Modular KUnit tests should not depend on KUNIT=y HID: fix an error code in hid_check_device_match() HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL Keyboard HID: i2c-hid: Switch i2c drivers back to use .probe() HID: i2c-hid: goodix: Add support for "goodix,no-reset-during-suspend" property dt-bindings: input: goodix: Add "goodix,no-reset-during-suspend" property HID: microsoft: Add rumble support to latest xbox controllers selftests: hid: Add touch tests for Wacom devices HID: ensure timely release of driver-allocated resources HID: split apart hid_device_probe to make logic more apparent HID: amd_sfh: Split sensor and HID initialization for SFH1.1 ... commit 675285ad819293844018aa8096ba9a6d7c77b90b Merge: e5476f57b3262 c2d22806aecb2 Author: Linus Torvalds Date: Thu Jun 29 10:20:38 2023 -0700 Merge tag 'fbdev-for-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev updates from Helge Deller: "Some fbdev fixes & cleanups. Includes is a fix for a potential out-of-bound memory access in fast_imageblit() and the switch of the VIA fbdev driver to use GPIO descriptors. Summary: - fix potential OOB read in fast_imageblit() - fbdev/media: Use GPIO descriptors for VIA GPIO - broadsheetfb & metronomefb: Add MODULE_FIRMWARE macro - omapfb: error handling fix in mipid_spi_probe() - sh_mobile_lcdcfb, sh7760fb: Typo and warning fixes - hitfb: code cleanups" * tag 'fbdev-for-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: fix potential OOB read in fast_imageblit() MAINTAINERS: adjust entry in VIA UNICHROME(PRO)/CHROME9 FRAMEBUFFER DRIVER fbdev: sh7760fb: Fix -Wimplicit-fallthrough warnings fbdev: sh_mobile_lcdcfb: Fix ARGB32 overlay format typo fbdev: hitfb: Use NULL for pointers fbdev: hitfb: Fix integer-to-pointer cast fbdev/media: Use GPIO descriptors for VIA GPIO video/hdmi: Reorder fields in 'struct hdmi_avi_infoframe' fbdev: broadsheetfb: Add MODULE_FIRMWARE macro fbdev: metronomefb: Add MODULE_FIRMWARE macro fbdev: hitfb: Declare hitfb_blank() as static fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe() commit e5476f57b32621eb8eab892a908df4d0b4808835 Merge: ff7ddcf0db48a 0ff9f5e57c5bb Author: Linus Torvalds Date: Thu Jun 29 10:11:10 2023 -0700 Merge tag 'gpio-updates-for-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "We have two new drivers, some improvements to the core code, lots of different updates to existing GPIO drivers and some dt-bindings on top. There's nothing controversial in here and almost everything has been in next for more than a week (95% a lot longer than this). The only thing that has spent less time in next is a new driver so no risk of regressions. The single merge pulls in changes that remove all usage of global GPIO numbers from arch/arm/mach-omap. Core GPIO library: - remove unused symbols - don't spam the kernel log with messages about hogs - remove old sysfs API cruft - improve handling of GPIO masks New drivers: - add a driver for the BlueField-3 GPIO controller - add GPIO support for the TPS65219 PMIC Driver improvements: - extend the gpio-aggregator driver to support ramp-up/ramp-down delay - remove unnecessary CONFIG_OF guards from gpio-aggregator - readability improvements in gpio-tangier - switch i2c drivers back to using probe() now that it's been converted in the i2c subsystem to not taking the id parameter - remove unused inclusions of of_gpio.h in several drivers - make pm ops static in gpio-davinci and fix a comment - use more devres in drivers to shrink and simplify the code - add missing include in gpio-sa1100 - add HAS_IOPORT KConfig dependency where needed - add permissions checks before accessing pins in gpio-tegra186 - convert the gpio-zynq driver to using immutable irqchips - preserve output settings set by the bootloader in gpio-mpc8xxx Selftests: - tweak the variable naming in script tests Device tree updates: - convert gpio-mmio and gpio-stmpe to YAML - add parsing of GPIO hogs to gpio-vf610 - add bindings for the Cirrus EP93xx GPIO controller - add gpio-line-names property to the gpio-pca9570 bindings - extend the binding for x-powers,axp209 with another block" * tag 'gpio-updates-for-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (58 commits) of: unittest: drop assertions for GPIO hog messages gpiolib: Drop unused domain_ops memeber of GPIO IRQ chip gpio: synq: remove unused zynq_gpio_irq_reqres/zynq_gpio_irq_relres dt-bindings: gpio: gpio-vf610: Add parsing of hogs gpio: lpc18xx: Remove unused of_gpio.h inclusion gpio: xra1403: Remove unused of_gpio.h inclusion gpio: mpc8xxx: Remove unused of_gpio.h inclusion dt-bindings: gpio: Add Cirrus EP93xx gpio: mpc8xxx: latch GPIOs state on module load when configured as output selftests: gpio: gpio-sim: Use same variable name for sysfs pathname gpio: mlxbf3: Add gpio driver support gpio: delay: Remove duplicative functionality gpio: aggregator: Set up a parser of delay line parameters gpio: aggregator: Support delay for setting up individual GPIOs gpio: aggregator: Remove CONFIG_OF and of_match_ptr() protections dt-bindings: gpio: pca9570: add gpio-line-names property gpiolib: remove unused gpio_cansleep() gpio: tps65219: add GPIO support for TPS65219 PMIC gpio: zynq: fix zynqmp_gpio not an immutable chip warning gpio: davinci: make davinci_gpio_dev_pm_ops static ... commit ff7ddcf0db48a7d9ae536eb0875428117be1d1f1 Merge: acd1d46b0ddec b9a40506a2cb6 Author: Linus Torvalds Date: Thu Jun 29 10:05:47 2023 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "This batch of clk driver updates contains almost no new SoC support. Instead there's a treewide patch series from Maxime that makes clk_ops::determine_rate mandatory for muxes. Beyond that core framework change we have the usual pile of clk driver updates such as migrating i2c drivers to use .probe() again or YAMLfication of clk DT bindings so we can validate DTBs. Overall the SoCs that got the most updates this time around in terms of diffstat are the Amlogic and Mediatek drivers because they added new SoC support or fixed up various drivers to have proper data. In general things look kinda quiet. I suspect the core framework change may still shake out some problems after the merge window, mostly because not everyone tests linux-next where that series has been for some number of weeks. I saw that there's at least one pending fix for Tegra that needs to be wrapped up into a proper patch. I'll try to catch those bits before the window closes so that -rc1 is bootable. More details below. Core: - Make clk_ops::determine_rate mandatory for muxes New Drivers: - Add amlogic a1 SoC family PLL and peripheral clock controller support Updates: - Handle allocation failures from kasprintf() and friends - Migrate platform clk drivers to .remove_new() - Migrate i2c clk drivers to .probe() instead of .probe_new() - Remove CLK_SET_PARENT from all Mediatek MSDC core clocks - Add infra_ao reset support for Mediatek MT8188 SoCs - Align driver_data to i2c_device_id tables in some i2c clk drivers - Use device_get_match_data() in vc5 clk driver - New Kconfig symbol name (SOC_MICROCHIP_POLARFIRE) for Microchip FPGA clock drivers - Use of_property_read_bool() to read "microchip,pic32mzda-sosc" boolean DT property in clk-pic32mzda - Convert AT91 clock dt-bindings to YAML - Remove CLK_SET_RATE_PARENT flag from LDB clocks on i.MX6SX - Keep i.MX UART clocks enabled during kernel boot if earlycon is set - Drop imx_unregister_clocks() as there are no users anymore - Switch to _safe iterator on imx_clk_scu_unregister() to avoid use after free - Add determine_rate op to the imx8m composite clock - Use device managed API for iomap and kzalloc for i.MXRT1050, i.MX8MN, i.MX8MP and i.MX93 clock controller drivers - Add missing interrupt DT property for the i.MX8M clock controller - Re-add support for Exynos4212 clock controller because we are re-introducing the SoC in the mainline - Add CONFIG_OF dependency to Samsung clk Kconfig symbols to solve some objtool warnings - Preselect PLL MIPI as TCON0 parent for Allwinner A64 SoC - Convert the Renesas clock drivers to readl_poll_timeout_atomic() - Add PWM clock on Renesas R-Car V3U - Fix PLL5 on Renesas RZ/G2L and RZ/V2L" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (149 commits) clk: fix typo in clk_hw_register_fixed_rate_parent_data() macro clk: Fix memory leak in devm_clk_notifier_register() clk: mvebu: Iterate over possible CPUs instead of DT CPU nodes clk: mvebu: Use of_get_cpu_hwid() to read CPU ID MAINTAINERS: Add Marvell mvebu clock drivers clk: clocking-wizard: check return value of devm_kasprintf() clk: ti: clkctrl: check return value of kasprintf() clk: keystone: sci-clk: check return value of kasprintf() clk: si5341: free unused memory on probe failure clk: si5341: check return value of {devm_}kasprintf() clk: si5341: return error if one synth clock registration fails clk: cdce925: check return value of kasprintf() clk: vc5: check memory returned by kasprintf() clk: mediatek: clk-mt8173-apmixedsys: Fix iomap not released issue clk: mediatek: clk-mt8173-apmixedsys: Fix return value for of_iomap() error clk: mediatek: clk-mtk: Grab iomem pointer for divider clocks clk: keystone: syscon-clk: Add support for audio refclk dt-bindings: clock: Add binding documentation for TI Audio REFCLK dt-bindings: clock: ehrpwm: Remove unneeded syscon compatible clk: keystone: syscon-clk: Allow the clock node to not be of type syscon ... commit acd1d46b0ddec686d4170b2205bc08c88d5d4d74 Merge: e8c716bc68122 90fc660e8479c Author: Linus Torvalds Date: Thu Jun 29 10:01:25 2023 -0700 Merge tag 'hwmon-for-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "New drivers: - Driver for MAX31827 - Driver to support HP WMI Sensors Added support to existing drivers: - aht10: Support for AHT20 - aquacomputer_d5next: Support for Aquacomputer Leakshield - asus-ec-sensors: Support for ROG Crosshair X670E Hero - corsair-psu: Cleanups and support for series 2022 and 2023 - it87: Various improvements and support for IT8732F - nct6683: Support customer ID of some MSI boards. - nct6755: Support for NCT6799D - oxp-sensors: Various cleanups; support for AYANEO 2, Geek, OXP Mini, and AOKZOE A1 PRO - pmbus/max16601: Support for new revisions of MAX16508 - pmbus/adm1275: Disable ADC while updating PMON_CONFIG, and fix problems with temperature monitoring on ADM1272 - sht3x: Various cleanups; support for medium repeatability Other notable changes: - Switched regmap drivers to Maple tree support where appropriate Various other minor fixes and improvements" * tag 'hwmon-for-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (54 commits) hwmon: max31827: Switch back to use struct i2c_driver::probe hwmon: (oxp-sensors) Add support for AOKZOE A1 PRO hwmon: (corsair-psu) update Series 2022 and 2023 support hwmon: (corsair-psu) various cleanups hwmon: (corsair-psu) add support for reading PWM values and mode hwmon: (pmbus/adm1275) Disable ADC while updating PMON_CONFIG hwmon: (pmbus/adm1275) Prepare for protected write to PMON_CONFIG hwmon: (oxp-sensors) Simplify logic of error return hwmon: (oxp-sensors) Remove unused header hwmon: (nct6755) Add support for NCT6799D hwmon: (oxp-sensors) Add tt_toggle attribute on supported boards hwmon: (sht3x) complement sysfs interface for sts3x hwmon: (sht3x) Add new non-stardard sysfs attribute hwmon: (sht3x) add medium repeatability support hwmon: (sht3x)replace "high-precision" property to "repeatability" hwmon: (sht3x) remove blocking_io property hwmon: (sht3x) remove sht3x_platform_data hwmon: (pmbus/max16601) Add support for new revisions of MAX16508 Documentation/hwmon: Fix description of devm_hwmon_device_unregister() hwmon: (tmp464) Use maple tree register cache ... commit 046f753da6143ee16452966915087ec8b0de3c70 Author: Tobias Heider Date: Wed Jun 28 02:13:32 2023 +0200 Add MODULE_FIRMWARE() for FIRMWARE_TG357766. Fixes a bug where on the M1 mac mini initramfs-tools fails to include the necessary firmware into the initrd. Fixes: c4dab50697ff ("tg3: Download 57766 EEE service patch firmware") Signed-off-by: Tobias Heider Reviewed-by: Michael Chan Link: https://lore.kernel.org/r/ZJt7LKzjdz8+dClx@tobhe.de Signed-off-by: Jakub Kicinski commit e8c716bc6812202ccf4ce0f0bad3428b794fb39c Author: Hugh Dickins Date: Wed Jun 28 21:31:35 2023 -0700 mm/khugepaged: fix regression in collapse_file() There is no xas_pause(&xas) in collapse_file()'s main loop, at the points where it does xas_unlock_irq(&xas) and then continues. That would explain why, once two weeks ago and twice yesterday, I have hit the VM_BUG_ON_PAGE(page != xas_load(&xas), page) since "mm/khugepaged: fix iteration in collapse_file" removed the xas_set(&xas, index) just before it: xas.xa_node could be left pointing to a stale node, if there was concurrent activity on the file which transformed its xarray. I tried inserting xas_pause()s, but then even bootup crashed on that VM_BUG_ON_PAGE(): there appears to be a subtle "nextness" implicit in xas_pause(). xas_next() and xas_pause() are good for use in simple loops, but not in this one: xas_set() worked well until now, so use xas_set(&xas, index) explicitly at the head of the loop; and change that VM_BUG_ON_PAGE() not to need its own xas_set(), and not to interfere with the xa_state (which would probably stop the crashes from xas_pause(), but I trust that less). The user-visible effects of this bug (if VM_BUG_ONs are configured out) would be data loss and data leak - potentially - though in practice I expect it is more likely that a subsequent check (e.g. on mapping or on nr_none) would notice an inconsistency, and just abandon the collapse. Link: https://lore.kernel.org/linux-mm/f18e4b64-3f88-a8ab-56cc-d1f5f9c58d4@google.com/ Fixes: c8a8f3b4a95a ("mm/khugepaged: fix iteration in collapse_file") Signed-off-by: Hugh Dickins Cc: stable@kernel.org Cc: Andrew Morton Cc: Matthew Wilcox Cc: David Stevens Cc: Peter Xu Signed-off-by: Linus Torvalds commit 2bed0d82c2f78b91a0a9a5a73da57ee883a0c070 Author: Dave Chinner Date: Wed Jun 28 11:04:34 2023 -0700 xfs: fix bounds check in xfs_defer_agfl_block() Need to happen before we allocate and then leak the xefi. Found by coverity via an xfsprogs libxfs scan. [djwong: This also fixes the type of the @agbno argument.] Fixes: 7dfee17b13e5 ("xfs: validate block number being freed before adding to xefi") Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit edd8276dd70279c29d412d99b99c2c0cac1b2cdd Author: Dave Chinner Date: Wed Jun 28 19:43:55 2023 -0700 xfs: AGF length has never been bounds checked The AGF verifier does not check that the AGF length field is within known good bounds. This has never been checked by runtime kernel code (i.e. the lack of verification goes back to 1993) yet we assume in many places that it is correct and verify other metdata against it. Add length verification to the AGF verifier. The length of the AGF must be equal to the size of the AG specified in the superblock, unless it is the last AG in the filesystem. In that case, it must be less than or equal to sb->sb_agblocks and greater than XFS_MIN_AG_BLOCKS, which is the smallest AG a growfs operation will allow to exist. This requires a bit of rework of the verifier function. We want to verify metadata before we use it to verify other metadata. Hence we need to verify the AGF sequence numbers before using them to verify the length of the AGF. Then we can verify the AGF length before we verify AGFL fields. Then we can verifier other fields that are bounds limited by the AGF length. And, finally, by calculating agf_length only once into a local variable, we can collapse repeated "if (xfs_has_foo() &&" conditionaly checks into single checks. This makes the code much easier to follow as all the checks for a given feature are obviously in the same place. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit f1e1765aad7de7a8b8102044fc6a44684bc36180 Author: Dave Chinner Date: Wed Jun 28 11:04:33 2023 -0700 xfs: journal geometry is not properly bounds checked If the journal geometry results in a sector or log stripe unit validation problem, it indicates that we cannot set the log up to safely write to the the journal. In these cases, we must abort the mount because the corruption needs external intervention to resolve. Similarly, a journal that is too large cannot be written to safely, either, so we shouldn't allow those geometries to mount, either. If the log is too small, we risk having transaction reservations overruning the available log space and the system hanging waiting for space it can never provide. This is purely a runtime hang issue, not a corruption issue as per the first cases listed above. We abort mounts of the log is too small for V5 filesystems, but we must allow v4 filesystems to mount because, historically, there was no log size validity checking and so some systems may still be out there with undersized logs. The problem is that on V4 filesystems, when we discover a log geometry problem, we skip all the remaining checks and then allow the log to continue mounting. This mean that if one of the log size checks fails, we skip the log stripe unit check. i.e. we allow the mount because a "non-fatal" geometry is violated, and then fail to check the hard fail geometries that should fail the mount. Move all these fatal checks to the superblock verifier, and add a new check for the two log sector size geometry variables having the same values. This will prevent any attempt to mount a log that has invalid or inconsistent geometries long before we attempt to mount the log. However, for the minimum log size checks, we can only do that once we've setup up the log and calculated all the iclog sizes and roundoffs. Hence this needs to remain in the log mount code after the log has been initialised. It is also the only case where we should allow a v4 filesystem to continue running, so leave that handling in place, too. Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 8ebbf262d4684e035af5e7aa2a71cab636673a9b Author: Dave Chinner Date: Wed Jun 28 11:04:33 2023 -0700 xfs: don't block in busy flushing when freeing extents If the current transaction holds a busy extent and we are trying to allocate a new extent to fix up the free list, we can deadlock if the AG is entirely empty except for the busy extent held by the transaction. This can occur at runtime processing an XEFI with multiple extents in this path: __schedule+0x22f at ffffffff81f75e8f schedule+0x46 at ffffffff81f76366 xfs_extent_busy_flush+0x69 at ffffffff81477d99 xfs_alloc_ag_vextent_size+0x16a at ffffffff8141711a xfs_alloc_ag_vextent+0x19b at ffffffff81417edb xfs_alloc_fix_freelist+0x22f at ffffffff8141896f xfs_free_extent_fix_freelist+0x6a at ffffffff8141939a __xfs_free_extent+0x99 at ffffffff81419499 xfs_trans_free_extent+0x3e at ffffffff814a6fee xfs_extent_free_finish_item+0x24 at ffffffff814a70d4 xfs_defer_finish_noroll+0x1f7 at ffffffff81441407 xfs_defer_finish+0x11 at ffffffff814417e1 xfs_itruncate_extents_flags+0x13d at ffffffff8148b7dd xfs_inactive_truncate+0xb9 at ffffffff8148bb89 xfs_inactive+0x227 at ffffffff8148c4f7 xfs_fs_destroy_inode+0xb8 at ffffffff81496898 destroy_inode+0x3b at ffffffff8127d2ab do_unlinkat+0x1d1 at ffffffff81270df1 do_syscall_64+0x40 at ffffffff81f6b5f0 entry_SYSCALL_64_after_hwframe+0x44 at ffffffff8200007c This can also happen in log recovery when processing an EFI with multiple extents through this path: context_switch() kernel/sched/core.c:3881 __schedule() kernel/sched/core.c:5111 schedule() kernel/sched/core.c:5186 xfs_extent_busy_flush() fs/xfs/xfs_extent_busy.c:598 xfs_alloc_ag_vextent_size() fs/xfs/libxfs/xfs_alloc.c:1641 xfs_alloc_ag_vextent() fs/xfs/libxfs/xfs_alloc.c:828 xfs_alloc_fix_freelist() fs/xfs/libxfs/xfs_alloc.c:2362 xfs_free_extent_fix_freelist() fs/xfs/libxfs/xfs_alloc.c:3029 __xfs_free_extent() fs/xfs/libxfs/xfs_alloc.c:3067 xfs_trans_free_extent() fs/xfs/xfs_extfree_item.c:370 xfs_efi_recover() fs/xfs/xfs_extfree_item.c:626 xlog_recover_process_efi() fs/xfs/xfs_log_recover.c:4605 xlog_recover_process_intents() fs/xfs/xfs_log_recover.c:4893 xlog_recover_finish() fs/xfs/xfs_log_recover.c:5824 xfs_log_mount_finish() fs/xfs/xfs_log.c:764 xfs_mountfs() fs/xfs/xfs_mount.c:978 xfs_fs_fill_super() fs/xfs/xfs_super.c:1908 mount_bdev() fs/super.c:1417 xfs_fs_mount() fs/xfs/xfs_super.c:1985 legacy_get_tree() fs/fs_context.c:647 vfs_get_tree() fs/super.c:1547 do_new_mount() fs/namespace.c:2843 do_mount() fs/namespace.c:3163 ksys_mount() fs/namespace.c:3372 __do_sys_mount() fs/namespace.c:3386 __se_sys_mount() fs/namespace.c:3383 __x64_sys_mount() fs/namespace.c:3383 do_syscall_64() arch/x86/entry/common.c:296 entry_SYSCALL_64() arch/x86/entry/entry_64.S:180 To avoid this deadlock, we should not block in xfs_extent_busy_flush() if we hold a busy extent in the current transaction. Now that the EFI processing code can handle requeuing a partially completed EFI, we can detect this situation in xfs_extent_busy_flush() and return -EAGAIN rather than going to sleep forever. The -EAGAIN get propagated back out to the xfs_trans_free_extent() context, where the EFD is populated and the transaction is rolled, thereby moving the busy extents into the CIL. At this point, we can retry the extent free operation again with a clean transaction. If we hit the same "all free extents are busy" situation when trying to fix up the free list, we can safely call xfs_extent_busy_flush() and wait for the busy extents to resolve and wake us. At this point, the allocation search can make progress again and we can fix up the free list. This deadlock was first reported by Chandan in mid-2021, but I couldn't make myself understood during review, and didn't have time to fix it myself. It was reported again in March 2023, and again I have found myself unable to explain the complexities of the solution needed during review. As such, I don't have hours more time to waste trying to get the fix written the way it needs to be written, so I'm just doing it myself. This patchset is largely based on Wengang Wang's last patch, but with all the unnecessary stuff removed, split up into multiple patches and cleaned up somewhat. Reported-by: Chandan Babu R Reported-by: Wengang Wang Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 0853b5de42b471a92f4ff128a8757b87427d2431 Author: Dave Chinner Date: Wed Jun 28 11:04:33 2023 -0700 xfs: allow extent free intents to be retried Extent freeing neeeds to be able to avoid a busy extent deadlock when the transaction itself holds the only busy extents in the allocation group. This may occur if we have an EFI that contains multiple extents to be freed, and the freeing the second intent requires the space the first extent free released to expand the AGFL. If we block on the busy extent at this point, we deadlock. We hold a dirty transaction that contains a entire atomic extent free operations within it, so if we can abort the extent free operation and commit the progress that we've made, the busy extent can be resolved by a log force. Hence we can restart the aborted extent free with a new transaction and continue to make progress without risking deadlocks. To enable this, we need the EFI processing code to be able to handle an -EAGAIN error to tell it to commit the current transaction and retry again. This mechanism is already built into the defer ops processing (used bythe refcount btree modification intents), so there's relatively little handling we need to add to the EFI code to enable this. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Reviewed-by: Chandan Babu R commit 6a2a9d776c4ae24a797e25eed2b9f7f33f756296 Author: Dave Chinner Date: Wed Jun 28 11:04:32 2023 -0700 xfs: pass alloc flags through to xfs_extent_busy_flush() To avoid blocking in xfs_extent_busy_flush() when freeing extents and the only busy extents are held by the current transaction, we need to pass the XFS_ALLOC_FLAG_FREEING flag context all the way into xfs_extent_busy_flush(). Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Reviewed-by: Chandan Babu R commit b742d7b4f0e03df25c2a772adcded35044b625ca Author: Dave Chinner Date: Wed Jun 28 11:04:32 2023 -0700 xfs: use deferred frees for btree block freeing Btrees that aren't freespace management trees use the normal extent allocation and freeing routines for their blocks. Hence when a btree block is freed, a direct call to xfs_free_extent() is made and the extent is immediately freed. This puts the entire free space management btrees under this path, so we are stacking btrees on btrees in the call stack. The inobt, finobt and refcount btrees all do this. However, the bmap btree does not do this - it calls xfs_free_extent_later() to defer the extent free operation via an XEFI and hence it gets processed in deferred operation processing during the commit of the primary transaction (i.e. via intent chaining). We need to change xfs_free_extent() to behave in a non-blocking manner so that we can avoid deadlocks with busy extents near ENOSPC in transactions that free multiple extents. Inserting or removing a record from a btree can cause a multi-level tree merge operation and that will free multiple blocks from the btree in a single transaction. i.e. we can call xfs_free_extent() multiple times, and hence the btree manipulation transaction is vulnerable to this busy extent deadlock vector. To fix this, convert all the remaining callers of xfs_free_extent() to use xfs_free_extent_later() to queue XEFIs and hence defer processing of the extent frees to a context that can be safely restarted if a deadlock condition is detected. Signed-off-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Reviewed-by: Chandan Babu R commit 939bd50dfbe7c17d958a62208e8b584442759bf5 Author: Dave Chinner Date: Wed Jun 28 11:04:31 2023 -0700 xfs: don't reverse order of items in bulk AIL insertion XFS has strict metadata ordering requirements. One of the things it does is maintain the commit order of items from transaction commit through the CIL and into the AIL. That is, if a transaction logs item A before item B in a modification, then they will be inserted into the CIL in the order {A, B}. These items are then written into the iclog during checkpointing in the order {A, B}. When the checkpoint commits, they are supposed to be inserted into the AIL in the order {A, B}, and when they are pushed from the AIL, they are pushed in the order {A, B}. If we crash, log recovery then replays the two items from the checkpoint in the order {A, B}, resulting in the objects the items apply to being queued for writeback at the end of the checkpoint in the order {A, B}. This means recovery behaves the same way as the runtime code. In places, we have subtle dependencies on this ordering being maintained. One of this place is performing intent recovery from the log. It assumes that recovering an intent will result in a non-intent object being the first thing that is modified in the recovery transaction, and so when the transaction commits and the journal flushes, the first object inserted into the AIL beyond the intent recovery range will be a non-intent item. It uses the transistion from intent items to non-intent items to stop the recovery pass. A recent log recovery issue indicated that an intent was appearing as the first item in the AIL beyond the recovery range, hence breaking the end of recovery detection that exists. Tracing indicated insertion of the items into the AIL was apparently occurring in the right order (the intent was last in the commit item list), but the intent was appearing first in the AIL. IOWs, the order of items in the AIL was {D,C,B,A}, not {A,B,C,D}, and bulk insertion was reversing the order of the items in the batch of items being inserted. Lucky for us, all the items fed to bulk insertion have the same LSN, so the reversal of order does not affect the log head/tail tracking that is based on the contents of the AIL. It only impacts on code that has implicit, subtle dependencies on object order, and AFAICT only the intent recovery loop is impacted by it. Make sure bulk AIL insertion does not reorder items incorrectly. Fixes: 0e57f6a36f9b ("xfs: bulk AIL insertion during transaction commit") Signed-off-by: Dave Chinner Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Reviewed-by: Chandan Babu R commit 347eb95b27eb97bebdc3ea7de23558216f4e2c90 Author: Colin Ian King Date: Wed Jun 28 10:59:37 2023 -0700 xfs: remove redundant initializations of pointers drop_leaf and save_leaf Pointers drop_leaf and save_leaf are initialized with values that are never read, they are being re-assigned later on just before they are used. Remove the redundant early initializations and keep the later assignments at the point where they are used. Cleans up two clang scan build warnings: fs/xfs/libxfs/xfs_attr_leaf.c:2288:29: warning: Value stored to 'drop_leaf' during its initialization is never read [deadcode.DeadStores] fs/xfs/libxfs/xfs_attr_leaf.c:2289:29: warning: Value stored to 'save_leaf' during its initialization is never read [deadcode.DeadStores] Signed-off-by: Colin Ian King Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 447a0bc108e4bae4c1ea845aacf43c10c28814e8 Author: Christoph Hellwig Date: Thu Jun 29 09:22:51 2023 -0700 iomap: drop me [hch] from MAINTAINERS for iomap As Darrick prefers to micro-manage this without looking at my input for code I wrote and then complain about getting burned out by that I might as well drop myself from the maintainers file. [djwong: and I don't like it when you all bikeshed a single-patch submission to the point that new bugs are being introduced in the scope creep that wasn't part of V1-V7!] Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 302efbef9d77a170a94dd81f4076814142dc5a31 Author: Lu Hongfei Date: Thu Jun 29 09:22:50 2023 -0700 fs: iomap: Change the type of blocksize from 'int' to 'unsigned int' in iomap_file_buffered_write_punch_delalloc The return value type of i_blocksize() is 'unsigned int', so the type of blocksize has been modified from 'int' to 'unsigned int' to ensure data type consistency. Signed-off-by: Lu Hongfei Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong commit 61986a58bc6abbb1aea26e52bd269f49e5bacf19 Author: Shyam Prasad N Date: Tue Jun 27 06:22:20 2023 +0000 cifs: new dynamic tracepoint to track ses not found errors It is perfectly valid to not find session not found errors when a reconnect of a session happens when requests for the same session are happening in parallel. We had these log messages as VFS logs. My last change dumped these logs as FYI logs. This change just creates a new dynamic tracepoint to capture events of this type, just in case it is useful while debugging issues in the future. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit ac615db03ba508d42d240612262f21f2e5836b67 Author: Shyam Prasad N Date: Tue Jun 20 02:56:06 2023 +0000 cifs: log session id when a matching ses is not found We do not log the session id in crypt_setup when a matching session is not found. Printing the session id helps debugging here. This change does just that. This change also changes this log to FYI, since it is normal to see then during a reconnect. Doing the same for a similar log in case of signed connections. The plan is to have a tracepoint for this event, so that we will be able to see this event if need be. That will be done as another change. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 0914e4d3cda853471a72b2c26a516c7619658b87 Author: Arnd Bergmann Date: Wed May 17 14:47:53 2023 +0200 kdb: include kdb_private.h for function prototypes The kdb_kbd_cleanup_state() is called from another file through the kdb_private.h file, but that is not included before the definition, causing a W=1 warning: kernel/debug/kdb/kdb_keyboard.c:198:6: error: no previous prototype for 'kdb_kbd_cleanup_state' [-Werror=missing-prototypes] Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230517124802.929751-1-arnd@kernel.org Signed-off-by: Daniel Thompson commit a587b046ce921cc1805de6f0f000209b3644cadd Author: Guenter Roeck Date: Thu Jun 29 01:30:47 2023 -0700 cdrom/gdrom: Fix build error Commit 7ae24fcee992 ("cdrom: remove the unused mode argument to cdrom_release") was supposed to remove an unused argument from cdrom_release(). but instead removed a used argument from cdrom_open(). This results in the following build error. drivers/cdrom/gdrom.c: In function 'gdrom_bdops_open': drivers/cdrom/gdrom.c:484:15: error: too few arguments to function 'cdrom_open' drivers/cdrom/gdrom.c: In function 'gdrom_bdops_release': drivers/cdrom/gdrom.c:492:35: error: 'mode' undeclared Fix it up. Fixes: 7ae24fcee992 ("cdrom: remove the unused mode argument to cdrom_release") Cc: Christoph Hellwig Cc: Phillip Potter Cc: Hannes Reinecke Cc: Christian Brauner Cc: Jens Axboe Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/20230629083047.3487172-1-linux@roeck-us.net Signed-off-by: Jens Axboe commit 8117f948f12bc559edf40916e7693512c8c9a50b Author: Douglas Anderson Date: Thu Jun 1 14:31:50 2023 -0700 kgdb: Provide a stub kgdb_nmicallback() if !CONFIG_KGDB To save architectures from needing to wrap the call in #ifdefs, add a stub no-op version of kgdb_nmicallback(), which returns 1 if it didn't handle anything. Reviewed-by: Daniel Thompson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20230601143109.v9.6.Ia3aeac89bb6751b682237e76e5ba594318e4b1aa@changeid Signed-off-by: Daniel Thompson commit 5ee35c769663cb1c5f26e12cad84904dc3002de8 Author: Tiezhu Yang Date: Thu Jun 29 20:58:44 2023 +0800 LoongArch: Remove five DIE_* definitions in kdebug.h For now, DIE_PAGE_FAULT, DIE_BREAK, DIE_SSTEPBP, DIE_UPROBE and DIE_UPROBE_XOL are not used by any code, remove them. Tested-by: Jeff Xie Suggested-by: Youling Tang Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 19bc6cb6409289106d38f9ad1b2ecf73980df6b5 Author: Tiezhu Yang Date: Thu Jun 29 20:58:44 2023 +0800 LoongArch: Add uprobes support Uprobes is the user-space counterpart to kprobes, this patch adds uprobes support for LoongArch. Here is a simple example with CONFIG_UPROBE_EVENTS=y: # cat test.c #include int add(int a, int b) { return a + b; } int main() { return add(2, 7); } # gcc test.c -o /tmp/test # nm /tmp/test | grep add 0000000120004194 T add # cd /sys/kernel/debug/tracing # echo > uprobe_events # echo "p:myuprobe /tmp/test:0x4194 %r4 %r5" > uprobe_events # echo "r:myuretprobe /tmp/test:0x4194 %r4" >> uprobe_events # echo 1 > events/uprobes/enable # echo 1 > tracing_on # /tmp/test # cat trace ... # TASK-PID CPU# ||||| TIMESTAMP FUNCTION # | | | ||||| | | test-1060 [001] DNZff 1015.770620: myuprobe: (0x120004194) arg1=0x2 arg2=0x7 test-1060 [001] DNZff 1015.770930: myuretprobe: (0x1200041f0 <- 0x120004194) arg1=0x9 Tested-by: Jeff Xie Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 6e320363339b585a36bf40d74592db3db021e017 Author: Tiezhu Yang Date: Thu Jun 29 20:58:44 2023 +0800 LoongArch: Use larch_insn_gen_break() for kprobes For now, we can use larch_insn_gen_break() to define KPROBE_BP_INSN and KPROBE_SSTEPBP_INSN. Because larch_insn_gen_break() returns instruction word, define kprobe_opcode_t as u32, then do some small changes related with type conversion, no functional change intended. Tested-by: Jeff Xie Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 49ed320da5f52ec729e7f2f9edbc6e79848455bd Author: Tiezhu Yang Date: Thu Jun 29 20:58:44 2023 +0800 LoongArch: Add larch_insn_gen_break() to generate break insns There exist various break insns such as BRK_KPROBE_BP, BRK_KPROBE_SSTEPBP, BRK_UPROBE_BP and BRK_UPROBE_XOLBP, add larch_insn_gen_break() to generate break insns simpler, this is preparation for later patch. Tested-by: Jeff Xie Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit b82fad4d5deb2c2a15fdb581a1e6725dcea666e7 Author: Tiezhu Yang Date: Thu Jun 29 20:58:44 2023 +0800 LoongArch: Check for AMO instructions in insns_not_supported() Like llsc instructions, the atomic memory access instructions shouldn't be supported for probing, so check for them in insns_not_supported(). Closes: https://lore.kernel.org/all/SY4P282MB351877A70A0333C790FE85A5C09C9@SY4P282MB3518.AUSP282.PROD.OUTLOOK.COM/ Tested-by: Jeff Xie Reported-by: Hengqi Chen Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 3d2c3daf82544283c5597028a8a3efc9ac0fb02b Author: Tiezhu Yang Date: Thu Jun 29 20:58:44 2023 +0800 LoongArch: Move three functions from kprobes.c to inst.c The three functions insns_not_supported(), insns_need_simulation() and arch_simulate_insn() will be used for uprobes, move them from kprobes.c to inst.c, this is preparation for later patch, no functionality change. Tested-by: Jeff Xie Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 7b0a096436c2dac6de77d132e751a8a3328798d5 Author: Haoran Jiang Date: Thu Jun 29 20:58:44 2023 +0800 LoongArch: Replace kretprobe with rethook This is an adaptation of commit f3a112c0c40d ("x86,rethook,kprobes: Replace kretprobe with rethook on x86") and commit b57c2f124098 ("riscv: add riscv rethook implementation") to LoongArch. Mainly refer to commit b57c2f124098 ("riscv: add riscv rethook implementation"). Replaces the kretprobe code with rethook on LoongArch. With this patch, kretprobe on LoongArch uses the rethook instead of kretprobe specific trampoline code. Signed-off-by: Haoran Jiang Signed-off-by: Huacai Chen commit f02644e32c9e4bd1a9b286dc0b84f9cbe294f4e2 Author: Youling Tang Date: Thu Jun 29 20:58:44 2023 +0800 LoongArch: Add jump-label implementation Add support for jump labels based on the ARM64 version. Acked-by: Peter Zijlstra (Intel) Signed-off-by: Youling Tang Signed-off-by: Huacai Chen commit 5d553770409de4a98a8c4f8c014559725dcfaa37 Author: Tiezhu Yang Date: Thu Jun 29 20:58:44 2023 +0800 LoongArch: Select HAVE_DEBUG_KMEMLEAK to support kmemleak We can see that DEBUG_KMEMLEAK depends on HAVE_DEBUG_KMEMLEAK after commit b69ec42b1b19 ("Kconfig: clean up the long arch list for the DEBUG_KMEMLEAK config option"), just select HAVE_DEBUG_KMEMLEAK to support kmemleak on LoongArch. Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 31f1a8b0ec66cf21d83807243c3a54469a7018c3 Author: Yinbo Zhu Date: Thu Jun 29 20:58:44 2023 +0800 LoongArch: Export some arch-specific pm interfaces Some PMC (Power Management Controllers) need to support DTS and will use the suspend interfaces thus this patch was to export such interfaces for their use. Signed-off-by: Yinbo Zhu Signed-off-by: Huacai Chen commit 01158487af60cd3915e8c31924144caf29cb0767 Author: Huacai Chen Date: Thu Jun 29 20:58:44 2023 +0800 LoongArch: Introduce hardware page table walker Loongson-3A6000 and newer processors have hardware page table walker (PTW) support. PTW can handle all fastpaths of TLBI/TLBL/TLBS/TLBM exceptions by hardware, software only need to handle slowpaths (page faults). BTW, PTW doesn't append _PAGE_MODIFIED for page table entries, so we change pmd_dirty() and pte_dirty() to also check _PAGE_DIRTY for the "dirty" attribute. Signed-off-by: Liang Gao Signed-off-by: Jun Yi Signed-off-by: Huacai Chen commit e031a5f3f1eddb961a6ded8a21ab8189d8760860 Author: Huacai Chen Date: Thu Jun 29 20:58:44 2023 +0800 LoongArch: Support dbar with different hints Traditionally, LoongArch uses "dbar 0" (full completion barrier) for everything. But the full completion barrier is a performance killer, so Loongson-3A6000 and newer processors have made finer granularity hints available: Bit4: ordering or completion (0: completion, 1: ordering) Bit3: barrier for previous read (0: true, 1: false) Bit2: barrier for previous write (0: true, 1: false) Bit1: barrier for succeeding read (0: true, 1: false) Bit0: barrier for succeeding write (0: true, 1: false) Hint 0x700: barrier for "read after read" from the same address, which is needed by LL-SC loops on old models (dbar 0x700 behaves the same as nop if such reordering is disabled on new models). This patch makes use of the various new hints for different kinds of memory barriers. It brings performance improvements on Loongson-3A6000 series, while not affecting the existing models because all variants are treated as 'dbar 0' there. Why override queued_spin_unlock()? After commit 01e3b958efe85a26d9b ("drivers: Remove explicit invocations of mmiowb()") we need a completion barrier in queued_spin_unlock(), but the generic implementation use smp_store_release() which only provide an ordering barrier. Signed-off-by: Jun Yi Signed-off-by: Huacai Chen commit f6f0c9a74a48448583c3cb0f3f067bc3fe0f13c6 Author: Huacai Chen Date: Thu Jun 29 20:58:43 2023 +0800 LoongArch: Add SMT (Simultaneous Multi-Threading) support Loongson-3A6000 has SMT (Simultaneous Multi-Threading) support, each physical core has two logical cores (threads). This patch add SMT probe and scheduler support via ACPI PPTT. If SCHED_SMT enabled, Loongson-3A6000 is treated as 4 cores, 8 threads; If SCHED_SMT disabled, Loongson-3A6000 is treated as 8 cores, 8 threads. Remove smp_num_siblings to support HMP (Heterogeneous Multi-Processing). Signed-off-by: Liupu Wang Signed-off-by: Huacai Chen commit 616500232e632dba8b03981eeccadacf2fbf1c30 Author: Huacai Chen Date: Thu Jun 29 20:58:43 2023 +0800 LoongArch: Add vector extensions support Add LoongArch's vector extensions support, which including 128bit LSX (i.e., Loongson SIMD eXtension) and 256bit LASX (i.e., Loongson Advanced SIMD eXtension). Linux kernel doesn't use vector itself, it only handle exceptions and context save/restore. So it only needs a subset of these instructions: * Vector load/store: vld vst vldx vstx xvld xvst xvldx xvstx * 8bit-elements move: vpickve2gr.b xvpickve2gr.b vinsgr2vr.b xvinsgr2vr.b * 16bit-elements move: vpickve2gr.h xvpickve2gr.h vinsgr2vr.h xvinsgr2vr.h * 32bit-elements move: vpickve2gr.w xvpickve2gr.w vinsgr2vr.w xvinsgr2vr.w * 64bit-elements move: vpickve2gr.d xvpickve2gr.d vinsgr2vr.d xvinsgr2vr.d * Elements permute: vpermi.w vpermi.d xvpermi.w xvpermi.d xvpermi.q Introduce AS_HAS_LSX_EXTENSION and AS_HAS_LASX_EXTENSION to avoid non- vector toolchains complains unsupported instructions. Signed-off-by: Huacai Chen commit aa5e65dc0818bbf676bf06927368ec46867778fd Author: Tiezhu Yang Date: Thu Jun 29 20:58:43 2023 +0800 LoongArch: Add support to clone a time namespace We can see that "Time namespaces are not supported" on LoongArch: (1) clone3 test # cd tools/testing/selftests/clone3 && make && ./clone3 ... # Time namespaces are not supported ok 18 # SKIP Skipping clone3() with CLONE_NEWTIME # Totals: pass:17 fail:0 xfail:0 xpass:0 skip:1 error:0 (2) timens test # cd tools/testing/selftests/timens && make && ./timens ... 1..0 # SKIP Time namespaces are not supported On LoongArch the current kernel does not support CONFIG_TIME_NS which depends on GENERIC_VDSO_TIME_NS, select GENERIC_VDSO_TIME_NS to enable CONFIG_TIME_NS to build kernel/time/namespace.c. Additionally, it needs to define some arch-dependent functions for the timens, such as __arch_get_timens_vdso_data(), arch_get_vdso_data() and vdso_join_timens(). At the same time, modify the layout of vvar to use one page size for generic vdso data, expand another page size for timens vdso data and assign LOONGARCH_VDSO_DATA_SIZE (maybe exceeds a page size if expand in the future) for loongarch vdso data, at last add the callback function vvar_fault() and modify stack_top(). With this patch under CONFIG_TIME_NS: (1) clone3 test # cd tools/testing/selftests/clone3 && make && ./clone3 ... ok 18 [739] Result (0) matches expectation (0) # Totals: pass:18 fail:0 xfail:0 xpass:0 skip:0 error:0 (2) timens test # cd tools/testing/selftests/timens && make && ./timens ... # Totals: pass:10 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 65eea6b44a5dd332c50390fdaeda7e197802c484 Author: WANG Xuerui Date: Thu Jun 29 20:58:43 2023 +0800 Makefile: Add loongarch target flag for Clang compilation The LoongArch kernel is 64-bit and built with the soft-float ABI, hence the loongarch64-linux-gnusf target. (The "libc" part can affect the codegen of libcalls: other arches do not use a bare-metal target, and currently the only fully supported libc on LoongArch is glibc anyway.) See: https://lore.kernel.org/loongarch/CAKwvOdnimxv8oJ4mVY74zqtt1x7KTMrWvn2_T9x22SFDbU6rHQ@mail.gmail.com/ Reviewed-by: Nick Desaulniers Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 5a31ed4678e0b09f8c4c8b2e711c6cc112082dd4 Author: WANG Xuerui Date: Thu Jun 29 20:58:43 2023 +0800 LoongArch: Mark Clang LTO as working Confirmed working with QEMU system emulation. Acked-by: Nick Desaulniers Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 5ddc7a3794ddd3470635ebd325fa1dffea5b18c0 Author: WANG Xuerui Date: Thu Jun 29 20:58:43 2023 +0800 LoongArch: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation This is a port of commit 08f6554ff90e ("mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation") to arch/loongarch, for fixing cross-compilation of Linux/LoongArch with Clang, where previously the `--target` flag would no longer be present for the CHECKFLAGS cc invocation leading to build failure. Reported-by: Nathan Chancellor Reviewed-by: Nathan Chancellor Link: https://github.com/ClangBuiltLinux/linux/issues/1787#issuecomment-1608306002 Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit b89673a91a31710a4a957114b0195cfd45feb122 Author: WANG Xuerui Date: Thu Jun 29 20:58:43 2023 +0800 LoongArch: vDSO: Use CLANG_FLAGS instead of filtering out '--target=' This is a port of commit 76d7fff22be3e ("MIPS: VDSO: Use CLANG_FLAGS instead of filtering out '--target='") to arch/loongarch, for fixing cross-compilation with Clang. Reported-by: Nathan Chancellor Reviewed-by: Nathan Chancellor Link: https://github.com/ClangBuiltLinux/linux/issues/1787#issuecomment-1608306002 Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 38b10b269d04540aee05c34a059dcf304cfce0a8 Author: WANG Xuerui Date: Thu Jun 29 20:58:43 2023 +0800 LoongArch: Tweak CFLAGS for Clang compatibility Now the arch code is mostly ready for LLVM/Clang consumption, it is time to re-organize the CFLAGS a little to actually enable the LLVM build. Namely, all -G0 switches from CFLAGS are removed, and -mexplicit-relocs and -mdirect-extern-access are now wrapped with cc-option (with the related asm/percpu.h definition guarded against toolchain combos that are known to not work). A build with !RELOCATABLE && !MODULE is confirmed working within a QEMU environment; support for the two features are currently blocked on LLVM/Clang, and will come later. Why -G0 can be removed: In GCC, -G stands for "small data threshold", that instructs the compiler to put data smaller than the specified threshold in a dedicated "small data" section (called .sdata on LoongArch and several other arches). However, benefiting from this would require ABI cooperation, which is not the case for LoongArch; and current GCC behave the same whether -G0 (equal to disabling this optimization) is given or not. So, remove -G0 from CFLAGS altogether for one less thing to care about. This also benefits LLVM/Clang compatibility where the -G switch is not supported. Why -mexplicit-relocs can now be conditionally applied without regressions: Originally -mexplicit-relocs is unconditionally added to CFLAGS in case of CONFIG_AS_HAS_EXPLICIT_RELOCS, because not having it (i.e. old GCC + new binutils) would not work: modules will have R_LARCH_ABS_* relocs inside, but given the rarity of such toolchain combo in the wild, it may not be worthwhile to support it, so support for such relocs in modules were not added back when explicit relocs support was upstreamed, and -mexplicit-relocs is unconditionally added to fail the build early. Now that Clang compatibility is desired, given Clang is behaving like -mexplicit-relocs from day one but without support for the CLI flag, we must ensure the flag is not passed in case of Clang. However, explicit compiler flavor checks can be more brittle than feature detection: in this case what actually matters is support for __attribute__((model)) when building modules. Given neither older GCC nor current Clang support this attribute, probing for the attribute support and #error'ing out would allow proper UX without checking for Clang, and also automatically work when Clang support for the attribute is to be added in the future. Why -mdirect-extern-access is now conditionally applied: This is actually a nice-to-have optimization that can reduce GOT accesses, but not having it is harmless either. Because Clang does not support the option currently, but might do so in the future, conditional application via cc-option ensures compatibility with both current and future Clang versions. Suggested-by: Xi Ruoyao # cc-option changes Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 83d8b38967d253942d9172b0c4d69b7d844d5f06 Author: WANG Xuerui Date: Thu Jun 29 20:58:43 2023 +0800 LoongArch: Simplify the invtlb wrappers The invtlb instruction has been supported by upstream LoongArch toolchains from day one, so ditch the raw opcode trickery and just use plain inline asm for it. While at it, also make the invtlb asm statements barriers, for proper modeling of the side effects. The functions are also marked as __always_inline instead of just "inline", because they cannot work at all if not inlined: the op argument will not be compile-time const in that case, thus failing to satisfy the "i" constraint. The signature of the other more specific invtlb wrappers contain unused arguments right now, but these are not removed right away in order for the patch to be focused. In the meantime, assertions are added to ensure no accidental misuse happens before the refactor. (The more specific wrappers cannot re-use the generic invtlb wrapper, because the ISA manual says $zero shall be used in case a particular op does not take the respective argument: re-using the generic wrapper would mean losing control over the register usage.) Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 53a4858ccd0d27538f9ab1ac2bead002fca97edc Author: WANG Xuerui Date: Thu Jun 29 20:58:43 2023 +0800 LoongArch: Make the CPUCFG&CSR ops simple aliases of compiler built-ins In addition to less visual clutter, this also makes Clang happy regarding the const-ness of arguments. In the original approach, all Clang gets to see is the incoming arguments whose const-ness cannot be proven without first being inlined; so Clang errors out here while GCC is fine. While at it, tweak several printk format strings because the return type of csr_read64 becomes effectively unsigned long, instead of unsigned long long. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 38bb46f94544c5385bc35aa2bfc776dcf53a7b5d Author: WANG Xuerui Date: Thu Jun 29 20:58:43 2023 +0800 LoongArch: Prepare for assemblers with proper FCSR class support The GNU assembler (as of 2.40) mis-treats FCSR operands as GPRs, but the LLVM IAS does not. Probe for this and refer to FCSRs as "$fcsrNN" if support is present. Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 24da0249d950bbf97a8513daf414b48548b8bbe9 Author: WANG Rui Date: Thu Jun 29 20:58:43 2023 +0800 LoongArch: extable: Also recognize ABI names of registers When the kernel is compiled with LLVM, the register names being handled during exception fixup building are ABI names instead of bare $rNN style. Add mapping for the ABI names for LLVM compatibility. Signed-off-by: WANG Rui Signed-off-by: WANG Xuerui Signed-off-by: Huacai Chen commit 414cefc798a30895d61e9d5b010fcf350af782d6 Author: WANG Rui Date: Thu Jun 29 20:58:42 2023 +0800 LoongArch: Calculate various sizes in the linker script Taking the address delta between symbols in different sections is not supported by the LLVM IAS. Instead, do this in the linker script, so the same data can be properly referenced in assembly. Signed-off-by: WANG Rui Signed-off-by: WANG Xuerui [chenhuacai: Fix build with !CONFIG_EFI_STUB] Signed-off-by: Huacai Chen commit 0d03e9dce5c91d841a35af05ca61a5cf318f5064 Author: WANG Rui Date: Thu Jun 29 20:58:42 2023 +0800 LoongArch: Add guard for the larch_insn_gen_xxx functions Add guard for the larch_insn_gen_xxx functions to verify whether the immediate operand is within the acceptable range. Signed-off-by: WANG Rui Signed-off-by: Huacai Chen commit d7c24960975b02211c53afe97c36acde5c8ff933 Author: Dan Carpenter Date: Thu Jun 29 20:58:42 2023 +0800 LoongArch: Delete unnecessary debugfs checking Debugfs functions are not supposed to be checked for errors. This is sort of unusual but it is described in the comments for the debugfs_create_dir() function. Also debugfs_create_dir() can never return NULL. Reviewed-by: WANG Xuerui Signed-off-by: Dan Carpenter Signed-off-by: Huacai Chen commit 872b368b2282604aafbc8af1275e0b28a73b8636 Author: Huacai Chen Date: Thu Jun 29 20:58:42 2023 +0800 LoongArch: Set CPU#0 as the io master for FDT ACPI systems set io masters by parsing ACPI MADT, FDT systems have no MADT so we explicitly set CPU#0 as the io master. Otherwise CPU#0 will be considered as hotpluggable. Signed-off-by: Huacai Chen commit 5998bb7642bfc984b2305dd4e37e085a2f654477 Merge: e999c897cd626 c1ae02d876898 Author: Paolo Abeni Date: Thu Jun 29 14:41:28 2023 +0200 Merge branch 'fix-ptp-received-on-wrong-port-with-bridged-sja1105-dsa' Vladimir Oltean says: ==================== Fix PTP received on wrong port with bridged SJA1105 DSA Since the changes were made to tag_8021q to support imprecise RX for bridged ports, the tag_sja1105 driver still prefers the source port information deduced from the VLAN headers for link-local traffic, even though the switch can theoretically do better and report the precise source port. The problem is that the tagger doesn't know when to trust one source of information over another, because the INCL_SRCPT option (to "tag" link local frames) is sometimes enabled and sometimes it isn't. The first patch makes the switch provide the hardware tag for link local traffic under all circumstances, and the second patch makes the tagger always use that hardware tag as primary source of information for link local packets. ==================== Link: https://lore.kernel.org/r/20230627094207.3385231-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni commit c1ae02d876898b1b8ca1e12c6f84d7b406263800 Author: Vladimir Oltean Date: Tue Jun 27 12:42:07 2023 +0300 net: dsa: tag_sja1105: always prefer source port information from INCL_SRCPT Currently the sja1105 tagging protocol prefers using the source port information from the VLAN header if that is available, falling back to the INCL_SRCPT option if it isn't. The VLAN header is available for all frames except for META frames initiated by the switch (containing RX timestamps), and thus, the "if (is_link_local)" branch is practically dead. The tag_8021q source port identification has become more loose ("imprecise") and will report a plausible rather than exact bridge port, when under a bridge (be it VLAN-aware or VLAN-unaware). But link-local traffic always needs to know the precise source port. With incorrect source port reporting, for example PTP traffic over 2 bridged ports will all be seen on sockets opened on the first such port, which is incorrect. Now that the tagging protocol has been changed to make link-local frames always contain source port information, we can reverse the order of the checks so that we always give precedence to that information (which is always precise) in lieu of the tag_8021q VID which is only precise for a standalone port. Fixes: d7f9787a763f ("net: dsa: tag_8021q: add support for imprecise RX based on the VBID") Fixes: 91495f21fcec ("net: dsa: tag_8021q: replace the SVL bridging with VLAN-unaware IVL bridging") Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit b4638af8885af93cd70351081da1909c59342440 Author: Vladimir Oltean Date: Tue Jun 27 12:42:06 2023 +0300 net: dsa: sja1105: always enable the INCL_SRCPT option Link-local traffic on bridged SJA1105 ports is sometimes tagged by the hardware with source port information (when the port is under a VLAN aware bridge). The tag_8021q source port identification has become more loose ("imprecise") and will report a plausible rather than exact bridge port, when under a bridge (be it VLAN-aware or VLAN-unaware). But link-local traffic always needs to know the precise source port. Modify the driver logic (and therefore: the tagging protocol itself) to always include the source port information with link-local packets, regardless of whether the port is standalone, under a VLAN-aware or VLAN-unaware bridge. This makes it possible for the tagging driver to give priority to that information over the tag_8021q VLAN header. The big drawback with INCL_SRCPT is that it makes it impossible to distinguish between an original MAC DA of 01:80:C2:XX:YY:ZZ and 01:80:C2:AA:BB:ZZ, because the tagger just patches MAC DA bytes 3 and 4 with zeroes. Only if PTP RX timestamping is enabled, the switch will generate a META follow-up frame containing the RX timestamp and the original bytes 3 and 4 of the MAC DA. Those will be used to patch up the original packet. Nonetheless, in the absence of PTP RX timestamping, we have to live with this limitation, since it is more important to have the more precise source port information for link-local traffic. Fixes: d7f9787a763f ("net: dsa: tag_8021q: add support for imprecise RX based on the VBID") Fixes: 91495f21fcec ("net: dsa: tag_8021q: replace the SVL bridging with VLAN-unaware IVL bridging") Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Signed-off-by: Paolo Abeni commit 861c249cd782cb9f2d5a881bbb32e8da7f0c1192 Author: Thomas Zimmermann Date: Tue Jun 27 16:58:20 2023 +0200 arch/sparc: Add module license and description for fbdev helpers Add MODULE_LICENSE() and MODULE_DESCRIPTION() for fbdev helpers on sparc. Fixes the following error: ERROR: modpost: missing MODULE_LICENSE() in arch/sparc/video/fbdev.o Reported-by: Guenter Roeck Closes: https://lore.kernel.org/dri-devel/c525adc9-6623-4660-8718-e0c9311563b8@roeck-us.net/ Suggested-by: Arnd Bergmann Fixes: 4eec0b3048fc ("arch/sparc: Implement fb_is_primary_device() in source file") Cc: "David S. Miller" Cc: Helge Deller Cc: Sam Ravnborg Cc: sparclinux@vger.kernel.org Signed-off-by: Thomas Zimmermann Reviewed-by: Randy Dunlap Reviewed-by: Arnd Bergmann Reviewed-by: Sam Ravnborg Link: https://patchwork.freedesktop.org/patch/msgid/20230627145843.31794-1-tzimmermann@suse.de commit e999c897cd626c05f5d68ab02028a210ceca3545 Merge: 3c4bb45ab2930 2edcfcbb3c594 Author: Paolo Abeni Date: Thu Jun 29 12:40:29 2023 +0200 Merge branch 'fix-ptp-packet-drops-with-ocelot-8021q-dsa-tag-protocol' Vladimir Oltean says: ==================== Fix PTP packet drops with ocelot-8021q DSA tag protocol Changes in v2: - Distinguish between L2 and L4 PTP packets v1 at: https://lore.kernel.org/netdev/20230626154003.3153076-1-vladimir.oltean@nxp.com/ Patch 3/3 fixes an issue with the ocelot/felix driver, where it would drop PTP traffic on RX unless hardware timestamping for that packet type was enabled. Fixing that requires the driver to know whether it had previously configured the hardware to timestamp PTP packets on that port. But it cannot correctly determine that today using the existing code structure, so patches 1/3 and 2/3 fix the control path of the code such that ocelot->ports[port]->trap_proto faithfully reflects whether that configuration took place. ==================== Link: https://lore.kernel.org/r/20230627163114.3561597-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni commit 70a6404ff610aa4889d98977da131c37f9ff9d1f Author: Sameer Pujar Date: Thu Jun 29 10:42:15 2023 +0530 ASoC: rt5640: Fix sleep in atomic context Following prints are observed while testing audio on Jetson AGX Orin which has onboard RT5640 audio codec: BUG: sleeping function called from invalid context at kernel/workqueue.c:3027 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 0, name: swapper/0 preempt_count: 10001, expected: 0 RCU nest depth: 0, expected: 0 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at kernel/irq/handle.c:159 __handle_irq_event_percpu+0x1e0/0x270 ---[ end trace ad1c64905aac14a6 ]- The IRQ handler rt5640_irq() runs in interrupt context and can sleep during cancel_delayed_work_sync(). Fix this by running IRQ handler, rt5640_irq(), in thread context. Hence replace request_irq() calls with devm_request_threaded_irq(). Fixes: 051dade34695 ("ASoC: rt5640: Fix the wrong state of JD1 and JD2") Cc: stable@vger.kernel.org Cc: Oder Chiou Signed-off-by: Sameer Pujar Link: https://lore.kernel.org/r/1688015537-31682-4-git-send-email-spujar@nvidia.com Signed-off-by: Mark Brown commit 2edcfcbb3c5946609be1d8875473a240b170673b Author: Vladimir Oltean Date: Tue Jun 27 19:31:14 2023 +0300 net: dsa: felix: don't drop PTP frames with tag_8021q when RX timestamping is disabled The driver implements a workaround for the fact that it doesn't have an IRQ source to tell it whether PTP frames are available through the extraction registers, for those frames to be processed and passed towards the network stack. That workaround is to configure the switch, through felix_hwtstamp_set() -> felix_update_trapping_destinations(), to create two copies of PTP packets: one sent over Ethernet to the DSA master, and one to be consumed through the aforementioned CPU extraction queue registers. The reason why we want PTP packets to be consumed through the CPU extraction registers in the first place is because we want to see their hardware RX timestamp. With tag_8021q, that is only visible that way, and it isn't visible with the copy of the packet that's transmitted over Ethernet. The problem with the workaround implementation is that it drops the packet received over Ethernet, in expectation of its copy being present in the CPU extraction registers. However, if felix_hwtstamp_set() hasn't run (aka PTP RX timestamping is disabled), the driver will drop the original PTP frame and there will be no copy of it in the CPU extraction registers. So, the network stack will simply not see any PTP frame. Look at the port's trapping configuration to see whether the driver has previously enabled the CPU extraction registers. If it hasn't, just don't RX timestamp the frame and let it be passed up the stack by DSA, which is perfectly fine. Fixes: 0a6f17c6ae21 ("net: dsa: tag_ocelot_8021q: add support for PTP timestamping") Signed-off-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 6dfe70be0b0dec0f9297811501bec26c05fd96ad Author: Sheetal Date: Thu Jun 29 10:42:14 2023 +0530 ASoC: tegra: Fix ADX byte map Byte mask for channel-1 of stream-1 is not getting enabled and this causes failures during ADX use cases. This happens because the byte map value 0 matches the byte map array and put() callback returns without enabling the corresponding bits in the byte mask. ADX supports 4 output streams and each stream can have a maximum of 16 channels. Each byte in the input frame is uniquely mapped to a byte in one of these 4 outputs. This mapping is done with the help of byte map array via user space control setting. The byte map array size in the driver is 16 and each array element is of size 4 bytes. This corresponds to 64 byte map values. Each byte in the byte map array can have any value between 0 to 255 to enable the corresponding bits in the byte mask. The value 256 is used as a way to disable the byte map. However the byte map array element cannot store this value. The put() callback disables the byte mask for 256 value and byte map value is reset to 0 for this case. This causes problems during subsequent runs since put() callback, for value of 0, just returns without enabling the byte mask. In short, the problem is coming because 0 and 256 control values are stored as 0 in the byte map array. Right now fix the put() callback by actually looking at the byte mask array state to identify if any change is needed and update the fields accordingly. The get() callback needs an update as well to return the correct control value that user has set before. Note that when user set 256, the value is stored as 0 and byte mask is disabled. So byte mask state is used to either return 256 or the value from byte map array. Given above, this looks bit complicated and all this happens because the byte map array is tightly packed and cannot actually store the 256 value. Right now the priority is to fix the existing failure and a TODO item is put to improve this logic. Fixes: 3c97881b8c8a ("ASoC: tegra: Fix kcontrol put callback in ADX") Cc: stable@vger.kernel.org Signed-off-by: Sheetal Reviewed-by: Mohan Kumar D Reviewed-by: Sameer Pujar Link: https://lore.kernel.org/r/1688015537-31682-3-git-send-email-spujar@nvidia.com Signed-off-by: Mark Brown commit 45d0fcb5bc9558d0bf3d2fa7fabc5d8a88d35439 Author: Vladimir Oltean Date: Tue Jun 27 19:31:13 2023 +0300 net: mscc: ocelot: don't keep PTP configuration of all ports in single structure In a future change, the driver will need to determine whether PTP RX timestamping is enabled on a port (including whether traps were set up on that port in particular) and that is currently not possible. The driver supports different RX filters (L2, L4) and kinds of TX timestamping (one-step, two-step) on its ports, but it saves all configuration in a single struct hwtstamp_config that is global to the switch. So, the latest timestamping configuration on one port (including a request to disable timestamping) affects what gets reported for all ports, even though the configuration itself is still individual to each port. The port timestamping configurations are only coupled because of the common structure, so replace the hwtstamp_config with a mask of trapped protocols saved per port. We also have the ptp_cmd to distinguish between one-step and two-step PTP timestamping, so with those 2 bits of information we can fully reconstruct a descriptive struct hwtstamp_config for each port, during the SIOCGHWTSTAMP ioctl. Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support") Fixes: 96ca08c05838 ("net: mscc: ocelot: set up traps for PTP packets") Signed-off-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 4fd44b82b7aceaa35c2901c6546d2c4198e0799d Author: Vladimir Oltean Date: Tue Jun 27 19:31:12 2023 +0300 net: mscc: ocelot: don't report that RX timestamping is enabled by default PTP RX timestamping should be enabled when the user requests it, not by default. If it is enabled by default, it can be problematic when the ocelot driver is a DSA master, and it sidesteps what DSA tries to avoid through __dsa_master_hwtstamp_validate(). Additionally, after the change which made ocelot trap PTP packets only to the CPU at ocelot_hwtstamp_set() time, it is no longer even true that RX timestamping is enabled by default, because until ocelot_hwtstamp_set() is called, the PTP traps are actually not set up. So the rx_filter field of ocelot->hwtstamp_config reflects an incorrect reality. Fixes: 96ca08c05838 ("net: mscc: ocelot: set up traps for PTP packets") Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support") Signed-off-by: Vladimir Oltean Signed-off-by: Paolo Abeni commit 49bd7b08149417a30aa7d92c8c85b3518de44a76 Author: Sheetal Date: Thu Jun 29 10:42:13 2023 +0530 ASoC: tegra: Fix AMX byte map Byte mask for channel-1 of stream-1 is not getting enabled and this causes failures during AMX use cases. This happens because the byte map value 0 matches the byte map array and put() callback returns without enabling the corresponding bits in the byte mask. AMX supports 4 input streams and each stream can take a maximum of 16 channels. Each byte in the output frame is uniquely mapped to a byte in one of these 4 inputs. This mapping is done with the help of byte map array via user space control setting. The byte map array size in the driver is 16 and each array element is of size 4 bytes. This corresponds to 64 byte map values. Each byte in the byte map array can have any value between 0 to 255 to enable the corresponding bits in the byte mask. The value 256 is used as a way to disable the byte map. However the byte map array element cannot store this value. The put() callback disables the byte mask for 256 value and byte map value is reset to 0 for this case. This causes problems during subsequent runs since put() callback, for value of 0, just returns without enabling the byte mask. In short, the problem is coming because 0 and 256 control values are stored as 0 in the byte map array. Right now fix the put() callback by actually looking at the byte mask array state to identify if any change is needed and update the fields accordingly. The get() callback needs an update as well to return the correct control value that user has set before. Note that when user sets 256, the value is stored as 0 and byte mask is disabled. So byte mask state is used to either return 256 or the value from byte map array. Given above, this looks bit complicated and all this happens because the byte map array is tightly packed and cannot actually store the 256 value. Right now the priority is to fix the existing failure and a TODO item is put to improve this logic. Fixes: 8db78ace1ba8 ("ASoC: tegra: Fix kcontrol put callback in AMX") Cc: stable@vger.kernel.org Signed-off-by: Sheetal Reviewed-by: Mohan Kumar D Reviewed-by: Sameer Pujar Link: https://lore.kernel.org/r/1688015537-31682-2-git-send-email-spujar@nvidia.com Signed-off-by: Mark Brown commit d10005837be83906bbd2078c3b4f9dfcbd6c95b6 Author: Dmitry Baryshkov Date: Thu Jun 29 12:58:47 2023 +0300 spi: spi-geni-qcom: enable SPI_CONTROLLER_MUST_TX for GPI DMA mode The GPI DMA mode requires for TX DMA to be prepared. Force SPI core to provide TX buffer even if the caller didn't provide one by setting the SPI_CONTROLLER_MUST_TX flag. Fixes: b59c122484ec ("spi: spi-geni-qcom: Add support for GPI dma") Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20230629095847.3648597-1-dmitry.baryshkov@linaro.org Signed-off-by: Mark Brown commit 893b24181b4c4bf1fa2841b1ed192e5413a97cb1 Author: Will Deacon Date: Wed Jun 28 16:56:05 2023 +0100 arm64: sme: Use STR P to clear FFR context field in streaming SVE mode The FFR is a predicate register which can vary between 16 and 256 bits in size depending upon the configured vector length. When saving the SVE state in streaming SVE mode, the FFR register is inaccessible and so commit 9f5848665788 ("arm64/sve: Make access to FFR optional") simply clears the FFR field of the in-memory context structure. Unfortunately, it achieves this using an unconditional 8-byte store and so if the SME vector length is anything other than 64 bytes in size we will either fail to clear the entire field or, worse, we will corrupt memory immediately following the structure. This has led to intermittent kfence splats in CI [1] and can trigger kmalloc Redzone corruption messages when running the 'fp-stress' kselftest: | ============================================================================= | BUG kmalloc-1k (Not tainted): kmalloc Redzone overwritten | ----------------------------------------------------------------------------- | | 0xffff000809bf1e22-0xffff000809bf1e27 @offset=7714. First byte 0x0 instead of 0xcc | Allocated in do_sme_acc+0x9c/0x220 age=2613 cpu=1 pid=531 | __kmalloc+0x8c/0xcc | do_sme_acc+0x9c/0x220 | ... Replace the 8-byte store with a store of a predicate register which has been zero-initialised with PFALSE, ensuring that the entire field is cleared in memory. [1] https://lore.kernel.org/r/CA+G9fYtU7HsV0R0dp4XEH5xXHSJFw8KyDf5VQrLLfMxWfxQkag@mail.gmail.com Cc: Mark Brown Cc: Mark Rutland Cc: Naresh Kamboju Fixes: 9f5848665788 ("arm64/sve: Make access to FFR optional") Reported-by: Linux Kernel Functional Testing Signed-off-by: Will Deacon Reviewed-by: Mark Brown Tested-by: Anders Roxell Link: https://lore.kernel.org/r/20230628155605.22296-1-will@kernel.org Signed-off-by: Catalin Marinas commit 3c4bb45ab29303265a8c6d7099e00c824503c586 Merge: 6feb37b3b06e9 93d75d475c5dc Author: Paolo Abeni Date: Thu Jun 29 12:10:39 2023 +0200 Merge branch 'net-sched-act_ipt-bug-fixes' Florian Westphal says: ==================== net/sched: act_ipt bug fixes v3: prefer skb_header() helper in patch 2. No other changes. I've retained Acks and RvB-Tags of v2. While checking if netfilter could be updated to replace selected instances of NF_DROP with kfree_skb_reason+NF_STOLEN to improve debugging info via drop monitor I found that act_ipt is incompatible with such an approach. Moreover, it lacks multiple sanity checks to avoid certain code paths that make assumptions that the tc layer doesn't meet, such as header sanity checks, availability of skb_dst, skb_nfct() and so on. act_ipt test in the tc selftest still pass with this applied. I think that we should consider removal of this module, while this should take care of all problems, its ipv4 only and I don't think there are any netfilter targets that lack a native tc equivalent, even when ignoring bpf. ==================== Link: https://lore.kernel.org/r/20230627123813.3036-1-fw@strlen.de Signed-off-by: Paolo Abeni commit 93d75d475c5dc3404292976147d063ee4d808592 Author: Florian Westphal Date: Tue Jun 27 14:38:13 2023 +0200 net/sched: act_ipt: zero skb->cb before calling target xtables relies on skb being owned by ip stack, i.e. with ipv4 check in place skb->cb is supposed to be IPCB. I don't see an immediate problem (REJECT target cannot be used anymore now that PRE/POSTROUTING hook validation has been fixed), but better be safe than sorry. A much better patch would be to either mark act_ipt as "depends on BROKEN" or remove it altogether. I plan to do this for -next in the near future. This tc extension is broken in the sense that tc lacks an equivalent of NF_STOLEN verdict. With NF_STOLEN, target function takes complete ownership of skb, caller cannot dereference it anymore. ACT_STOLEN cannot be used for this: it has a different meaning, caller is allowed to dereference the skb. At this time NF_STOLEN won't be returned by any targets as far as I can see, but this may change in the future. It might be possible to work around this via list of allowed target extensions known to only return DROP or ACCEPT verdicts, but this is error prone/fragile. Existing selftest only validates xt_LOG and act_ipt is restricted to ipv4 so I don't think this action is used widely. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Florian Westphal Reviewed-by: Simon Horman Acked-by: Jamal Hadi Salim Signed-off-by: Paolo Abeni commit b2dc32dcba08bf55cec600caa76f4afd2e3614df Author: Florian Westphal Date: Tue Jun 27 14:38:12 2023 +0200 net/sched: act_ipt: add sanity checks on skb before calling target Netfilter targets make assumptions on the skb state, for example iphdr is supposed to be in the linear area. This is normally done by IP stack, but in act_ipt case no such checks are made. Some targets can even assume that skb_dst will be valid. Make a minimum effort to check for this: - Don't call the targets eval function for non-ipv4 skbs. - Don't call the targets eval function for POSTROUTING emulation when the skb has no dst set. v3: use skb_protocol helper (Davide Caratti) Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Florian Westphal Reviewed-by: Simon Horman Acked-by: Jamal Hadi Salim Signed-off-by: Paolo Abeni commit b4ee93380b3c891fea996af8d1d3ca0e36ad31f0 Author: Florian Westphal Date: Tue Jun 27 14:38:11 2023 +0200 net/sched: act_ipt: add sanity checks on table name and hook locations Looks like "tc" hard-codes "mangle" as the only supported table name, but on kernel side there are no checks. This is wrong. Not all xtables targets are safe to call from tc. E.g. "nat" targets assume skb has a conntrack object assigned to it. Normally those get called from netfilter nat core which consults the nat table to obtain the address mapping. "tc" userspace either sets PRE or POSTROUTING as hook number, but there is no validation of this on kernel side, so update netlink policy to reject bogus numbers. Some targets may assume skb_dst is set for input/forward hooks, so prevent those from being used. act_ipt uses the hook number in two places: 1. the state hook number, this is fine as-is 2. to set par.hook_mask The latter is a bit mask, so update the assignment to make xt_check_target() to the right thing. Followup patch adds required checks for the skb/packet headers before calling the targets evaluation function. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Florian Westphal Reviewed-by: Simon Horman Acked-by: Jamal Hadi Salim Signed-off-by: Paolo Abeni commit 6feb37b3b06e9049e20dcf7e23998f92c9c5be9a Author: Chengfeng Ye Date: Tue Jun 27 12:03:40 2023 +0000 sctp: fix potential deadlock on &net->sctp.addr_wq_lock As &net->sctp.addr_wq_lock is also acquired by the timer sctp_addr_wq_timeout_handler() in protocal.c, the same lock acquisition at sctp_auto_asconf_init() seems should disable irq since it is called from sctp_accept() under process context. Possible deadlock scenario: sctp_accept() -> sctp_sock_migrate() -> sctp_auto_asconf_init() -> spin_lock(&net->sctp.addr_wq_lock) -> sctp_addr_wq_timeout_handler() -> spin_lock_bh(&net->sctp.addr_wq_lock); (deadlock here) This flaw was found using an experimental static analysis tool we are developing for irq-related deadlock. The tentative patch fix the potential deadlock by spin_lock_bh(). Signed-off-by: Chengfeng Ye Fixes: 34e5b0118685 ("sctp: delay auto_asconf init until binding the first addr") Acked-by: Xin Long Link: https://lore.kernel.org/r/20230627120340.19432-1-dg573847474@gmail.com Signed-off-by: Paolo Abeni commit 86fca926c042138c7defc94e1b55b5f29ca4fa13 Author: Andy Shevchenko Date: Mon Jun 26 14:00:23 2023 +0300 ACPI: bus: Constify acpi_companion_match() returned value acpi_companion_match() doesn't alter the contents of the passed parameter, so we don't expect that returned value can be altered either. So constify it. Signed-off-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit 7a8227b2e76be506b2ac64d2beac950ca04892a5 Author: Moritz Fischer Date: Tue Jun 27 03:50:00 2023 +0000 net: lan743x: Don't sleep in atomic context dev_set_rx_mode() grabs a spin_lock, and the lan743x implementation proceeds subsequently to go to sleep using readx_poll_timeout(). Introduce a helper wrapping the readx_poll_timeout_atomic() function and use it to replace the calls to readx_polL_timeout(). Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver") Cc: stable@vger.kernel.org Cc: Bryan Whitehead Cc: UNGLinuxDriver@microchip.com Signed-off-by: Moritz Fischer Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230627035000.1295254-1-moritzf@google.com Signed-off-by: Paolo Abeni commit 7ba6b73db3dbe6cf365a8122e4ce36559a7714cc Author: Andy Shevchenko Date: Mon Jun 26 13:55:27 2023 +0300 ACPI: scan: Move acpi_root to internal header Compiler is not happy about handling of acpi_root variable: ...drivers/acpi/bus.c:37:20: warning: symbol 'acpi_root' was not declared. Should it be static? Move it's definition to the internal header. Signed-off-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki commit 75065a8929069bc93181848818e23f147a73f83a Author: Lin Ma Date: Tue Jun 27 11:39:54 2023 +0800 net: af_key: fix sadb_x_filter validation When running xfrm_state_walk_init(), the xfrm_address_filter being used is okay to have a splen/dplen that equals to sizeof(xfrm_address_t)<<3. This commit replaces >= to > to make sure the boundary checking is correct. Fixes: 37bd22420f85 ("af_key: pfkey_dump needs parameter validation") Signed-off-by: Lin Ma Signed-off-by: Steffen Klassert commit dfa73c17d55b921e1d4e154976de35317e43a93a Author: Lin Ma Date: Tue Jun 27 11:31:38 2023 +0800 net: xfrm: Fix xfrm_address_filter OOB read We found below OOB crash: [ 44.211730] ================================================================== [ 44.212045] BUG: KASAN: slab-out-of-bounds in memcmp+0x8b/0xb0 [ 44.212045] Read of size 8 at addr ffff88800870f320 by task poc.xfrm/97 [ 44.212045] [ 44.212045] CPU: 0 PID: 97 Comm: poc.xfrm Not tainted 6.4.0-rc7-00072-gdad9774deaf1-dirty #4 [ 44.212045] Call Trace: [ 44.212045] [ 44.212045] dump_stack_lvl+0x37/0x50 [ 44.212045] print_report+0xcc/0x620 [ 44.212045] ? __virt_addr_valid+0xf3/0x170 [ 44.212045] ? memcmp+0x8b/0xb0 [ 44.212045] kasan_report+0xb2/0xe0 [ 44.212045] ? memcmp+0x8b/0xb0 [ 44.212045] kasan_check_range+0x39/0x1c0 [ 44.212045] memcmp+0x8b/0xb0 [ 44.212045] xfrm_state_walk+0x21c/0x420 [ 44.212045] ? __pfx_dump_one_state+0x10/0x10 [ 44.212045] xfrm_dump_sa+0x1e2/0x290 [ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 44.212045] ? __kernel_text_address+0xd/0x40 [ 44.212045] ? kasan_unpoison+0x27/0x60 [ 44.212045] ? mutex_lock+0x60/0xe0 [ 44.212045] ? __pfx_mutex_lock+0x10/0x10 [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] netlink_dump+0x322/0x6c0 [ 44.212045] ? __pfx_netlink_dump+0x10/0x10 [ 44.212045] ? mutex_unlock+0x7f/0xd0 [ 44.212045] ? __pfx_mutex_unlock+0x10/0x10 [ 44.212045] __netlink_dump_start+0x353/0x430 [ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410 [ 44.212045] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 44.212045] ? __pfx_xfrm_dump_sa_done+0x10/0x10 [ 44.212045] ? __stack_depot_save+0x382/0x4e0 [ 44.212045] ? filter_irq_stacks+0x1c/0x70 [ 44.212045] ? kasan_save_stack+0x32/0x50 [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] ? kasan_set_track+0x25/0x30 [ 44.212045] ? __kasan_slab_alloc+0x59/0x70 [ 44.212045] ? kmem_cache_alloc_node+0xf7/0x260 [ 44.212045] ? kmalloc_reserve+0xab/0x120 [ 44.212045] ? __alloc_skb+0xcf/0x210 [ 44.212045] ? netlink_sendmsg+0x509/0x700 [ 44.212045] ? sock_sendmsg+0xde/0xe0 [ 44.212045] ? __sys_sendto+0x18d/0x230 [ 44.212045] ? __x64_sys_sendto+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? netlink_sendmsg+0x509/0x700 [ 44.212045] ? sock_sendmsg+0xde/0xe0 [ 44.212045] ? __sys_sendto+0x18d/0x230 [ 44.212045] ? __x64_sys_sendto+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] ? kasan_set_track+0x25/0x30 [ 44.212045] ? kasan_save_free_info+0x2e/0x50 [ 44.212045] ? __kasan_slab_free+0x10a/0x190 [ 44.212045] ? kmem_cache_free+0x9c/0x340 [ 44.212045] ? netlink_recvmsg+0x23c/0x660 [ 44.212045] ? sock_recvmsg+0xeb/0xf0 [ 44.212045] ? __sys_recvfrom+0x13c/0x1f0 [ 44.212045] ? __x64_sys_recvfrom+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? copyout+0x3e/0x50 [ 44.212045] netlink_rcv_skb+0xd6/0x210 [ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 44.212045] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 44.212045] ? __pfx_sock_has_perm+0x10/0x10 [ 44.212045] ? mutex_lock+0x8d/0xe0 [ 44.212045] ? __pfx_mutex_lock+0x10/0x10 [ 44.212045] xfrm_netlink_rcv+0x44/0x50 [ 44.212045] netlink_unicast+0x36f/0x4c0 [ 44.212045] ? __pfx_netlink_unicast+0x10/0x10 [ 44.212045] ? netlink_recvmsg+0x500/0x660 [ 44.212045] netlink_sendmsg+0x3b7/0x700 [ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.212045] sock_sendmsg+0xde/0xe0 [ 44.212045] __sys_sendto+0x18d/0x230 [ 44.212045] ? __pfx___sys_sendto+0x10/0x10 [ 44.212045] ? rcu_core+0x44a/0xe10 [ 44.212045] ? __rseq_handle_notify_resume+0x45b/0x740 [ 44.212045] ? _raw_spin_lock_irq+0x81/0xe0 [ 44.212045] ? __pfx___rseq_handle_notify_resume+0x10/0x10 [ 44.212045] ? __pfx_restore_fpregs_from_fpstate+0x10/0x10 [ 44.212045] ? __pfx_blkcg_maybe_throttle_current+0x10/0x10 [ 44.212045] ? __pfx_task_work_run+0x10/0x10 [ 44.212045] __x64_sys_sendto+0x71/0x90 [ 44.212045] do_syscall_64+0x3f/0x90 [ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] RIP: 0033:0x44b7da [ 44.212045] RSP: 002b:00007ffdc8838548 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 44.212045] RAX: ffffffffffffffda RBX: 00007ffdc8839978 RCX: 000000000044b7da [ 44.212045] RDX: 0000000000000038 RSI: 00007ffdc8838770 RDI: 0000000000000003 [ 44.212045] RBP: 00007ffdc88385b0 R08: 00007ffdc883858c R09: 000000000000000c [ 44.212045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 44.212045] R13: 00007ffdc8839968 R14: 00000000004c37d0 R15: 0000000000000001 [ 44.212045] [ 44.212045] [ 44.212045] Allocated by task 97: [ 44.212045] kasan_save_stack+0x22/0x50 [ 44.212045] kasan_set_track+0x25/0x30 [ 44.212045] __kasan_kmalloc+0x7f/0x90 [ 44.212045] __kmalloc_node_track_caller+0x5b/0x140 [ 44.212045] kmemdup+0x21/0x50 [ 44.212045] xfrm_dump_sa+0x17d/0x290 [ 44.212045] netlink_dump+0x322/0x6c0 [ 44.212045] __netlink_dump_start+0x353/0x430 [ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410 [ 44.212045] netlink_rcv_skb+0xd6/0x210 [ 44.212045] xfrm_netlink_rcv+0x44/0x50 [ 44.212045] netlink_unicast+0x36f/0x4c0 [ 44.212045] netlink_sendmsg+0x3b7/0x700 [ 44.212045] sock_sendmsg+0xde/0xe0 [ 44.212045] __sys_sendto+0x18d/0x230 [ 44.212045] __x64_sys_sendto+0x71/0x90 [ 44.212045] do_syscall_64+0x3f/0x90 [ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] [ 44.212045] The buggy address belongs to the object at ffff88800870f300 [ 44.212045] which belongs to the cache kmalloc-64 of size 64 [ 44.212045] The buggy address is located 32 bytes inside of [ 44.212045] allocated 36-byte region [ffff88800870f300, ffff88800870f324) [ 44.212045] [ 44.212045] The buggy address belongs to the physical page: [ 44.212045] page:00000000e4de16ee refcount:1 mapcount:0 mapping:000000000 ... [ 44.212045] flags: 0x100000000000200(slab|node=0|zone=1) [ 44.212045] page_type: 0xffffffff() [ 44.212045] raw: 0100000000000200 ffff888004c41640 dead000000000122 0000000000000000 [ 44.212045] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 44.212045] page dumped because: kasan: bad access detected [ 44.212045] [ 44.212045] Memory state around the buggy address: [ 44.212045] ffff88800870f200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 44.212045] ffff88800870f280: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] >ffff88800870f300: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ^ [ 44.212045] ffff88800870f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ffff88800870f400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ================================================================== By investigating the code, we find the root cause of this OOB is the lack of checks in xfrm_dump_sa(). The buggy code allows a malicious user to pass arbitrary value of filter->splen/dplen. Hence, with crafted xfrm states, the attacker can achieve 8 bytes heap OOB read, which causes info leak. if (attrs[XFRMA_ADDRESS_FILTER]) { filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]), sizeof(*filter), GFP_KERNEL); if (filter == NULL) return -ENOMEM; // NO MORE CHECKS HERE !!! } This patch fixes the OOB by adding necessary boundary checks, just like the code in pfkey_dump() function. Fixes: d3623099d350 ("ipsec: add support of limited SA dump") Signed-off-by: Lin Ma Signed-off-by: Steffen Klassert commit c61480a2ea5e5b997d10dfda556d3a63e31f87cd Author: Mauro Carvalho Chehab Date: Wed Jun 28 21:48:53 2023 +0200 media: wl128x: fix a clang warning Clang-16 produces this warning, which is fatal with CONFIG_WERROR: ../drivers/media/radio/wl128x/fmdrv_common.c:1237:19: error: variable 'cmd_cnt' set but not used [-Werror,-Wunused-but-set-variable] int ret, fw_len, cmd_cnt; ^ 1 error generated. What happens is that cmd_cnt tracks the amount of firmware data packets were transfered, which is printed only when debug is used. Switch to use the firmware count, as the message is all about reporting a partial firmware transfer. Link: https://lore.kernel.org/linux-media/6badd27ebfa718d5737f517f18b29a3e0f6e43f8.1687981726.git.mchehab@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 22065e4214c1196b54fc164892c2e193a743caf3 Author: Werner Sembach Date: Wed Jun 28 17:54:34 2023 +0200 ALSA: hda/realtek: Add quirk for Clevo NPx0SNx This applies a SND_PCI_QUIRK(...) to the Clevo NPx0SNx barebones fixing the microphone not being detected on the headset combo port. Signed-off-by: Werner Sembach Cc: Link: https://lore.kernel.org/r/20230628155434.584159-1-wse@tuxedocomputers.com Signed-off-by: Takashi Iwai commit 8ac04063354a01a484d2e55d20ed1958aa0d3392 Author: Petr Tesarik Date: Mon Jun 26 15:01:04 2023 +0200 swiotlb: reduce the number of areas to match actual memory pool size Although the desired size of the SWIOTLB memory pool is increased in swiotlb_adjust_nareas() to match the number of areas, the actual allocation may be smaller, which may require reducing the number of areas. For example, Xen uses swiotlb_init_late(), which in turn uses the page allocator. On x86, page size is 4 KiB and MAX_ORDER is 10 (1024 pages), resulting in a maximum memory pool size of 4 MiB. This corresponds to 2048 slots of 2 KiB each. The minimum area size is 128 (IO_TLB_SEGSIZE), allowing at most 2048 / 128 = 16 areas. If num_possible_cpus() is greater than the maximum number of areas, areas are smaller than IO_TLB_SEGSIZE and contiguous groups of free slots will span multiple areas. When allocating and freeing slots, only one area will be properly locked, causing race conditions on the unlocked slots and ultimately data corruption, kernel hangs and crashes. Fixes: 20347fca71a3 ("swiotlb: split up the global swiotlb lock") Signed-off-by: Petr Tesarik Reviewed-by: Roberto Sassu Signed-off-by: Christoph Hellwig commit aabd12609f91155f26584508b01f548215cc3c0c Author: Petr Tesarik Date: Mon Jun 26 15:01:03 2023 +0200 swiotlb: always set the number of areas before allocating the pool The number of areas defaults to the number of possible CPUs. However, the total number of slots may have to be increased after adjusting the number of areas. Consequently, the number of areas must be determined before allocating the memory pool. This is even explained with a comment in swiotlb_init_remap(), but swiotlb_init_late() adjusts the number of areas after slots are already allocated. The areas may end up being smaller than IO_TLB_SEGSIZE, which breaks per-area locking. While fixing swiotlb_init_late(), move all relevant comments before the definition of swiotlb_adjust_nareas() and convert them to kernel-doc. Fixes: 20347fca71a3 ("swiotlb: split up the global swiotlb lock") Signed-off-by: Petr Tesarik Reviewed-by: Roberto Sassu Signed-off-by: Christoph Hellwig commit 9cedc58bdbe9fff9aacd0ca19ee5777659f28fd7 Author: Arnd Bergmann Date: Mon Jun 19 10:19:38 2023 +0200 ksmbd: avoid field overflow warning clang warns about a possible field overflow in a memcpy: In file included from fs/smb/server/smb_common.c:7: include/linux/fortify-string.h:583:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning] __write_overflow_field(p_size_field, size); It appears to interpret the "&out[baselen + 4]" as referring to a single byte of the character array, while the equivalen "out + baselen + 4" is seen as an offset into the array. I don't see that kind of warning elsewhere, so just go with the simple rework. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Signed-off-by: Arnd Bergmann Acked-by: Namjae Jeon Signed-off-by: Steve French commit 9471f1f2f50282b9e8f59198ec6bb738b4ccc009 Merge: 3a8a670eeeaa4 a425ac5365f6c Author: Linus Torvalds Date: Wed Jun 28 20:35:21 2023 -0700 Merge branch 'expand-stack' This modifies our user mode stack expansion code to always take the mmap_lock for writing before modifying the VM layout. It's actually something we always technically should have done, but because we didn't strictly need it, we were being lazy ("opportunistic" sounds so much better, doesn't it?) about things, and had this hack in place where we would extend the stack vma in-place without doing the proper locking. And it worked fine. We just needed to change vm_start (or, in the case of grow-up stacks, vm_end) and together with some special ad-hoc locking using the anon_vma lock and the mm->page_table_lock, it all was fairly straightforward. That is, it was all fine until Ruihan Li pointed out that now that the vma layout uses the maple tree code, we *really* don't just change vm_start and vm_end any more, and the locking really is broken. Oops. It's not actually all _that_ horrible to fix this once and for all, and do proper locking, but it's a bit painful. We have basically three different cases of stack expansion, and they all work just a bit differently: - the common and obvious case is the page fault handling. It's actually fairly simple and straightforward, except for the fact that we have something like 24 different versions of it, and you end up in a maze of twisty little passages, all alike. - the simplest case is the execve() code that creates a new stack. There are no real locking concerns because it's all in a private new VM that hasn't been exposed to anybody, but lockdep still can end up unhappy if you get it wrong. - and finally, we have GUP and page pinning, which shouldn't really be expanding the stack in the first place, but in addition to execve() we also use it for ptrace(). And debuggers do want to possibly access memory under the stack pointer and thus need to be able to expand the stack as a special case. None of these cases are exactly complicated, but the page fault case in particular is just repeated slightly differently many many times. And ia64 in particular has a fairly complicated situation where you can have both a regular grow-down stack _and_ a special grow-up stack for the register backing store. So to make this slightly more manageable, the bulk of this series is to first create a helper function for the most common page fault case, and convert all the straightforward architectures to it. Thus the new 'lock_mm_and_find_vma()' helper function, which ends up being used by x86, arm, powerpc, mips, riscv, alpha, arc, csky, hexagon, loongarch, nios2, sh, sparc32, and xtensa. So we not only convert more than half the architectures, we now have more shared code and avoid some of those twisty little passages. And largely due to this common helper function, the full diffstat of this series ends up deleting more lines than it adds. That still leaves eight architectures (ia64, m68k, microblaze, openrisc, parisc, s390, sparc64 and um) that end up doing 'expand_stack()' manually because they are doing something slightly different from the normal pattern. Along with the couple of special cases in execve() and GUP. So there's a couple of patches that first create 'locked' helper versions of the stack expansion functions, so that there's a obvious path forward in the conversion. The execve() case is then actually pretty simple, and is a nice cleanup from our old "grow-up stackls are special, because at execve time even they grow down". The #ifdef CONFIG_STACK_GROWSUP in that code just goes away, because it's just more straightforward to write out the stack expansion there manually, instead od having get_user_pages_remote() do it for us in some situations but not others and have to worry about locking rules for GUP. And the final step is then to just convert the remaining odd cases to a new world order where 'expand_stack()' is called with the mmap_lock held for reading, but where it might drop it and upgrade it to a write, only to return with it held for reading (in the success case) or with it completely dropped (in the failure case). In the process, we remove all the stack expansion from GUP (where dropping the lock wouldn't be ok without special rules anyway), and add it in manually to __access_remote_vm() for ptrace(). Thanks to Adrian Glaubitz and Frank Scheiner who tested the ia64 cases. Everything else here felt pretty straightforward, but the ia64 rules for stack expansion are really quite odd and very different from everything else. Also thanks to Vegard Nossum who caught me getting one of those odd conditions entirely the wrong way around. Anyway, I think I want to actually move all the stack expansion code to a whole new file of its own, rather than have it split up between mm/mmap.c and mm/memory.c, but since this will have to be backported to the initial maple tree vma introduction anyway, I tried to keep the patches _fairly_ minimal. Also, while I don't think it's valid to expand the stack from GUP, the final patch in here is a "warn if some crazy GUP user wants to try to expand the stack" patch. That one will be reverted before the final release, but it's left to catch any odd cases during the merge window and release candidates. Reported-by: Ruihan Li * branch 'expand-stack': gup: add warning if some caller would seem to want stack expansion mm: always expand the stack with the mmap write lock held execve: expand new process stack manually ahead of time mm: make find_extend_vma() fail if write lock not held powerpc/mm: convert coprocessor fault to lock_mm_and_find_vma() mm/fault: convert remaining simple cases to lock_mm_and_find_vma() arm/mm: Convert to using lock_mm_and_find_vma() riscv/mm: Convert to using lock_mm_and_find_vma() mips/mm: Convert to using lock_mm_and_find_vma() powerpc/mm: Convert to using lock_mm_and_find_vma() arm64/mm: Convert to using lock_mm_and_find_vma() mm: make the page fault mmap locking killable mm: introduce new 'lock_mm_and_find_vma()' page fault helper commit 24033d71cc36ae8af02b56ec22c7490779a9e39f Author: Keoseong Park Date: Tue Jun 27 10:29:31 2023 +0900 scsi: ufs: core: Remove unused function declaration Commit 2468da61ea09 ("scsi: ufs: core: mcq: Configure operation and runtime interface") added ufshcd_mcq_select_mcq_mode(), but it's not used anywhere. So remove it. Signed-off-by: Keoseong Park Link: https://lore.kernel.org/r/20230627012931epcms2p76f458e0b2ce8a591b56bbcc6a2f1a3bb@epcms2p7 Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 7bcf57782503b7025941372863a20e2587483baf Author: Rong Tao Date: Mon Jun 26 08:51:47 2023 +0800 scsi: target: docs: Remove tcm_mod_builder.py This script is not used and requires additional development to sync with the SCSI target code. Signed-off-by: Rong Tao Link: https://lore.kernel.org/r/tencent_58D7935159C421036421B42CD04B0A959207@qq.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 40863cb945c93a55aeaf8a2fd2bef1c7507ee8f2 Author: Mike Christie Date: Fri Jun 23 11:11:36 2023 -0500 scsi: target: iblock: Quiet bool conversion warning with pr_preempt use We want to pass in true for pr_preempt's argument if we are doing a PRO_PREEMPT_AND_ABORT, so just test sa against PRO_PREEMPT_AND_ABORT, and pass the result directly to pr_preempt. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306221655.Kwtqi1gI-lkp@intel.com/ Signed-off-by: Mike Christie Link: https://lore.kernel.org/r/20230623161136.6270-1-michael.christie@oracle.com Reviewed-by: Maurizio Lombardi Signed-off-by: Martin K. Petersen commit 9b7c13b83c1dedb79a746eae9dfabc10a2673049 Author: Abel Vesa Date: Fri Jun 23 14:30:05 2023 +0300 scsi: dt-bindings: ufs: qcom: Fix ICE phandle The check for 'qcom,ice' property is wrong. Fix it by checking using if-required clause and expand the clocks minItems and maxItems for platforms where 'qcom,ice' is not required so that it includes platforms with single reg entry and clocks that do not provide an ICE one. Fixes: 29a6d1215b7c ("scsi: ufs: dt-bindings: qcom: Add ICE phandle") Signed-off-by: Abel Vesa Link: https://lore.kernel.org/r/20230623113009.2512206-2-abel.vesa@linaro.org Reviewed-by: Krzysztof Kozlowski Signed-off-by: Martin K. Petersen commit 71e3e85ccf2b816e612c94b7460309dc5007caef Author: Damien Le Moal Date: Fri Jun 23 16:30:57 2023 +0900 scsi: core: Simplify scsi_cdl_check_cmd() Reading the 800+ pages of SPC often leads to a brain shutdown and to less than ideal code... This resulted in the checks of the rwcdlp and cdlp fields in scsi_cdl_check_cmd() to have identical if-else branches. Replace this with a comment describing the cases we are interested in and replace the if-else code block with a simple test of the cdlp field that is used as the function return value. Reported-by: kernel test robot Reported-by: Julia Lawall Closes: https://lore.kernel.org/r/202306221657.BJHEADkz-lkp@intel.com/ Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20230623073057.816199-1-dlemoal@kernel.org Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen commit 4e45236982bcc3ce8a0ea719e1159cc5c935eb94 Author: Yueh-Shun Li Date: Thu Jun 22 01:26:29 2023 +0000 scsi: isci: Fix comment typo Spell "transmitting" properly. Found by searching for keyword "tranm". Signed-off-by: Yueh-Shun Li Link: https://lore.kernel.org/r/20230622012627.15050-5-shamrocklee@posteo.net Signed-off-by: Martin K. Petersen commit 3a8a670eeeaa40d87bd38a587438952741980c18 Merge: 6a8cbd9253abc ae230642190a5 Author: Linus Torvalds Date: Wed Jun 28 16:43:10 2023 -0700 Merge tag 'net-next-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking changes from Jakub Kicinski: "WiFi 7 and sendpage changes are the biggest pieces of work for this release. The latter will definitely require fixes but I think that we got it to a reasonable point. Core: - Rework the sendpage & splice implementations Instead of feeding data into sockets page by page extend sendmsg handlers to support taking a reference on the data, controlled by a new flag called MSG_SPLICE_PAGES Rework the handling of unexpected-end-of-file to invoke an additional callback instead of trying to predict what the right combination of MORE/NOTLAST flags is Remove the MSG_SENDPAGE_NOTLAST flag completely - Implement SCM_PIDFD, a new type of CMSG type analogous to SCM_CREDENTIALS, but it contains pidfd instead of plain pid - Enable socket busy polling with CONFIG_RT - Improve reliability and efficiency of reporting for ref_tracker - Auto-generate a user space C library for various Netlink families Protocols: - Allow TCP to shrink the advertised window when necessary, prevent sk_rcvbuf auto-tuning from growing the window all the way up to tcp_rmem[2] - Use per-VMA locking for "page-flipping" TCP receive zerocopy - Prepare TCP for device-to-device data transfers, by making sure that payloads are always attached to skbs as page frags - Make the backoff time for the first N TCP SYN retransmissions linear. Exponential backoff is unnecessarily conservative - Create a new MPTCP getsockopt to retrieve all info (MPTCP_FULL_INFO) - Avoid waking up applications using TLS sockets until we have a full record - Allow using kernel memory for protocol ioctl callbacks, paving the way to issuing ioctls over io_uring - Add nolocalbypass option to VxLAN, forcing packets to be fully encapsulated even if they are destined for a local IP address - Make TCPv4 use consistent hash in TIME_WAIT and SYN_RECV. Ensure in-kernel ECMP implementation (e.g. Open vSwitch) select the same link for all packets. Support L4 symmetric hashing in Open vSwitch - PPPoE: make number of hash bits configurable - Allow DNS to be overwritten by DHCPACK in the in-kernel DHCP client (ipconfig) - Add layer 2 miss indication and filtering, allowing higher layers (e.g. ACL filters) to make forwarding decisions based on whether packet matched forwarding state in lower devices (bridge) - Support matching on Connectivity Fault Management (CFM) packets - Hide the "link becomes ready" IPv6 messages by demoting their printk level to debug - HSR: don't enable promiscuous mode if device offloads the proto - Support active scanning in IEEE 802.15.4 - Continue work on Multi-Link Operation for WiFi 7 BPF: - Add precision propagation for subprogs and callbacks. This allows maintaining verification efficiency when subprograms are used, or in fact passing the verifier at all for complex programs, especially those using open-coded iterators - Improve BPF's {g,s}setsockopt() length handling. Previously BPF assumed the length is always equal to the amount of written data. But some protos allow passing a NULL buffer to discover what the output buffer *should* be, without writing anything - Accept dynptr memory as memory arguments passed to helpers - Add routing table ID to bpf_fib_lookup BPF helper - Support O_PATH FDs in BPF_OBJ_PIN and BPF_OBJ_GET commands - Drop bpf_capable() check in BPF_MAP_FREEZE command (used to mark maps as read-only) - Show target_{obj,btf}_id in tracing link fdinfo - Addition of several new kfuncs (most of the names are self-explanatory): - Add a set of new dynptr kfuncs: bpf_dynptr_adjust(), bpf_dynptr_is_null(), bpf_dynptr_is_rdonly(), bpf_dynptr_size() and bpf_dynptr_clone(). - bpf_task_under_cgroup() - bpf_sock_destroy() - force closing sockets - bpf_cpumask_first_and(), rework bpf_cpumask_any*() kfuncs Netfilter: - Relax set/map validation checks in nf_tables. Allow checking presence of an entry in a map without using the value - Increase ip_vs_conn_tab_bits range for 64BIT builds - Allow updating size of a set - Improve NAT tuple selection when connection is closing Driver API: - Integrate netdev with LED subsystem, to allow configuring HW "offloaded" blinking of LEDs based on link state and activity (i.e. packets coming in and out) - Support configuring rate selection pins of SFP modules - Factor Clause 73 auto-negotiation code out of the drivers, provide common helper routines - Add more fool-proof helpers for managing lifetime of MDIO devices associated with the PCS layer - Allow drivers to report advanced statistics related to Time Aware scheduler offload (taprio) - Allow opting out of VF statistics in link dump, to allow more VFs to fit into the message - Split devlink instance and devlink port operations New hardware / drivers: - Ethernet: - Synopsys EMAC4 IP support (stmmac) - Marvell 88E6361 8 port (5x1GE + 3x2.5GE) switches - Marvell 88E6250 7 port switches - Microchip LAN8650/1 Rev.B0 PHYs - MediaTek MT7981/MT7988 built-in 1GE PHY driver - WiFi: - Realtek RTL8192FU, 2.4 GHz, b/g/n mode, 2T2R, 300 Mbps - Realtek RTL8723DS (SDIO variant) - Realtek RTL8851BE - CAN: - Fintek F81604 Drivers: - Ethernet NICs: - Intel (100G, ice): - support dynamic interrupt allocation - use meta data match instead of VF MAC addr on slow-path - nVidia/Mellanox: - extend link aggregation to handle 4, rather than just 2 ports - spawn sub-functions without any features by default - OcteonTX2: - support HTB (Tx scheduling/QoS) offload - make RSS hash generation configurable - support selecting Rx queue using TC filters - Wangxun (ngbe/txgbe): - add basic Tx/Rx packet offloads - add phylink support (SFP/PCS control) - Freescale/NXP (enetc): - report TAPRIO packet statistics - Solarflare/AMD: - support matching on IP ToS and UDP source port of outer header - VxLAN and GENEVE tunnel encapsulation over IPv4 or IPv6 - add devlink dev info support for EF10 - Virtual NICs: - Microsoft vNIC: - size the Rx indirection table based on requested configuration - support VLAN tagging - Amazon vNIC: - try to reuse Rx buffers if not fully consumed, useful for ARM servers running with 16kB pages - Google vNIC: - support TCP segmentation of >64kB frames - Ethernet embedded switches: - Marvell (mv88e6xxx): - enable USXGMII (88E6191X) - Microchip: - lan966x: add support for Egress Stage 0 ACL engine - lan966x: support mapping packet priority to internal switch priority (based on PCP or DSCP) - Ethernet PHYs: - Broadcom PHYs: - support for Wake-on-LAN for BCM54210E/B50212E - report LPI counter - Microsemi PHYs: support RGMII delay configuration (VSC85xx) - Micrel PHYs: receive timestamp in the frame (LAN8841) - Realtek PHYs: support optional external PHY clock - Altera TSE PCS: merge the driver into Lynx PCS which it is a variant of - CAN: Kvaser PCIEcan: - support packet timestamping - WiFi: - Intel (iwlwifi): - major update for new firmware and Multi-Link Operation (MLO) - configuration rework to drop test devices and split the different families - support for segmented PNVM images and power tables - new vendor entries for PPAG (platform antenna gain) feature - Qualcomm 802.11ax (ath11k): - Multiple Basic Service Set Identifier (MBSSID) and Enhanced MBSSID Advertisement (EMA) support in AP mode - support factory test mode - RealTek (rtw89): - add RSSI based antenna diversity - support U-NII-4 channels on 5 GHz band - RealTek (rtl8xxxu): - AP mode support for 8188f - support USB RX aggregation for the newer chips" * tag 'net-next-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1602 commits) net: scm: introduce and use scm_recv_unix helper af_unix: Skip SCM_PIDFD if scm->pid is NULL. net: lan743x: Simplify comparison netlink: Add __sock_i_ino() for __netlink_diag_dump(). net: dsa: avoid suspicious RCU usage for synced VLAN-aware MAC addresses Revert "af_unix: Call scm_recv() only after scm_set_cred()." phylink: ReST-ify the phylink_pcs_neg_mode() kdoc libceph: Partially revert changes to support MSG_SPLICE_PAGES net: phy: mscc: fix packet loss due to RGMII delays net: mana: use vmalloc_array and vcalloc net: enetc: use vmalloc_array and vcalloc ionic: use vmalloc_array and vcalloc pds_core: use vmalloc_array and vcalloc gve: use vmalloc_array and vcalloc octeon_ep: use vmalloc_array and vcalloc net: usb: qmi_wwan: add u-blox 0x1312 composition perf trace: fix MSG_SPLICE_PAGES build error ipvlan: Fix return value of ipvlan_queue_xmit() netfilter: nf_tables: fix underflow in chain reference counter netfilter: nf_tables: unbind non-anonymous set if rule construction fails ... commit 6a8cbd9253abc1bd0df4d60c4c24fa555190376d Merge: 4e3c09e95499e 2f2665c13af48 Author: Linus Torvalds Date: Wed Jun 28 16:05:21 2023 -0700 Merge tag 'v6.5-rc1-sysctl-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull sysctl updates from Luis Chamberlain: "The changes for sysctl are in line with prior efforts to stop usage of deprecated routines which incur recursion and also make it hard to remove the empty array element in each sysctl array declaration. The most difficult user to modify was parport which required a bit of re-thinking of how to declare shared sysctls there, Joel Granados has stepped up to the plate to do most of this work and eventual removal of register_sysctl_table(). That work ended up saving us about 1465 bytes according to bloat-o-meter. Since we gained a few bloat-o-meter karma points I moved two rather small sysctl arrays from kernel/sysctl.c leaving us only two more sysctl arrays to move left. Most changes have been tested on linux-next for about a month. The last straggler patches are a minor parport fix, changes to the sysctl kernel selftest so to verify correctness and prevent regressions for the future change he made to provide an alternative solution for the special sysctl mount point target which was using the now deprecated sysctl child element. This is all prep work to now finally be able to remove the empty array element in all sysctl declarations / registrations which is expected to save us a bit of bytes all over the kernel. That work will be tested early after v6.5-rc1 is out" * tag 'v6.5-rc1-sysctl-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: sysctl: replace child with an enumeration sysctl: Remove debugging dump_stack test_sysclt: Test for registering a mount point test_sysctl: Add an option to prevent test skip test_sysctl: Add an unregister sysctl test test_sysctl: Group node sysctl test under one func test_sysctl: Fix test metadata getters parport: plug a sysctl register leak sysctl: move security keys sysctl registration to its own file sysctl: move umh sysctl registration to its own file signal: move show_unhandled_signals sysctl to its own file sysctl: remove empty dev table sysctl: Remove register_sysctl_table sysctl: Refactor base paths registrations sysctl: stop exporting register_sysctl_table parport: Removed sysctl related defines parport: Remove register_sysctl_table from parport_default_proc_register parport: Remove register_sysctl_table from parport_device_proc_register parport: Remove register_sysctl_table from parport_proc_register parport: Move magic number "15" to a define commit 4e3c09e95499e83dafc93860d56070a76d20e830 Merge: 9b9879fc03275 0eeaf1eb40a34 Author: Linus Torvalds Date: Wed Jun 28 15:51:08 2023 -0700 Merge tag 'v6.5-rc1-modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux Pull module updates from Luis Chamberlain: "The changes queued up for modules are pretty tame, mostly code removal of moving of code. Only two minor functional changes are made, the only one which stands out is Sebastian Andrzej Siewior's simplification of module reference counting by removing preempt_disable() and that has been tested on linux-next for well over a month without no regressions. I'm now, I guess, also a kitchen sink for some kallsyms changes" [ There was a mis-communication about the concurrent module load changes that I had expected to come through Luis despite me authoring the patch. So some of the module updates were left hanging in the email ether, and I just committed them separately. It's my bad - I should have made it more clear that I expected my own patches to come through the module tree too. Now they missed linux-next, but hopefully that won't cause any issues - Linus ] * tag 'v6.5-rc1-modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/linux: kallsyms: make kallsyms_show_value() as generic function kallsyms: move kallsyms_show_value() out of kallsyms.c kallsyms: remove unsed API lookup_symbol_attrs kallsyms: remove unused arch_get_kallsym() helper module: Remove preempt_disable() from module reference counting. commit 9b9879fc03275ffe0da328cf5b864d9e694167c8 Author: Linus Torvalds Date: Mon May 29 21:39:51 2023 -0400 modules: catch concurrent module loads, treat them as idempotent This is the new-and-improved attempt at avoiding huge memory load spikes when the user space boot sequence tries to load hundreds (or even thousands) of redundant duplicate modules in parallel. See commit 9828ed3f695a ("module: error out early on concurrent load of the same module file") for background and an earlier failed attempt that was reverted. That earlier attempt just said "concurrently loading the same module is silly, just open the module file exclusively and return -ETXTBSY if somebody else is already loading it". While it is true that concurrent module loads of the same module is silly, the reason that earlier attempt then failed was that the concurrently loaded module would often be a prerequisite for another module. Thus failing to load the prerequisite would then cause cascading failures of the other modules, rather than just short-circuiting that one unnecessary module load. At the same time, we still really don't want to load the contents of the same module file hundreds of times, only to then wait for an eventually successful load, and have everybody else return -EEXIST. As a result, this takes another approach, and treats concurrent module loads from the same file as "idempotent" in the inode. So if one module load is ongoing, we don't start a new one, but instead just wait for the first one to complete and return the same return value as it did. So unlike the first attempt, this does not return early: the intent is not to speed up the boot, but to avoid a thundering herd problem in allocating memory (both physical and virtual) for a module more than once. Also note that this does change behavior: it used to be that when you had concurrent loads, you'd have one "winner" that would return success, and everybody else would return -EEXIST. In contrast, this idempotent logic goes all Oprah on the problem, and says "You are a winner! And you are a winner! We are ALL winners". But since there's no possible actual real semantic difference between "you loaded the module" and "somebody else already loaded the module", this is more of a feel-good change than an actual honest-to-goodness semantic change. Of course, any true Johnny-come-latelies that don't get caught in the concurrency filter will still return -EEXIST. It's no different from not even getting a seat at an Oprah taping. That's life. See the long thread on the kernel mailing list about this all, which includes some numbers for memory use before and after the patch. Link: https://lore.kernel.org/lkml/20230524213620.3509138-1-mcgrof@kernel.org/ Reviewed-by: Johan Hovold Tested-by: Johan Hovold Tested-by: Luis Chamberlain Tested-by: Dan Williams Tested-by: Rudi Heitbaum Tested-by: David Hildenbrand Signed-off-by: Linus Torvalds commit 054a73009c22a5fb8bbeee5394980809276bc9fe Author: Linus Torvalds Date: Mon May 29 20:55:13 2023 -0400 module: split up 'finit_module()' into init_module_from_file() helper This will simplify the next step, where we can then key off the inode to do one idempotent module load. Let's do the obvious re-organization in one step, and then the new code in another. Signed-off-by: Linus Torvalds commit 9408d8a37e6cce8803681ab816383450a056c3a9 Author: Keith Busch Date: Mon Jun 12 12:03:43 2023 -0700 nvme: improved uring polling Drivers can poll requests directly, so use that. We just need to ensure the driver's request was allocated from a polled hctx, so a special driver flag is added to struct io_uring_cmd. The allows unshared and multipath namespaces to use the same polling callback, and multipath is guaranteed to get the same queue as the command was submitted on. Previously multipath polling might check a different path and poll the wrong info. The other bonus is we don't need a bio payload in order to poll, allowing commands like 'flush' and 'write zeroes' to be submitted on the same high priority queue as read and write commands. Finally, using the request based polling skips the unnecessary bio overhead. Signed-off-by: Keith Busch Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230612190343.2087040-3-kbusch@meta.com Signed-off-by: Jens Axboe commit f6c80cffcd47a2d41943e3a41fbe9034d9f6d7b0 Author: Keith Busch Date: Mon Jun 12 12:03:42 2023 -0700 block: add request polling helper Provide a direct request polling will for drivers. The interface does not require a bio, and can skip the overhead associated with polling those. The biggest gain from skipping the relatively expensive xarray lookup unnecessary when you already have the request. With this, the simple rq/qc conversion functions have only one caller each, so open code this and remove the helpers. Signed-off-by: Keith Busch Reviewed-by: Kanchan Joshi Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230612190343.2087040-2-kbusch@meta.com Signed-off-by: Jens Axboe commit 3a08284ff22080e742814dad1dbabb4b66349642 Merge: 89181f544ffa4 6d85ebf95c44e Author: Jens Axboe Date: Wed Jun 28 16:08:19 2023 -0600 Merge branch 'for-6.5/block-late' into block-6.5 * for-6.5/block-late: blk-sysfs: add a new attr_group for blk_mq blk-iocost: move wbt_enable/disable_default() out of spinlock blk-wbt: cleanup rwb_enabled() and wbt_disabled() blk-wbt: remove dead code to handle wbt enable/disable with io inflight blk-wbt: don't create wbt sysfs entry if CONFIG_BLK_WBT is disabled blk-mq: fix two misuses on RQF_USE_SCHED blk-throttle: Fix io statistics for cgroup v1 bcache: Fix bcache device claiming bcache: Alloc holder object before async registration raid10: avoid spin_lock from fastpath from raid10_unplug() md: fix 'delete_mutex' deadlock md: use mddev->external to select holder in export_rdev() md/raid1-10: fix casting from randomized structure in raid1_submit_write() md/raid10: fix the condition to call bio_end_io_acct() commit 89181f544ffa4da682b0145738342f9b78b9e8dc Merge: 1364b4068a421 06b5d4fea89cd Author: Linus Torvalds Date: Wed Jun 28 14:06:39 2023 -0700 Merge tag 'mmc-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC core: - Allow synchronous detection of (e)MMC/SD/SDIO cards - Fixup error check for ioctls for SPI hosts - Disable broken SD-Cache support for Kingston Canvas Go Plus from 2019 - Disable broken eMMC-Trim support for Kingston EMMC04G-M627 - Disable broken eMMC-Trim support for Micron MTFC4GACAJCN-1M MMC host: - bcm2835: Convert DT bindings to YAML - mmci: - Enable asynchronous probe - Transform the ux500 HW-busy detection into a proper state machine - Add support for SW busy-end timeouts for the ux500 variants - mmci_stm32: - Add support for sdm32 variant revision v3.0 used on STM32MP25 - Improve the tuning sequence - mtk-sd: Tune polling-period to improve performance - sdhci: Fixup DMA configuration for 64-bit DMA mode - sdhci-bcm-kona: Convert DT bindings to YAML - sdhci-msm: - Switch to use the new ICE API - Add support for the SC8280XP/IPQ6018/QDU1000/QRU1000 variants - sdhci-pci-gli: - Add support SD Express cards for GL9767 - Add support for the Genesys Logic GL9767 variant" * tag 'mmc-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (42 commits) dt-bindings: mmc: fsl-imx-esdhc: Add imx6ul support mmc: mmci: Add support for SW busy-end timeouts mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston Canvas Go Plus from 11/2019 mmc: core: disable TRIM on Kingston EMMC04G-M627 mmc: mmci: stm32: add delay block support for STM32MP25 mmc: mmci: stm32: prepare other delay block support mmc: mmci: stm32: manage block gap hardware flow control mmc: mmci: Add support for sdmmc variant revision v3.0 mmc: mmci: add stm32_idmabsize_align parameter dt-bindings: mmc: mmci: Add st,stm32mp25-sdmmc2 compatible mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M mmc: mmci: Break out a helper function mmc: mmci: Use a switch statement machine mmc: mmci: Use state machine state as exit condition mmc: mmci: Retry the busy start condition mmc: mmci: Make busy complete state machine explicit mmc: mmci: Break out error check in busy detect mmc: mmci: Stash status while waiting for busy mmc: mmci: Unwind big if() clause mmc: mmci: Clear busy_status when starting command ... commit 1364b4068a421d99fb4da8b570e54525096b1cef Merge: 84fccbba93103 cf431a5998326 Author: Linus Torvalds Date: Wed Jun 28 14:02:03 2023 -0700 Merge tag 'mtd/for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd updates from "Core MTD changes: - otp: - Put factory OTP/NVRAM into the entropy pool - Clean up on error in mtd_otp_nvmem_add() MTD devices changes: - sm_ftl: Fix typos in comments - Use SPDX license headers - pismo: Switch back to use i2c_driver's .probe() - mtdpart: Drop useless LIST_HEAD - st_spi_fsm: Use the devm_clk_get_enabled() helper function DT binding changes: - partitions: - Include TP-Link SafeLoader in allowed list - Add missing type for "linux,rootfs" - Extend the nand node names filter - Create a file for raw NAND chip properties - Mark nand-ecc-placement deprecated - Describe nand-ecc-mode - Prevent NAND chip unevaluated properties in all NAND bindings with a NAND chip reference. - Qcom: Fix a property position - Marvell: Convert to YAML DT schema Raw NAND chip drivers changes: - Macronix: OTP access for MX30LFxG18AC - Add basic Sandisk manufacturer ops - Add support for Sandisk SDTNQGAMA Raw NAND controller driver changes: - Meson: - Replace integer consts with proper defines - Allow waiting w/o wired ready/busy pin - Check buffer length validity - Fix unaligned DMA buffers handling - dt-bindings: Fix 'nand-rb' property - Arasan: Revert "mtd: rawnand: arasan: Prevent an unsupported configuration" as this limitation is no longer true thanks to the recent efforts in improving the clocks support in this driver SPI-NAND changes: - Gigadevice: add support for GD5F2GQ5xExxH - Macronix: Add support for serial NAND flashes" * tag 'mtd/for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (38 commits) dt-bindings: mtd: marvell-nand: Convert to YAML DT scheme dt-bindings: mtd: ti,am654: Prevent unevaluated properties dt-bindings: mtd: mediatek: Prevent NAND chip unevaluated properties dt-bindings: mtd: mediatek: Reference raw-nand-chip.yaml dt-bindings: mtd: stm32: Prevent NAND chip unevaluated properties dt-bindings: mtd: rockchip: Prevent NAND chip unevaluated properties dt-bindings: mtd: intel: Prevent NAND chip unevaluated properties dt-bindings: mtd: denali: Prevent NAND chip unevaluated properties dt-bindings: mtd: brcmnand: Prevent NAND chip unevaluated properties dt-bindings: mtd: meson: Prevent NAND chip unevaluated properties dt-bindings: mtd: sunxi: Prevent NAND chip unevaluated properties dt-bindings: mtd: ingenic: Prevent NAND chip unevaluated properties dt-bindings: mtd: qcom: Prevent NAND chip unevaluated properties dt-bindings: mtd: qcom: Fix a property position dt-bindings: mtd: Describe nand-ecc-mode dt-bindings: mtd: Mark nand-ecc-placement deprecated dt-bindings: mtd: Create a file for raw NAND chip properties dt-bindings: mtd: Accept nand related node names mtd: sm_ftl: Fix typos in comments mtd: otp: clean up on error in mtd_otp_nvmem_add() ... commit 5f2a0afa9890e728428db2ed9281bddca242e90b Author: Paulo Alcantara Date: Tue Jun 27 21:24:50 2023 -0300 smb: client: improve DFS mount check Some servers may return error codes from REQ_GET_DFS_REFERRAL requests that are unexpected by the client, so to make it easier, assume non-DFS mounts when the client can't get the initial DFS referral of @ctx->UNC in dfs_mount_share(). Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 3ae872de410751fe5e629e04da491a632d95201c Author: Paulo Alcantara Date: Mon Jun 26 16:04:17 2023 -0300 smb: client: fix shared DFS root mounts with different prefixes When having two DFS root mounts that are connected to same namespace, same mount options but different prefix paths, we can't really use the shared @server->origin_fullpath when chasing DFS links in them. Move the origin_fullpath field to cifs_tcon structure so when having shared DFS root mounts with different prefix paths, and we need to chase any DFS links, dfs_get_automount_devname() will pick up the correct full path out of the @tcon that will be used for the new mount. Before patch mount.cifs //dom/dfs/dir /mnt/1 -o ... mount.cifs //dom/dfs /mnt/2 -o ... # shared server, ses, tcon # server: origin_fullpath=//dom/dfs/dir # @server->origin_fullpath + '/dir/link1' $ ls /mnt/2/dir/link1 ls: cannot open directory '/mnt/2/dir/link1': No such file or directory After patch mount.cifs //dom/dfs/dir /mnt/1 -o ... mount.cifs //dom/dfs /mnt/2 -o ... # shared server & ses # tcon_1: origin_fullpath=//dom/dfs/dir # tcon_2: origin_fullpath=//dom/dfs # @tcon_2->origin_fullpath + '/dir/link1' $ ls /mnt/2/dir/link1 dir0 dir1 dir10 dir3 dir5 dir6 dir7 dir9 target2_file.txt tsub Fixes: 8e3554150d6c ("cifs: fix sharing of DFS connections") Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 84fccbba93103b22044617e419ba20e1403b4a65 Merge: 362067b6d5ca5 e884a133340a4 Author: Linus Torvalds Date: Wed Jun 28 13:48:42 2023 -0700 Merge tag 'spi-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "One small core feature this time around but mostly driver improvements and additions for SPI: - Add support for controlling the idle state of MOSI, some systems can support this and depending on the system integration may need it to avoid glitching in some situations - Support for polling mode in the S3C64xx driver and DMA on the Qualcomm QSPI driver - Support for several Allwinner SoCs, AMD Pensando Elba, Intel Mount Evans, Renesas RZ/V2M, and ST STM32H7" * tag 'spi-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (66 commits) spi: dt-bindings: atmel,at91rm9200-spi: fix broken sam9x7 compatible spi: dt-bindings: atmel,at91rm9200-spi: add sam9x7 compatible spi: Add support for Renesas CSI spi: dt-bindings: Add bindings for RZ/V2M CSI spi: sun6i: Use the new helper to derive the xfer timeout value spi: atmel: Prevent false timeouts on long transfers spi: dt-bindings: stm32: do not disable spi-slave property for stm32f4-f7 spi: Create a helper to derive adaptive timeouts spi: spi-geni-qcom: correctly handle -EPROBE_DEFER from dma_request_chan() spi: stm32: disable spi-slave property for stm32f4-f7 spi: stm32: introduction of stm32h7 SPI device mode support spi: stm32: use dmaengine_terminate_{a}sync instead of _all spi: stm32: renaming of spi_master into spi_controller spi: dw: Remove misleading comment for Mount Evans SoC spi: dt-bindings: snps,dw-apb-ssi: Add compatible for Intel Mount Evans SoC spi: dw: Add compatible for Intel Mount Evans SoC spi: s3c64xx: Use dev_err_probe() spi: s3c64xx: Use the managed spi master allocation function spi: spl022: Probe defer is no error spi: spi-imx: fix mixing of native and gpio chipselects for imx51/imx53/imx6 variants ... commit 362067b6d5ca5b59a849a8e1183fb51d616fcf19 Merge: 4171a9aa23598 54e47eade7304 Author: Linus Torvalds Date: Wed Jun 28 13:32:47 2023 -0700 Merge tag 'regulator-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "This release is almost all drivers, there's some small improvements in the core but otherwise everything is updates to drivers, mostly the addition of new ones. There's also a bunch of changes pulled in from the MFD subsystem as dependencies, Rockchip and TI core MFD code that the regulator drivers depend on. I've also yet again managed to put a SPI commit in the regulator tree, I don't know what it is about those two trees (this for spi-geni-qcom). Summary: - Support for Renesas RAA215300, Rockchip RK808, Texas Instruments TPS6594 and TPS6287x, and X-Powers AXP15060 and AXP313a" * tag 'regulator-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (43 commits) regulator: Add Renesas PMIC RAA215300 driver regulator: dt-bindings: Add Renesas RAA215300 PMIC bindings regulator: ltc3676: Use maple tree register cache regulator: ltc3589: Use maple tree register cache regulator: helper: Document ramp_delay parameter of regulator_set_ramp_delay_regmap() regulator: mt6358: Use linear voltage helpers for single range regulators regulator: mt6358: Const-ify mt6358_regulator_info data structures regulator: mt6358: Drop *_SSHUB regulators regulator: mt6358: Merge VCN33_* regulators regulator: dt-bindings: mt6358: Drop *_sshub regulators regulator: dt-bindings: mt6358: Merge ldo_vcn33_* regulators regulator: dt-bindings: pwm-regulator: Add missing type for "pwm-dutycycle-unit" regulator: Switch two more i2c drivers back to use .probe() spi: spi-geni-qcom: Do not do DMA map/unmap inside driver, use framework instead soc: qcom: geni-se: Add interfaces geni_se_tx_init_dma() and geni_se_rx_init_dma() regulator: tps6594-regulator: Add driver for TI TPS6594 regulators regulator: axp20x: Add AXP15060 support regulator: axp20x: Add support for AXP313a variant dt-bindings: pfuze100.yaml: Add an entry for interrupts regulator: stm32-pwr: Fix regulator disabling ... commit e9bd04e52d649c3cfd713b594c5db35cab03c42b Author: Biju Das Date: Wed Jun 28 18:40:04 2023 +0100 regulator: raa215300: Add build dependency with COMMON_CLK The COMMON_CLK config is not enabled in some of the architectures. This causes build issues. Fix these issues by adding build dependency. ERROR: modpost: "clk_unregister_fixed_rate" [drivers/regulator/raa215300.ko] undefined! ERROR: modpost: "clk_register_fixed_rate" [drivers/regulator/raa215300.ko] undefined! Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306282012.sPQAuAN7-lkp@intel.com/ Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230628174004.63984-1-biju.das.jz@bp.renesas.com Reviewed-by: Geert Uytterhoeven Signed-off-by: Mark Brown commit 4171a9aa235988fc5cb19d84d493496cb73e6988 Merge: 1b2c92a1cb246 d0c99ffe21267 Author: Linus Torvalds Date: Wed Jun 28 13:26:19 2023 -0700 Merge tag 'regmap-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "Another busy release for regmap with the second half of the maple tree register cache implementation, there's some smaller optimisations that could be done but this should now be able to replace the rbtree cache for most devices. We also had a followup from Aidan MacDonald's refactoring of some of the regmap-irq interfaces, the conversion is complete so the old interfaces are removed. This means that even with the new features for the maple tree cache we'd have a nice negative diffstat were it not for the addition of a bunch more KUnit coverage. There's one GPIO patch in here, it was a dependency for a cleanup of an API in the regmap-irq code for which the gpio-104-dio-48e driver was the only user. Highlights: - The maple tree cache can now load in default values more efficiently, and is capabale of syncing multiple registers in a single write during cache sync - More KUnit coverage, including some coverage for raw I/O and a dummy RAM backed cache to support it - Removal of several old interfaces in regmap-irq now all users have been modernised" * tag 'regmap-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: (23 commits) regmap: Allow reads from write only registers with the flat cache regmap: Drop early readability check regmap: Check for register readability before checking cache during read regmap: Add test to make sure we don't sync to read only registers regmap: Add a test case for write only registers regmap: Add test that writes to write only registers are prevented regmap: Add debugfs file for forcing field writes regmap: Don't check for changes in regcache_set_val() regmap: maple: Implement block sync for the maple tree cache regmap: Provide basic KUnit coverage for the raw register I/O regmap: Provide a ram backed regmap with raw support regmap: Add missing cache_only checks regmap: regmap-irq: Move handle_post_irq to before pm_runtime_put regmap: Load register defaults in blocks rather than register by register regmap: mmio: Allow passing an empty config->reg_stride regmap-irq: Drop backward compatibility for inverted mask/unmask regmap-irq: Minor adjustments to .handle_mask_sync() regmap-irq: Remove support for not_fixed_stride regmap-irq: Remove type registers regmap-irq: Remove virtual registers ... commit 5ff2977b19769fd24b0cfbe7cbe4d5114b6106af Merge: 2222dcb0775d3 274d4b96b12f7 Author: Dave Airlie Date: Thu Jun 29 06:25:25 2023 +1000 Merge tag 'drm-intel-next-fixes-2023-06-21' of git://anongit.freedesktop.org/drm/drm-intel into drm-next One fix for incorrect error handling in the frame buffer mmap callback, HuC init error handling fix, missing wakeref during GSC init and a build fix when !CONFIG_PROC_FS. Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/ZJLI8ON96ApPTl8H@tursulin-desk commit 1b2c92a1cb2469d8c0079dbf496ab86e22e1cb7c Author: Linus Torvalds Date: Wed Jun 28 12:47:30 2023 -0700 x86/mem_encrypt: Remove stale mem_encrypt_init() declaration The memory encryption initialization logic was moved from init/main.c into arch_cpu_finalize_init() in commit 439e17576eb4 ("init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init()"), but a stale declaration for the init function was left in . And didn't cause any problems if you had X86_MEM_ENCRYPT enabled, which apparently everybody involved did have. See also commit 0a9567ac5e6a ("x86/mem_encrypt: Unbreak the AMD_MEM_ENCRYPT=n build") in this whole sad saga of conflicting declarations for different situations. Reported-by: Matthew Wilcox Fixes: 439e17576eb4 init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() Cc: Thomas Gleixner Signed-off-by: Linus Torvalds commit 6581ccf03e717926be97dc3d27182ce351232f3c Author: Linus Torvalds Date: Wed Jun 28 12:20:24 2023 -0700 mm: fix __access_remote_vm() GUP failure case Commit ca5e863233e8 ("mm/gup: remove vmas parameter from get_user_pages_remote()") removed the vma argument from GUP handling, and instead added a helper function (get_user_page_vma_remote()) that looks it up separately using 'vma_lookup()'. And then converted existing users that needed a vma to use the helper instead. However, the helper function intentionally acts exactly like the old get_user_pages_remote() did, and only fills in 'vma' on successful page lookup. Fine so far. However, __access_remote_vm() wants the vma even for the unsuccessful case, and used to do a vma = vma_lookup(mm, addr); explicitly to look it up when the get_user_page() failed. However, that conversion commit incorrectly removed that vma lookup, thinking that get_user_page_vma_remote() would have done it. Not so. So add the vma_lookup() back in. Fixes: ca5e863233e8 ("mm/gup: remove vmas parameter from get_user_pages_remote()") Cc: Lorenzo Stoakes Cc: David Hildenbrand Cc: Christoph Hellwig Cc: Andrew Morton Signed-off-by: Linus Torvalds commit 77b1a7f7a05c673c187894b4ae898a8c0cdc776c Merge: 6e17c6de3ddf3 4afc9a402aa38 Author: Linus Torvalds Date: Wed Jun 28 10:59:38 2023 -0700 Merge tag 'mm-nonmm-stable-2023-06-24-19-23' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-mm updates from Andrew Morton: - Arnd Bergmann has fixed a bunch of -Wmissing-prototypes in top-level directories - Douglas Anderson has added a new "buddy" mode to the hardlockup detector. It permits the detector to work on architectures which cannot provide the required interrupts, by having CPUs periodically perform checks on other CPUs - Zhen Lei has enhanced kexec's ability to support two crash regions - Petr Mladek has done a lot of cleanup on the hard lockup detector's Kconfig entries - And the usual bunch of singleton patches in various places * tag 'mm-nonmm-stable-2023-06-24-19-23' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (72 commits) kernel/time/posix-stubs.c: remove duplicated include ocfs2: remove redundant assignment to variable bit_off watchdog/hardlockup: fix typo in config HARDLOCKUP_DETECTOR_PREFER_BUDDY powerpc: move arch_trigger_cpumask_backtrace from nmi.h to irq.h devres: show which resource was invalid in __devm_ioremap_resource() watchdog/hardlockup: define HARDLOCKUP_DETECTOR_ARCH watchdog/sparc64: define HARDLOCKUP_DETECTOR_SPARC64 watchdog/hardlockup: make HAVE_NMI_WATCHDOG sparc64-specific watchdog/hardlockup: declare arch_touch_nmi_watchdog() only in linux/nmi.h watchdog/hardlockup: make the config checks more straightforward watchdog/hardlockup: sort hardlockup detector related config values a logical way watchdog/hardlockup: move SMP barriers from common code to buddy code watchdog/buddy: simplify the dependency for HARDLOCKUP_DETECTOR_PREFER_BUDDY watchdog/buddy: don't copy the cpumask in watchdog_next_cpu() watchdog/buddy: cleanup how watchdog_buddy_check_hardlockup() is called watchdog/hardlockup: remove softlockup comment in touch_nmi_watchdog() watchdog/hardlockup: in watchdog_hardlockup_check() use cpumask_copy() watchdog/hardlockup: don't use raw_cpu_ptr() in watchdog_hardlockup_kick() watchdog/hardlockup: HAVE_NMI_WATCHDOG must implement watchdog_hardlockup_probe() watchdog/hardlockup: keep kernel.nmi_watchdog sysctl as 0444 if probe fails ... commit 55e544e1a922d272b62ec576a3de92329f838ce9 Author: Nischala Yelchuri Date: Tue Jun 20 11:40:38 2023 -0700 x86/hyperv: Improve code for referencing hyperv_pcpu_input_arg Several places in code for Hyper-V reference the per-CPU variable hyperv_pcpu_input_arg. Older code uses a multi-line sequence to reference the variable, and usually includes a cast. Newer code does a much simpler direct assignment. The latter is preferable as the complexity of the older code is unnecessary. Update older code to use the simpler direct assignment. Signed-off-by: Nischala Yelchuri Link: https://lore.kernel.org/r/1687286438-9421-1-git-send-email-niyelchu@linux.microsoft.com Signed-off-by: Wei Liu commit a6fe043880820981f6e4918240f967ea79bb063e Author: Kameron Carr Date: Fri Jun 23 15:09:49 2023 -0700 Drivers: hv: Change hv_free_hyperv_page() to take void * argument Currently hv_free_hyperv_page() takes an unsigned long argument, which is inconsistent with the void * return value from the corresponding hv_alloc_hyperv_page() function and variants. This creates unnecessary extra casting. Change the hv_free_hyperv_page() argument type to void *. Also remove redundant casts from invocations of hv_alloc_hyperv_page() and variants. Signed-off-by: Kameron Carr Reviewed-by: Nuno Das Neves Reviewed-by: Dexuan Cui Link: https://lore.kernel.org/r/1687558189-19734-1-git-send-email-kameroncarr@linux.microsoft.com Signed-off-by: Wei Liu commit 47f04616f2c9b2f4f0c9127e30ca515a078db591 Author: Matthias Kaehlcke Date: Tue Jun 27 20:28:01 2023 +0000 dm: verity-loadpin: Add NULL pointer check for 'bdev' parameter Add a NULL check for the 'bdev' parameter of dm_verity_loadpin_is_bdev_trusted(). The function is called by loadpin_check(), which passes the block device that corresponds to the super block of the file system from which a file is being loaded. Generally a super_block structure has an associated block device, however that is not always the case (e.g. tmpfs). Cc: stable@vger.kernel.org # v6.0+ Fixes: b6c1c5745ccc ("dm: Add verity helpers for LoadPin") Signed-off-by: Matthias Kaehlcke Link: https://lore.kernel.org/r/20230627202800.1.Id63f7f59536d20f1ab83e1abdc1fda1471c7d031@changeid Signed-off-by: Kees Cook commit 6e17c6de3ddf3073741d9c91a796ee696914d8a0 Merge: 6aeadf7896bff acc72d59c7509 Author: Linus Torvalds Date: Wed Jun 28 10:28:11 2023 -0700 Merge tag 'mm-stable-2023-06-24-19-15' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull mm updates from Andrew Morton: - Yosry Ahmed brought back some cgroup v1 stats in OOM logs - Yosry has also eliminated cgroup's atomic rstat flushing - Nhat Pham adds the new cachestat() syscall. It provides userspace with the ability to query pagecache status - a similar concept to mincore() but more powerful and with improved usability - Mel Gorman provides more optimizations for compaction, reducing the prevalence of page rescanning - Lorenzo Stoakes has done some maintanance work on the get_user_pages() interface - Liam Howlett continues with cleanups and maintenance work to the maple tree code. Peng Zhang also does some work on maple tree - Johannes Weiner has done some cleanup work on the compaction code - David Hildenbrand has contributed additional selftests for get_user_pages() - Thomas Gleixner has contributed some maintenance and optimization work for the vmalloc code - Baolin Wang has provided some compaction cleanups, - SeongJae Park continues maintenance work on the DAMON code - Huang Ying has done some maintenance on the swap code's usage of device refcounting - Christoph Hellwig has some cleanups for the filemap/directio code - Ryan Roberts provides two patch series which yield some rationalization of the kernel's access to pte entries - use the provided APIs rather than open-coding accesses - Lorenzo Stoakes has some fixes to the interaction between pagecache and directio access to file mappings - John Hubbard has a series of fixes to the MM selftesting code - ZhangPeng continues the folio conversion campaign - Hugh Dickins has been working on the pagetable handling code, mainly with a view to reducing the load on the mmap_lock - Catalin Marinas has reduced the arm64 kmalloc() minimum alignment from 128 to 8 - Domenico Cerasuolo has improved the zswap reclaim mechanism by reorganizing the LRU management - Matthew Wilcox provides some fixups to make gfs2 work better with the buffer_head code - Vishal Moola also has done some folio conversion work - Matthew Wilcox has removed the remnants of the pagevec code - their functionality is migrated over to struct folio_batch * tag 'mm-stable-2023-06-24-19-15' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (380 commits) mm/hugetlb: remove hugetlb_set_page_subpool() mm: nommu: correct the range of mmap_sem_read_lock in task_mem() hugetlb: revert use of page_cache_next_miss() Revert "page cache: fix page_cache_next/prev_miss off by one" mm/vmscan: fix root proactive reclaim unthrottling unbalanced node mm: memcg: rename and document global_reclaim() mm: kill [add|del]_page_to_lru_list() mm: compaction: convert to use a folio in isolate_migratepages_block() mm: zswap: fix double invalidate with exclusive loads mm: remove unnecessary pagevec includes mm: remove references to pagevec mm: rename invalidate_mapping_pagevec to mapping_try_invalidate mm: remove struct pagevec net: convert sunrpc from pagevec to folio_batch i915: convert i915_gpu_error to use a folio_batch pagevec: rename fbatch_count() mm: remove check_move_unevictable_pages() drm: convert drm_gem_put_pages() to use a folio_batch i915: convert shmem_sg_free_table() to use a folio_batch scatterlist: add sg_set_folio() ... commit b2918089d5cb452e928ad9f86c5ee601c592cee3 Author: Rafael J. Wysocki Date: Tue Jun 27 19:50:48 2023 +0200 intel_idle: Add __init annotation to matchup_vm_state_with_baremetal() The caller of (recently added) matchup_vm_state_with_baremetal() is an __init function and it uses some __initdata data structures, so add the __init annotation to it for consistency. This addresses the following build warnings: WARNING: modpost: vmlinux: section mismatch in reference: matchup_vm_state_with_baremetal+0x51 (section: .text) -> intel_idle_max_cstate_reached (section: .init.text) WARNING: modpost: vmlinux: section mismatch in reference: matchup_vm_state_with_baremetal+0x62 (section: .text) -> cpuidle_state_table (section: .init.data) WARNING: modpost: vmlinux: section mismatch in reference: matchup_vm_state_with_baremetal+0x79 (section: .text) -> icpu (section: .init.data) Fixes: 0fac214bb75e ("intel_idle: Add a "Long HLT" C1 state for the VM guest mode") Reported-by: Randy Dunlap Signed-off-by: Rafael J. Wysocki Tested-by: Randy Dunlap # build-tested Reviewed-by: Randy Dunlap commit dfbe5561ae9339516a3742a3fbd678609ad59fd0 Author: Jens Axboe Date: Wed Jun 28 11:06:05 2023 -0600 io_uring: flush offloaded and delayed task_work on exit io_uring offloads task_work for cancelation purposes when the task is exiting. This is conceptually fine, but we should be nicer and actually wait for that work to complete before returning. Add an argument to io_fallback_tw() telling it to flush the deferred work when it's all queued up, and have it flush a ctx behind whenever the ctx changes. Signed-off-by: Jens Axboe commit 49024ec8795ed2bd7217c249ef50a70c4e25d662 Author: Paulo Alcantara Date: Tue Jun 27 21:24:47 2023 -0300 smb: client: fix parsing of source mount option Handle trailing and leading separators when parsing UNC and prefix paths in smb3_parse_devname(). Then, store the sanitised paths in smb3_fs_context::source. This fixes the following cases $ mount //srv/share// /mnt/1 -o ... $ cat /mnt/1/d0/f0 cat: /mnt/1/d0/f0: Invalid argument The -EINVAL was returned because the client sent SMB2_CREATE "\\d0\f0" rather than SMB2_CREATE "\d0\f0". $ mount //srv//share /mnt/1 -o ... mount: Invalid argument The -EINVAL was returned correctly although the client only realised it after sending a couple of bad requests rather than bailing out earlier when parsing mount options. Signed-off-by: Paulo Alcantara (SUSE) Cc: stable@vger.kernel.org Signed-off-by: Steve French commit d439b29057e26464120fc6c18f97433aa003b5fe Author: Paulo Alcantara Date: Tue Jun 27 21:24:49 2023 -0300 smb: client: fix broken file attrs with nodfs mounts *_get_inode_info() functions expect -EREMOTE when query path info calls find a DFS link, regardless whether !CONFIG_CIFS_DFS_UPCALL or 'nodfs' mount option. Otherwise, those files will miss the fake DFS file attributes. Before patch $ mount.cifs //srv/dfs /mnt/1 -o ...,nodfs $ ls -l /mnt/1 ls: cannot access '/mnt/1/link': Operation not supported total 0 -rwxr-xr-x 1 root root 0 Jul 26 2022 dfstest2_file1.txt drwxr-xr-x 2 root root 0 Aug 8 2022 dir1 d????????? ? ? ? ? ? link After patch $ mount.cifs //srv/dfs /mnt/1 -o ...,nodfs $ ls -l /mnt/1 total 0 -rwxr-xr-x 1 root root 0 Jul 26 2022 dfstest2_file1.txt drwxr-xr-x 2 root root 0 Aug 8 2022 dir1 drwx--x--x 2 root root 0 Jun 26 20:29 link Fixes: c877ce47e137 ("cifs: reduce roundtrips on create/qinfo requests") Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 380958ac4f93cca18b0d5775b4682ad1dff87f79 Author: Shyam Prasad N Date: Tue Jun 27 12:09:43 2023 +0000 cifs: print client_guid in DebugData Having the ClientGUID info makes it easier to debug issues related to a client on a server that serves a number of clients. This change prints the ClientGUID in DebugData. Signed-off-by: Shyam Prasad N Acked-by: Tom Talpey Signed-off-by: Steve French commit 66be5c48ee1b5b8c919cc329fe6d32e16badaa40 Author: Winston Wen Date: Mon Jun 26 11:42:57 2023 +0800 cifs: fix session state check in smb2_find_smb_ses Chech the session state and skip it if it's exiting. Signed-off-by: Winston Wen Reviewed-by: Shyam Prasad N Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 99f280700b4cc02d5f141b8d15f8e9fad0418f65 Author: Winston Wen Date: Mon Jun 26 11:42:56 2023 +0800 cifs: fix session state check in reconnect to avoid use-after-free issue Don't collect exiting session in smb2_reconnect_server(), because it will be released soon. Note that the exiting session will stay in server->smb_ses_list until it complete the cifs_free_ipc() and logoff() and then delete itself from the list. Signed-off-by: Winston Wen Reviewed-by: Shyam Prasad N Signed-off-by: Steve French commit 326a8d04f147e2bf393f6f9cdb74126ee6900607 Author: Shyam Prasad N Date: Thu Jun 22 18:16:04 2023 +0000 cifs: do all necessary checks for credits within or before locking All the server credits and in-flight info is protected by req_lock. Once the req_lock is held, and we've determined that we have enough credits to continue, this lock cannot be dropped till we've made the changes to credits and in-flight count. However, we used to drop the lock in order to avoid deadlock with the recent srv_lock. This could cause the checks already made to be invalidated. Fixed it by moving the server status check to before locking req_lock. Fixes: d7d7a66aacd6 ("cifs: avoid use of global locks for high contention data") Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 33f736187d08f6bc822117629f263b97d3df4165 Author: Shyam Prasad N Date: Thu Jun 22 18:16:03 2023 +0000 cifs: prevent use-after-free by freeing the cfile later In smb2_compound_op we have a possible use-after-free which can cause hard to debug problems later on. This was revealed during stress testing with KASAN enabled kernel. Fixing it by moving the cfile free call to a few lines below, after the usage. Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+") Reviewed-by: Paulo Alcantara (SUSE) Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit f5983dab0ead92dc2690d147f0604a0badcac6a8 Author: Masahiro Yamada Date: Wed Jun 28 01:32:05 2023 +0900 modpost: define more R_ARM_* for old distributions On CentOS 7, the following build error occurs. scripts/mod/modpost.c: In function 'addend_arm_rel': scripts/mod/modpost.c:1312:7: error: 'R_ARM_MOVW_ABS_NC' undeclared (first use in this function); did you mean 'R_ARM_THM_ABS5'? case R_ARM_MOVW_ABS_NC: ^~~~~~~~~~~~~~~~~ R_ARM_THM_ABS5 scripts/mod/modpost.c:1312:7: note: each undeclared identifier is reported only once for each function it appears in scripts/mod/modpost.c:1313:7: error: 'R_ARM_MOVT_ABS' undeclared (first use in this function); did you mean 'R_ARM_THM_ABS5'? case R_ARM_MOVT_ABS: ^~~~~~~~~~~~~~ R_ARM_THM_ABS5 scripts/mod/modpost.c:1326:7: error: 'R_ARM_THM_MOVW_ABS_NC' undeclared (first use in this function); did you mean 'R_ARM_THM_ABS5'? case R_ARM_THM_MOVW_ABS_NC: ^~~~~~~~~~~~~~~~~~~~~ R_ARM_THM_ABS5 scripts/mod/modpost.c:1327:7: error: 'R_ARM_THM_MOVT_ABS' undeclared (first use in this function); did you mean 'R_ARM_THM_ABS5'? case R_ARM_THM_MOVT_ABS: ^~~~~~~~~~~~~~~~~~ R_ARM_THM_ABS5 Fixes: 12ca2c67d742 ("modpost: detect section mismatch for R_ARM_{MOVW_ABS_NC,MOVT_ABS}") Fixes: cd1824fb7a37 ("modpost: detect section mismatch for R_ARM_THM_{MOVW_ABS_NC,MOVT_ABS}") Reported-by: Tetsuo Handa Signed-off-by: Masahiro Yamada commit d34a271accf8fad00e05aad2cecb9fb53a840a94 Author: sunliming Date: Mon Jun 26 19:13:44 2023 +0800 selftests/user_events: Add test cases when event is disabled When user_events are disabled, it's write operation should return -EBADF. Add this test cases. Link: https://lkml.kernel.org/r/20230626111344.19136-4-sunliming@kylinos.cn Acked-by: Beau Belgrave Signed-off-by: sunliming Signed-off-by: Steven Rostedt (Google) commit c27b40cf919254459698d6622828152b509b9980 Author: sunliming Date: Mon Jun 26 19:13:43 2023 +0800 selftests/user_events: Enable the event before write_fault test in ftrace self-test The user_event has not be enabled in write_fault test in ftrace self-test, Just enable it. Link: https://lkml.kernel.org/r/20230626111344.19136-3-sunliming@kylinos.cn Acked-by: Beau Belgrave Signed-off-by: sunliming Signed-off-by: Steven Rostedt (Google) commit f6d026eea390d59787a6cdc2ef5c983d02e029d0 Author: sunliming Date: Mon Jun 26 19:13:42 2023 +0800 tracing/user_events: Fix incorrect return value for writing operation when events are disabled The writing operation return the count of writes regardless of whether events are enabled or disabled. Switch it to return -EBADF to indicates that the event is disabled. Link: https://lkml.kernel.org/r/20230626111344.19136-2-sunliming@kylinos.cn Cc: stable@vger.kernel.org 7f5a08c79df35 ("user_events: Add minimal support for trace_event into ftrace") Acked-by: Beau Belgrave Signed-off-by: sunliming Signed-off-by: Steven Rostedt (Google) commit b05740d71bd2f8b2261930944bfe95f529190b8b Author: Okan Sahin Date: Wed Apr 12 14:12:45 2023 +0300 dt-bindings: mfd: max77541: Add ADI MAX77541/MAX77540 Add ADI MAX77541/MAX77540 devicetree document. Signed-off-by: Okan Sahin Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230412111256.40013-5-okan.sahin@analog.com Signed-off-by: Lee Jones commit 04c9a8eb722ff6ebafd95217bed4faf6193e7e46 Author: Okan Sahin Date: Wed Apr 12 14:12:44 2023 +0300 iio: adc: max77541: Add ADI MAX77541 ADC Support The MAX77541 has an 8-bit Successive Approximation Register (SAR) ADC with four multiplexers for supporting the telemetry feature. Signed-off-by: Okan Sahin Reviewed-by: Jonathan Cameron Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230412111256.40013-4-okan.sahin@analog.com Signed-off-by: Lee Jones commit c2b2afe6c8811290e4207dcb1d627def32a970f8 Author: Okan Sahin Date: Wed Apr 12 14:12:43 2023 +0300 regulator: max77541: Add ADI MAX77541/MAX77540 Regulator Support Regulator driver for both MAX77541 and MAX77540. The MAX77541 is a high-efficiency step-down converter with two 3A switching phases for single-cell Li+ battery and 5VDC systems. The MAX77540 is a high-efficiency step-down converter with two 3A switching phases. Signed-off-by: Okan Sahin Reviewed-by: Andy Shevchenko Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20230412111256.40013-3-okan.sahin@analog.com Signed-off-by: Lee Jones commit 8640b38234cf295a6b548fc303e93322464155ad Author: Okan Sahin Date: Wed Apr 12 14:12:42 2023 +0300 dt-bindings: regulator: max77541: Add ADI MAX77541/MAX77540 Regulator Add ADI MAX77541/MAX77540 Regulator devicetree document. Signed-off-by: Okan Sahin Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230412111256.40013-2-okan.sahin@analog.com Signed-off-by: Lee Jones commit 6c26bd4384da24841bac4f067741bbca18b0fb74 Author: David Woodhouse Date: Wed Jun 28 10:55:03 2023 +0100 mm/mmap: Fix error return in do_vmi_align_munmap() If mas_store_gfp() in the gather loop failed, the 'error' variable that ultimately gets returned was not being set. In many cases, its original value of -ENOMEM was still in place, and that was fine. But if VMAs had been split at the start or end of the range, then 'error' could be zero. Change to the 'error = foo(); if (error) goto …' idiom to fix the bug. Also clean up a later case which avoided the same bug by *explicitly* setting error = -ENOMEM right before calling the function that might return -ENOMEM. In a final cosmetic change, move the 'Point of no return' comment to *after* the goto. That's been in the wrong place since the preallocation was removed, and this new error path was added. Fixes: 606c812eb1d5 ("mm/mmap: Fix error path in do_vmi_align_munmap()") Signed-off-by: David Woodhouse Cc: stable@vger.kernel.org Reviewed-by: Greg Kroah-Hartman Reviewed-by: Liam R. Howlett commit 190e2e1177010ab9ffccd5f968500099c247e8e5 Author: Mauro Carvalho Chehab Date: Wed Jun 28 15:03:39 2023 +0200 media: dvb: mb86a20s: get rid of a clang-15 warning When building with clang-15: this warning is produced: ../drivers/media/dvb-frontends/mb86a20s.c:1572:6: error: variable 'active_layers' set but not used [-Werror,-Wunused-but-set-variable] int active_layers = 0, pre_ber_layers = 0, post_ber_layers = 0; ^ 1 error generated. Link: https://lore.kernel.org/linux-media/20230628130339.206261-1-mchehab@kernel.org Signed-off-by: Mauro Carvalho Chehab commit d15e4314abec83e4f910659437bc809b0889e3a5 Author: Sumanth Korikkar Date: Fri Jun 23 15:12:05 2023 +0200 s390/vdso: filter out mno-pic-data-is-text-relative cflag cmd_vdso_check checks if there are any dynamic relocations in vdso64.so.dbg. When kernel is compiled with -mno-pic-data-is-text-relative, R_390_RELATIVE relocs are generated and this results in kernel build error. kpatch uses -mno-pic-data-is-text-relative option when building the kernel to prevent relative addressing between code and data. The flag avoids relocation error when klp text and data are too far apart kpatch does not patch vdso code and hence the mno-pic-data-is-text-relative flag is not essential. Signed-off-by: Sumanth Korikkar Acked-by: Ilya Leoshkevich Signed-off-by: Alexander Gordeev commit 27d45655faa83bde1545251b8a576ab4f1a9e731 Author: Heiko Carstens Date: Thu Jun 22 13:24:40 2023 +0200 s390: consistently use .balign instead of .align The .align directive has inconsistent behavior across architectures. Use .balign instead everywhere. This is a no-op for s390, but with this there is no mix in using .align and .balign anymore. Future code is supposed to use only .balign. Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 938f0c35d7d93a822ab9c9728e3205e8e57409d0 Author: Heiko Carstens Date: Thu Jun 22 14:55:08 2023 +0200 s390/decompressor: fix misaligned symbol build error Nathan Chancellor reported a kernel build error on Fedora 39: $ clang --version | head -1 clang version 16.0.5 (Fedora 16.0.5-1.fc39) $ s390x-linux-gnu-ld --version | head -1 GNU ld version 2.40-1.fc39 $ make -skj"$(nproc)" ARCH=s390 CC=clang CROSS_COMPILE=s390x-linux-gnu- olddefconfig all s390x-linux-gnu-ld: arch/s390/boot/startup.o(.text+0x5b4): misaligned symbol `_decompressor_end' (0x35b0f) for relocation R_390_PC32DBL make[3]: *** [.../arch/s390/boot/Makefile:78: arch/s390/boot/vmlinux] Error 1 It turned out that the problem with misaligned symbols on s390 was fixed with commit 80ddf5ce1c92 ("s390: always build relocatable kernel") for the kernel image, but did not take into account that the decompressor uses its own set of CFLAGS, which come without -fPIE. Add the -fPIE flag also to the decompresser CFLAGS to fix this. Reported-by: Nathan Chancellor Tested-by: Nathan Chancellor Reported-by: CKI Suggested-by: Ulrich Weigand Link: https://github.com/ClangBuiltLinux/linux/issues/1747 Link: https://lore.kernel.org/32935.123062114500601371@us-mta-9.us.mimecast.lan/ Link: https://lore.kernel.org/r/20230622125508.1068457-1-hca@linux.ibm.com Cc: Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 13cf06d57fa8d2313d53ac19fbc8f1f7c751a4c4 Author: Heiko Carstens Date: Wed Jun 21 10:31:23 2023 +0200 s390/zcrypt: use kvmalloc_array() instead of kzalloc() zcrypt_unlocked_ioctl() allocates 256k with kzalloc() which is likely to fail if memory is fragmented. To avoid that use kvmalloc_array() instead, like it is done at several other places for the same reason. Reviewed-by: Harald Freudenberger Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 0dd0bbc2003a33a0e4705f8eec6ba6535b1e49d1 Author: Sven Schnelle Date: Wed Jun 21 09:18:52 2023 +0200 s390/vdso: check for undefined symbols after build When adding an undefined symbol the build still succeeds, but userspace is crashing trying to execute vdso because the undefined symbol is not resolved. Add the check for undefined symbols to prevent this. Signed-off-by: Sven Schnelle Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 51f513fd9659faf00976071a9525474b08764ccb Author: Baoquan He Date: Sun Jun 11 18:37:43 2023 +0800 s390/mm: do not include directly We should always include in ARCH, but not directly. Otherwise, macro defined by ARCH won't be seen and could cause building error. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306100105.8GHnoMCP-lkp@intel.com/ Link: https://lore.kernel.org/all/ZIWrtFMUnRfVP5h0@MiWiFi-R3L-srv/ Signed-off-by: Baoquan He [agordeev@linux.ibm.com changed patch description] Signed-off-by: Alexander Gordeev commit 688fcbbb9c0b023b54cf306cbac54300cef7fa5b Author: Alexander Gordeev Date: Sat Jun 17 22:04:26 2023 +0200 s390/vmem: fix virtual vs physical address confusion Fix virtual vs physical address confusion (which currently are the same). Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 456be42aa713e7f83b467db66ceae779431c7d9d Author: Alexander Gordeev Date: Sat Jun 17 20:58:18 2023 +0200 s390/mm: get rid of VMEM_MAX_PHYS macro VMEM_MAX_PHYS is supposed to be the highest physical address that can be added to the identity mapping. It should match ident_map_size, which has the same meaning. However, unlike ident_map_size it is not adjusted against various limiting factors (see the comment to setup_ident_map_size() function). That renders all checks against VMEM_MAX_PHYS invalid. Further, VMEM_MAX_PHYS is currently set to vmemmap, which is an address in virtual memory space. However, it gets compared against physical addresses in various locations. That works, because both address spaces are the same on s390, but otherwise it is wrong. Instead of fixing VMEM_MAX_PHYS misuse and semantics just remove it. Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 4926a34b1b4e568edcd47b7215718dc187147780 Merge: a64db0b9dfac2 4eecae44a51a1 Author: Takashi Iwai Date: Wed Jun 28 11:44:39 2023 +0200 Merge branch 'topic/midi20' into for-linus Pull a typo fix in MIDI 2.0 helper code. Signed-off-by: Takashi Iwai commit 4eecae44a51a13be2d017cebc4f760173253d238 Author: Takashi Iwai Date: Wed Jun 28 11:43:52 2023 +0200 ALSA: ump: Correct wrong byte size at converting a UMP System message A wrong size for UMP_SYSTEM_STATUS_MIDI_TIME_CODE and case UMP_SYSTEM_STATUS_SONG_SELECT was reported at converting to the legacy MIDI 1.0 stream. This patch corrects the value. Fixes: 0b5288f5fe63 ("ALSA: ump: Add legacy raw MIDI support") Link: https://lore.kernel.org/r/20230628094352.15754-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit a64db0b9dfac2011e14e88faf59847baac1dad5a Author: Takashi Sakamoto Date: Wed Jun 28 08:54:06 2023 +0900 ALSA: fireface: make read-only const array for model names static It is preferable not to populate the constant array for constant strings on the stack. Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20230627235406.289970-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai commit d17f0ce9a9ee1372b9c71b4dc9bd6c8fbe73790f Author: Colin Ian King Date: Tue Jun 27 12:32:53 2023 +0100 ALSA: oxfw: make read-only const array models static Don't populate the const array on the stack, instead make it static. Signed-off-by: Colin Ian King Reviewed-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20230627113253.700065-1-colin.i.king@gmail.com Signed-off-by: Takashi Iwai commit 29f96ac23648b2259f42d40703c47dd18fd172ca Author: Randy Dunlap Date: Thu Jun 8 04:54:35 2023 +0200 media: cec: i2c: ch7322: also select REGMAP Selecting only REGMAP_I2C can leave REGMAP unset, causing build errors, so also select REGMAP to prevent the build errors. ../drivers/media/cec/i2c/ch7322.c:158:21: error: variable 'ch7322_regmap' has initializer but incomplete type 158 | static const struct regmap_config ch7322_regmap = { ../drivers/media/cec/i2c/ch7322.c:159:10: error: 'const struct regmap_config' has no member named 'reg_bits' 159 | .reg_bits = 8, ../drivers/media/cec/i2c/ch7322.c:159:21: warning: excess elements in struct initializer 159 | .reg_bits = 8, ../drivers/media/cec/i2c/ch7322.c:160:10: error: 'const struct regmap_config' has no member named 'val_bits' 160 | .val_bits = 8, ../drivers/media/cec/i2c/ch7322.c:160:21: warning: excess elements in struct initializer 160 | .val_bits = 8, ../drivers/media/cec/i2c/ch7322.c:161:10: error: 'const struct regmap_config' has no member named 'max_register' 161 | .max_register = 0x7f, ../drivers/media/cec/i2c/ch7322.c:161:25: warning: excess elements in struct initializer 161 | .max_register = 0x7f, ../drivers/media/cec/i2c/ch7322.c:162:10: error: 'const struct regmap_config' has no member named 'disable_locking' 162 | .disable_locking = true, ../drivers/media/cec/i2c/ch7322.c:162:28: warning: excess elements in struct initializer 162 | .disable_locking = true, ../drivers/media/cec/i2c/ch7322.c: In function 'ch7322_probe': ../drivers/media/cec/i2c/ch7322.c:468:26: error: implicit declaration of function 'devm_regmap_init_i2c' [-Werror=implicit-function-declaration] 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap); ../drivers/media/cec/i2c/ch7322.c:468:24: warning: assignment to 'struct regmap *' from 'int' makes pointer from integer without a cast [-Wint-conversion] 468 | ch7322->regmap = devm_regmap_init_i2c(client, &ch7322_regmap); ../drivers/media/cec/i2c/ch7322.c: At top level: ../drivers/media/cec/i2c/ch7322.c:158:35: error: storage size of 'ch7322_regmap' isn't known 158 | static const struct regmap_config ch7322_regmap = { Link: https://lore.kernel.org/linux-media/20230608025435.29249-1-rdunlap@infradead.org Fixes: 21b9a47e0ec7 ("media: cec: i2c: ch7322: Add ch7322 CEC controller driver") Signed-off-by: Randy Dunlap Cc: Jeff Chase Cc: Hans Verkuil Cc: Joe Tessler Cc: Arnd Bergmann Cc: Mark Brown Cc: Masahiro Yamada Signed-off-by: Mauro Carvalho Chehab commit 7997604bc90bbb367396dd406ecb50645ab406ef Author: Niklas Schnelle Date: Mon May 22 12:50:23 2023 +0200 media: add HAS_IOPORT dependencies In a future patch HAS_IOPORT=n will result in inb()/outb() and friends not being declared. We thus need to add HAS_IOPORT as dependency for those drivers using them. Link: https://lore.kernel.org/linux-media/20230522105049.1467313-19-schnelle@linux.ibm.com Reviewed-by: Sean Young # media/rc Co-developed-by: Arnd Bergmann Signed-off-by: Arnd Bergmann Signed-off-by: Niklas Schnelle Signed-off-by: Mauro Carvalho Chehab commit 582d4ad468cbc6ef2db4689ff3bd5868d95402c9 Author: Arnd Bergmann Date: Fri Jun 23 17:23:09 2023 +0200 media: tc358746: select CONFIG_GENERIC_PHY The tc358746 driver selects CONFIG_GENERIC_PHY_MIPI_DPHY and links to that, but this fails when CONFIG_GENERIC_PHY is disabled, because Kbuild then never enters the drivers/phy directory for building object files: ERROR: modpost: "phy_mipi_dphy_get_default_config_for_hsclk" [drivers/media/i2c/tc358746.ko] undefined! Add an explicit 'select GENERIC_PHY' here to ensure that the directory is entered, and add another dependency on that symbol so make it more obvious what is going on if another driver has the same problem, as this will produce a Kconfig warning. Link: https://lore.kernel.org/linux-media/20230623152318.2276816-1-arnd@kernel.org Fixes: 80a21da360516 ("media: tc358746: add Toshiba TC358746 Parallel to CSI-2 bridge driver") Signed-off-by: Arnd Bergmann Reviewed-by: Marco Felsch Signed-off-by: Mauro Carvalho Chehab commit 628eaa4e877af8230ef7326d378e15d511c506ba Author: Ian Rogers Date: Tue Jun 27 11:28:34 2023 -0700 perf pmus: Add placeholder core PMU If loading a core PMU fails, legacy hardware/cache events may segv due to there being no PMU. Create a placeholder empty PMU for this case. This was discussed in: https://lore.kernel.org/lkml/20230614151625.2077-1-yangjihong1@huawei.com/ Reported-by: Yang Jihong Tested-by: Yang Jihong Signed-off-by: Ian Rogers Cc: Ravi Bangoria Cc: James Clark Cc: Mark Rutland Cc: Suzuki Poulouse Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Rob Herring Cc: Alexander Shishkin Cc: Kan Liang Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230627182834.117565-1-irogers@google.com Signed-off-by: Namhyung Kim commit 6aeadf7896bff4ca230702daba8788455e6b866e Merge: 582c161cf38cf f40f97aaf7fa6 Author: Linus Torvalds Date: Tue Jun 27 21:52:15 2023 -0700 Merge tag 'docs-arm64-move' of git://git.lwn.net/linux Pull arm64 documentation move from Jonathan Corbet: "Move the arm64 architecture documentation under Documentation/arch/. This brings some order to the documentation directory, declutters the top-level directory, and makes the documentation organization more closely match that of the source" * tag 'docs-arm64-move' of git://git.lwn.net/linux: perf arm-spe: Fix a dangling Documentation/arm64 reference mm: Fix a dangling Documentation/arm64 reference arm64: Fix dangling references to Documentation/arm64 dt-bindings: fix dangling Documentation/arm64 reference docs: arm64: Move arm64 documentation under Documentation/arch/ commit 582c161cf38cf016cd573af6f087fa5fa786949b Merge: 8ad78685ffa6e acf15e07eb065 Author: Linus Torvalds Date: Tue Jun 27 21:24:18 2023 -0700 Merge tag 'hardening-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: "There are three areas of note: A bunch of strlcpy()->strscpy() conversions ended up living in my tree since they were either Acked by maintainers for me to carry, or got ignored for multiple weeks (and were trivial changes). The compiler option '-fstrict-flex-arrays=3' has been enabled globally, and has been in -next for the entire devel cycle. This changes compiler diagnostics (though mainly just -Warray-bounds which is disabled) and potential UBSAN_BOUNDS and FORTIFY _warning_ coverage. In other words, there are no new restrictions, just potentially new warnings. Any new FORTIFY warnings we've seen have been fixed (usually in their respective subsystem trees). For more details, see commit df8fc4e934c12b. The under-development compiler attribute __counted_by has been added so that we can start annotating flexible array members with their associated structure member that tracks the count of flexible array elements at run-time. It is possible (likely?) that the exact syntax of the attribute will change before it is finalized, but GCC and Clang are working together to sort it out. Any changes can be made to the macro while we continue to add annotations. As an example of that last case, I have a treewide commit waiting with such annotations found via Coccinelle: https://git.kernel.org/linus/adc5b3cb48a049563dc673f348eab7b6beba8a9b Also see commit dd06e72e68bcb4 for more details. Summary: - Fix KMSAN vs FORTIFY in strlcpy/strlcat (Alexander Potapenko) - Convert strreplace() to return string start (Andy Shevchenko) - Flexible array conversions (Arnd Bergmann, Wyes Karny, Kees Cook) - Add missing function prototypes seen with W=1 (Arnd Bergmann) - Fix strscpy() kerndoc typo (Arne Welzel) - Replace strlcpy() with strscpy() across many subsystems which were either Acked by respective maintainers or were trivial changes that went ignored for multiple weeks (Azeem Shaikh) - Remove unneeded cc-option test for UBSAN_TRAP (Nick Desaulniers) - Add KUnit tests for strcat()-family - Enable KUnit tests of FORTIFY wrappers under UML - Add more complete FORTIFY protections for strlcat() - Add missed disabling of FORTIFY for all arch purgatories. - Enable -fstrict-flex-arrays=3 globally - Tightening UBSAN_BOUNDS when using GCC - Improve checkpatch to check for strcpy, strncpy, and fake flex arrays - Improve use of const variables in FORTIFY - Add requested struct_size_t() helper for types not pointers - Add __counted_by macro for annotating flexible array size members" * tag 'hardening-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (54 commits) netfilter: ipset: Replace strlcpy with strscpy uml: Replace strlcpy with strscpy um: Use HOST_DIR for mrproper kallsyms: Replace all non-returning strlcpy with strscpy sh: Replace all non-returning strlcpy with strscpy of/flattree: Replace all non-returning strlcpy with strscpy sparc64: Replace all non-returning strlcpy with strscpy Hexagon: Replace all non-returning strlcpy with strscpy kobject: Use return value of strreplace() lib/string_helpers: Change returned value of the strreplace() jbd2: Avoid printing outside the boundary of the buffer checkpatch: Check for 0-length and 1-element arrays riscv/purgatory: Do not use fortified string functions s390/purgatory: Do not use fortified string functions x86/purgatory: Do not use fortified string functions acpi: Replace struct acpi_table_slit 1-element array with flex-array clocksource: Replace all non-returning strlcpy with strscpy string: use __builtin_memcpy() in strlcpy/strlcat staging: most: Replace all non-returning strlcpy with strscpy drm/i2c: tda998x: Replace all non-returning strlcpy with strscpy ... commit 8ad78685ffa6e3836b5b32197bffb03ee3389bec Merge: d416a46c954ef d97038d5ec206 Author: Linus Torvalds Date: Tue Jun 27 21:21:32 2023 -0700 Merge tag 'pstore-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore updates from Kees Cook: - Check for out-of-memory condition (Jiasheng Jiang) - Convert to platform remove callback returning void (Uwe Kleine-König) * tag 'pstore-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore/ram: Add check for kstrdup pstore/ram: Convert to platform remove callback returning void commit d416a46c954ef0b753595ebfe6bb0988a24c2a57 Merge: 98be618ad0301 aa88054b70905 Author: Linus Torvalds Date: Tue Jun 27 21:12:41 2023 -0700 Merge tag 'execve-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve updates from Kees Cook: - Fix a few comments for correctness and typos (Baruch Siach) - Small simplifications for binfmt (Christophe JAILLET) - Set p_align to 4 for PT_NOTE in core dump (Fangrui Song) * tag 'execve-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: binfmt_elf: fix comment typo s/reset/regset/ elf: correct note name comment binfmt: Slightly simplify elf_fdpic_map_file() binfmt: Use struct_size() coredump, vmcore: Set p_align to 4 for PT_NOTE commit 98be618ad03010b1173fc3c35f6cbb4447ee2b07 Merge: b4c7f2e6ef40f 2c085f3a8f23c Author: Linus Torvalds Date: Tue Jun 27 17:58:06 2023 -0700 Merge tag 'Smack-for-6.5' of https://github.com/cschaufler/smack-next Pull smack updates from Casey Schaufler: "There are two patches, both of which change how Smack initializes the SMACK64TRANSMUTE extended attribute. The first corrects the behavior of overlayfs, which creates inodes differently from other filesystems. The second ensures that transmute attributes specified by mount options are correctly assigned" * tag 'Smack-for-6.5' of https://github.com/cschaufler/smack-next: smack: Record transmuting in smk_transmuted smack: Retrieve transmuting information in smack_inode_getsecurity() commit b4c7f2e6ef40f545054a902e4708ed908d562318 Merge: 21953eb16c2a6 95526d13038c2 Author: Linus Torvalds Date: Tue Jun 27 17:32:34 2023 -0700 Merge tag 'integrity-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity subsystem updates from Mimi Zohar: "An i_version change, one bug fix, and three kernel doc fixes: - instead of IMA detecting file change by directly accesssing i_version, it now calls vfs_getattr_nosec(). - fix a race condition when inserting a new node in the iint rb-tree" * tag 'integrity-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: Fix build warnings evm: Fix build warnings evm: Complete description of evm_inode_setattr() integrity: Fix possible multiple allocation in integrity_inode_get() IMA: use vfs_getattr_nosec to get the i_version commit 21953eb16c2a6ebc039126d63acf84b286a58a02 Merge: 729b39ec1bdb7 4be22f16a4a1a Author: Linus Torvalds Date: Tue Jun 27 17:24:26 2023 -0700 Merge tag 'lsm-pr-20230626' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull lsm updates from Paul Moore: - A SafeSetID patch to correct what appears to be a cut-n-paste typo in the code causing a UID to be printed where a GID was desired. This is coming via the LSM tree because we haven't been able to get a response from the SafeSetID maintainer (Micah Morton) in several months. Hopefully we are able to get in touch with Micah, but until we do I'm going to pick them up in the LSM tree. - A small fix to the reiserfs LSM xattr code. We're continuing to work through some issues with the reiserfs code as we try to fixup the LSM xattr handling, but in the process we're uncovering some ugly problems in reiserfs and we may just end up removing the LSM xattr support in reiserfs prior to reiserfs' removal. For better or worse, this shouldn't impact any of the reiserfs users, as we discovered that LSM xattrs on reiserfs were completely broken, meaning no one is currently using the combo of reiserfs and a file labeling LSM. - A tweak to how the cap_user_data_t struct/typedef is declared in the header file to appease the Sparse gods. - In the process of trying to sort out the SafeSetID lost-maintainer problem I realized that I needed to update the labeled networking entry to "Supported". - Minor comment/documentation and spelling fixes. * tag 'lsm-pr-20230626' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: device_cgroup: Fix kernel-doc warnings in device_cgroup SafeSetID: fix UID printed instead of GID MAINTAINERS: move labeled networking to "supported" capability: erase checker warnings about struct __user_cap_data_struct lsm: fix a number of misspellings reiserfs: Initialize sec->length in reiserfs_security_init(). capability: fix kernel-doc warnings in capability.c commit 729b39ec1bdb7e1ca594e14069d05f682d9ab868 Merge: cae72026b5ecf 447a5688005e5 Author: Linus Torvalds Date: Tue Jun 27 17:18:48 2023 -0700 Merge tag 'selinux-pr-20230626' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: - Thanks to help from the MPTCP folks, it looks like we have finally sorted out a proper solution to the MPTCP socket labeling issue, see the new security_mptcp_add_subflow() LSM hook. - Fix the labeled NFS handling such that a labeled NFS share mounted prior to the initial SELinux policy load is properly labeled once a policy is loaded; more information in the commit description. - Two patches to security/selinux/Makefile, the first took the cleanups in v6.4 a bit further and the second removed the grouped targets support as that functionality doesn't appear to be properly supported prior to make v4.3. - Deprecate the "fs" object context type in SELinux policies. The fs object context type was an old vestige that was introduced back in v2.6.12-rc2 but never really used. - A number of small changes that remove dead code, clean up some awkward bits, and generally improve the quality of the code. See the individual commit descriptions for more information. * tag 'selinux-pr-20230626' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: avoid bool as identifier name selinux: fix Makefile for versions of make < v4.3 selinux: make labeled NFS work when mounted before policy load selinux: cleanup exit_sel_fs() declaration selinux: deprecated fs ocon selinux: make header files self-including selinux: keep context struct members in sync selinux: Implement mptcp_add_subflow hook security, lsm: Introduce security_mptcp_add_subflow() selinux: small cleanups in selinux_audit_rule_init() selinux: declare read-only data arrays const selinux: retain const qualifier on string literal in avtab_hash_eval() selinux: drop return at end of void function avc_insert() selinux: avc: drop unused function avc_disable() selinux: adjust typos in comments selinux: do not leave dangling pointer behind selinux: more Makefile tweaks commit cae72026b5ecf059687ccb431cb0e5965e863fea Merge: 26642864f8b21 e455ca40dbcf2 Author: Linus Torvalds Date: Tue Jun 27 17:15:35 2023 -0700 Merge tag 'audit-pr-20230626' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit update from Paul Moore: "A single audit patch that resolves two compiler warnings regarding missing function prototypes" * tag 'audit-pr-20230626' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: avoid missing-prototype warnings commit 26642864f8b212964f80fbd69685eb850ced5f45 Merge: 6e2332e0ab532 35ca423992973 Author: Linus Torvalds Date: Tue Jun 27 17:10:27 2023 -0700 Merge tag 'landlock-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull landlock updates from Mickaël Salaün: "Add support for Landlock to UML. To do this, this fixes the way hostfs manages inodes according to the underlying filesystem [1]. They are now properly handled as for other filesystems, which enables Landlock support (and probably other features). This also extends Landlock's tests with 6 pseudo filesystems, including hostfs" [1] https://lore.kernel.org/all/20230612191430.339153-1-mic@digikod.net/ * tag 'landlock-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: selftests/landlock: Add hostfs tests selftests/landlock: Add tests for pseudo filesystems selftests/landlock: Make mounts configurable selftests/landlock: Add supports_filesystem() helper selftests/landlock: Don't create useless file layouts hostfs: Fix ephemeral inodes commit 6e2332e0ab532eb01f1fde39080dbfa9bf65c4cf Merge: 72dc6db7e3b69 81621430c81bb Author: Linus Torvalds Date: Tue Jun 27 16:54:21 2023 -0700 Merge tag 'cgroup-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: - Whenever cpuset needs to rebuild sched_domain, it walked all tasks looking for DEADLINE tasks as they need to be accounted on the new domain. Walking all tasks can be expensive and there may not be any DEADLINE tasks at all. Task iteration is now omitted if there are no DEADLINE tasks - Fixes DEADLINE bandwidth misaccounting after task migration failures - When no controller is enabled, -Wstringop-overflow warning is triggered. The fix patch added an early exit which is too eager and got reverted for now. Will fix later - Everything else is minor cleanups * tag 'cgroup-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: Revert "cgroup: Avoid -Wstringop-overflow warnings" cgroup/misc: Expose misc.current on cgroup v2 root cgroup: Avoid -Wstringop-overflow warnings cgroup: remove obsolete comment on cgroup_on_dfl() cgroup: remove unused task_cgroup_path() cgroup/cpuset: remove unneeded header files cgroup: make cgroup_is_threaded() and cgroup_is_thread_root() static rdmacg: fix kernel-doc warnings in rdmacg cgroup: Replace the css_set call with cgroup_get cgroup: remove unused macro for_each_e_css() cgroup: Update out-of-date comment in cgroup_migrate() cgroup: Replace all non-returning strlcpy with strscpy cgroup/cpuset: remove unneeded header files cgroup/cpuset: Free DL BW in case can_attach() fails sched/deadline: Create DL BW alloc, free & check overflow interface cgroup/cpuset: Iterate only if DEADLINE tasks are present sched/cpuset: Keep track of SCHED_DEADLINE task in cpusets sched/cpuset: Bring back cpuset_mutex cgroup/cpuset: Rename functions dealing with DEADLINE accounting commit 72dc6db7e3b692f46f3386b8dd5101d3f431adef Merge: 7ab044a4f42ae 78ef970385ea4 Author: Linus Torvalds Date: Tue Jun 27 16:46:06 2023 -0700 Merge tag 'wq-for-6.5-cleanup-ordered' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull ordered workqueue creation updates from Tejun Heo: "For historical reasons, unbound workqueues with max concurrency limit of 1 are considered ordered, even though the concurrency limit hasn't been system-wide for a long time. This creates ambiguity around whether ordered execution is actually required for correctness, which was actually confusing for e.g. btrfs (btrfs updates are being routed through the btrfs tree). There aren't that many users in the tree which use the combination and there are pending improvements to unbound workqueue affinity handling which will make inadvertent use of ordered workqueue a bigger loss. This clarifies the situation for most of them by updating the ones which require ordered execution to use alloc_ordered_workqueue(). There are some conversions being routed through subsystem-specific trees and likely a few stragglers. Once they're all converted, workqueue can trigger a warning on unbound + @max_active==1 usages and eventually drop the implicit ordered behavior" * tag 'wq-for-6.5-cleanup-ordered' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: rxrpc: Use alloc_ordered_workqueue() to create ordered workqueues net: qrtr: Use alloc_ordered_workqueue() to create ordered workqueues net: wwan: t7xx: Use alloc_ordered_workqueue() to create ordered workqueues dm integrity: Use alloc_ordered_workqueue() to create ordered workqueues media: amphion: Use alloc_ordered_workqueue() to create ordered workqueues scsi: NCR5380: Use default @max_active for hostdata->work_q media: coda: Use alloc_ordered_workqueue() to create ordered workqueues crypto: octeontx2: Use alloc_ordered_workqueue() to create ordered workqueues wifi: ath10/11/12k: Use alloc_ordered_workqueue() to create ordered workqueues wifi: mwifiex: Use default @max_active for workqueues wifi: iwlwifi: Use default @max_active for trans_pcie->rba.alloc_wq xen/pvcalls: Use alloc_ordered_workqueue() to create ordered workqueues virt: acrn: Use alloc_ordered_workqueue() to create ordered workqueues net: octeontx2: Use alloc_ordered_workqueue() to create ordered workqueues net: thunderx: Use alloc_ordered_workqueue() to create ordered workqueues greybus: Use alloc_ordered_workqueue() to create ordered workqueues powerpc, workqueue: Use alloc_ordered_workqueue() to create ordered workqueues commit 7ab044a4f42aecba23db5ce96e763e5ec807bf42 Merge: 18eb3b6dff007 18c8ae813156a Author: Linus Torvalds Date: Tue Jun 27 16:32:52 2023 -0700 Merge tag 'wq-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: - Concurrency-managed per-cpu work items that hog CPUs and delay the execution of other work items are now automatically detected and excluded from concurrency management. Reporting on such work items can also be enabled through a config option. - Added tools/workqueue/wq_monitor.py which improves visibility into workqueue usages and behaviors. - Arnd's minimal fix for gcc-13 enum warning on 32bit compiles, superseded by commit afa4bb778e48 in mainline. * tag 'wq-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Disable per-cpu CPU hog detection when wq_cpu_intensive_thresh_us is 0 workqueue: Fix WARN_ON_ONCE() triggers in worker_enter_idle() workqueue: fix enum type for gcc-13 workqueue: Track and monitor per-workqueue CPU time usage workqueue: Report work funcs that trigger automatic CPU_INTENSIVE mechanism workqueue: Automatically mark CPU-hogging work items CPU_INTENSIVE workqueue: Improve locking rule description for worker fields workqueue: Move worker_set/clr_flags() upwards workqueue: Re-order struct worker fields workqueue: Add pwq->stats[] and a monitoring script Further upgrade queue_work_on() comment commit 18eb3b6dff007f2e4ef4f0d8567dfb5cdb6086fc Merge: 6a46676994607 fb9b7b4b2b82d Author: Linus Torvalds Date: Tue Jun 27 16:03:20 2023 -0700 Merge tag 'for-linus-6.5-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - three patches adding missing prototypes - a fix for finding the iBFT in a Xen dom0 for supporting diskless iSCSI boot * tag 'for-linus-6.5-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: x86: xen: add missing prototypes x86/xen: add prototypes for paravirt mmu functions iscsi_ibft: Fix finding the iBFT under Xen Dom 0 xen: xen_debug_interrupt prototype to global header commit 71baec7b8500c92f9723f39d06a7ae465483da1f Author: Davidlohr Bueso Date: Tue Jun 27 01:02:02 2023 -0700 cxl/pci: Use correct flag for sanitize polling This is a bogus value, left behind from a previous version. Fixes: 0c36b6ad436a ("cxl/mbox: Add sanitization handling machinery") Signed-off-by: Davidlohr Bueso Link: https://lore.kernel.org/r/7q3vcjqidtmxmys4n34g6b3mygvhaen7yikzxanpz56lw43fz7@7subbtbfkmyx Signed-off-by: Dan Williams commit 6a46676994607a1bde51cba71c1b0d373a555f45 Merge: 8d8026f376c8e 9b9cf3c77e7e0 Author: Linus Torvalds Date: Tue Jun 27 15:49:10 2023 -0700 Merge tag 's390-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Alexander Gordeev: - Fix the style of protected key API driver source: use x-mas tree for all local variable declarations - Rework protected key API driver to not use the struct pkey_protkey and pkey_clrkey anymore. Both structures have a fixed size buffer, but with the support of ECC protected key these buffers are not big enough. Use dynamic buffers internally and transparently for userspace - Add support for a new 'non CCA clear key token' with ECC clear keys supported: ECC P256, ECC P384, ECC P521, ECC ED25519 and ECC ED448. This makes it possible to derive a protected key from the ECC clear key input via PKEY_KBLOB2PROTK3 ioctl, while currently the only way to derive is via PCKMO instruction - The s390 PMU of PAI crypto and extension 1 NNPA counters use atomic_t for reference counting. Replace this with the proper data type refcount_t - Select ARCH_SUPPORTS_INT128, but limit this to clang for now, since gcc generates inefficient code, which may lead to stack overflows - Replace one-element array with flexible-array member in struct vfio_ccw_parent and refactor the rest of the code accordingly. Also, prefer struct_size() over sizeof() open- coded versions - Introduce OS_INFO_FLAGS_ENTRY pointing to a flags field and OS_INFO_FLAG_REIPL_CLEAR flag that informs a dumper whether the system memory should be cleared or not once dumped - Fix a hang when a user attempts to remove a VFIO-AP mediated device attached to a guest: add VFIO_DEVICE_GET_IRQ_INFO and VFIO_DEVICE_SET_IRQS IOCTLs and wire up the VFIO bus driver callback to request a release of the device - Fix calculation for R_390_GOTENT relocations for modules - Allow any user space process with CAP_PERFMON capability read and display the CPU Measurement facility counter sets - Rework large statically-defined per-CPU cpu_cf_events data structure and replace it with dynamically allocated structures created when a perf_event_open() system call is invoked or /dev/hwctr device is accessed * tag 's390-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/cpum_cf: rework PER_CPU_DEFINE of struct cpu_cf_events s390/cpum_cf: open access to hwctr device for CAP_PERFMON privileged process s390/module: fix rela calculation for R_390_GOTENT s390/vfio-ap: wire in the vfio_device_ops request callback s390/vfio-ap: realize the VFIO_DEVICE_SET_IRQS ioctl s390/vfio-ap: realize the VFIO_DEVICE_GET_IRQ_INFO ioctl s390/pkey: add support for ecc clear key s390/pkey: do not use struct pkey_protkey s390/pkey: introduce reverse x-mas trees s390/zcore: conditionally clear memory on reipl s390/ipl: add REIPL_CLEAR flag to os_info vfio/ccw: use struct_size() helper vfio/ccw: replace one-element array with flexible-array member s390: select ARCH_SUPPORTS_INT128 s390/pai_ext: replace atomic_t with refcount_t s390/pai_crypto: replace atomic_t with refcount_t commit 8d8026f376c8e46cc90c59de91256d8ee4322ad8 Merge: 0ae612299621b f7667ca106df5 Author: Linus Torvalds Date: Tue Jun 27 15:44:11 2023 -0700 Merge tag 'xtensa-20230627' of https://github.com/jcmvbkbc/linux-xtensa Pull xtensa updates from Max Filippov: - clean up platform_* interface of the xtensa architecture - enable HAVE_ASM_MODVERSIONS - drop ARCH_WANT_FRAME_POINTERS - clean up unaligned access exception handler - provide handler for load/store exceptions - various small fixes and cleanups * tag 'xtensa-20230627' of https://github.com/jcmvbkbc/linux-xtensa: xtensa: dump userspace code around the exception PC xtensa: rearrange show_stack output xtensa: add load/store exception handler xtensa: rearrange unaligned exception handler xtensa: always install slow handler for unaligned access exception xtensa: move early_trap_init from kasan_early_init to init_arch xtensa: drop ARCH_WANT_FRAME_POINTERS xtensa: report trax and perf counters in cpuinfo xtensa: add asm-prototypes.h xtensa: only build __strncpy_user with CONFIG_ARCH_HAS_STRNCPY_FROM_USER xtensa: drop bcopy implementation xtensa: drop EXPORT_SYMBOL for common_exception_return xtensa: boot-redboot: clean up Makefile xtensa: clean up default platform functions xtensa: drop platform_halt and platform_power_off xtensa: drop platform_restart xtensa: drop platform_heartbeat xtensa: xt2000: drop empty platform_init commit 0ae612299621b5ae76bec55cc92503b6ed3f554b Author: Dinh Nguyen Date: Tue Jun 27 17:14:30 2023 -0500 Revert "nios2: Convert __pte_free_tlb() to use ptdescs" This reverts commit 6ebe94baa2b9ddf3ccbb7f94df6ab26234532734. The patch "nios2: Convert __pte_free_tlb() to use ptdescs" was supposed to go together with a patchset that Vishal Moola had planned taking it through the mm tree. By just having this patch, all NIOS2 builds are broken. Signed-off-by: Dinh Nguyen Signed-off-by: Linus Torvalds commit 10e1c0d59006c6492d380602aa0a6c4eb9441426 Author: Jens Axboe Date: Tue Jun 27 11:57:53 2023 -0600 io_uring: remove io_fallback_tw() forward declaration It's used just one function higher up, get rid of the declaration and just move it up a bit. Signed-off-by: Jens Axboe commit b65db9211ecb7f8383e02dcf71b8c1e9c7043a40 Author: Jens Axboe Date: Tue Jun 27 12:05:01 2023 -0600 io_uring/net: use proper value for msg_inq struct msghdr->msg_inq is a signed type, yet we attempt to store what is essentially an unsigned bitmask in there. We only really need to know if the field was stored or not, but let's use the proper type to avoid any misunderstandings on what is being attempted here. Link: https://lore.kernel.org/io-uring/CAHk-=wjKb24aSe6fE4zDH-eh8hr-FB9BbukObUVSMGOrsBHCRQ@mail.gmail.com/ Reported-by: Linus Torvalds Signed-off-by: Jens Axboe commit 6f612579be9d0ff527ca2e517e10bfaf08cc1860 Merge: 4d6751815b1d3 301cf77e21317 Author: Linus Torvalds Date: Tue Jun 27 15:05:41 2023 -0700 Merge tag 'objtool-core-2023-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool updates from Ingo Molar: "Build footprint & performance improvements: - Reduce memory usage with CONFIG_DEBUG_INFO=y In the worst case of an allyesconfig+CONFIG_DEBUG_INFO=y kernel, DWARF creates almost 200 million relocations, ballooning objtool's peak heap usage to 53GB. These patches reduce that to 25GB. On a distro-type kernel with kernel IBT enabled, they reduce objtool's peak heap usage from 4.2GB to 2.8GB. These changes also improve the runtime significantly. Debuggability improvements: - Add the unwind_debug command-line option, for more extend unwinding debugging output - Limit unreachable warnings to once per function - Add verbose option for disassembling affected functions - Include backtrace in verbose mode - Detect missing __noreturn annotations - Ignore exc_double_fault() __noreturn warnings - Remove superfluous global_noreturns entries - Move noreturn function list to separate file - Add __kunit_abort() to noreturns Unwinder improvements: - Allow stack operations in UNWIND_HINT_UNDEFINED regions - drm/vmwgfx: Add unwind hints around RBP clobber Cleanups: - Move the x86 entry thunk restore code into thunk functions - x86/unwind/orc: Use swap() instead of open coding it - Remove unnecessary/unused variables Fixes for modern stack canary handling" * tag 'objtool-core-2023-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (42 commits) x86/orc: Make the is_callthunk() definition depend on CONFIG_BPF_JIT=y objtool: Skip reading DWARF section data objtool: Free insns when done objtool: Get rid of reloc->rel[a] objtool: Shrink elf hash nodes objtool: Shrink reloc->sym_reloc_entry objtool: Get rid of reloc->jump_table_start objtool: Get rid of reloc->addend objtool: Get rid of reloc->type objtool: Get rid of reloc->offset objtool: Get rid of reloc->idx objtool: Get rid of reloc->list objtool: Allocate relocs in advance for new rela sections objtool: Add for_each_reloc() objtool: Don't free memory in elf_close() objtool: Keep GElf_Rel[a] structs synced objtool: Add elf_create_section_pair() objtool: Add mark_sec_changed() objtool: Fix reloc_hash size objtool: Consolidate rel/rela handling ... commit 4d6751815b1d3057423b3feb156bd1525b7183e2 Merge: a193cc7506fde 78841cd185aa7 Author: Linus Torvalds Date: Tue Jun 27 14:47:17 2023 -0700 Merge tag 'x86-mm-2023-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm updates from Ingo Molnar: - Remove Xen-PV leftovers from init_32.c - Fix __swp_entry_to_pte() warning splat for Xen PV guests, triggered on CONFIG_DEBUG_VM_PGTABLE=y * tag 'x86-mm-2023-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Remove Xen-PV leftovers from init_32.c x86/mm: Fix __swp_entry_to_pte() for Xen PV guests commit a193cc7506fde23185a7c0d99474a03a8ec5ee4c Merge: bc6cb4d5bc3a4 228020b490eda Author: Linus Torvalds Date: Tue Jun 27 14:43:02 2023 -0700 Merge tag 'perf-core-2023-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf events updates from Ingo Molnar: - Rework & fix the event forwarding logic by extending the core interface. This fixes AMD PMU events that have to be forwarded from the core PMU to the IBS PMU. - Add self-tests to test AMD IBS invocation via core PMU events - Clean up Intel FixCntrCtl MSR encoding & handling * tag 'perf-core-2023-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Re-instate the linear PMU search perf/x86/intel: Define bit macros for FixCntrCtl MSR perf test: Add selftest to test IBS invocation via core pmu events perf/core: Remove pmu linear searching code perf/ibs: Fix interface via core pmu events perf/core: Rework forwarding of {task|cpu}-clock events commit bc6cb4d5bc3a44197de30784eae71d8ba28483eb Merge: ed3b7923a816d b33eb50a92b0a Author: Linus Torvalds Date: Tue Jun 27 14:14:30 2023 -0700 Merge tag 'locking-core-2023-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: - Introduce cmpxchg128() -- aka. the demise of cmpxchg_double() The cmpxchg128() family of functions is basically & functionally the same as cmpxchg_double(), but with a saner interface. Instead of a 6-parameter horror that forced u128 - u64/u64-halves layout details on the interface and exposed users to complexity, fragility & bugs, use a natural 3-parameter interface with u128 types. - Restructure the generated atomic headers, and add kerneldoc comments for all of the generic atomic{,64,_long}_t operations. The generated definitions are much cleaner now, and come with documentation. - Implement lock_set_cmp_fn() on lockdep, for defining an ordering when taking multiple locks of the same type. This gets rid of one use of lockdep_set_novalidate_class() in the bcache code. - Fix raw_cpu_generic_try_cmpxchg() bug due to an unintended variable shadowing generating garbage code on Clang on certain ARM builds. * tag 'locking-core-2023-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (43 commits) locking/atomic: scripts: fix ${atomic}_dec_if_positive() kerneldoc percpu: Fix self-assignment of __old in raw_cpu_generic_try_cmpxchg() locking/atomic: treewide: delete arch_atomic_*() kerneldoc locking/atomic: docs: Add atomic operations to the driver basic API documentation locking/atomic: scripts: generate kerneldoc comments docs: scripts: kernel-doc: accept bitwise negation like ~@var locking/atomic: scripts: simplify raw_atomic*() definitions locking/atomic: scripts: simplify raw_atomic_long*() definitions locking/atomic: scripts: split pfx/name/sfx/order locking/atomic: scripts: restructure fallback ifdeffery locking/atomic: scripts: build raw_atomic_long*() directly locking/atomic: treewide: use raw_atomic*_() locking/atomic: scripts: add trivial raw_atomic*_() locking/atomic: scripts: factor out order template generation locking/atomic: scripts: remove leftover "${mult}" locking/atomic: scripts: remove bogus order parameter locking/atomic: xtensa: add preprocessor symbols locking/atomic: x86: add preprocessor symbols locking/atomic: sparc: add preprocessor symbols locking/atomic: sh: add preprocessor symbols ... commit ed3b7923a816ded62dccef377c9ee346c7d3b1b4 Merge: e8f75c0270d93 ebb83d84e49b5 Author: Linus Torvalds Date: Tue Jun 27 14:03:21 2023 -0700 Merge tag 'sched-core-2023-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "Scheduler SMP load-balancer improvements: - Avoid unnecessary migrations within SMT domains on hybrid systems. Problem: On hybrid CPU systems, (processors with a mixture of higher-frequency SMT cores and lower-frequency non-SMT cores), under the old code lower-priority CPUs pulled tasks from the higher-priority cores if more than one SMT sibling was busy - resulting in many unnecessary task migrations. Solution: The new code improves the load balancer to recognize SMT cores with more than one busy sibling and allows lower-priority CPUs to pull tasks, which avoids superfluous migrations and lets lower-priority cores inspect all SMT siblings for the busiest queue. - Implement the 'runnable boosting' feature in the EAS balancer: consider CPU contention in frequency, EAS max util & load-balance busiest CPU selection. This improves CPU utilization for certain workloads, while leaves other key workloads unchanged. Scheduler infrastructure improvements: - Rewrite the scheduler topology setup code by consolidating it into the build_sched_topology() helper function and building it dynamically on the fly. - Resolve the local_clock() vs. noinstr complications by rewriting the code: provide separate sched_clock_noinstr() and local_clock_noinstr() functions to be used in instrumentation code, and make sure it is all instrumentation-safe. Fixes: - Fix a kthread_park() race with wait_woken() - Fix misc wait_task_inactive() bugs unearthed by the -rt merge: - Fix UP PREEMPT bug by unifying the SMP and UP implementations - Fix task_struct::saved_state handling - Fix various rq clock update bugs, unearthed by turning on the rq clock debugging code. - Fix the PSI WINDOW_MIN_US trigger limit, which was easy to trigger by creating enough cgroups, by removing the warnign and restricting window size triggers to PSI file write-permission or CAP_SYS_RESOURCE. - Propagate SMT flags in the topology when removing degenerate domain - Fix grub_reclaim() calculation bug in the deadline scheduler code - Avoid resetting the min update period when it is unnecessary, in psi_trigger_destroy(). - Don't balance a task to its current running CPU in load_balance(), which was possible on certain NUMA topologies with overlapping groups. - Fix the sched-debug printing of rq->nr_uninterruptible Cleanups: - Address various -Wmissing-prototype warnings, as a preparation to (maybe) enable this warning in the future. - Remove unused code - Mark more functions __init - Fix shadow-variable warnings" * tag 'sched-core-2023-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (50 commits) sched/core: Avoid multiple calling update_rq_clock() in __cfsb_csd_unthrottle() sched/core: Avoid double calling update_rq_clock() in __balance_push_cpu_stop() sched/core: Fixed missing rq clock update before calling set_rq_offline() sched/deadline: Update GRUB description in the documentation sched/deadline: Fix bandwidth reclaim equation in GRUB sched/wait: Fix a kthread_park race with wait_woken() sched/topology: Mark set_sched_topology() __init sched/fair: Rename variable cpu_util eff_util arm64/arch_timer: Fix MMIO byteswap sched/fair, cpufreq: Introduce 'runnable boosting' sched/fair: Refactor CPU utilization functions cpuidle: Use local_clock_noinstr() sched/clock: Provide local_clock_noinstr() x86/tsc: Provide sched_clock_noinstr() clocksource: hyper-v: Provide noinstr sched_clock() clocksource: hyper-v: Adjust hv_read_tsc_page_tsc() to avoid special casing U64_MAX x86/vdso: Fix gettimeofday masking math64: Always inline u128 version of mul_u64_u64_shr() s390/time: Provide sched_clock_noinstr() loongarch: Provide noinstr sched_clock_read() ... commit 356fa4975950d48d12b6ee9f9050ad429db25852 Merge: 3f711c249032f fb9c384625dd6 Author: Arnd Bergmann Date: Tue Jun 27 22:54:28 2023 +0200 Merge tag 'soc-fsl-next-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/leo/linux into soc/drivers NXP/FSL SoC driver updates for v6.5 - fsl-mc: Make remove function return void - QE USB: fix build issue caused by missing dependency * tag 'soc-fsl-next-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/leo/linux: bus: fsl-mc: fsl-mc-allocator: Drop a write-only variable bus: fsl-mc: fsl-mc-allocator: Initialize mc_bus_dev before use soc/fsl/qe: fix usb.c build errors bus: fsl-mc: Make remove function return void soc: fsl: dpio: Suppress duplicated error reporting on device remove bus: fsl-mc: fsl-mc-allocator: Improve error reporting bus: fsl-mc: fsl-mc-allocator: Drop if block with always wrong condition bus: fsl-mc: dprc: Push down error message from fsl_mc_driver_remove() bus: fsl-mc: Only warn once about errors on device unbind Link: https://lore.kernel.org/r/20230621222503.12402-1-leoyang.li@nxp.com Signed-off-by: Arnd Bergmann commit e8f75c0270d930ef675fee22d74d1a3250e96962 Merge: 12dc010071131 1e327963cfab0 Author: Linus Torvalds Date: Tue Jun 27 13:49:33 2023 -0700 Merge tag 'x86_sgx_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull SGX update from Borislav Petkov: - A fix to avoid using a list iterator variable after the loop it is used in * tag 'x86_sgx_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sgx: Avoid using iterator after loop in sgx_mmu_notifier_release() commit b571809ec3b0af1a93d46bb09fece4ddeafe5a97 Merge: ef4ca0517c860 9a6c0e28e2155 Author: Jiri Kosina Date: Tue Jun 27 22:43:39 2023 +0200 Merge branch 'for-6.5/wacom' into for-linus - touch selftests for hid-wacom (Joshua Dickens) - conversion of hid-wacom to use ktime_t (Jason Gerecke) commit ef4ca0517c860b34fe4f112960ef40c4e3e9f39b Merge: f5e3e50b7df8c f88af60e74a5b Author: Jiri Kosina Date: Tue Jun 27 22:42:48 2023 +0200 Merge branch 'for-6.5/nvidia' into for-linus - support for nVidia Thunderstrike (SHIELD 2017) controller (Rahul Rameshbabu) commit f5e3e50b7df8c3dbb79a17eebc10da5f5133f2a6 Merge: 278cc2f13d803 e4b880758a918 Author: Jiri Kosina Date: Tue Jun 27 22:42:28 2023 +0200 Merge branch 'for-6.5/i2c-hid' into for-linus commit 278cc2f13d8031e23b04744de739310257eaf6b2 Merge: 1639f986e37ad 7607f12ba735f Author: Jiri Kosina Date: Tue Jun 27 22:41:03 2023 +0200 Merge branch 'for-6.5/goodix' into for-linus - power management reset-during-suspend fix for goodix Chromebook devices (Fei Shao) commit 1639f986e37ada6407f21825dd079ca3c17141b7 Merge: e80b500370e71 49904a0ebf23b Author: Jiri Kosina Date: Tue Jun 27 22:38:37 2023 +0200 Merge branch 'for-6.5/core' into for-linus - more bullet-proof handling of devres-managed resources in HID core (Dmitry Torokhov) - kunit test Kconfig dependency fix (Geert Uytterhoeven) commit e80b500370e71b8cd7dd64be4080cee0a3e5068f Merge: 177d591aba383 72e49cadea390 Author: Jiri Kosina Date: Tue Jun 27 22:37:24 2023 +0200 Merge branch 'for-6.5/apple' into for-linus - improved support for Keychron K8 keyboard (Lasse Brun) commit 177d591aba3838abc13968a25a3b339b420d97ca Merge: e7de761b027ed 19b60accb67b6 Author: Jiri Kosina Date: Tue Jun 27 22:32:06 2023 +0200 Merge branch 'for-6.5/amd-sfh' into for-linus - amd-sfh driver code cleanups (Basavaraj Natikar) commit e7de761b027ed92bf7cef45cb3880e94c3f2bc75 Merge: 944ee77dc6ec7 e6c7e2711df65 Author: Jiri Kosina Date: Tue Jun 27 22:30:34 2023 +0200 Merge branch 'for-6.5/acer' into for-linus - ASUS ROG Z13 keyboard support and other assorted fixes to hid-asus (Luke D. Jones) commit 12dc010071131aeabd6626a14809e6d3af266bd4 Merge: dc43fc753bb59 da86eb9611840 Author: Linus Torvalds Date: Tue Jun 27 13:26:30 2023 -0700 Merge tag 'x86_sev_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 SEV updates from Borislav Petkov: - Some SEV and CC platform helpers cleanup and simplifications now that the usage patterns are becoming apparent [ I'm sure I'm the only one that has gets confused by all the TLAs, but in case there are others: here SEV is AMD's "Secure Encrypted Virtualization" and CC is generic "Confidential Computing". There's also Intel SGX (Software Guard Extensions) and TDX (Trust Domain Extensions), along with all the vendor memory encryption extensions (SME, TSME, TME, and WTF). And then we have arm64 with RMA and CCA, and I probably forgot another dozen or so related acronyms - Linus ] * tag 'x86_sev_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/coco: Get rid of accessor functions x86/sev: Get rid of special sev_es_enable_key x86/coco: Mark cc_platform_has() and descendants noinstr commit dc43fc753bb5946e91ccdce9f393074675379a00 Merge: 4baa098a147d7 30d65d1b19850 Author: Linus Torvalds Date: Tue Jun 27 13:11:32 2023 -0700 Merge tag 'x86_mtrr_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mtrr updates from Borislav Petkov: "A serious scrubbing of the MTRR code including adding a new map mechanism in order to look up the memory type of a region easily. Also address memory range lookup issues like returning an invalid memory type. Furthermore, this handles the decoupling of PAT from MTRR more naturally. All work by Juergen Gross" * tag 'x86_mtrr_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/xen: Set default memory type for PV guests to WB x86/mtrr: Unify debugging printing x86/mtrr: Remove unused code x86/mm: Only check uniform after calling mtrr_type_lookup() x86/mtrr: Don't let mtrr_type_lookup() return MTRR_TYPE_INVALID x86/mtrr: Use new cache_map in mtrr_type_lookup() x86/mtrr: Add mtrr=debug command line option x86/mtrr: Construct a memory map with cache modes x86/mtrr: Add get_effective_type() service function x86/mtrr: Allocate mtrr_value array dynamically x86/mtrr: Move 32-bit code from mtrr.c to legacy.c x86/mtrr: Have only one set_mtrr() variant x86/mtrr: Replace vendor tests in MTRR code x86/xen: Set MTRR state when running as Xen PV initial domain x86/hyperv: Set MTRR state when running as SEV-SNP Hyper-V guest x86/mtrr: Support setting MTRR state for software defined MTRRs x86/mtrr: Replace size_or_mask and size_and_mask with a much easier concept x86/mtrr: Remove physical address size calculation commit e2c789cab60a493a72b42cb53eb5fbf96d5f1ae3 Author: Mikulas Patocka Date: Mon Jun 26 16:48:40 2023 +0200 dm: get rid of GFP_NOIO workarounds for __vmalloc and kvmalloc In the past, the function __vmalloc didn't respect the GFP flags - it allocated memory with the provided gfp flags, but it allocated page tables with GFP_KERNEL. This was fixed in commit 451769ebb7e7 ("mm/vmalloc: alloc GFP_NO{FS,IO} for vmalloc") so the memalloc_noio_{save,restore} workaround is no longer needed. The function kvmalloc didn't like flags different from GFP_KERNEL. This was fixed in commit a421ef303008 ("mm: allow !GFP_KERNEL allocations for kvmalloc"), so kvmalloc can now be called with GFP_NOIO. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 3be1622895af25101f7046ed0b2286bead2219d4 Author: Mikulas Patocka Date: Mon Jun 26 16:46:57 2023 +0200 dm integrity: scale down the recalculate buffer if memory allocation fails If memory allocation fails, try to reduce the size of the recalculate buffer and continue with that smaller buffer. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit da8b4fc1f63a01a0eca9338ae338b804c437b51f Author: Mikulas Patocka Date: Mon Jun 26 16:46:00 2023 +0200 dm integrity: only allocate recalculate buffer when needed dm-integrity preallocated 8MiB buffer for recalculating in the constructor and freed it in the destructor. This wastes memory when the user has many dm-integrity devices. Fix dm-integrity so that the buffer is only allocated when recalculation is in progress; allocate the buffer at the beginning of integrity_recalc() and free it at the end. Note that integrity_recalc() doesn't hold any locks when allocating the buffer, so it shouldn't cause low-memory deadlock. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 6d50eb4725934fd22f5eeccb401000687c790fd0 Author: Mikulas Patocka Date: Mon Jun 26 16:44:34 2023 +0200 dm integrity: reduce vmalloc space footprint on 32-bit architectures It was reported that dm-integrity runs out of vmalloc space on 32-bit architectures. On x86, there is only 128MiB vmalloc space and dm-integrity consumes it quickly because it has a 64MiB journal and 8MiB recalculate buffer. Fix this by reducing the size of the journal to 4MiB and the size of the recalculate buffer to 1MiB, so that multiple dm-integrity devices can be created and activated on 32-bit architectures. Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 4baa098a147d76a9ad1a6867fa14286db52085b6 Merge: 4aacacee86174 5516c89d58283 Author: Linus Torvalds Date: Tue Jun 27 12:25:42 2023 -0700 Merge tag 'x86_misc_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc x86 updates from Borislav Petkov: - Remove the local symbols prefix of the get/put_user() exception handling symbols so that tools do not get confused by the presence of code belonging to the wrong symbol/not belonging to any symbol - Improve csum_partial()'s performance - Some improvements to the kcpuid tool * tag 'x86_misc_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/lib: Make get/put_user() exception handling a visible symbol x86/csum: Fix clang -Wuninitialized in csum_partial() x86/csum: Improve performance of `csum_partial` tools/x86/kcpuid: Add .gitignore tools/x86/kcpuid: Dump the correct CPUID function in error commit ad5f604e186ac08d12c401e34ea96c09c38ddbc5 Author: Namhyung Kim Date: Mon Jun 26 23:32:57 2023 -0700 perf test: Fix a compile error on pe-file-parsing.c The dso__find_symbol_by_name() should be have idx pointer argument. Found during the build-test. $ make build-test ... CC /tmp/tmp.6JwPK1xbWG/tests/pe-file-parsing.o tests/pe-file-parsing.c: In function ‘run_dir’: tests/pe-file-parsing.c:64:15: error: too few arguments to function ‘dso__find_symbol_by_name’ 64 | sym = dso__find_symbol_by_name(dso, "main"); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from tests/pe-file-parsing.c:16: /usr/local/google/home/namhyung/project/linux/tools/perf/util/symbol.h:135:16: note: declared here 135 | struct symbol *dso__find_symbol_by_name(struct dso *dso, const char *name, size_t *idx); | ^~~~~~~~~~~~~~~~~~~~~~~~ Fixes: 259dce914e93 ("perf symbol: Remove symbol_name_rb_node") Acked-by: Ian Rogers Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230627063257.549005-1-namhyung@kernel.org Signed-off-by: Namhyung Kim commit 78987bb02ad29161a75d7c512822232321250d1d Author: Fangrui Song Date: Sat Jun 24 00:27:08 2023 +0000 perf: Replace deprecated -target with --target= for Clang -target has been deprecated since Clang 3.4 in 2013. Use the preferred --target=bpf form instead. This matches how we use --target= in scripts/Makefile.clang. Signed-off-by: Fangrui Song Acked-by: Yonghong Song Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: llvm@lists.linux.dev Cc: Ingo Molnar Cc: bpf@vger.kernel.org Link: https://github.com/llvm/llvm-project/commit/274b6f0c87a6a1798de0a68135afc7f95def6277 Link: https://lore.kernel.org/r/20230624002708.1907962-1-maskray@google.com [ resolved a conflict with GEN_VMLINUX_H changes ] Signed-off-by: Namhyung Kim commit 710dffc969023315c3c32717dc08b543012e60d8 Author: Ian Rogers Date: Sun Jun 25 22:30:48 2023 -0700 perf pmu: Correct auto_merge_stats test The original logic was to check is_pmu_hybrid() like in the below. It just checks the name of PMU specifically for Intel hybrid systems which means uncore PMU events should return false. https://lore.kernel.org/all/20230527072210.2900565-35-irogers@google.com/ The is_pmu_hybrid() was replaced by arch-agnostic way but with the incorrect condition which was fixed for core PMUs but not uncore. This change fixes both. Fixes: e23421426e13 ("perf pmu: Correct perf_pmu__auto_merge_stats() affecting hybrid") Signed-off-by: Ian Rogers Tested-by: Namhyung Kim Cc: James Clark Cc: Mark Rutland Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Andi Kleen Cc: Alexander Shishkin Cc: Kan Liang Cc: Ingo Molnar Link: https://lore.kernel.org/all/CAP-5=fXOi=xQ4=j5xAq+jWLR9n7uvfsWK+PzXkY1MZ3Fz-xccw@mail.gmail.com/ Link: https://lore.kernel.org/r/20230626053048.257959-1-irogers@google.com [ rephrase the commit log a bit ] Signed-off-by: Namhyung Kim commit 49a5e3edd35352833270dd18b0d5ca414fcc9406 Author: Jiri Olsa Date: Mon Jun 26 22:16:05 2023 +0200 perf tools: Add missing else to cmd_daemon subcommand condition Namhyung reported segfault in perf daemon start command. It's caused by extra check on argv[0] which is set to NULL by previous __cmd_start call. Adding missing else to skip the extra check. Fixes: 92294b906e6c ("perf daemon: Dynamically allocate path to perf") Reported-and-Tested-by: Namhyung Kim Reported-by: Thomas Richter Signed-off-by: Jiri Olsa Cc: Mark Rutland Cc: Peter Zijlstra Cc: Ian Rogers Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Ingo Molnar Cc: Alexander Shishkin Link: https://lore.kernel.org/r/20230626201606.2514679-1-jolsa@kernel.org Signed-off-by: Namhyung Kim commit 4aacacee8617424e1dacead8d830e5b768eb3e53 Merge: 04fc8904d5d18 a32b0f0db3f39 Author: Linus Torvalds Date: Tue Jun 27 12:03:44 2023 -0700 Merge tag 'x86_microcode_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode loader updates from Borislav Petkov: - Load late on both SMT threads on AMD, just like it is being done in the early loading procedure - Cleanups * tag 'x86_microcode_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode/AMD: Load late on both threads too x86/microcode/amd: Remove unneeded pointer arithmetic x86/microcode/AMD: Get rid of __find_equiv_id() commit 04fc8904d5d18a132f5ad67b79ee980b6602c8c6 Merge: a3540495324af f8c25662028b3 Author: Linus Torvalds Date: Tue Jun 27 11:58:16 2023 -0700 Merge tag 'docs-arm-move' of git://git.lwn.net/linux Pull arm documentation move from Jonathan Corbet: "Move the Arm architecture documentation under Documentation/arch/. This brings some order to the documentation directory, declutters the top-level directory, and makes the documentation organization more closely match that of the source" * tag 'docs-arm-move' of git://git.lwn.net/linux: dt-bindings: Update Documentation/arm references docs: update some straggling Documentation/arm references crypto: update some Arm documentation references mips: update a reference to a moved Arm Document arm64: Update Documentation/arm references arm: update in-source documentation references arm: docs: Move Arm documentation to Documentation/arch/ commit a3540495324af9b7fa95b62da2ccbf7cdb4e3622 Merge: dedbf31ac8a57 a1e72bb00a486 Author: Linus Torvalds Date: Tue Jun 27 11:33:47 2023 -0700 Merge tag 'docs-6.5' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "It's been a relatively calm cycle in docsland. We do have: - Some initial page-table documentation from Linus (the other Linus) - Regression-handling documentation improvements from Thorsten - Addition of kerneldoc documentation for the ERR_PTR() and related macros from James Seo ... and the usual collection of fixes and updates" * tag 'docs-6.5' of git://git.lwn.net/linux: docs: consolidate storage interfaces Documentation: update git configuration for Link: tag Documentation: KVM: make corrections to vcpu-requests.rst Documentation: KVM: make corrections to ppc-pv.rst Documentation: KVM: make corrections to locking.rst Documentation: KVM: make corrections to halt-polling.rst Documentation: virt: correct location of haltpoll module params Documentation/mm: Initial page table documentation docs: crypto: async-tx-api: fix typo in struct name docs/doc-guide: Clarify how to write tables docs: handling-regressions: rework section about fixing procedures docs: process: fix a typoed cross-reference docs: submitting-patches: Discuss interleaved replies MAINTAINERS: direct process doc changes to a dedicated ML Documentation: core-api: Add error pointer functions to kernel-api err.h: Add missing kerneldocs for error pointer functions Documentation: conf.py: Add __force to c_id_attributes docs: clarify KVM related kernel parameters' descriptions docs: consolidate human interface subsystems docs: admin-guide: Add information about intel_pstate active mode commit dedbf31ac8a57eaa29b6e4f9745dadffa83dd947 Merge: 9ba92dc1de0a2 8cd0d8633e2de Author: Linus Torvalds Date: Tue Jun 27 11:28:56 2023 -0700 Merge tag 'linux-kselftest-next-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest updates from Shuah Khan: - allow runners to override the timeout This change is made to avoid future increases of long timeouts - several other spelling and cleanups - a new subtest to video_device_test - enhancements to test coverage in clone3 test - other fixes to ftrace and cpufreq tests * tag 'linux-kselftest-next-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/ftace: Fix KTAP output ordering selftests/cpufreq: Don't enable generic lock debugging options kselftests: Sort the collections list to avoid duplicate tests selftest: pidfd: Omit long and repeating outputs selftests: allow runners to override the timeout selftests/ftrace: Add new test case which checks for optimized probes selftests/clone3: test clone3 with exit signal in flags kselftest: vDSO: Fix accumulation of uninitialized ret when CLOCK_REALTIME is undefined selftests: prctl: Fix spelling mistake "anonynous" -> "anonymous" selftests: media_tests: Add new subtest to video_device_test commit bb814518bf7c2d6c0468a39153de222e0400e3a4 Merge: 40e8e98f512fc 5fb2864cbd50a Author: Rafael J. Wysocki Date: Tue Jun 27 20:15:17 2023 +0200 Merge tag 'opp-updates-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull OPP (Operating Performance Points) updates for 6.5 from Viresh Kumar: "- Simplify performance state related logic in the OPP core (Viresh Kumar). - Fix use-after-free and improve locking around lazy_opp_tables (Viresh Kumar and Stephan Gerhold). - Minor cleanups - using dev_err_probe() and rate-limiting debug messages (Andrew Halaney and Adrián Larumbe)." * tag 'opp-updates-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: OPP: Properly propagate error along when failing to get icc_path OPP: Use dev_err_probe() when failing to get icc_path OPP: Simplify the over-designed pstate <-> level dance OPP: pstate is only valid for genpd OPP tables OPP: don't drop performance constraint on OPP table removal OPP: Protect `lazy_opp_tables` list with `opp_table_lock` OPP: Staticize `lazy_opp_tables` in of.c opp: Fix use-after-free in lazy_opp_tables after probe deferral OPP: rate-limit debug messages when no change in OPP is required commit 9ba92dc1de0a25e72b0cddb30386bf611e6cb46e Merge: b19edac5992da 2e66833579ed7 Author: Linus Torvalds Date: Tue Jun 27 11:12:55 2023 -0700 Merge tag 'linux-kselftest-kunit-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull KUnit updates from Shuah Khan: - kunit_add_action() API to defer a call until test exit - Update document to add kunit_add_action() usage notes - Changes to always run cleanup from a test kthread - Documentation updates to clarify cleanup usage (assertions should not be used in cleanup) - Documentation update to clearly indicate that exit functions should run even if init fails - Several fixes and enhancements to existing tests * tag 'linux-kselftest-kunit-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: MAINTAINERS: Add source tree entry for kunit Documentation: kunit: Rename references to kunit_abort() kunit: Move kunit_abort() call out of kunit_do_failed_assertion() kunit: Fix obsolete name in documentation headers (func->action) Documentation: Kunit: add MODULE_LICENSE to sample code kunit: Update kunit_print_ok_not_ok function kunit: Fix reporting of the skipped parameterized tests kunit/test: Add example test showing parameterized testing Documentation: kunit: Add usage notes for kunit_add_action() kunit: kmalloc_array: Use kunit_add_action() kunit: executor_test: Use kunit_add_action() kunit: Add kunit_add_action() to defer a call until test exit kunit: example: Provide example exit functions Documentation: kunit: Warn that exit functions run even if init fails Documentation: kunit: Note that assertions should not be used in cleanup kunit: Always run cleanup from a test kthread Documentation: kunit: Modular tests should not depend on KUNIT=y kunit: tool: undo type subscripts for subprocess.Popen commit 813ce98178b1f723de813949a5dd2d50690a95e7 Merge: 40e8e98f512fc 5ee64250286e8 Author: Rafael J. Wysocki Date: Tue Jun 27 20:10:57 2023 +0200 Merge tag 'cpufreq-arm-updates-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Pull ARM cpufreq updates for 6.5 from Viresh Kumar: "- Add support to build cpufreq-dt-platdev as module (Zhipeng Wang). - Don't allocate Sparc's cpufreq_driver dynamically (Viresh Kumar). - Add support for TI's AM62A7 platform (Vibhore Vardhan). - Add support for Armada's ap807 platform (Russell King (Oracle)). - Add support for StarFive JH7110 SoC (Mason Huo). - Fix voltage selection for Mediatek Socs (Daniel Golle). - Fix error handling in Tegra's cpufreq driver (Christophe JAILLET). - Document Qualcomm's IPQ8074 in DT bindings (Robert Marko). - Don't warn for disabling a non-existing frequency for imx6q cpufreq driver (Christoph Niedermaier). - Use dev_err_probe() in Qualcomm's cpufreq driver (Andrew Halaney)." commit ff598081e5b9d0bdd6874bfe340811bbb75b35e4 Author: Eric Farman Date: Mon Jun 26 15:36:42 2023 +0200 vfio/mdev: Move the compat_class initialization to module init The pointer to mdev_bus_compat_class is statically defined at the top of mdev_core, and was originally (commit 7b96953bc640 ("vfio: Mediated device Core driver") serialized by the parent_list_lock. The blamed commit removed this mutex, leaving the pointer initialization unserialized. As a result, the creation of multiple MDEVs in parallel (such as during boot) can encounter errors during the creation of the sysfs entries, such as: [ 8.337509] sysfs: cannot create duplicate filename '/class/mdev_bus' [ 8.337514] vfio_ccw 0.0.01d8: MDEV: Registered [ 8.337516] CPU: 13 PID: 946 Comm: driverctl Not tainted 6.4.0-rc7 #20 [ 8.337522] Hardware name: IBM 3906 M05 780 (LPAR) [ 8.337525] Call Trace: [ 8.337528] [<0000000162b0145a>] dump_stack_lvl+0x62/0x80 [ 8.337540] [<00000001622aeb30>] sysfs_warn_dup+0x78/0x88 [ 8.337549] [<00000001622aeca6>] sysfs_create_dir_ns+0xe6/0xf8 [ 8.337552] [<0000000162b04504>] kobject_add_internal+0xf4/0x340 [ 8.337557] [<0000000162b04d48>] kobject_add+0x78/0xd0 [ 8.337561] [<0000000162b04e0a>] kobject_create_and_add+0x6a/0xb8 [ 8.337565] [<00000001627a110e>] class_compat_register+0x5e/0x90 [ 8.337572] [<000003ff7fd815da>] mdev_register_parent+0x102/0x130 [mdev] [ 8.337581] [<000003ff7fdc7f2c>] vfio_ccw_sch_probe+0xe4/0x178 [vfio_ccw] [ 8.337588] [<0000000162a7833c>] css_probe+0x44/0x80 [ 8.337599] [<000000016279f4da>] really_probe+0xd2/0x460 [ 8.337603] [<000000016279fa08>] driver_probe_device+0x40/0xf0 [ 8.337606] [<000000016279fb78>] __device_attach_driver+0xc0/0x140 [ 8.337610] [<000000016279cbe0>] bus_for_each_drv+0x90/0xd8 [ 8.337618] [<00000001627a00b0>] __device_attach+0x110/0x190 [ 8.337621] [<000000016279c7c8>] bus_rescan_devices_helper+0x60/0xb0 [ 8.337626] [<000000016279cd48>] drivers_probe_store+0x48/0x80 [ 8.337632] [<00000001622ac9b0>] kernfs_fop_write_iter+0x138/0x1f0 [ 8.337635] [<00000001621e5e14>] vfs_write+0x1ac/0x2f8 [ 8.337645] [<00000001621e61d8>] ksys_write+0x70/0x100 [ 8.337650] [<0000000162b2bdc4>] __do_syscall+0x1d4/0x200 [ 8.337656] [<0000000162b3c828>] system_call+0x70/0x98 [ 8.337664] kobject: kobject_add_internal failed for mdev_bus with -EEXIST, don't try to register things with the same name in the same directory. [ 8.337668] kobject: kobject_create_and_add: kobject_add error: -17 [ 8.337674] vfio_ccw: probe of 0.0.01d9 failed with error -12 [ 8.342941] vfio_ccw_mdev aeb9ca91-10c6-42bc-a168-320023570aea: Adding to iommu group 2 Move the initialization of the mdev_bus_compat_class pointer to the init path, to match the cleanup in module exit. This way the code in mdev_register_parent() can simply link the new parent to it, rather than determining whether initialization is required first. Fixes: 89345d5177aa ("vfio/mdev: embedd struct mdev_parent in the parent data structure") Reported-by: Alexander Egorenkov Signed-off-by: Eric Farman Reviewed-by: Kevin Tian Reviewed-by: Christoph Hellwig Reviewed-by: Tony Krowiak Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20230626133642.2939168-1-farman@linux.ibm.com Signed-off-by: Alex Williamson commit b19edac5992da0188be98454ca592621d3d89844 Merge: af96134dc8562 dd58d666ac08e Author: Linus Torvalds Date: Tue Jun 27 10:56:41 2023 -0700 Merge tag 'nolibc.2023.06.22a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull nolibc updates from Paul McKenney: - Add stackprotector support - Fix RISC-V load-store instruction syntax to support 32-bit binaries, plus fixes for generic 32-bit support - Fix use of s390 sys_fork() - Add my_syscall6() for ARM - Support different platforms having different errno definitions - Fix ppoll/ppoll_time64 arguments (add the fifth argument) - Force use of little endian on MIPS - Improved testing, for example, better handling of different compilers and compiler versions, comparing nolibc behavior to that of libc, and additional test cases - Improve syntax and header ordering - Use existing instead of redefining constants - Add syscall() * tag 'nolibc.2023.06.22a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: (53 commits) selftests/nolibc: make sure gcc always use little endian on MIPS selftests/nolibc: also count skipped and failed tests in output selftests/nolibc: add new gettimeofday test cases selftests/nolibc: remove gettimeofday_bad1/2 completely selftests/nolibc: support two errnos with EXPECT_SYSER2() tools/nolibc: open: fix up compile warning for arm tools/nolibc: arm: add missing my_syscall6 selftests/nolibc: use INT_MAX instead of __INT_MAX__ selftests/nolibc: not include limits.h for nolibc selftests/nolibc: fix up compile warning with glibc on x86_64 selftests/nolibc: allow specify extra arguments for qemu selftests/nolibc: remove test gettimeofday_null tools/nolibc: ensure fast64 integer types have 64 bits selftests/nolibc: test_fork: fix up duplicated print tools/nolibc: ppoll/ppoll_time64: add a missing argument selftests/nolibc: remove the duplicated gettimeofday_bad2 selftests/nolibc: print name instead of number for EOVERFLOW tools/nolibc: support nanoseconds in stat() selftests/nolibc: prevent coredumps during test execution tools/nolibc: add support for prctl() ... commit ae230642190a51b85656d6da2df744d534d59544 Merge: 30ac666a2fcca a9c49cc2f5b57 Author: Jakub Kicinski Date: Tue Jun 27 10:50:24 2023 -0700 Merge branch 'af_unix-followup-fixes-for-so_passpidfd' Kuniyuki Iwashima says: ==================== af_unix: Followup fixes for SO_PASSPIDFD. This series fixes 2 issues introduced by commit 5e2ff6704a27 ("scm: add SO_PASSPIDFD and SCM_PIDFD"). The 1st patch fixes a warning in scm_pidfd_recv() reported by syzkaller. The 2nd patch fixes a regression that bluetooth can't be built as module. ==================== Link: https://lore.kernel.org/r/20230627174314.67688-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit a9c49cc2f5b578c4ffa0ee135aa552d06dec0e82 Author: Alexander Mikhalitsyn Date: Tue Jun 27 10:43:14 2023 -0700 net: scm: introduce and use scm_recv_unix helper Recently, our friends from bluetooth subsystem reported [1] that after commit 5e2ff6704a27 ("scm: add SO_PASSPIDFD and SCM_PIDFD") scm_recv() helper become unusable in kernel modules (because it uses unexported pidfd_prepare() API). We were aware of this issue and workarounded it in a hard way by commit 97154bcf4d1b ("af_unix: Kconfig: make CONFIG_UNIX bool"). But recently a new functionality was added in the scope of commit 817efd3cad74 ("Bluetooth: hci_sock: Forward credentials to monitor") and after that bluetooth can't be compiled as a kernel module. After some discussion in [1] we decided to split scm_recv() into two helpers, one won't support SCM_PIDFD (used for unix sockets), and another one will be completely the same as it was before commit 5e2ff6704a27 ("scm: add SO_PASSPIDFD and SCM_PIDFD"). Link: https://lore.kernel.org/lkml/CAJqdLrpFcga4n7wxBhsFqPQiN8PKFVr6U10fKcJ9W7AcZn+o6Q@mail.gmail.com/ [1] Fixes: 5e2ff6704a27 ("scm: add SO_PASSPIDFD and SCM_PIDFD") Signed-off-by: Alexander Mikhalitsyn Reviewed-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230627174314.67688-3-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit 603fc57ab70c306fa483ca66152223e861455e09 Author: Kuniyuki Iwashima Date: Tue Jun 27 10:43:13 2023 -0700 af_unix: Skip SCM_PIDFD if scm->pid is NULL. syzkaller hit a WARN_ON_ONCE(!scm->pid) in scm_pidfd_recv(). In unix_stream_read_generic(), if there is no skb in the queue, we could bail out the do-while loop without calling scm_set_cred(): 1. No skb in the queue 2. sk is non-blocking or shutdown(sk, RCV_SHUTDOWN) is called concurrently or peer calls close() If the socket is configured with SO_PASSPIDFD, scm_pidfd_recv() would populate cmsg with garbage emitting the warning. Let's skip SCM_PIDFD if scm->pid is NULL in scm_pidfd_recv(). Note another way would be skip calling scm_recv() in such cases, but this caused a regression resulting in commit 9d797ee2dce1 ("Revert "af_unix: Call scm_recv() only after scm_set_cred().""). WARNING: CPU: 1 PID: 3245 at include/net/scm.h:138 scm_pidfd_recv include/net/scm.h:138 [inline] WARNING: CPU: 1 PID: 3245 at include/net/scm.h:138 scm_recv.constprop.0+0x754/0x850 include/net/scm.h:177 Modules linked in: CPU: 1 PID: 3245 Comm: syz-executor.1 Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:scm_pidfd_recv include/net/scm.h:138 [inline] RIP: 0010:scm_recv.constprop.0+0x754/0x850 include/net/scm.h:177 Code: 67 fd e9 55 fd ff ff e8 4a 70 67 fd e9 7f fd ff ff e8 40 70 67 fd e9 3e fb ff ff e8 36 70 67 fd e9 02 fd ff ff e8 8c 3a 20 fd <0f> 0b e9 fe fb ff ff e8 50 70 67 fd e9 2e f9 ff ff e8 46 70 67 fd RSP: 0018:ffffc90009af7660 EFLAGS: 00010216 RAX: 00000000000000a1 RBX: ffff888041e58a80 RCX: ffffc90003852000 RDX: 0000000000040000 RSI: ffffffff842675b4 RDI: 0000000000000007 RBP: ffffc90009af7810 R08: 0000000000000007 R09: 0000000000000013 R10: 00000000000000f8 R11: 0000000000000001 R12: ffffc90009af7db0 R13: 0000000000000000 R14: ffff888041e58a88 R15: 1ffff9200135eecc FS: 00007f6b7113f640(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6b7111de38 CR3: 0000000012a6e002 CR4: 0000000000770ee0 PKRU: 55555554 Call Trace: unix_stream_read_generic+0x5fe/0x1f50 net/unix/af_unix.c:2830 unix_stream_recvmsg+0x194/0x1c0 net/unix/af_unix.c:2880 sock_recvmsg_nosec net/socket.c:1019 [inline] sock_recvmsg+0x188/0x1d0 net/socket.c:1040 ____sys_recvmsg+0x210/0x610 net/socket.c:2712 ___sys_recvmsg+0xff/0x190 net/socket.c:2754 do_recvmmsg+0x25d/0x6c0 net/socket.c:2848 __sys_recvmmsg net/socket.c:2927 [inline] __do_sys_recvmmsg net/socket.c:2950 [inline] __se_sys_recvmmsg net/socket.c:2943 [inline] __x64_sys_recvmmsg+0x224/0x290 net/socket.c:2943 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f6b71da2e5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007f6b7113ecc8 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00000000004bc050 RCX: 00007f6b71da2e5d RDX: 0000000000000007 RSI: 0000000020006600 RDI: 000000000000000b RBP: 00000000004bc050 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000120 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007f6b71e03530 R15: 0000000000000000 Fixes: 5e2ff6704a27 ("scm: add SO_PASSPIDFD and SCM_PIDFD") Reported-by: syzkaller Signed-off-by: Kuniyuki Iwashima Link: https://lore.kernel.org/r/20230627174314.67688-2-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit af96134dc8562f9fcbb8358af36f6086619a29ab Merge: 1ef6663a587ba 2e31da752c6d0 Author: Linus Torvalds Date: Tue Jun 27 10:37:01 2023 -0700 Merge tag 'rcu.2023.06.22a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull RCU updates from Paul McKenney: "Documentation updates Miscellaneous fixes, perhaps most notably: - Remove RCU_NONIDLE(). The new visibility of most of the idle loop to RCU has obsoleted this API. - Make the RCU_SOFTIRQ callback-invocation time limit also apply to the rcuc kthreads that invoke callbacks for CONFIG_PREEMPT_RT. - Add a jiffies-based callback-invocation time limit to handle long-running callbacks. (The local_clock() function is only invoked once per 32 callbacks due to its high overhead.) - Stop rcu_tasks_invoke_cbs() from using never-onlined CPUs, which fixes a bug that can occur on systems with non-contiguous CPU numbering. kvfree_rcu updates: - Eliminate the single-argument variant of k[v]free_rcu() now that all uses have been converted to k[v]free_rcu_mightsleep(). - Add WARN_ON_ONCE() checks for k[v]free_rcu*() freeing callbacks too soon. Yes, this is closing the barn door after the horse has escaped, but Murphy says that there will be more horses. Callback-offloading updates: - Fix a number of bugs involving the shrinker and lazy callbacks. Tasks RCU updates Torture-test updates" * tag 'rcu.2023.06.22a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: (32 commits) torture: Remove duplicated argument -enable-kvm for ppc64 doc/rcutorture: Add description of rcutorture.stall_cpu_block rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup() rcutorture: Correct name of use_softirq module parameter locktorture: Add long_hold to adjust lock-hold delays rcu/nocb: Make shrinker iterate only over NOCB CPUs rcu-tasks: Stop rcu_tasks_invoke_cbs() from using never-onlined CPUs rcu: Make rcu_cpu_starting() rely on interrupts being disabled rcu: Mark rcu_cpu_kthread() accesses to ->rcu_cpu_has_work rcu: Mark additional concurrent load from ->cpu_no_qs.b.exp rcu: Employ jiffies-based backstop to callback time limit rcu: Check callback-invocation time limit for rcuc kthreads rcu: Remove RCU_NONIDLE() rcu: Add more RCU files to kernel-api.rst rcu-tasks: Clarify the cblist_init_generic() function's pr_info() output rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic() rcu/nocb: Recheck lazy callbacks under the ->nocb_lock from shrinker rcu/nocb: Fix shrinker race against callback enqueuer rcu/nocb: Protect lazy shrinker against concurrent (de-)offloading ... commit 5f004bcaee4cb552cf1b46a505f18f08777db7e5 Merge: 4251f631fdfba 6995e2de6891c Author: Jason Gunthorpe Date: Tue Jun 27 14:06:29 2023 -0300 Merge tag 'v6.4' into rdma.git for-next Linux 6.4 Resolve conflicts between rdma rc and next in rxe_cq matching linux-next: drivers/infiniband/sw/rxe/rxe_cq.c: https://lore.kernel.org/r/20230622115246.365d30ad@canb.auug.org.au Signed-off-by: Jason Gunthorpe commit 4251f631fdfba0b38e4634510c5950ee157cc069 Author: Dan Carpenter Date: Tue Jun 27 10:20:13 2023 +0300 RDMA/bnxt_re: Fix an IS_ERR() vs NULL check The bnxt_re_mmap_entry_insert() function returns NULL, not error pointers. Update the check for errors accordingly. Fixes: 360da60d6c6e ("RDMA/bnxt_re: Enable low latency push") Link: https://lore.kernel.org/r/8d92e85f-626b-4eca-8501-ca7024cfc0ee@moroto.mountain Signed-off-by: Dan Carpenter Acked-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 30ac666a2fccaa8c164199ea8844dc28aa714453 Author: Moritz Fischer Date: Tue Jun 27 03:54:32 2023 +0000 net: lan743x: Simplify comparison Simplify comparison, no functional changes. Cc: Bryan Whitehead Cc: UNGLinuxDriver@microchip.com Suggested-by: Jakub Kicinski Signed-off-by: Moritz Fischer Link: https://lore.kernel.org/r/20230627035432.1296760-1-moritzf@google.com Signed-off-by: Jakub Kicinski commit 3674fbf0451df0395f9fa18df3122927006a3829 Merge: 9d797ee2dce1e 25a9c8a4431c3 Author: Jakub Kicinski Date: Tue Jun 27 09:45:22 2023 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Merge in late fixes to prepare for the 6.5 net-next PR. Signed-off-by: Jakub Kicinski commit a425ac5365f6cb3cc47bf83e6bff0213c10445f7 Author: Linus Torvalds Date: Sun Jun 25 14:02:25 2023 -0700 gup: add warning if some caller would seem to want stack expansion It feels very unlikely that anybody would want to do a GUP in an unmapped area under the stack pointer, but real users sometimes do some really strange things. So add a (temporary) warning for the case where a GUP fails and expanding the stack might have made it work. It's trivial to do the expansion in the caller as part of getting the mm lock in the first place - see __access_remote_vm() for ptrace, for example - it's just that it's unnecessarily painful to do it deep in the guts of the GUP lookup when we might have to drop and re-take the lock. I doubt anybody actually does anything quite this strange, but let's be proactive: adding these warnings is simple, and will make debugging it much easier if they trigger. Signed-off-by: Linus Torvalds commit 8d7071af890768438c14db6172cc8f9f4d04e184 Author: Linus Torvalds Date: Sat Jun 24 13:45:51 2023 -0700 mm: always expand the stack with the mmap write lock held This finishes the job of always holding the mmap write lock when extending the user stack vma, and removes the 'write_locked' argument from the vm helper functions again. For some cases, we just avoid expanding the stack at all: drivers and page pinning really shouldn't be extending any stacks. Let's see if any strange users really wanted that. It's worth noting that architectures that weren't converted to the new lock_mm_and_find_vma() helper function are left using the legacy "expand_stack()" function, but it has been changed to drop the mmap_lock and take it for writing while expanding the vma. This makes it fairly straightforward to convert the remaining architectures. As a result of dropping and re-taking the lock, the calling conventions for this function have also changed, since the old vma may no longer be valid. So it will now return the new vma if successful, and NULL - and the lock dropped - if the area could not be extended. Tested-by: Vegard Nossum Tested-by: John Paul Adrian Glaubitz # ia64 Tested-by: Frank Scheiner # ia64 Signed-off-by: Linus Torvalds commit 25a9c8a4431c364f97f75558cb346d2ad3f53fbb Author: Kuniyuki Iwashima Date: Mon Jun 26 09:43:13 2023 -0700 netlink: Add __sock_i_ino() for __netlink_diag_dump(). syzbot reported a warning in __local_bh_enable_ip(). [0] Commit 8d61f926d420 ("netlink: fix potential deadlock in netlink_set_err()") converted read_lock(&nl_table_lock) to read_lock_irqsave() in __netlink_diag_dump() to prevent a deadlock. However, __netlink_diag_dump() calls sock_i_ino() that uses read_lock_bh() and read_unlock_bh(). If CONFIG_TRACE_IRQFLAGS=y, read_unlock_bh() finally enables IRQ even though it should stay disabled until the following read_unlock_irqrestore(). Using read_lock() in sock_i_ino() would trigger a lockdep splat in another place that was fixed in commit f064af1e500a ("net: fix a lockdep splat"), so let's add __sock_i_ino() that would be safe to use under BH disabled. [0]: WARNING: CPU: 0 PID: 5012 at kernel/softirq.c:376 __local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376 Modules linked in: CPU: 0 PID: 5012 Comm: syz-executor487 Not tainted 6.4.0-rc7-syzkaller-00202-g6f68fc395f49 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 RIP: 0010:__local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376 Code: 45 bf 01 00 00 00 e8 91 5b 0a 00 e8 3c 15 3d 00 fb 65 8b 05 ec e9 b5 7e 85 c0 74 58 5b 5d c3 65 8b 05 b2 b6 b4 7e 85 c0 75 a2 <0f> 0b eb 9e e8 89 15 3d 00 eb 9f 48 89 ef e8 6f 49 18 00 eb a8 0f RSP: 0018:ffffc90003a1f3d0 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000201 RCX: 1ffffffff1cf5996 RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff8805c6f3 RBP: ffffffff8805c6f3 R08: 0000000000000001 R09: ffff8880152b03a3 R10: ffffed1002a56074 R11: 0000000000000005 R12: 00000000000073e4 R13: dffffc0000000000 R14: 0000000000000002 R15: 0000000000000000 FS: 0000555556726300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000045ad50 CR3: 000000007c646000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: sock_i_ino+0x83/0xa0 net/core/sock.c:2559 __netlink_diag_dump+0x45c/0x790 net/netlink/diag.c:171 netlink_diag_dump+0xd6/0x230 net/netlink/diag.c:207 netlink_dump+0x570/0xc50 net/netlink/af_netlink.c:2269 __netlink_dump_start+0x64b/0x910 net/netlink/af_netlink.c:2374 netlink_dump_start include/linux/netlink.h:329 [inline] netlink_diag_handler_dump+0x1ae/0x250 net/netlink/diag.c:238 __sock_diag_cmd net/core/sock_diag.c:238 [inline] sock_diag_rcv_msg+0x31e/0x440 net/core/sock_diag.c:269 netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2547 sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x925/0xe30 net/netlink/af_netlink.c:1914 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0xde/0x190 net/socket.c:747 ____sys_sendmsg+0x71c/0x900 net/socket.c:2503 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2557 __sys_sendmsg+0xf7/0x1c0 net/socket.c:2586 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f5303aaabb9 Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc7506e548 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5303aaabb9 RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000003 RBP: 00007f5303a6ed60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5303a6edf0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Fixes: 8d61f926d420 ("netlink: fix potential deadlock in netlink_set_err()") Reported-by: syzbot+5da61cf6a9bc1902d422@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=5da61cf6a9bc1902d422 Suggested-by: Eric Dumazet Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20230626164313.52528-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit d06f925f13976ab82167c93467c70a337a0a3cda Author: Vladimir Oltean Date: Mon Jun 26 18:44:02 2023 +0300 net: dsa: avoid suspicious RCU usage for synced VLAN-aware MAC addresses When using the felix driver (the only one which supports UC filtering and MC filtering) as a DSA master for a random other DSA switch, one can see the following stack trace when the downstream switch ports join a VLAN-aware bridge: ============================= WARNING: suspicious RCU usage ----------------------------- net/8021q/vlan_core.c:238 suspicious rcu_dereference_protected() usage! stack backtrace: Workqueue: dsa_ordered dsa_slave_switchdev_event_work Call trace: lockdep_rcu_suspicious+0x170/0x210 vlan_for_each+0x8c/0x188 dsa_slave_sync_uc+0x128/0x178 __hw_addr_sync_dev+0x138/0x158 dsa_slave_set_rx_mode+0x58/0x70 __dev_set_rx_mode+0x88/0xa8 dev_uc_add+0x74/0xa0 dsa_port_bridge_host_fdb_add+0xec/0x180 dsa_slave_switchdev_event_work+0x7c/0x1c8 process_one_work+0x290/0x568 What it's saying is that vlan_for_each() expects rtnl_lock() context and it's not getting it, when it's called from the DSA master's ndo_set_rx_mode(). The caller of that - dsa_slave_set_rx_mode() - is the slave DSA interface's dsa_port_bridge_host_fdb_add() which comes from the deferred dsa_slave_switchdev_event_work(). We went to great lengths to avoid the rtnl_lock() context in that call path in commit 0faf890fc519 ("net: dsa: drop rtnl_lock from dsa_slave_switchdev_event_work"), and calling rtnl_lock() is simply not an option due to the possibility of deadlocking when calling dsa_flush_workqueue() from the call paths that do hold rtnl_lock() - basically all of them. So, when the DSA master calls vlan_for_each() from its ndo_set_rx_mode(), the state of the 8021q driver on this device is really not protected from concurrent access by anything. Looking at net/8021q/, I don't think that vlan_info->vid_list was particularly designed with RCU traversal in mind, so introducing an RCU read-side form of vlan_for_each() - vlan_for_each_rcu() - won't be so easy, and it also wouldn't be exactly what we need anyway. In general I believe that the solution isn't in net/8021q/ anyway; vlan_for_each() is not cut out for this task. DSA doesn't need rtnl_lock() to be held per se - since it's not a netdev state change that we're blocking, but rather, just concurrent additions/removals to a VLAN list. We don't even need sleepable context - the callback of vlan_for_each() just schedules deferred work. The proposed escape is to remove the dependency on vlan_for_each() and to open-code a non-sleepable, rtnl-free alternative to that, based on copies of the VLAN list modified from .ndo_vlan_rx_add_vid() and .ndo_vlan_rx_kill_vid(). Fixes: 64fdc5f341db ("net: dsa: sync unicast and multicast addresses for VLAN filters too") Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20230626154402.3154454-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 9d797ee2dce1e3e243bcc18dad7728df72fd11a4 Author: Kuniyuki Iwashima Date: Mon Jun 26 13:58:37 2023 -0700 Revert "af_unix: Call scm_recv() only after scm_set_cred()." This reverts commit 3f5f118bb657f94641ea383c7c1b8c09a5d46ea2. Konrad reported that desktop environment below cannot be reached after commit 3f5f118bb657 ("af_unix: Call scm_recv() only after scm_set_cred().") - postmarketOS (Alpine Linux w/ musl 1.2.4) - busybox 1.36.1 - GNOME 44.1 - networkmanager 1.42.6 - openrc 0.47 Regarding to the warning of SO_PASSPIDFD, I'll post another patch to suppress it by skipping SCM_PIDFD if scm->pid == NULL in scm_pidfd_recv(). Reported-by: Konrad Dybcio Link: https://lore.kernel.org/netdev/8c7f9abd-4f84-7296-2788-1e130d6304a0@kernel.org/ Signed-off-by: Kuniyuki Iwashima Tested-by: Ido Schimmel Tested-by: Gal Pressman Link: https://lore.kernel.org/r/20230626205837.82086-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit 5fc10e76fa2a96d0207ed4d0cc9d16fb61371f71 Author: Masahiro Yamada Date: Tue Jun 27 08:30:13 2023 +0900 kbuild: revive "Entering directory" for Make >= 4.4.1 With commit 9da0763bdd82 ("kbuild: Use relative path when building in a subdir of the source tree"), compiler messages in out-of-tree builds include relative paths, which are relative to the build directory, not the directory where make was started. To help IDEs/editors find the source files, Kbuild lets GNU Make print "Entering directory ..." when it changes the working directory. It has been working fine for a long time, but David reported it is broken with the latest GNU Make. The behavior was changed by GNU Make commit 8f9e7722ff0f ("[SV 63537] Fix setting -w in makefiles"). Previously, setting --no-print-directory to MAKEFLAGS only affected child makes, but it is now interpreted in the current make as soon as it is set. [test code] $ cat /tmp/Makefile ifneq ($(SUBMAKE),1) MAKEFLAGS += --no-print-directory all: ; $(MAKE) SUBMAKE=1 else all: ; : endif [before 8f9e7722ff0f] $ make -C /tmp make: Entering directory '/tmp' make SUBMAKE=1 : make: Leaving directory '/tmp' [after 8f9e7722ff0f] $ make -C /tmp make SUBMAKE=1 : Previously, the effect of --no-print-directory was delayed until Kbuild started the directory descending, but it is no longer true with GNU Make 4.4.1. This commit adds one more recursion to cater to GNU Make >= 4.4.1. When Kbuild needs to change the working directory, __submake will be executed twice. __submake without --no-print-directory --> show "Entering directory ..." __submake with --no-print-directory --> parse the rest of Makefile We end up with one more recursion than needed for GNU Make < 4.4.1, but I do not want to complicate the version check. Reported-by: David Howells Closes: https://lore.kernel.org/all/2427604.1686237298@warthog.procyon.org.uk/ Signed-off-by: Masahiro Yamada Tested-by: Nicolas Schier commit 5fa94ceb793e93870541dc5a1235aec87b0871bc Author: Masahiro Yamada Date: Tue Jun 27 08:30:12 2023 +0900 kbuild: set correct abs_srctree and abs_objtree for package builds When you run 'make rpm-pkg', the rpmbuild tool builds the kernel in rpmbuild/BUILD, but $(abs_srctree) and $(abs_objtree) point to the directory path where make was started, not the kernel is actually being built. The same applies to 'make snap-pkg'. Fix it. Signed-off-by: Masahiro Yamada commit 1a3f6fc430ed220889c7fb1a63bc2a30267ebc2a Author: Jakub Kicinski Date: Mon Jun 26 14:46:40 2023 -0700 phylink: ReST-ify the phylink_pcs_neg_mode() kdoc Stephen reports warnings when rendering phylink kdocs as HTML: include/linux/phylink.h:110: ERROR: Unexpected indentation. include/linux/phylink.h:111: WARNING: Block quote ends without a blank line; unexpected unindent. include/linux/phylink.h:614: WARNING: Inline literal start-string without end-string. include/linux/phylink.h:644: WARNING: Inline literal start-string without end-string. Make phylink_pcs_neg_mode() use a proper list format to fix the first two warnings. The last two warnings, AFAICT, come from the use of shorthand like phylink_mode_*(). Perhaps those should be special-cased at the Sphinx level. Reported-by: Stephen Rothwell Link: https://lore.kernel.org/all/20230626162908.2f149f98@canb.auug.org.au/ Link: https://lore.kernel.org/r/20230626214640.3142252-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5da4d7b8e6dfd5bd7d61f7fe1338b1e5d5b4f76c Author: David Howells Date: Tue Jun 27 14:49:48 2023 +0100 libceph: Partially revert changes to support MSG_SPLICE_PAGES Fix the mishandling of MSG_DONTWAIT and also reinstates the per-page checking of the source pages (which might have come from a DIO write by userspace) by partially reverting the changes to support MSG_SPLICE_PAGES and doing things a little differently. In messenger_v1: (1) The ceph_tcp_sendpage() is resurrected and the callers reverted to use that. (2) The callers now pass MSG_MORE unconditionally. Previously, they were passing in MSG_MORE|MSG_SENDPAGE_NOTLAST and then degrading that to just MSG_MORE on the last call to ->sendpage(). (3) Make ceph_tcp_sendpage() a wrapper around sendmsg() rather than sendpage(), setting MSG_SPLICE_PAGES if sendpage_ok() returns true on the page. In messenger_v2: (4) Bring back do_try_sendpage() and make the callers use that. (5) Make do_try_sendpage() use sendmsg() for both cases and set MSG_SPLICE_PAGES if sendpage_ok() is set. Fixes: 40a8c17aa770 ("ceph: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage") Fixes: fa094ccae1e7 ("ceph: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage()") Reported-by: Ilya Dryomov Link: https://lore.kernel.org/r/CAOi1vP9vjLfk3W+AJFeexC93jqPaPUn2dD_4NrzxwoZTbYfOnw@mail.gmail.com/ Link: https://lore.kernel.org/r/CAOi1vP_Bn918j24S94MuGyn+Gxk212btw7yWeDrRcW1U8pc_BA@mail.gmail.com/ Signed-off-by: David Howells cc: Xiubo Li cc: Jeff Layton cc: Jens Axboe cc: Matthew Wilcox Link: https://lore.kernel.org/r/3101881.1687801973@warthog.procyon.org.uk/ # v1 Link: https://lore.kernel.org/r/3111635.1687813501@warthog.procyon.org.uk/ # v2 Reviewed-by: Ilya Dryomov Link: https://lore.kernel.org/r/3199652.1687873788@warthog.procyon.org.uk Signed-off-by: Jakub Kicinski commit 528a08bcd820d07887edeae706df88ceb06db109 Author: Vladimir Oltean Date: Tue Jun 27 16:42:35 2023 +0300 net: phy: mscc: fix packet loss due to RGMII delays Two deadly typos break RX and TX traffic on the VSC8502 PHY using RGMII if phy-mode = "rgmii-id" or "rgmii-txid", and no "tx-internal-delay-ps" override exists. The negative error code from phy_get_internal_delay() does not get overridden with the delay deduced from the phy-mode, and later gets committed to hardware. Also, the rx_delay gets overridden by what should have been the tx_delay. Fixes: dbb050d2bfc8 ("phy: mscc: Add support for RGMII delay configuration") Signed-off-by: Vladimir Oltean Reviewed-by: Harini Katakam Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230627134235.3453358-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit d9b1a5a60ac33da3a2921c41ef26b84bfdf67044 Merge: 2553a5270d6c2 e9c74f8b8a31f Author: Jakub Kicinski Date: Tue Jun 27 09:28:25 2023 -0700 Merge branch 'use-vmalloc_array-and-vcalloc' Julia Lawall says: ==================== use vmalloc_array and vcalloc The functions vmalloc_array and vcalloc were introduced in commit a8749a35c399 ("mm: vmalloc: introduce array allocation functions") but are not used much yet. This series introduces uses of these functions, to protect against multiplication overflows. The changes were done using the following Coccinelle semantic patch. @initialize:ocaml@ @@ let rename alloc = match alloc with "vmalloc" -> "vmalloc_array" | "vzalloc" -> "vcalloc" | _ -> failwith "unknown" @@ size_t e1,e2; constant C1, C2; expression E1, E2, COUNT, x1, x2, x3; typedef u8; typedef __u8; type t = {u8,__u8,char,unsigned char}; identifier alloc = {vmalloc,vzalloc}; fresh identifier realloc = script:ocaml(alloc) { rename alloc }; @@ ( alloc(x1*x2*x3) | alloc(C1 * C2) | alloc((sizeof(t)) * (COUNT), ...) | - alloc((e1) * (e2)) + realloc(e1, e2) | - alloc((e1) * (COUNT)) + realloc(COUNT, e1) | - alloc((E1) * (E2)) + realloc(E1, E2) ) v2: This series uses vmalloc_array and vcalloc instead of array_size. It also leaves a multiplication of a constant by a sizeof as is. Two patches are thus dropped from the series. ==================== Link: https://lore.kernel.org/r/20230627144339.144478-1-Julia.Lawall@inria.fr Signed-off-by: Jakub Kicinski commit e9c74f8b8a31f77f8e9d7bbed5fc9f2eacbf32a5 Author: Julia Lawall Date: Tue Jun 27 16:43:37 2023 +0200 net: mana: use vmalloc_array and vcalloc Use vmalloc_array and vcalloc to protect against multiplication overflows. The changes were done using the following Coccinelle semantic patch: // @initialize:ocaml@ @@ let rename alloc = match alloc with "vmalloc" -> "vmalloc_array" | "vzalloc" -> "vcalloc" | _ -> failwith "unknown" @@ size_t e1,e2; constant C1, C2; expression E1, E2, COUNT, x1, x2, x3; typedef u8; typedef __u8; type t = {u8,__u8,char,unsigned char}; identifier alloc = {vmalloc,vzalloc}; fresh identifier realloc = script:ocaml(alloc) { rename alloc }; @@ ( alloc(x1*x2*x3) | alloc(C1 * C2) | alloc((sizeof(t)) * (COUNT), ...) | - alloc((e1) * (e2)) + realloc(e1, e2) | - alloc((e1) * (COUNT)) + realloc(COUNT, e1) | - alloc((E1) * (E2)) + realloc(E1, E2) ) // Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/20230627144339.144478-23-Julia.Lawall@inria.fr Signed-off-by: Jakub Kicinski commit fa87c54693ae248db9ff867baa28b792db671b24 Author: Julia Lawall Date: Tue Jun 27 16:43:33 2023 +0200 net: enetc: use vmalloc_array and vcalloc Use vmalloc_array and vcalloc to protect against multiplication overflows. The changes were done using the following Coccinelle semantic patch: // @initialize:ocaml@ @@ let rename alloc = match alloc with "vmalloc" -> "vmalloc_array" | "vzalloc" -> "vcalloc" | _ -> failwith "unknown" @@ size_t e1,e2; constant C1, C2; expression E1, E2, COUNT, x1, x2, x3; typedef u8; typedef __u8; type t = {u8,__u8,char,unsigned char}; identifier alloc = {vmalloc,vzalloc}; fresh identifier realloc = script:ocaml(alloc) { rename alloc }; @@ ( alloc(x1*x2*x3) | alloc(C1 * C2) | alloc((sizeof(t)) * (COUNT), ...) | - alloc((e1) * (e2)) + realloc(e1, e2) | - alloc((e1) * (COUNT)) + realloc(COUNT, e1) | - alloc((E1) * (E2)) + realloc(E1, E2) ) // Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/20230627144339.144478-19-Julia.Lawall@inria.fr Signed-off-by: Jakub Kicinski commit f712c8297e0a4dadc14ba2094c92e3e99a0ff871 Author: Julia Lawall Date: Tue Jun 27 16:43:26 2023 +0200 ionic: use vmalloc_array and vcalloc Use vmalloc_array and vcalloc to protect against multiplication overflows. The changes were done using the following Coccinelle semantic patch: // @initialize:ocaml@ @@ let rename alloc = match alloc with "vmalloc" -> "vmalloc_array" | "vzalloc" -> "vcalloc" | _ -> failwith "unknown" @@ size_t e1,e2; constant C1, C2; expression E1, E2, COUNT, x1, x2, x3; typedef u8; typedef __u8; type t = {u8,__u8,char,unsigned char}; identifier alloc = {vmalloc,vzalloc}; fresh identifier realloc = script:ocaml(alloc) { rename alloc }; @@ ( alloc(x1*x2*x3) | alloc(C1 * C2) | alloc((sizeof(t)) * (COUNT), ...) | - alloc((e1) * (e2)) + realloc(e1, e2) | - alloc((e1) * (COUNT)) + realloc(COUNT, e1) | - alloc((E1) * (E2)) + realloc(E1, E2) ) // Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/20230627144339.144478-12-Julia.Lawall@inria.fr Signed-off-by: Jakub Kicinski commit 906a76cc764541bdb7f602a01e3b4cdd93dea96a Author: Julia Lawall Date: Tue Jun 27 16:43:24 2023 +0200 pds_core: use vmalloc_array and vcalloc Use vmalloc_array and vcalloc to protect against multiplication overflows. The changes were done using the following Coccinelle semantic patch: // @initialize:ocaml@ @@ let rename alloc = match alloc with "vmalloc" -> "vmalloc_array" | "vzalloc" -> "vcalloc" | _ -> failwith "unknown" @@ size_t e1,e2; constant C1, C2; expression E1, E2, COUNT, x1, x2, x3; typedef u8; typedef __u8; type t = {u8,__u8,char,unsigned char}; identifier alloc = {vmalloc,vzalloc}; fresh identifier realloc = script:ocaml(alloc) { rename alloc }; @@ ( alloc(x1*x2*x3) | alloc(C1 * C2) | alloc((sizeof(t)) * (COUNT), ...) | - alloc((e1) * (e2)) + realloc(e1, e2) | - alloc((e1) * (COUNT)) + realloc(COUNT, e1) | - alloc((E1) * (E2)) + realloc(E1, E2) ) // Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/20230627144339.144478-10-Julia.Lawall@inria.fr Signed-off-by: Jakub Kicinski commit a13de901e8d590a7d26a6d4a1c4c7e9eebbb6ca6 Author: Julia Lawall Date: Tue Jun 27 16:43:19 2023 +0200 gve: use vmalloc_array and vcalloc Use vmalloc_array and vcalloc to protect against multiplication overflows. The changes were done using the following Coccinelle semantic patch: // @initialize:ocaml@ @@ let rename alloc = match alloc with "vmalloc" -> "vmalloc_array" | "vzalloc" -> "vcalloc" | _ -> failwith "unknown" @@ size_t e1,e2; constant C1, C2; expression E1, E2, COUNT, x1, x2, x3; typedef u8; typedef __u8; type t = {u8,__u8,char,unsigned char}; identifier alloc = {vmalloc,vzalloc}; fresh identifier realloc = script:ocaml(alloc) { rename alloc }; @@ ( alloc(x1*x2*x3) | alloc(C1 * C2) | alloc((sizeof(t)) * (COUNT), ...) | - alloc((e1) * (e2)) + realloc(e1, e2) | - alloc((e1) * (COUNT)) + realloc(COUNT, e1) | - alloc((E1) * (E2)) + realloc(E1, E2) ) // Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/20230627144339.144478-5-Julia.Lawall@inria.fr Signed-off-by: Jakub Kicinski commit 32d462a5c3e5b312e7dcd886e20e71b0c33abf10 Author: Julia Lawall Date: Tue Jun 27 16:43:17 2023 +0200 octeon_ep: use vmalloc_array and vcalloc Use vmalloc_array and vcalloc to protect against multiplication overflows. The changes were done using the following Coccinelle semantic patch: // @initialize:ocaml@ @@ let rename alloc = match alloc with "vmalloc" -> "vmalloc_array" | "vzalloc" -> "vcalloc" | _ -> failwith "unknown" @@ size_t e1,e2; constant C1, C2; expression E1, E2, COUNT, x1, x2, x3; typedef u8; typedef __u8; type t = {u8,__u8,char,unsigned char}; identifier alloc = {vmalloc,vzalloc}; fresh identifier realloc = script:ocaml(alloc) { rename alloc }; @@ ( alloc(x1*x2*x3) | alloc(C1 * C2) | alloc((sizeof(t)) * (COUNT), ...) | - alloc((e1) * (e2)) + realloc(e1, e2) | - alloc((e1) * (COUNT)) + realloc(COUNT, e1) | - alloc((E1) * (E2)) + realloc(E1, E2) ) // Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/20230627144339.144478-3-Julia.Lawall@inria.fr Signed-off-by: Jakub Kicinski commit d7dbed457c2ef83709a2a2723a2d58de43623449 Author: Tavian Barnes Date: Fri Jun 23 17:09:06 2023 -0400 nfsd: Fix creation time serialization order In nfsd4_encode_fattr(), TIME_CREATE was being written out after all other times. However, they should be written out in an order that matches the bit flags in bmval1, which in this case are #define FATTR4_WORD1_TIME_ACCESS (1UL << 15) #define FATTR4_WORD1_TIME_CREATE (1UL << 18) #define FATTR4_WORD1_TIME_DELTA (1UL << 19) #define FATTR4_WORD1_TIME_METADATA (1UL << 20) #define FATTR4_WORD1_TIME_MODIFY (1UL << 21) so TIME_CREATE should come second. I noticed this on a FreeBSD NFSv4.2 client, which supports creation times. On this client, file times were weirdly permuted. With this patch applied on the server, times looked normal on the client. Fixes: e377a3e698fb ("nfsd: Add support for the birth time attribute") Link: https://unix.stackexchange.com/q/749605/56202 Signed-off-by: Tavian Barnes Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 99160af413b4ff1c3b4741e8a7583f8e7197f201 Author: Sagi Grimberg Date: Tue Jun 20 16:07:36 2023 +0300 nvme-mpath: fix I/O failure with EAGAIN when failing over I/O It is possible that the next available path we failover to, happens to be frozen (for example if it is during connection establishment). If the original I/O was set with NOWAIT, this cause the I/O to unnecessarily fail because the request queue cannot be entered, hence the I/O fails with EAGAIN. The NOWAIT restriction that was originally set for the I/O is no longer relevant or needed because this is the nvme requeue context. Hence we clear the REQ_NOWAIT flag when failing over I/O. This fix a simple test case of nvme controller reset during I/O when the multipath device that has only a single path and I/O fails with "Resource temporarily unavailable" errno. Note that this reproduces with io_uring which by default sets IOCB_NOWAIT by default. Signed-off-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: Keith Busch commit 86da1bae4c64ab3dcbdda0c77ce37c9bf47a501f Author: Damien Le Moal Date: Thu Jun 22 16:53:07 2023 +0900 nvme: host: fix command name spelling Correctly spell "Zeroes" in nvme_cmd_write_zeroes command name. Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Signed-off-by: Keith Busch commit b5539eb5ee70257520e40bb636a295217c329a50 Author: Rafael J. Wysocki Date: Tue Jun 27 16:35:52 2023 +0200 ACPI: EC: Fix acpi_ec_dispatch_gpe() Commit 896e97bf99ec ("ACPI: EC: Clear GPE on interrupt handling only") broke suspend-to-idle at least on Dell XPS13 9360 and 9380. The problem is that acpi_ec_dispatch_gpe() must clear the EC GPE, because the EC GPE handler never runs when the system is in the suspend-to-idle state and if the EC GPE is not cleared by the suspend- to-idle loop, it is never cleared at all which leads to a GPE storm. This causes suspend-to-idle to burn energy instead of saving it which is potentially dangerous (the affected machines heat up rather badly when that happens). Addess this by making acpi_ec_dispatch_gpe() clear the EC GPE as it did before. Fixes: 896e97bf99ec ("ACPI: EC: Clear GPE on interrupt handling only") Tested-by: Rafael J. Wysocki Signed-off-by: Rafael J. Wysocki commit bc9a2b3e686e32ebd764d92e66e21c01e23ffb16 Author: Eli Cohen Date: Wed Jun 7 22:00:06 2023 +0300 vdpa/mlx5: Support interrupt bypassing Add support for generation of interrupts from the device directly to the VM to the VCPU thus avoiding the overhead on the host CPU. When supported, the driver will attempt to allocate vectors for each data virtqueue. If a vector for a virtqueue cannot be provided it will use the QP mode where notifications go through the driver. In addition, we add a shutdown callback to make sure allocated interrupts are released in case of shutdown to allow clean shutdown. Signed-off-by: Eli Cohen Signed-off-by: Saeed Mahameed Message-Id: <20230607190007.290505-1-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin commit 33bd91fd24367ad664de6c05d0e0206d0b149767 Author: Simon Horman Date: Thu May 25 16:35:42 2023 +0200 virtio: Add missing documentation for structure fields Add missing documentation for the vqs_list_lock field of struct virtio_device, and the validate field of struct virtio_driver. ./scripts/kernel-doc says: .../virtio.h:131: warning: Function parameter or member 'vqs_list_lock' not described in 'virtio_device' .../virtio.h:192: warning: Function parameter or member 'validate' not described in 'virtio_driver' 2 warnings as Errors No functional changes intended. Signed-off-by: Simon Horman Message-Id: <20230510-virtio-kdoc-v3-1-e2681ed7a425@kernel.org> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella commit 9a8864d2a8dc5c49acd66284fd382871d99b5db8 Author: Shannon Nelson Date: Fri May 19 14:56:32 2023 -0700 pds_vdpa: pds_vdps.rst and Kconfig Add the documentation and Kconfig entry for pds_vdpa driver. Signed-off-by: Shannon Nelson Acked-by: Jason Wang Message-Id: <20230519215632.12343-12-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin commit 67f27b8b3a342b988b97b2a4b81e9e894eb502ba Author: Shannon Nelson Date: Fri May 19 14:56:31 2023 -0700 pds_vdpa: subscribe to the pds_core events Register for the pds_core's notification events, primarily to find out when the FW has been reset so we can pass this on back up the chain. Signed-off-by: Shannon Nelson Acked-by: Jason Wang Message-Id: <20230519215632.12343-11-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin commit 151cc834f3ddafec869269fe48036460d920d08a Author: Shannon Nelson Date: Fri May 19 14:56:30 2023 -0700 pds_vdpa: add support for vdpa and vdpamgmt interfaces This is the vDPA device support, where we advertise that we can support the virtio queues and deal with the configuration work through the pds_core's adminq. Signed-off-by: Shannon Nelson Message-Id: <20230519215632.12343-10-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit c16d5a412ed4e0e6e0b02f69c2c65187869659f2 Author: Shannon Nelson Date: Fri May 19 14:56:29 2023 -0700 pds_vdpa: add vdpa config client commands These are the adminq commands that will be needed for setting up and using the vDPA device. There are a number of commands defined in the FW's API, but by making use of the FW's virtio BAR we only need a few of these commands for vDPA support. Signed-off-by: Shannon Nelson Acked-by: Jason Wang Message-Id: <20230519215632.12343-9-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin commit 94591894df81ce443b0696440b9198fda6615c45 Author: Shannon Nelson Date: Fri May 19 14:56:28 2023 -0700 pds_vdpa: virtio bar setup for vdpa Prep and use the "modern" virtio bar utilities to get our virtio config space ready. Signed-off-by: Shannon Nelson Acked-by: Jason Wang Message-Id: <20230519215632.12343-8-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin commit 25d1270b6e9ea893c2fe19a4bd52ebfde22812f4 Author: Shannon Nelson Date: Fri May 19 14:56:27 2023 -0700 pds_vdpa: get vdpa management info Find the vDPA management information from the DSC in order to advertise it to the vdpa subsystem. Signed-off-by: Shannon Nelson Acked-by: Jason Wang Message-Id: <20230519215632.12343-7-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin commit e0c6de13ff87b917407e8c817c1007c3dc7ece6f Author: Shannon Nelson Date: Fri May 19 14:56:26 2023 -0700 pds_vdpa: new adminq entries Add new adminq definitions in support for vDPA operations. Signed-off-by: Shannon Nelson Acked-by: Jason Wang Message-Id: <20230519215632.12343-6-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin commit a8492cd8cde0906b93c819992d50ac6d79a5cad1 Author: Shannon Nelson Date: Fri May 19 14:56:25 2023 -0700 pds_vdpa: move enum from common to adminq header The pds_core_logical_qtype enum and IFNAMSIZ are not needed in the common PDS header, only needed when working with the adminq, so move them to the adminq header. Note: This patch might conflict with pds_vfio patches that are in review, depending on which patchset gets pulled first. Signed-off-by: Shannon Nelson Acked-by: Jason Wang Message-Id: <20230519215632.12343-5-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin commit a16291b5bcbbd75586c8396555a0ee9fd4183372 Author: Shannon Nelson Date: Fri May 19 14:56:24 2023 -0700 pds_vdpa: Add new vDPA driver for AMD/Pensando DSC This is the initial auxiliary driver framework for a new vDPA device driver, an auxiliary_bus client of the pds_core driver. The pds_core driver supplies the PCI services for the VF device and for accessing the adminq in the PF device. This patch adds the very basics of registering for the auxiliary device and setting up debugfs entries. Signed-off-by: Shannon Nelson Acked-by: Jason Wang Message-Id: <20230519215632.12343-4-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin commit 5d7d82d39eb4cab2c7d0d85baaee0fc45d2c7900 Author: Shannon Nelson Date: Fri May 19 14:56:23 2023 -0700 virtio: allow caller to override device DMA mask in vp_modern To add a bit of vendor flexibility with various virtio based devices, allow the caller to specify a different DMA mask. This adds a dma_mask field to struct virtio_pci_modern_device. If defined by the driver, this mask will be used in a call to dma_set_mask_and_coherent() instead of the traditional DMA_BIT_MASK(64). This allows limiting the DMA space on vendor devices with address limitations. Signed-off-by: Shannon Nelson Acked-by: Jason Wang Message-Id: <20230519215632.12343-3-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin commit a37c0191acbd58efab4da43372585207f30e3102 Author: Shannon Nelson Date: Fri May 19 14:56:22 2023 -0700 virtio: allow caller to override device id in vp_modern To add a bit of vendor flexibility with various virtio based devices, allow the caller to check for a different device id. This adds a function pointer field to struct virtio_pci_modern_device to specify an override device id check. If defined by the driver, this function will be called to check that the PCI device is the vendor's expected device, and will return the found device id to be stored in mdev->id.device. This allows vendors with alternative vendor device ids to use this library on their own device BAR. Note: A lot of the diff in this is simply indenting the existing code into an else block. Signed-off-by: Shannon Nelson Acked-by: Jason Wang Message-Id: <20230519215632.12343-2-shannon.nelson@amd.com> Signed-off-by: Michael S. Tsirkin commit 4f0fc22534e3d81ebd470e899fed3c0dbb4aeb56 Author: Feng Liu Date: Tue May 16 09:54:46 2023 -0400 virtio_pci: Optimize virtio_pci_device structure size Improve the size of the virtio_pci_device structure, which is commonly used to represent a virtio PCI device. A given virtio PCI device can either of legacy type or modern type, with the struct virtio_pci_legacy_device occupying 32 bytes and the struct virtio_pci_modern_device occupying 88 bytes. Make them a union, thereby save 32 bytes of memory as shown by the pahole tool. This improvement is particularly beneficial when dealing with numerous devices, as it helps conserve memory resources. Before the modification, pahole tool reported the following: struct virtio_pci_device { [...] struct virtio_pci_legacy_device ldev; /* 824 32 */ /* --- cacheline 13 boundary (832 bytes) was 24 bytes ago --- */ struct virtio_pci_modern_device mdev; /* 856 88 */ /* XXX last struct has 4 bytes of padding */ [...] /* size: 1056, cachelines: 17, members: 19 */ [...] }; After the modification, pahole tool reported the following: struct virtio_pci_device { [...] union { struct virtio_pci_legacy_device ldev; /* 824 32 */ struct virtio_pci_modern_device mdev; /* 824 88 */ }; /* 824 88 */ [...] /* size: 1024, cachelines: 16, members: 18 */ [...] }; Signed-off-by: Feng Liu Reviewed-by: Jiri Pirko Message-Id: <20230516135446.16266-1-feliu@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo Acked-by: Jason Wang commit 77b894f220cbd04301b3d941df8247106e67f8e4 Author: Peng Fan Date: Thu Mar 23 12:00:24 2023 +0800 tools/virtio: fix build break for aarch64 "-mfunction-return=thunk -mindirect-branch-register" are only valid for x86. So introduce compiler operation check to avoid such issues Fixes: 0d0ed4006127 ("tools/virtio: enable to build with retpoline") Signed-off-by: Peng Fan Message-Id: <20230323040024.3809108-1-peng.fan@oss.nxp.com> Signed-off-by: Michael S. Tsirkin commit fe37efba475375caa2dbc71cb06f53f7086277ef Author: Dragos Tatulea Date: Thu May 4 16:50:52 2023 +0300 virtio-vdpa: Fix unchecked call to NULL set_vq_affinity The referenced patch calls set_vq_affinity without checking if the op is valid. This patch adds the check. Fixes: 3dad56823b53 ("virtio-vdpa: Support interrupt affinity spreading mechanism") Reviewed-by: Gal Pressman Signed-off-by: Dragos Tatulea Message-Id: <20230504135053.2283816-1-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Feng Liu commit ef9da01c121120f89d89b2bdde59a23bf507a39f Author: Alvaro Karsz Date: Tue May 2 16:10:48 2023 +0300 vdpa/snet: implement the resume vDPA callback The callback sends a resume command to the DPU through the control mechanism. Signed-off-by: Alvaro Karsz Message-Id: <20230502131048.61134-1-alvaro.karsz@solid-run.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 47b60ec7ba22a6359379bce9643bfff7a1ffe9ed Author: Krzysztof Kozlowski Date: Thu May 11 19:54:51 2023 +0200 vdpa: solidrun: constify pointers to hwmon_channel_info Statically allocated array of pointers to hwmon_channel_info can be made const for safety. Acked-by: Michael S. Tsirkin Reviewed-by: Alvaro Karsz Signed-off-by: Krzysztof Kozlowski Message-Id: <20230511175451.282096-1-krzysztof.kozlowski@linaro.org> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 49a64c6dbcd3b8289e3b6f8e9a42049e23c243c1 Author: Zhu Lingshan Date: Fri May 26 22:52:54 2023 +0800 vDPA/ifcvf: a vendor driver should not set _CONFIG_S_FAILED VIRTIO_CONFIG_S_FAILED indicates the guest driver has given up the device due to fatal errors. So it is the guest decision, the vendor driver should not set this status to the device. Signed-off-by: Zhu Lingshan Acked-by: Jason Wang Message-Id: <20230526145254.39537-6-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit 386a26208524dc9db5d6b01be4b8358a551dda42 Author: Zhu Lingshan Date: Fri May 26 22:52:53 2023 +0800 vDPA/ifcvf: synchronize irqs in the reset routine This commit synchronize irqs of the virtqueues and config space in the reset routine. Thus ifcvf_stop() and reset() are refactored as well. This commit renames ifcvf_stop_hw() to ifcvf_stop() Signed-off-by: Zhu Lingshan Acked-by: Jason Wang Message-Id: <20230526145254.39537-5-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit aeb5ef30bbcc2a4c605f7d44f088113a073c0224 Author: Zhu Lingshan Date: Fri May 26 22:52:52 2023 +0800 vDPA/ifcvf: retire ifcvf_start_datapath and ifcvf_add_status Rather than former lazy-initialization mechanism, now the virtqueue operations and driver_features related ops access the virtio registers directly to take immediate actions. So ifcvf_start_datapath() should retire. ifcvf_add_status() is retierd because we should not change device status by a vendor driver's decision, this driver should only set device status which is from virito drivers upon vdpa_ops.set_status() Signed-off-by: Zhu Lingshan Acked-by: Jason Wang Message-Id: <20230526145254.39537-4-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit 1a252f0391d48733174276247c3d22b8a85a4406 Author: Zhu Lingshan Date: Fri May 26 22:52:51 2023 +0800 vDPA/ifcvf: get_driver_features from virtio registers This commit implements a new function ifcvf_get_driver_feature() which read driver_features from virtio registers. To be less ambiguous, ifcvf_set_features() is renamed to ifcvf_set_driver_features(), and ifcvf_get_features() is renamed to ifcvf_get_dev_features() which returns the provisioned vDPA device features. Signed-off-by: Zhu Lingshan Acked-by: Jason Wang Message-Id: <20230526145254.39537-3-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit a4751306bf696785b7446503c287010e667d002b Author: Zhu Lingshan Date: Fri May 26 22:52:50 2023 +0800 vDPA/ifcvf: virt queue ops take immediate actions In this commit, virtqueue operations including: set_vq_num(), set_vq_address(), set_vq_ready() and get_vq_ready() access PCI registers directly to take immediate actions. Signed-off-by: Zhu Lingshan Acked-by: Jason Wang Message-Id: <20230526145254.39537-2-lingshan.zhu@intel.com> Signed-off-by: Michael S. Tsirkin commit 5f81018753dfd4989e33ece1f0cb6b8aae498b82 Author: Jiri Olsa Date: Thu Jun 15 13:52:36 2023 +0200 fprobe: Release rethook after the ftrace_ops is unregistered While running bpf selftests it's possible to get following fault: general protection fault, probably for non-canonical address \ 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI ... Call Trace: fprobe_handler+0xc1/0x270 ? __pfx_bpf_testmod_init+0x10/0x10 ? __pfx_bpf_testmod_init+0x10/0x10 ? bpf_fentry_test1+0x5/0x10 ? bpf_fentry_test1+0x5/0x10 ? bpf_testmod_init+0x22/0x80 ? do_one_initcall+0x63/0x2e0 ? rcu_is_watching+0xd/0x40 ? kmalloc_trace+0xaf/0xc0 ? do_init_module+0x60/0x250 ? __do_sys_finit_module+0xac/0x120 ? do_syscall_64+0x37/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc In unregister_fprobe function we can't release fp->rethook while it's possible there are some of its users still running on another cpu. Moving rethook_free call after fp->ops is unregistered with unregister_ftrace_function call. Link: https://lore.kernel.org/all/20230615115236.3476617-1-jolsa@kernel.org/ Fixes: 5b0ab78998e3 ("fprobe: Add exit_handler support") Cc: stable@vger.kernel.org Reviewed-by: Steven Rostedt (Google) Signed-off-by: Jiri Olsa Acked-by: Masami Hiramatsu (Google) Signed-off-by: Masami Hiramatsu (Google) commit ecdb004843ed91222be38ed838e7ce7167018222 Author: Sergio Paracuellos Date: Fri Jun 23 05:59:01 2023 +0200 dt-bindings: interrupt-controller: add Ralink SoCs interrupt controller Add YAML doc for the interrupt controller which is present on Ralink SoCs. Reviewed-by: Conor Dooley Signed-off-by: Sergio Paracuellos Link: https://lore.kernel.org/r/20230623035901.1514341-1-sergio.paracuellos@gmail.com Signed-off-by: Rob Herring commit 3216ceeb708b816ffacb19ae2387ac68bb872631 Author: Sebastian Reichel Date: Fri Jun 16 19:00:21 2023 +0200 dt-bindings: PCI: dwc: rockchip: Update for RK3588 The PCIe 2.0 controllers on RK3588 need one additional clock, one additional reset line and one for ranges entry. Signed-off-by: Sebastian Reichel Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20230616170022.76107-4-sebastian.reichel@collabora.com Signed-off-by: Rob Herring commit eaaacb085144e7e950061bfd6d097eb87f7513d7 Author: Davide Tronchin Date: Mon Jun 26 14:53:36 2023 +0200 net: usb: qmi_wwan: add u-blox 0x1312 composition Add RmNet support for LARA-R6 01B. The new LARA-R6 product variant identified by the "01B" string can be configured (by AT interface) in three different USB modes: * Default mode (Vendor ID: 0x1546 Product ID: 0x1311) with 4 serial interfaces * RmNet mode (Vendor ID: 0x1546 Product ID: 0x1312) with 4 serial interfaces and 1 RmNet virtual network interface * CDC-ECM mode (Vendor ID: 0x1546 Product ID: 0x1313) with 4 serial interface and 1 CDC-ECM virtual network interface The first 4 interfaces of all the 3 configurations (default, RmNet, ECM) are the same. In RmNet mode LARA-R6 01B exposes the following interfaces: If 0: Diagnostic If 1: AT parser If 2: AT parser If 3: AT parset/alternative functions If 4: RMNET interface Signed-off-by: Davide Tronchin Link: https://lore.kernel.org/r/20230626125336.3127-1-davide.tronchin.94@gmail.com Signed-off-by: Paolo Abeni commit 2553a5270d6c281b8fc43bd34611197bff67d715 Author: Matthieu Baerts Date: Mon Jun 26 11:02:39 2023 +0200 perf trace: fix MSG_SPLICE_PAGES build error Our MPTCP CI and Stephen got this error: In file included from builtin-trace.c:907: trace/beauty/msg_flags.c: In function 'syscall_arg__scnprintf_msg_flags': trace/beauty/msg_flags.c:28:21: error: 'MSG_SPLICE_PAGES' undeclared (first use in this function) 28 | if (flags & MSG_##n) { | ^~~~ trace/beauty/msg_flags.c:50:9: note: in expansion of macro 'P_MSG_FLAG' 50 | P_MSG_FLAG(SPLICE_PAGES); | ^~~~~~~~~~ trace/beauty/msg_flags.c:28:21: note: each undeclared identifier is reported only once for each function it appears in 28 | if (flags & MSG_##n) { | ^~~~ trace/beauty/msg_flags.c:50:9: note: in expansion of macro 'P_MSG_FLAG' 50 | P_MSG_FLAG(SPLICE_PAGES); | ^~~~~~~~~~ The fix is similar to what was done with MSG_FASTOPEN: the new macro is defined if it is not defined in the system headers. Fixes: b848b26c6672 ("net: Kill MSG_SENDPAGE_NOTLAST") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/r/20230626112847.2ef3d422@canb.auug.org.au/ Signed-off-by: Matthieu Baerts Link: https://lore.kernel.org/r/20230626090239.899672-1-matthieu.baerts@tessares.net Signed-off-by: Paolo Abeni commit 1a7d09a737a09297e77d9cd575cfe7d1bd14aad9 Merge: 8a9922e7be6d0 b389139f12f28 Author: Paolo Abeni Date: Tue Jun 27 12:47:43 2023 +0200 Merge tag 'nf-23-06-27' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Reset shift on Boyer-Moore string match for each block, from Jeremy Sowden. 2) Fix acccess to non-linear area in DCCP conntrack helper, from Florian Westphal. 3) Fix kernel-doc warnings, by Randy Dunlap. 4) Bail out if expires= does not show in SIP helper message, or make ct_sip_parse_numerical_param() tristate and report error if expires= cannot be parsed. 5) Unbind non-anonymous set in case rule construction fails. 6) Fix underflow in chain reference counter in case set element already exists or it cannot be created. netfilter pull request 23-06-27 ==================== Link: https://lore.kernel.org/r/20230627065304.66394-1-pablo@netfilter.org Signed-off-by: Paolo Abeni commit 2e28a798c3092ea42b968fa16ac835969d124898 Author: Ard Biesheuvel Date: Tue Jun 27 09:33:09 2023 +0200 efi/libstub: Disable PCI DMA before grabbing the EFI memory map Currently, the EFI stub will disable PCI DMA as the very last thing it does before calling ExitBootServices(), to avoid interfering with the firmware's normal operation as much as possible. However, the stub will invoke DisconnectController() on all endpoints downstream of the PCI bridges it disables, and this may affect the layout of the EFI memory map, making it substantially more likely that ExitBootServices() will fail the first time around, and that the EFI memory map needs to be reloaded. This, in turn, increases the likelihood that the slack space we allocated is insufficient (and we can no longer allocate memory via boot services after having called ExitBootServices() once), causing the second call to GetMemoryMap (and therefore the boot) to fail. This makes the PCI DMA disable feature a bit more fragile than it already is, so let's make it more robust, by allocating the space for the EFI memory map after disabling PCI DMA. Fixes: 4444f8541dad16fe ("efi: Allow disabling PCI busmastering on bridges during boot") Reported-by: Glenn Washburn Acked-by: Matthew Garrett Signed-off-by: Ard Biesheuvel commit 486bfb05913ac9969a3a71a4dc48f17f31cb162d Author: Herbert Xu Date: Tue Jun 27 17:59:32 2023 +0800 crypto: akcipher - Do not copy dst if it is NULL As signature verification has a NULL destination buffer, the pointer needs to be checked before the memcpy is done. Fixes: addde1f2c966 ("crypto: akcipher - Add sync interface without SG lists") Signed-off-by: Herbert Xu commit 8a9922e7be6d042fa00f894c376473b17a162b66 Author: Cambda Zhu Date: Mon Jun 26 17:33:47 2023 +0800 ipvlan: Fix return value of ipvlan_queue_xmit() ipvlan_queue_xmit() should return NET_XMIT_XXX, but ipvlan_xmit_mode_l2/l3() returns rx_handler_result_t or NET_RX_XXX in some cases. ipvlan_rcv_frame() will only return RX_HANDLER_CONSUMED in ipvlan_xmit_mode_l2/l3() because 'local' is true. It's equal to NET_XMIT_SUCCESS. But dev_forward_skb() can return NET_RX_SUCCESS or NET_RX_DROP, and returning NET_RX_DROP(NET_XMIT_DROP) will increase both ipvlan and ipvlan->phy_dev drops counter. The skb to forward can be treated as xmitted successfully. This patch makes ipvlan_queue_xmit() return NET_XMIT_SUCCESS for forward skb. Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") Signed-off-by: Cambda Zhu Link: https://lore.kernel.org/r/20230626093347.7492-1-cambda@linux.alibaba.com Signed-off-by: Paolo Abeni commit 5b7826355e5b9f48eea29275215fc55165cd17c3 Author: Imre Deak Date: Fri Jun 16 21:51:01 2023 +0300 drm/i915: Add missing forward declarations/includes to display power headers Add the seq_file struct forward declaration to intel_display_power.h fixing the build error below. While at it add the rest of missing forward declarations/includes to the display power header files. In file included from : ./../drivers/gpu/drm/i915/display/intel_display_power.h:255:70: error: 'struct seq_file' declared inside parameter list will not be visible outside of this definition or declaration [-Werror] 255 | void intel_display_power_debug(struct drm_i915_private *i915, struct seq_file *m); | ^~~~~~~~ Closes: https://lore.kernel.org/intel-gfx/89adc1ac-25a0-6eb6-4cc9-ab6cc8d49730@infradead.org/ Reported-by: Randy Dunlap Acked-by: Randy Dunlap Tested-by: Randy Dunlap # build-tested Reviewed-by: Jouni Högander Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20230616185104.2502003-1-imre.deak@intel.com (cherry picked from commit f4fab137dd2bc7dfdf8d17f8c53c472a5316109c) Signed-off-by: Tvrtko Ursulin commit 891ebfdfa3d08bf55ebec523c99bb68ac9c34cf7 Author: Herbert Xu Date: Mon Jun 26 18:33:44 2023 +0800 crypto: sig - Fix verify call The dst SG list needs to be set to NULL for verify calls. Do this as otherwise the underlying algorithm may fail. Furthermore the digest needs to be copied just like the source. Fixes: 6cb8815f41a9 ("crypto: sig - Add interface for sign/verify") Signed-off-by: Herbert Xu commit 767cfee8368f43c6d6c58cdf8c2d143a027fa55f Author: Herbert Xu Date: Mon Jun 26 18:20:25 2023 +0800 crypto: akcipher - Set request tfm on sync path The request tfm needs to be set. Fixes: addde1f2c966 ("crypto: akcipher - Add sync interface without SG lists") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202306261421.2ac744fa-oliver.sang@intel.com Signed-off-by: Herbert Xu commit 84d21f13af40f35e2e658f046d0c1e508e8a82ee Merge: 6995e2de6891c a3f1132c4c6be Author: Huacai Chen Date: Tue Jun 27 14:56:51 2023 +0800 Merge 'irq/loongarch-fixes-6.5' into loongarch-next LoongArch architecture changes for 6.5 depend on the irq changes to work on both ACPI and FDT systems, so merge them to create a base. commit 54a11654de163994e32b24e3aa90ef81f4a3184d Author: Masahiro Yamada Date: Thu Jan 19 17:22:50 2023 +0900 powerpc: remove checks for binutils older than 2.25 Commit e4412739472b ("Documentation: raise minimum supported version of binutils to 2.25") allows us to remove the checks for old binutils. There is no more user for ld-ifversion. Remove it as well. Signed-off-by: Masahiro Yamada Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230119082250.151485-1-masahiroy@kernel.org commit a590f03d8de7c4cb7ce4916dc7f2fd10711faabe Author: Thomas Hellström Date: Mon Jun 26 11:14:50 2023 +0200 drm/ttm: Don't leak a resource on swapout move error If moving the bo to system for swapout failed, we were leaking a resource. Fix. Fixes: bfa3357ef9ab ("drm/ttm: allocate resource object instead of embedding it v2") Cc: Christian König Cc: "Christian König" Cc: dri-devel@lists.freedesktop.org Cc: # v5.14+ Signed-off-by: Thomas Hellström Reviewed-by: Nirmoy Das Reviewed-by: Andi Shyti Reviewed-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20230626091450.14757-5-thomas.hellstrom@linux.intel.com commit e8188c461ee015ba0b9ab2fc82dbd5ebca5a5532 Author: Thomas Hellström Date: Mon Jun 26 11:14:49 2023 +0200 drm/ttm: Don't leak a resource on eviction error On eviction errors other than -EMULTIHOP we were leaking a resource. Fix. v2: - Avoid yet another goto (Andi Shyti) Fixes: 403797925768 ("drm/ttm: Fix multihop assert on eviction.") Cc: Andrey Grodzovsky Cc: Christian König Cc: Christian Koenig Cc: Huang Rui Cc: dri-devel@lists.freedesktop.org Cc: # v5.15+ Signed-off-by: Thomas Hellström Reviewed-by: Nirmoy Das #v1 Reviewed-by: Andi Shyti Reviewed-by: Christian König Link: https://patchwork.freedesktop.org/patch/msgid/20230626091450.14757-4-thomas.hellstrom@linux.intel.com commit 25ea739ea1d4d3de41acc4f4eb2d1a97eee0eb75 Author: Naveen N Rao Date: Tue May 30 11:44:36 2023 +0530 powerpc: Fail build if using recordmcount with binutils v2.37 binutils v2.37 drops unused section symbols, which prevents recordmcount from capturing mcount locations in sections that have no non-weak symbols. This results in a build failure with a message such as: Cannot find symbol for section 12: .text.perf_callchain_kernel. kernel/events/callchain.o: failed The change to binutils was reverted for v2.38, so this behavior is specific to binutils v2.37: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=c09c8b42021180eee9495bd50d8b35e683d3901b Objtool is able to cope with such sections, so this issue is specific to recordmcount. Fail the build and print a warning if binutils v2.37 is detected and if we are using recordmcount. Cc: stable@vger.kernel.org Suggested-by: Joel Stanley Signed-off-by: Naveen N Rao Signed-off-by: Michael Ellerman Link: https://msgid.link/20230530061436.56925-1-naveen@kernel.org commit 1ef6663a587ba3e57dc5065a477db1c64481eedd Merge: 8d7868c41df58 2b8cc5858a07a Author: Linus Torvalds Date: Mon Jun 26 20:12:07 2023 -0700 Merge tag 'tag-chrome-platform-for-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Tzung-Bi Shih: "Improvements: - Support Pin Assignment D in getting mux state - Emit an uevent when EC panics so that userland programs get chance to capture EC coredumps (LPC interface only) - Send EC_CMD_HOST_SLEEP_EVENT to EC at the very beginning/end of system suspend/resume so that EC can watch the duration more accurately (LPC interface only) Misc: - Switch back from I2C .probe_new() to .probe() - Use %*ph for printing hexdump of small buffers" * tag 'tag-chrome-platform-for-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: cros_ec_spi: Use %*ph for printing hexdump of a small buffer platform/chrome: Switch i2c drivers back to use .probe() platform/chrome: cros_ec_lpc: Move host command to prepare/complete platform/chrome: cros_ec: Report EC panic as uevent platform/chrome: cros_typec_switch: Add Pin D support commit 8d7868c41df58edabc4e408d119a1aef58a54d9d Merge: 40e8e98f512fc a8460ba59464c Author: Linus Torvalds Date: Mon Jun 26 19:41:26 2023 -0700 Merge tag 'thermal-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "These extend the int340x thermal driver, add thermal DT bindings for some Qcom platforms, add DT bindings and support for Armada AP807 and MSM8909, allow selecting the bang-bang thermal governor as the default one, address issues in several thermal drivers for ARM platforms and clean up code. Specifics: - Add new IOCTLs to the int340x thermal driver to allow user space to retrieve the Passive v2 thermal table (Srinivas Pandruvada) - Add DT bindings for SM6375, MSM8226 and QCM2290 Qcom platforms (Konrad Dybcio) - Add DT bindings and support for QCom MSM8226 (Matti Lehtimäki) - Add DT bindings for QCom ipq9574 (Praveenkumar I) - Convert bcm2835 DT bindings to the yaml schema (Stefan Wahren) - Allow selecting the bang-bang governor as default (Thierry Reding) - Refactor and prepare the code to set the scene for RCar Gen4 (Wolfram Sang) - Clean up and fix the QCom tsens drivers. Add DT bindings and calibration for the MSM8909 platform (Stephan Gerhold) - Revert a patch introducing a wrong usage of devm_of_iomap() on the Mediatek platform (Ricardo Cañuelo) - Fix the clock vs reset ordering in order to conform to the documentation on the sun8i (Christophe JAILLET) - Prevent setting up undocumented registers, enable the only described sensors and add the version 2.1 on the Qoriq sensor (Peng Fan) - Add DT bindings and support for the Armada AP807 (Alex Leibovich) - Update the mlx5 driver with the recent thermal changes (Daniel Lezcano) - Convert to platform remove callback returning void on STM32 (Uwe Kleine-König) - Add an error information printing for devm_thermal_add_hwmon_sysfs() and remove the error from the Sun8i, Amlogic, i.MX, TI, K3, Tegra, Qoriq, Mediateka and QCom (Yangtao Li) - Register as hwmon sensor for the Generic ADC (Chen-Yu Tsai) - Use the dev_err_probe() function in the QCom tsens alarm driver (Luca Weiss)" * tag 'thermal-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (39 commits) thermal/drivers/qcom/temp-alarm: Use dev_err_probe thermal/drivers/generic-adc: Register thermal zones as hwmon sensors thermal/drivers/mediatek/lvts_thermal: Remove redundant msg in lvts_ctrl_start() thermal/drivers/qcom: Remove redundant msg at probe time thermal/drivers/ti-soc: Remove redundant msg in ti_thermal_expose_sensor() thermal/drivers/qoriq: Remove redundant msg in qoriq_tmu_register_tmu_zone() thermal/drivers/tegra: Remove redundant msg in tegra_tsensor_register_channel() drivers/thermal/k3: Remove redundant msg in k3_bandgap_probe() thermal/drivers/imx: Remove redundant msg in imx8mm_tmu_probe() and imx_sc_thermal_probe() thermal/drivers/amlogic: Remove redundant msg in amlogic_thermal_probe() thermal/drivers/sun8i: Remove redundant msg in sun8i_ths_register() thermal/hwmon: Add error information printing for devm_thermal_add_hwmon_sysfs() thermal/drivers/stm32: Convert to platform remove callback returning void net/mlx5: Update the driver with the recent thermal changes thermal/drivers/armada: Add support for AP807 thermal data dt-bindings: armada-thermal: Add armada-ap807-thermal compatible thermal/drivers/qoriq: Support version 2.1 thermal/drivers/qoriq: Only enable supported sensors thermal/drivers/qoriq: No need to program site adjustment register thermal/drivers/mediatek/lvts_thermal: Register thermal zones as hwmon sensors ... commit 40e8e98f512fc76891ae2328a63e2e4ffdbe3010 Merge: bb6950556d4b1 c89a27f4f8fbf Author: Linus Torvalds Date: Mon Jun 26 19:36:30 2023 -0700 Merge tag 'pm-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "These add Intel TPMI (Topology Aware Register and PM Capsule Interface) support to the power capping subsystem, extend the intel_idle driver to work in VM guests where MWAIT is not available, extend the system-wide power management diagnostics, fix bugs and clean up code. Specifics: - Introduce power capping core support for Intel TPMI (Topology Aware Register and PM Capsule Interface) and a TPMI interface driver for Intel RAPL (Zhang Rui, Dan Carpenter) - Fix CONFIG_IOSF_MBI dependency in the Intel RAPL power capping driver (Zhang Rui) - Fix invalid initialization for pl4_supported field in the Intel RAPL power capping driver (Sumeet Pawnikar) - Clean up the intel_idle driver, make it work with VM guests that cannot use the MWAIT instruction and address the case in which the host may enter a deep idle state when the guest is idle (Arjan van de Ven) - Prevent cpufreq drivers that provide the ->adjust_perf() callback without a ->fast_switch() one which is used as a fallback from the former in some cases (Wyes Karny) - Fix some issues related to the AMD P-state cpufreq driver (Mario Limonciello, Wyes Karny) - Fix the energy_performance_preference attribute handling in the intel_pstate driver in passive mode (Tero Kristo) - Fix the handling of pm_suspend_target_state when CONFIG_PM is unset (Kai-Heng Feng) - Correct spelling mistake in a comment in the hibernation code (Wang Honghui) - Add arch_resume_nosmt() prototype to avoid a "missing prototypes" build warning (Arnd Bergmann) - Restrict pm_pr_dbg() to system-wide power transitions and use it in a few additional places (Mario Limonciello) - Drop verification of in-params from genpd_add_device() and ensure that all of its callers will do it (Ulf Hansson) - Prevent possible integer overflows from occurring in genpd_parse_state() (Nikita Zhandarovich) - Reorder fieldls in 'struct devfreq_dev_status' to reduce its size somewhat (Christophe JAILLET) - Ensure that the Exynos PPMU driver is already loaded before the Exynos Bus driver starts probing so as to avoid a possible freeze loading of the kernel modules (Marek Szyprowski) - Fix variable deferencing before NULL check in the mtk-cci devfreq driver (Sukrut Bellary)" * tag 'pm-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (42 commits) intel_idle: Add a "Long HLT" C1 state for the VM guest mode cpufreq: intel_pstate: Fix energy_performance_preference for passive cpufreq: amd-pstate: Add a kernel config option to set default mode cpufreq: amd-pstate: Set a fallback policy based on preferred_profile ACPI: CPPC: Add definition for undefined FADT preferred PM profile value cpufreq: amd-pstate: Set default governor to schedutil PM: domains: Move the verification of in-params from genpd_add_device() cpufreq: amd-pstate: Make amd-pstate EPP driver name hyphenated cpufreq: amd-pstate: Write CPPC enable bit per-socket intel_idle: Add support for using intel_idle in a VM guest using just hlt cpufreq: Fail driver register if it has adjust_perf without fast_switch intel_idle: clean up the (new) state_update_enter_method function intel_idle: refactor state->enter manipulation into its own function platform/x86/amd: pmc: Use pm_pr_dbg() for suspend related messages pinctrl: amd: Use pm_pr_dbg to show debugging messages ACPI: x86: Add pm_debug_messages for LPS0 _DSM state tracking include/linux/suspend.h: Only show pm_pr_dbg messages at suspend/resume powercap: RAPL: Fix a NULL vs IS_ERR() bug powercap: RAPL: Fix CONFIG_IOSF_MBI dependency powercap: RAPL: fix invalid initialization for pl4_supported field ... commit bb6950556d4b1dd1226c1f09e84b53cb37e5340f Merge: 2605e80d3438c 01fee479846bb Author: Linus Torvalds Date: Mon Jun 26 19:30:19 2023 -0700 Merge tag 'acpi-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These rework the handling of notifications in ACPI button drivers (to enable future simplifications and cleanups), clean up the ACPI thermal driver, update the ACPI backlight driver, add quirks working around AML bugs on some systems, fix some assorted issues and clean up code. Specifics: - Reduce ACPI device enumeration overhead related to devices with dependencies (Rafael Wysocki) - Fix the handling of Microsoft LPS0 _DSM for suspend-to-idle (Mario Limonciello) - Fix section mismatch warning in the ACPI suspend-to-idle code (Arnd Bergmann) - Drop several ACPI resource management quirks related to IRQ ovverides on AMD "Zen" systems (Mario Limonciello) - Modify the ACPI EC driver to make it only clear the EC GPE status when handling the GPE (Jeremy Compostella) - Add quirks to work around ACPI tables defects on Lenovo Yoga Book yb1-x90f/l and Nextbook Ares 8A (Hans de Goede) - Add ACPi backlight quirks for Dell Studio 1569, Lenovo ThinkPad X131e (3371 AMD version) and Apple iMac11,3 and stop trying to use vendor backlight control on relatively recent systems (Hans de Goede) - Add pwm_lookup_table entry for second PWM on CHT/BSW devices in the ACPI LPSS (Intel SoC) driver (Hans de Goede) - Add nfit_intel_shutdown_status() declaration to a local header to avoid a "missing prototypes" build warning (Arnd Bergmann) - Clean up the ACPI thermal driver and drop some dead or otherwise unneded code from it (Rafael Wysocki) - Rework the handling of notifications in the ACPI button drivers so as to allow the common notification handling code for devices to be simplified (Rafael Wysocki) - Make ghes_get_devices() return NULL to indicate that there are no GHES devices so as to allow vendor-specific EDAC drivers to probe then (Li Yang) - Mark bert_disable() as __initdata and drop an unused function from the APEI GHES code (Miaohe Lin) - Make the ACPI PAD (Processor Aggregator Device) driver realize that Zhaoxin CPUs support nonstop TSC (Tony W Wang-oc) - Drop the certainly unnecessary and likely incorrect inclusion of linux/arm-smccc.h from acpi_ffh.c (Sudeep Holla)" * tag 'acpi-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (30 commits) ACPI: video: Add backlight=native DMI quirk for Dell Studio 1569 ACPI: thermal: Drop struct acpi_thermal_flags ACPI: thermal: Drop struct acpi_thermal_state ACPI: bus: Simplify installation and removal of notify callback ACPI: tiny-power-button: Eliminate the driver notify callback ACPI: button: Use different notify handlers for lid and buttons ACPI: button: Eliminate the driver notify callback ACPI: thermal: Eliminate struct acpi_thermal_state_flags ACPI: thermal: Move acpi_thermal_driver definition ACPI: thermal: Move symbol definitions to one place ACPI: thermal: Drop redundant ACPI_TRIPS_REFRESH_DEVICES symbol ACPI: thermal: Use BIT() macro for defining flags APEI: GHES: correctly return NULL for ghes_get_devices() ACPI: FFH: Drop the inclusion of linux/arm-smccc.h ACPI: PAD: mark Zhaoxin CPUs NONSTOP TSC correctly ACPI: APEI: mark bert_disable as __initdata ACPI: EC: Clear GPE on interrupt handling only ACPI: video: Stop trying to use vendor backlight control on laptops from after ~2012 ACPI: x86: s2idle: Adjust Microsoft LPS0 _DSM handling sequence ACPI: resource: Remove "Zen" specific match and quirks ... commit 5fb2864cbd50a84a73af4fdd900b31f2daddea34 Author: Andrew Halaney Date: Mon Jun 26 08:46:46 2023 -0500 OPP: Properly propagate error along when failing to get icc_path fa155f4f8348 ("OPP: Use dev_err_probe() when failing to get icc_path") failed to actually use the error it was trying to log: smatch warnings: drivers/opp/of.c:516 dev_pm_opp_of_find_icc_paths() warn: passing zero to 'dev_err_probe' Make sure to use the right error and pass it along. Fixes: fa155f4f8348 ("OPP: Use dev_err_probe() when failing to get icc_path") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202306262008.guNLgjt6-lkp@intel.com/ Signed-off-by: Andrew Halaney Signed-off-by: Viresh Kumar commit 2605e80d3438c77190f55b821c6575048c68268e Merge: 2b603cd5b78fe abc17128c81ae Author: Linus Torvalds Date: Mon Jun 26 17:11:53 2023 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Catalin Marinas: "Notable features are user-space support for the memcpy/memset instructions and the permission indirection extension. - Support for the Armv8.9 Permission Indirection Extensions. While this feature doesn't add new functionality, it enables future support for Guarded Control Stacks (GCS) and Permission Overlays - User-space support for the Armv8.8 memcpy/memset instructions - arm64 perf: support the HiSilicon SoC uncore PMU, Arm CMN sysfs identifier, support for the NXP i.MX9 SoC DDRC PMU, fixes and cleanups - Removal of superfluous ISBs on context switch (following retrospective architecture tightening) - Decode the ISS2 register during faults for additional information to help with debugging - KPTI clean-up/simplification of the trampoline exit code - Addressing several -Wmissing-prototype warnings - Kselftest improvements for signal handling and ptrace - Fix TPIDR2_EL0 restoring on sigreturn - Clean-up, robustness improvements of the module allocation code - More sysreg conversions to the automatic register/bitfields generation - CPU capabilities handling cleanup - Arm documentation updates: ACPI, ptdump" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (124 commits) kselftest/arm64: Add a test case for TPIDR2 restore arm64/signal: Restore TPIDR2 register rather than memory state arm64: alternatives: make clean_dcache_range_nopatch() noinstr-safe Documentation/arm64: Add ptdump documentation arm64: hibernate: remove WARN_ON in save_processor_state kselftest/arm64: Log signal code and address for unexpected signals docs: perf: Fix warning from 'make htmldocs' in hisi-pmu.rst arm64/fpsimd: Exit streaming mode when flushing tasks docs: perf: Add new description for HiSilicon UC PMU drivers/perf: hisi: Add support for HiSilicon UC PMU driver drivers/perf: hisi: Add support for HiSilicon H60PA and PAv3 PMU driver perf: arm_cspmu: Add missing MODULE_DEVICE_TABLE perf/arm-cmn: Add sysfs identifier perf/arm-cmn: Revamp model detection perf/arm_dmc620: Add cpumask arm64: mm: fix VA-range sanity check arm64/mm: remove now-superfluous ISBs from TTBR writes Documentation/arm64: Update ACPI tables from BBR Documentation/arm64: Update references in arm-acpi Documentation/arm64: Update ARM and arch reference ... commit 2b603cd5b78fe79af0498824fbd9281b1fba6a75 Merge: f810c182366ac 85e18ed32e260 Author: Linus Torvalds Date: Mon Jun 26 17:07:53 2023 -0700 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM updates from Russell King: - lots of build cleanups from Arnd spread throughout the arch/arm tree - replace strlcpy() with the preferred strscpy() - use sign_extend32() in the module linker - drop handle_irq() machine descriptor method * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 9315/1: fiq: include asm/mach/irq.h for prototypes ARM: 9314/1: tcm: move tcm_init() prototype to asm/tcm.h ARM: 9313/1: vdso: add missing prototypes ARM: 9312/1: vfp: include asm/neon.h in vfpmodule.c ARM: 9311/1: decompressor: move function prototypes to misc.h ARM: 9310/1: xip-kernel: add __inflate_kernel_data prototype ARM: 9309/1: add missing syscall prototypes ARM: 9308/1: move setup functions to header ARM: 9307/1: nommu: include asm/idmap.h ARM: 9306/1: cacheflush: avoid __flush_anon_page() missing-prototype warning ARM: 9305/1: add clear/copy_user_highpage declarations ARM: 9304/1: add prototype for function called only from asm ARM: 9303/1: kprobes: avoid missing-declaration warnings ARM: 9302/1: traps: hide unused functions on NOMMU ARM: 9301/1: dma-mapping: hide unused dma_contiguous_early_fixup function ARM: 9300/1: Replace all non-returning strlcpy with strscpy ARM: 9299/1: module: use sign_extend32() to extend the signedness ARM: 9298/1: Drop custom mdesc->handle_irq() commit f810c182366acd2eb7eb5efb3c06b1fc9f719835 Merge: 19300488c9d9c 4055eabe04a26 Author: Linus Torvalds Date: Mon Jun 26 17:04:03 2023 -0700 Merge tag 'm68k-for-v6.5-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - miscellaneous NuBus fixes and improvements - defconfig updates * tag 'm68k-for-v6.5-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: defconfig: Update defconfigs for v6.4-rc1 nubus: Don't list slot resources by default nubus: Remove proc entries before adding them nubus: Partially revert proc_create_single_data() conversion commit 19300488c9d9c9ed539ab3f4f1bfc0050c9a4482 Merge: 5dfe7a7e52ccd b360cbd254fde Author: Linus Torvalds Date: Mon Jun 26 16:43:54 2023 -0700 Merge tag 'x86_cleanups_for_6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Dave Hansen: "As usual, these are all over the map. The biggest cluster is work from Arnd to eliminate -Wmissing-prototype warnings: - Address -Wmissing-prototype warnings - Remove repeated 'the' in comments - Remove unused current_untag_mask() - Document urgent tip branch timing - Clean up MSR kernel-doc notation - Clean up paravirt_ops doc - Update Srivatsa S. Bhat's maintained areas - Remove unused extern declaration acpi_copy_wakeup_routine()" * tag 'x86_cleanups_for_6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (22 commits) x86/acpi: Remove unused extern declaration acpi_copy_wakeup_routine() Documentation: virt: Clean up paravirt_ops doc x86/mm: Remove unused current_untag_mask() x86/mm: Remove repeated word in comments x86/lib/msr: Clean up kernel-doc notation x86/platform: Avoid missing-prototype warnings for OLPC x86/mm: Add early_memremap_pgprot_adjust() prototype x86/usercopy: Include arch_wb_cache_pmem() declaration x86/vdso: Include vdso/processor.h x86/mce: Add copy_mc_fragile_handle_tail() prototype x86/fbdev: Include asm/fb.h as needed x86/hibernate: Declare global functions in suspend.h x86/entry: Add do_SYSENTER_32() prototype x86/quirks: Include linux/pnp.h for arch_pnpbios_disabled() x86/mm: Include asm/numa.h for set_highmem_pages_init() x86: Avoid missing-prototype warnings for doublefault code x86/fpu: Include asm/fpu/regset.h x86: Add dummy prototype for mk_early_pgtbl_32() x86/pci: Mark local functions as 'static' x86/ftrace: Move prepare_ftrace_return prototype to header ... commit 2ef6c32a914b85217b44a0a2418e830e520b085e Author: Theodore Ts'o Date: Fri Jun 23 10:18:51 2023 -0400 ext4: avoid updating the superblock on a r/o mount if not needed This was noticed by a user who noticied that the mtime of a file backing a loopback device was getting bumped when the loopback device is mounted read/only. Note: This doesn't show up when doing a loopback mount of a file directly, via "mount -o ro /tmp/foo.img /mnt", since the loop device is set read-only when mount automatically creates loop device. However, this is noticeable for a LUKS loop device like this: % cryptsetup luksOpen /tmp/foo.img test % mount -o ro /dev/loop0 /mnt ; umount /mnt or, if LUKS is not in use, if the user manually creates the loop device like this: % losetup /dev/loop0 /tmp/foo.img % mount -o ro /dev/loop0 /mnt ; umount /mnt The modified mtime causes rsync to do a rolling checksum scan of the file on the local and remote side, incrementally increasing the time to rsync the not-modified-but-touched image file. Fixes: eee00237fa5e ("ext4: commit super block if fs record error when journal record without error") Cc: stable@kernel.org Link: https://lore.kernel.org/r/ZIauBR7YiV3rVAHL@glitch Reported-by: Sean Greenslade Signed-off-by: Theodore Ts'o commit 31464ab01fff910cb88376384e2b6824f7bf713f Author: Zhang Yi Date: Fri Jun 16 09:55:47 2023 +0800 jbd2: skip reading super block if it has been verified We got a NULL pointer dereference issue below while running generic/475 I/O failure pressure test. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 1 PID: 15600 Comm: fsstress Not tainted 6.4.0-rc5-xfstests-00055-gd3ab1bca26b4 #190 RIP: 0010:jbd2_journal_set_features+0x13d/0x430 ... Call Trace: ? __die+0x23/0x60 ? page_fault_oops+0xa4/0x170 ? exc_page_fault+0x67/0x170 ? asm_exc_page_fault+0x26/0x30 ? jbd2_journal_set_features+0x13d/0x430 jbd2_journal_revoke+0x47/0x1e0 __ext4_forget+0xc3/0x1b0 ext4_free_blocks+0x214/0x2f0 ext4_free_branches+0xeb/0x270 ext4_ind_truncate+0x2bf/0x320 ext4_truncate+0x1e4/0x490 ext4_handle_inode_extension+0x1bd/0x2a0 ? iomap_dio_complete+0xaf/0x1d0 The root cause is the journal super block had been failed to write out due to I/O fault injection, it's uptodate bit was cleared by end_buffer_write_sync() and didn't reset yet in jbd2_write_superblock(). And it raced by journal_get_superblock()->bh_read(), unfortunately, the read IO is also failed, so the error handling in journal_fail_superblock() unexpectedly clear the journal->j_sb_buffer, finally lead to above NULL pointer dereference issue. If the journal super block had been read and verified, there is no need to call bh_read() read it again even if it has been failed to written out. So the fix could be simply move buffer_verified(bh) in front of bh_read(). Also remove a stale comment left in jbd2_journal_check_used_features(). Fixes: 51bacdba23d8 ("jbd2: factor out journal initialization from journal_get_superblock()") Reported-by: Theodore Ts'o Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230616015547.3155195-1-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit c4d13222afd8a64bf11bc7ec68645496ee8b54b9 Author: Chao Yu Date: Tue Jun 6 15:32:03 2023 +0800 ext4: fix to check return value of freeze_bdev() in ext4_shutdown() freeze_bdev() can fail due to a lot of reasons, it needs to check its reason before later process. Fixes: 783d94854499 ("ext4: add EXT4_IOC_GOINGDOWN ioctl") Cc: stable@kernel.org Signed-off-by: Chao Yu Link: https://lore.kernel.org/r/20230606073203.1310389-1-chao@kernel.org Signed-off-by: Theodore Ts'o commit f3c1c42e0c40656e73f12ab5dcb1110f83ef8e65 Author: Baokun Li Date: Mon Mar 27 22:16:30 2023 +0800 ext4: refactoring to use the unified helper ext4_quotas_off() Rename ext4_quota_off_umount() to ext4_quotas_off(), and add type parameter to replace open code in ext4_enable_quotas(). Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230327141630.156875-3-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit d13f99632748462c32fc95d729f5e754bab06064 Author: Baokun Li Date: Mon Mar 27 22:16:29 2023 +0800 ext4: turn quotas off if mount failed after enabling quotas Yi found during a review of the patch "ext4: don't BUG on inconsistent journal feature" that when ext4_mark_recovery_complete() returns an error value, the error handling path does not turn off the enabled quotas, which triggers the following kmemleak: ================================================================ unreferenced object 0xffff8cf68678e7c0 (size 64): comm "mount", pid 746, jiffies 4294871231 (age 11.540s) hex dump (first 32 bytes): 00 90 ef 82 f6 8c ff ff 00 00 00 00 41 01 00 00 ............A... c7 00 00 00 bd 00 00 00 0a 00 00 00 48 00 00 00 ............H... backtrace: [<00000000c561ef24>] __kmem_cache_alloc_node+0x4d4/0x880 [<00000000d4e621d7>] kmalloc_trace+0x39/0x140 [<00000000837eee74>] v2_read_file_info+0x18a/0x3a0 [<0000000088f6c877>] dquot_load_quota_sb+0x2ed/0x770 [<00000000340a4782>] dquot_load_quota_inode+0xc6/0x1c0 [<0000000089a18bd5>] ext4_enable_quotas+0x17e/0x3a0 [ext4] [<000000003a0268fa>] __ext4_fill_super+0x3448/0x3910 [ext4] [<00000000b0f2a8a8>] ext4_fill_super+0x13d/0x340 [ext4] [<000000004a9489c4>] get_tree_bdev+0x1dc/0x370 [<000000006e723bf1>] ext4_get_tree+0x1d/0x30 [ext4] [<00000000c7cb663d>] vfs_get_tree+0x31/0x160 [<00000000320e1bed>] do_new_mount+0x1d5/0x480 [<00000000c074654c>] path_mount+0x22e/0xbe0 [<0000000003e97a8e>] do_mount+0x95/0xc0 [<000000002f3d3736>] __x64_sys_mount+0xc4/0x160 [<0000000027d2140c>] do_syscall_64+0x3f/0x90 ================================================================ To solve this problem, we add a "failed_mount10" tag, and call ext4_quota_off_umount() in this tag to release the enabled qoutas. Fixes: 11215630aada ("ext4: don't BUG on inconsistent journal feature") Cc: stable@kernel.org Signed-off-by: Zhang Yi Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230327141630.156875-2-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit b21154256dbfc63778e4f235b9ae452e3c1c575e Author: Andrew Davis Date: Fri Jun 23 15:15:19 2023 -0500 dt-bindings: mfd: ti,j721e-system-controller: Remove syscon from example The binding for ti,am654-ehrpwm-tbclk was updated to remove the syscon compatible hint. Remove the same from the example in this binding. Signed-off-by: Andrew Davis Link: https://lore.kernel.org/r/20230623201519.194269-1-afd@ti.com Acked-by: Rob Herring Signed-off-by: Stephen Boyd commit 82e58e69d7007260e2513ceec9fb31fcbed1d02d Merge: b9a40506a2cb6 7ed1cefbf1693 ff1c6c904c8dd Author: Stephen Boyd Date: Mon Jun 26 16:36:14 2023 -0700 Merge branches 'clk-qcom' and 'clk-microchip' into clk-next * clk-qcom: (63 commits) clk: qcom: gcc-sc8280xp: Add runtime PM clk: qcom: gpucc-sc8280xp: Add runtime PM clk: qcom: mmcc-msm8974: fix MDSS_GDSC power flags clk: qcom: gpucc-sm6375: Enable runtime pm dt-bindings: clock: sm6375-gpucc: Add VDD_GX clk: qcom: gcc-sm6115: Add missing PLL config properties clk: qcom: clk-alpha-pll: Add a way to update some bits of test_ctl(_hi) clk: qcom: gcc-ipq6018: remove duplicate initializers clk: qcom: gcc-ipq9574: Enable crypto clocks dt-bindings: clock: Add crypto clock and reset definitions clk: qcom: Add lpass audio clock controller driver for SC8280XP clk: qcom: Add lpass clock controller driver for SC8280XP dt-bindings: clock: Add LPASS AUDIOCC and reset controller for SC8280XP dt-bindings: clock: Add LPASSCC and reset controller for SC8280XP dt-bindings: clock: qcom,mmcc: define clocks/clock-names for MSM8226 clk: qcom: gpucc-sm8550: Add support for graphics clock controller clk: qcom: Add support for SM8450 GPUCC clk: qcom: gcc-sm8450: Enable hw_clk_ctrl clk: qcom: rcg2: Make hw_clk_ctrl toggleable dt-bindings: clock: qcom: Add SM8550 graphics clock controller ... * clk-microchip: clk: at91: sama7g5: s/ep_chg_chg_id/ep_chg_id clk: at91: sama7g5: switch to parent_hw and parent_data clk: at91: sckc: switch to parent_data/parent_hw clk: at91: clk-sam9x60-pll: add support for parent_hw clk: at91: clk-utmi: add support for parent_hw clk: at91: clk-system: add support for parent_hw clk: at91: clk-programmable: add support for parent_hw clk: at91: clk-peripheral: add support for parent_hw clk: at91: clk-master: add support for parent_hw clk: at91: clk-generated: add support for parent_hw clk: at91: clk-main: add support for parent_data/parent_hw commit 71025b8565a383223ea2d94325db37cdabbcc453 Author: Pierre-Clément Tosi Date: Mon Jun 26 12:29:46 2023 +0000 scripts/mksysmap: Ignore prefixed KCFI symbols The (relatively) new KCFI feature in LLVM/Clang encodes type information for C functions by generating symbols named __kcfi_typeid_, which can then be referenced from assembly. However, some custom build rules (e.g. nVHE or early PIE on arm64) use objcopy to add a prefix to all the symbols in their object files, making mksysmap's ignore filter miss those KCFI symbols. Therefore, explicitly list those twice-prefixed KCFI symbols as ignored. Alternatively, this could also be achieved in a less verbose way by ignoring any symbol containing the string "__kcfi_typeid_". However, listing the combined prefixes explicitly saves us from running the small risk of ignoring symbols that should be kept. Signed-off-by: Pierre-Clément Tosi Reviewed-by: Sami Tolvanen Signed-off-by: Masahiro Yamada commit bd5a594b5b1cfa14646bc29e6c7745c961025055 Author: Zhang Yi Date: Wed Mar 22 09:33:53 2023 +0800 ext4: update doc about journal superblock description Update the description in doc about the s_head parameter in the journal superblock. Signed-off-by: Zhang Yi Link: https://lore.kernel.org/r/20230322013353.1843306-4-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 7294505824254da9cb5ee6cb12d783c9eeea030e Author: Zhang Yi Date: Wed Mar 22 09:33:52 2023 +0800 ext4: add journal cycled recording support Always enable 'JBD2_CYCLE_RECORD' journal option on ext4, letting the jbd2 continue to record new journal transactions from the recovered journal head or the checkpointed transactions in the previous mount. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230322013353.1843306-3-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit c7fc60555864c0e67f5e5754a9053986f8fb8491 Author: Zhang Yi Date: Wed Mar 22 09:33:51 2023 +0800 jbd2: continue to record log between each mount For a newly mounted file system, the journal committing thread always record new transactions from the start of the journal area, no matter whether the journal was clean or just has been recovered. So the logdump code in debugfs cannot dump continuous logs between each mount, it is disadvantageous to analysis corrupted file system image and locate the file system inconsistency bugs. If we get a corrupted file system in the running products and want to find out what has happened, besides lookup the system log, one effective way is to backtrack the journal log. But we may not always run e2fsck before each mount and the default fsck -a mode also cannot always checkout all inconsistencies, so it could left over some inconsistencies into the next mount until we detect it. Finally, transactions in the journal may probably discontinuous and some relatively new transactions has been covered, it becomes hard to analyse. If we could record transactions continuously between each mount, we could acquire more useful info from the journal. Like this: |Previous mount checkpointed/recovered logs|Current mount logs | |{------}{---}{--------} ... {------}| ... |{======}{========}...000000| And yes the journal area is limited and cannot record everything, the problematic transaction may also be covered even if we do this, but this is still useful for fuzzy tests and short-running products. This patch save the head blocknr in the superblock after flushing the journal or unmounting the file system, let the next mount could continue to record new transaction behind it. This change is backward compatible because the old kernel does not care about the head blocknr of the journal. It is also fine if we mount a clean old image without valid head blocknr, we fail back to set it to s_first just like before. Finally, for the case of mount an unclean file system, we could also get the journal head easily after scanning/replaying the journal, it will continue to record new transaction after the recovered transactions. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230322013353.1843306-2-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 04c2e98179658d223665661f12c5043224e8f8d3 Author: Zhang Yi Date: Wed Mar 15 09:31:28 2023 +0800 jbd2: remove j_format_version journal->j_format_version is no longer used, remove it. Signed-off-by: Zhang Yi Signed-off-by: Zhihao Cheng Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230315013128.3911115-7-chengzhihao1@huawei.com Signed-off-by: Theodore Ts'o commit 3e5cf02cfa3fa9cc9f568930624faed6d3a53ff4 Author: Zhang Yi Date: Wed Mar 15 09:31:27 2023 +0800 jbd2: factor out journal initialization from journal_get_superblock() Current journal_get_superblock() couple journal superblock checking and partial journal initialization, factor out initialization part from it to make things clear. Signed-off-by: Zhang Yi Signed-off-by: Zhihao Cheng Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230315013128.3911115-6-chengzhihao1@huawei.com Signed-off-by: Theodore Ts'o commit 5cf036d4f1489d7ba04b948e415f662521902c30 Author: Zhang Yi Date: Wed Mar 15 09:31:26 2023 +0800 jbd2: switch to check format version in superblock directly We should only check and set extented features if journal format version is 2, and now we check the in memory copy of the superblock 'journal->j_format_version', which relys on the parameter initialization sequence, switch to use the h_blocktype in superblock cloud be more clear. Signed-off-by: Zhang Yi Signed-off-by: Zhihao Cheng Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230315013128.3911115-5-chengzhihao1@huawei.com Signed-off-by: Theodore Ts'o commit 5c5bd1fef3ec913f9c597c6f61a9b903096415bf Author: Zhang Yi Date: Wed Mar 15 09:31:25 2023 +0800 jbd2: remove unused feature macros JBD2_HAS_[IN|RO_]COMPAT_FEATURE macros are no longer used, just remove them. Signed-off-by: Zhang Yi Signed-off-by: Zhihao Cheng Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230315013128.3911115-4-chengzhihao1@huawei.com Signed-off-by: Theodore Ts'o commit 93e92cfcc1977b2b914c75333aa4b629b2fa7ca2 Author: Zhihao Cheng Date: Wed Mar 15 09:31:24 2023 +0800 ext4: ext4_put_super: Remove redundant checking for 'sbi->s_journal_bdev' As discussed in [1], 'sbi->s_journal_bdev != sb->s_bdev' will always become true if sbi->s_journal_bdev exists. Filesystem block device and journal block device are both opened with 'FMODE_EXCL' mode, so these two devices can't be same one. Then we can remove the redundant checking 'sbi->s_journal_bdev != sb->s_bdev' if 'sbi->s_journal_bdev' exists. [1] https://lore.kernel.org/lkml/f86584f6-3877-ff18-47a1-2efaa12d18b2@huawei.com/ Signed-off-by: Zhihao Cheng Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230315013128.3911115-3-chengzhihao1@huawei.com Signed-off-by: Theodore Ts'o commit 26fb5290240dc31cae99b8b4dd2af7f46dfcba6b Author: Zhihao Cheng Date: Wed Mar 15 09:31:23 2023 +0800 ext4: Fix reusing stale buffer heads from last failed mounting Following process makes ext4 load stale buffer heads from last failed mounting in a new mounting operation: mount_bdev ext4_fill_super | ext4_load_and_init_journal | ext4_load_journal | jbd2_journal_load | load_superblock | journal_get_superblock | set_buffer_verified(bh) // buffer head is verified | jbd2_journal_recover // failed caused by EIO | goto failed_mount3a // skip 'sb->s_root' initialization deactivate_locked_super kill_block_super generic_shutdown_super if (sb->s_root) // false, skip ext4_put_super->invalidate_bdev-> // invalidate_mapping_pages->mapping_evict_folio-> // filemap_release_folio->try_to_free_buffers, which // cannot drop buffer head. blkdev_put blkdev_put_whole if (atomic_dec_and_test(&bdev->bd_openers)) // false, systemd-udev happens to open the device. Then // blkdev_flush_mapping->kill_bdev->truncate_inode_pages-> // truncate_inode_folio->truncate_cleanup_folio-> // folio_invalidate->block_invalidate_folio-> // filemap_release_folio->try_to_free_buffers will be skipped, // dropping buffer head is missed again. Second mount: ext4_fill_super ext4_load_and_init_journal ext4_load_journal ext4_get_journal jbd2_journal_init_inode journal_init_common bh = getblk_unmovable bh = __find_get_block // Found stale bh in last failed mounting journal->j_sb_buffer = bh jbd2_journal_load load_superblock journal_get_superblock if (buffer_verified(bh)) // true, skip journal->j_format_version = 2, value is 0 jbd2_journal_recover do_one_pass next_log_block += count_tags(journal, bh) // According to journal_tag_bytes(), 'tag_bytes' calculating is // affected by jbd2_has_feature_csum3(), jbd2_has_feature_csum3() // returns false because 'j->j_format_version >= 2' is not true, // then we get wrong next_log_block. The do_one_pass may exit // early whenoccuring non JBD2_MAGIC_NUMBER in 'next_log_block'. The filesystem is corrupted here, journal is partially replayed, and new journal sequence number actually is already used by last mounting. The invalidate_bdev() can drop all buffer heads even racing with bare reading block device(eg. systemd-udev), so we can fix it by invalidating bdev in error handling path in __ext4_fill_super(). Fetch a reproducer in [Link]. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217171 Fixes: 25ed6e8a54df ("jbd2: enable journal clients to enable v2 checksumming") Cc: stable@vger.kernel.org # v3.5 Signed-off-by: Zhihao Cheng Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230315013128.3911115-2-chengzhihao1@huawei.com Signed-off-by: Theodore Ts'o commit 310ee0902b8d9d0a13a5a13e94688a5863fa29c2 Author: Brian Foster Date: Tue Mar 14 09:07:59 2023 -0400 ext4: allow concurrent unaligned dio overwrites We've had reports of significant performance regression of sub-block (unaligned) direct writes due to the added exclusivity restrictions in ext4. The purpose of the exclusivity requirement for unaligned direct writes is to avoid data corruption caused by unserialized partial block zeroing in the iomap dio layer across overlapping writes. XFS has similar requirements for the same underlying reasons, yet doesn't suffer the extreme performance regression that ext4 does. The reason for this is that XFS utilizes IOMAP_DIO_OVERWRITE_ONLY mode, which allows for optimistic submission of concurrent unaligned I/O and kicks back writes that require partial block zeroing such that they can be submitted in a safe, exclusive context. Since ext4 already performs most of these checks pre-submission, it can support something similar without necessarily relying on the iomap flag and associated retry mechanism. Update the dio write submission path to allow concurrent submission of unaligned direct writes that are purely overwrite and so will not require block zeroing. To improve readability of the various related checks, move the unaligned I/O handling down into ext4_dio_write_checks(), where the dio draining and force wait logic can immediately follow the locking requirement checks. Finally, the IOMAP_DIO_OVERWRITE_ONLY flag is set to enable a warning check as a precaution should the ext4 overwrite logic ever become inconsistent with the zeroing expectations of iomap dio. The performance improvement of sub-block direct write I/O is shown in the following fio test on a 64xcpu guest vm: Test: fio --name=test --ioengine=libaio --direct=1 --group_reporting --overwrite=1 --thread --size=10G --filename=/mnt/fio --readwrite=write --ramp_time=10s --runtime=60s --numjobs=8 --blocksize=2k --iodepth=256 --allow_file_create=0 v6.2: write: IOPS=4328, BW=8724KiB/s v6.2 (patched): write: IOPS=801k, BW=1565MiB/s Signed-off-by: Brian Foster Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230314130759.642710-1-bfoster@redhat.com Signed-off-by: Theodore Ts'o commit 4c0cfebdf3c34c9cd2c55844f549fa46b1da3164 Author: Theodore Ts'o Date: Thu Jun 8 10:39:35 2023 -0400 ext4: clean up mballoc criteria comments Line wrap and slightly clarify the comments describing mballoc's cirtiera. Define EXT4_MB_NUM_CRS as part of the enum, so that it will automatically get updated when criteria is added or removed. Also fix a potential unitialized use of 'cr' variable if CONFIG_EXT4_DEBUG is enabled. Signed-off-by: Theodore Ts'o commit ab8627e104696b8c1c6953ad5255def5b0821e06 Author: Baokun Li Date: Mon Apr 24 11:38:46 2023 +0800 ext4: make ext4_zeroout_es() return void After ext4_es_insert_extent() returns void, the return value in ext4_zeroout_es() is also unnecessary, so make it return void too. Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230424033846.4732-13-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 6c120399cde6b1b5cf65ce403765c579fb3d3e50 Author: Baokun Li Date: Mon Apr 24 11:38:45 2023 +0800 ext4: make ext4_es_insert_extent() return void Now ext4_es_insert_extent() never return error, so make it return void. Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230424033846.4732-12-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 8782b020ccbef6c4b62f00c86423f4d37ec60932 Author: Baokun Li Date: Mon Apr 24 11:38:44 2023 +0800 ext4: make ext4_es_insert_delayed_block() return void Now it never fails when inserting a delay extent, so the return value in ext4_es_insert_delayed_block is no longer necessary, let it return void. [ Fixed bug which caused system hangs during bigalloc test runs. See https://lore.kernel.org/r/20230612030405.GH1436857@mit.edu for more details. -- TYT ] Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230424033846.4732-11-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit ed5d285b3f2a9a37ff778c5e440daf49351fcc4d Author: Baokun Li Date: Mon Apr 24 11:38:43 2023 +0800 ext4: make ext4_es_remove_extent() return void Now ext4_es_remove_extent() never fails, so make it return void. Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230424033846.4732-10-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 2a69c450083db164596c75c0f5b4d9c4c0e18eba Author: Baokun Li Date: Mon Apr 24 11:38:42 2023 +0800 ext4: using nofail preallocation in ext4_es_insert_extent() Similar to in ext4_es_insert_delayed_block(), we use preallocations that do not fail to avoid inconsistencies, but we do not care about es that are not must be kept, and we return 0 even if such es memory allocation fails. Suggested-by: Jan Kara Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230424033846.4732-9-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 4a2d98447b37bcb68a7f06a1078edcb4f7e6ce7e Author: Baokun Li Date: Mon Apr 24 11:38:41 2023 +0800 ext4: using nofail preallocation in ext4_es_insert_delayed_block() Similar to in ext4_es_remove_extent(), we use a no-fail preallocation to avoid inconsistencies, except that here we may have to preallocate two extent_status. Suggested-by: Jan Kara Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230424033846.4732-8-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit e9fe2b882bd5b26b987c9ba110c2222796f72af5 Author: Baokun Li Date: Mon Apr 24 11:38:40 2023 +0800 ext4: using nofail preallocation in ext4_es_remove_extent() If __es_remove_extent() returns an error it means that when splitting extent, allocating an extent that must be kept failed, where returning an error directly would cause the extent tree to be inconsistent. So we use GFP_NOFAIL to pre-allocate an extent_status and pass it to __es_remove_extent() to avoid this problem. In addition, since the allocated memory is outside the i_es_lock, the extent_status tree may change and the pre-allocated extent_status is no longer needed, so we release the pre-allocated extent_status when es->es_len is not initialized. Suggested-by: Jan Kara Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230424033846.4732-7-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit bda3efaf774fb687c2b7a555aaec3006b14a8857 Author: Baokun Li Date: Mon Apr 24 11:38:39 2023 +0800 ext4: use pre-allocated es in __es_remove_extent() When splitting extent, if the second extent can not be dropped, we return -ENOMEM and use GFP_NOFAIL to preallocate an extent_status outside of i_es_lock and pass it to __es_remove_extent() to be used as the second extent. This ensures that __es_remove_extent() is executed successfully, thus ensuring consistency in the extent status tree. If the second extent is not undroppable, we simply drop it and return 0. Then retry is no longer necessary, remove it. Now, __es_remove_extent() will always remove what it should, maybe more. Suggested-by: Jan Kara Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230424033846.4732-6-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 95f0b320339a977cf69872eac107122bf536775d Author: Baokun Li Date: Mon Apr 24 11:38:38 2023 +0800 ext4: use pre-allocated es in __es_insert_extent() Pass a extent_status pointer prealloc to __es_insert_extent(). If the pointer is non-null, it is used directly when a new extent_status is needed to avoid memory allocation failures. Suggested-by: Jan Kara Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230424033846.4732-5-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 73a2f033656be11298912201ad50615307b4477a Author: Baokun Li Date: Mon Apr 24 11:38:37 2023 +0800 ext4: factor out __es_alloc_extent() and __es_free_extent() Factor out __es_alloc_extent() and __es_free_extent(), which only allocate and free extent_status in these two helpers. The ext4_es_alloc_extent() function is split into __es_alloc_extent() and ext4_es_init_extent(). In __es_alloc_extent() we allocate memory using GFP_KERNEL | __GFP_NOFAIL | __GFP_ZERO if the memory allocation cannot fail, otherwise we use GFP_ATOMIC. and the ext4_es_init_extent() is used to initialize extent_status and update related variables after a successful allocation. This is to prepare for the use of pre-allocated extent_status later. Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230424033846.4732-4-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 9649eb18c6288f514cacffdd699d5cd999c2f8f6 Author: Baokun Li Date: Mon Apr 24 11:38:36 2023 +0800 ext4: add a new helper to check if es must be kept In the extent status tree, we have extents which we can just drop without issues and extents we must not drop - this depends on the extent's status - currently ext4_es_is_delayed() extents must stay, others may be dropped. A helper function is added to help determine if the current extent can be dropped, although only ext4_es_is_delayed() extents cannot be dropped currently. Suggested-by: Jan Kara Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230424033846.4732-3-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit de25d6e9610a8b30cce9bbb19b50615d02ebca02 Author: Baokun Li Date: Mon Apr 24 11:38:35 2023 +0800 ext4: only update i_reserved_data_blocks on successful block allocation In our fault injection test, we create an ext4 file, migrate it to non-extent based file, then punch a hole and finally trigger a WARN_ON in the ext4_da_update_reserve_space(): EXT4-fs warning (device sda): ext4_da_update_reserve_space:369: ino 14, used 11 with only 10 reserved data blocks When writing back a non-extent based file, if we enable delalloc, the number of reserved blocks will be subtracted from the number of blocks mapped by ext4_ind_map_blocks(), and the extent status tree will be updated. We update the extent status tree by first removing the old extent_status and then inserting the new extent_status. If the block range we remove happens to be in an extent, then we need to allocate another extent_status with ext4_es_alloc_extent(). use old to remove to add new |----------|------------|------------| old extent_status The problem is that the allocation of a new extent_status failed due to a fault injection, and __es_shrink() did not get free memory, resulting in a return of -ENOMEM. Then do_writepages() retries after receiving -ENOMEM, we map to the same extent again, and the number of reserved blocks is again subtracted from the number of blocks in that extent. Since the blocks in the same extent are subtracted twice, we end up triggering WARN_ON at ext4_da_update_reserve_space() because used > ei->i_reserved_data_blocks. For non-extent based file, we update the number of reserved blocks after ext4_ind_map_blocks() is executed, which causes a problem that when we call ext4_ind_map_blocks() to create a block, it doesn't always create a block, but we always reduce the number of reserved blocks. So we move the logic for updating reserved blocks to ext4_ind_map_blocks() to ensure that the number of reserved blocks is updated only after we do succeed in allocating some new blocks. Fixes: 5f634d064c70 ("ext4: Fix quota accounting error with fallocate") Cc: stable@kernel.org Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20230424033846.4732-2-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit f52f3d2b9fbab73c776f4d3386393e9bbc83b87d Author: Ojaswin Mujoo Date: Tue May 30 18:03:50 2023 +0530 ext4: Give symbolic names to mballoc criterias mballoc criterias have historically been called by numbers like CR0, CR1... however this makes it confusing to understand what each criteria is about. Change these criterias from numbers to symbolic names and add relevant comments. While we are at it, also reformat and add some comments to ext4_seq_mb_stats_show() for better readability. Additionally, define CR_FAST which signifies the criteria below which we can make quicker decisions like: * quitting early if (free block < requested len) * avoiding to scan free extents smaller than required len. * avoiding to initialize buddy cache and work with existing cache * limiting prefetches Suggested-by: Jan Kara Signed-off-by: Ojaswin Mujoo Link: https://lore.kernel.org/r/a2dc6ec5aea5e5e68cf8e788c2a964ffead9c8b0.1685449706.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 7e170922f06bf46effa7c57f6035fc463d6edc7e Author: Ojaswin Mujoo Date: Tue May 30 18:03:49 2023 +0530 ext4: Add allocation criteria 1.5 (CR1_5) CR1_5 aims to optimize allocations which can't be satisfied in CR1. The fact that we couldn't find a group in CR1 suggests that it would be difficult to find a continuous extent to compleltely satisfy our allocations. So before falling to the slower CR2, in CR1.5 we proactively trim the the preallocations so we can find a group with (free / fragments) big enough. This speeds up our allocation at the cost of slightly reduced preallocation. The patch also adds a new sysfs tunable: * /sys/fs/ext4//mb_cr1_5_max_trim_order This controls how much CR1.5 can trim a request before falling to CR2. For example, for a request of order 7 and max trim order 2, CR1.5 can trim this upto order 5. Suggested-by: Ritesh Harjani (IBM) Signed-off-by: Ojaswin Mujoo Reviewed-by: Ritesh Harjani (IBM) Link: https://lore.kernel.org/r/150fdf65c8e4cc4dba71e020ce0859bcf636a5ff.1685449706.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 856d865c178b4fbf4c629d5a7d0df9352d123280 Author: Ojaswin Mujoo Date: Tue May 30 18:03:48 2023 +0530 ext4: Abstract out logic to search average fragment list Make the logic of searching average fragment list of a given order reusable by abstracting it out to a differnet function. This will also avoid code duplication in upcoming patches. No functional changes. Signed-off-by: Ojaswin Mujoo Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/028c11d95b17ce0285f45456709a0ca922df1b83.1685449706.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 4f3d1e4533b0982034f316ace85415d3bc57e3da Author: Ojaswin Mujoo Date: Tue May 30 18:03:47 2023 +0530 ext4: Ensure ext4_mb_prefetch_fini() is called for all prefetched BGs Before this patch, the call stack in ext4_run_li_request is as follows: /* * nr = no. of BGs we want to fetch (=s_mb_prefetch) * prefetch_ios = no. of BGs not uptodate after * ext4_read_block_bitmap_nowait() */ next_group = ext4_mb_prefetch(sb, group, nr, prefetch_ios); ext4_mb_prefetch_fini(sb, next_group prefetch_ios); ext4_mb_prefetch_fini() will only try to initialize buddies for BGs in range [next_group - prefetch_ios, next_group). This is incorrect since sometimes (prefetch_ios < nr), which causes ext4_mb_prefetch_fini() to incorrectly ignore some of the BGs that might need initialization. This issue is more notable now with the previous patch enabling "fetching" of BLOCK_UNINIT BGs which are marked buffer_uptodate by default. Fix this by passing nr to ext4_mb_prefetch_fini() instead of prefetch_ios so that it considers the right range of groups. Similarly, make sure we don't pass nr=0 to ext4_mb_prefetch_fini() in ext4_mb_regular_allocator() since we might have prefetched BLOCK_UNINIT groups that would need buddy initialization. Signed-off-by: Ojaswin Mujoo Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/05e648ae04ec5b754207032823e9c1de9a54f87a.1685449706.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 3c6296046c85333bc52555a670a9093d9e2657bb Author: Ojaswin Mujoo Date: Tue May 30 18:03:46 2023 +0530 ext4: Don't skip prefetching BLOCK_UNINIT groups Currently, ext4_mb_prefetch() and ext4_mb_prefetch_fini() skip BLOCK_UNINIT groups since fetching their bitmaps doesn't need disk IO. As a consequence, we end not initializing the buddy structures and CR0/1 lists for these BGs, even though it can be done without any disk IO overhead. Hence, don't skip such BGs during prefetch and prefetch_fini. This improves the accuracy of CR0/1 allocation as earlier, we could have essentially empty BLOCK_UNINIT groups being ignored by CR0/1 due to their buddy not being initialized, leading to slower CR2 allocations. With this patch CR0/1 will be able to discover these groups as well, thus improving performance. Signed-off-by: Ojaswin Mujoo Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/dc3130b8daf45ffe63d8a3c1edcf00eb8ba70e1f.1685449706.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 1b420011210802a7a1b1e99f30bc1d62c352ac71 Author: Ojaswin Mujoo Date: Tue May 30 18:03:45 2023 +0530 ext4: Avoid scanning smaller extents in BG during CR1 When we are inside ext4_mb_complex_scan_group() in CR1, we can be sure that this group has atleast 1 big enough continuous free extent to satisfy our request because (free / fragments) > goal length. Hence, instead of wasting time looping over smaller free extents, only try to consider the free extent if we are sure that it has enough continuous free space to satisfy goal length. This is particularly useful when scanning highly fragmented BGs in CR1 as, without this patch, the allocator might stop scanning early before reaching the big enough free extent (due to ac_found > mb_max_to_scan) which causes us to uncessarily trim the request. Signed-off-by: Ojaswin Mujoo Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/a5473df4517c53ec940bc9b603ef83a547032a32.1685449706.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 3ef5d263879696027c70548532a94418aad3bd95 Author: Ojaswin Mujoo Date: Tue May 30 18:03:44 2023 +0530 ext4: Add counter to track successful allocation of goal length Track number of allocations where the length of blocks allocated is equal to the length of goal blocks (post normalization). This metric could be useful if making changes to the allocator logic in the future as it could give us visibility into how often do we trim our requests. PS: ac_b_ex.fe_len might get modified due to preallocation efforts and hence we use ac_f_ex.fe_len instead since we want to compare how much the allocator was able to actually find. Signed-off-by: Ojaswin Mujoo Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/343620e2be8a237239ea2613a7a866ee8607e973.1685449706.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit fdd9a00943a5f6687937628e01506dad697c9140 Author: Ojaswin Mujoo Date: Tue May 30 18:03:43 2023 +0530 ext4: Add per CR extent scanned counter This gives better visibility into the number of extents scanned in each particular CR. For example, this information can be used to see how out block group scanning logic is performing when the BG is fragmented. Signed-off-by: Ojaswin Mujoo Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/55bb6d80f6e22ed2a5a830aa045572bdffc8b1b9.1685449706.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 4eb7a4a1a33bdaf259fca8528f2546c90ad18f0d Author: Ojaswin Mujoo Date: Tue May 30 18:03:42 2023 +0530 ext4: Convert mballoc cr (criteria) to enum Convert criteria to be an enum so it easier to maintain and update the tracefiles to use enum names. This change also makes it easier to insert new criterias in the future. There is no functional change in this patch. Signed-off-by: Ojaswin Mujoo Reviewed-by: Ritesh Harjani (IBM) Link: https://lore.kernel.org/r/5d82fd467bdf70ea45bdaef810af3b146013946c.1685449706.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 5730cce35344fba94e2c329d2bc0a170333a059f Author: Ritesh Harjani Date: Tue May 30 18:03:41 2023 +0530 ext4: Remove unused extern variables declaration ext4_mb_stats & ext4_mb_max_to_scan are never used. We use sbi->s_mb_stats and sbi->s_mb_max_to_scan instead. Hence kill these extern declarations. Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Ojaswin Mujoo Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/928b3142062172533b6d1b5a94de94700590fef3.1685449706.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 569f196f1e7a14472f21734170411f75a3179db0 Author: Ritesh Harjani Date: Tue May 30 18:03:40 2023 +0530 ext4: mballoc: Remove useless setting of ac_criteria There will be changes coming in future patches which will introduce a new criteria for block allocation. This removes the useless setting of ac_criteria. AFAIU, this might be only used to differentiate between whether a preallocated blocks was allocated or was regular allocator called for allocating blocks. Hence this also adds the debug prints to identify what type of block allocation was done in ext4_mb_show_ac(). Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Ojaswin Mujoo Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/1dbae05617519cb6202f1b299c9d1be3e7cda763.1685449706.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 2ec6d0a5ea72689a79e6f725fd8b443a788ae279 Author: Kemeng Shi Date: Sat Jun 3 23:03:19 2023 +0800 ext4: fix wrong unit use in ext4_mb_new_blocks Function ext4_free_blocks_simple needs count in cluster. Function ext4_free_blocks accepts count in block. Convert count to cluster to fix the mismatch. Signed-off-by: Kemeng Shi Cc: stable@kernel.org Reviewed-by: Ojaswin Mujoo Link: https://lore.kernel.org/r/20230603150327.3596033-12-shikemeng@huaweicloud.com Signed-off-by: Theodore Ts'o commit 247c3d214c23dfeeeb892e91a82ac1188bdaec9f Author: Kemeng Shi Date: Sat Jun 3 23:03:18 2023 +0800 ext4: fix wrong unit use in ext4_mb_clear_bb Function ext4_issue_discard need count in cluster. Pass count_clusters instead of count to fix the mismatch. Signed-off-by: Kemeng Shi Cc: stable@kernel.org Reviewed-by: Ojaswin Mujoo Link: https://lore.kernel.org/r/20230603150327.3596033-11-shikemeng@huaweicloud.com Signed-off-by: Theodore Ts'o commit ad78b5efe4246e5deba8d44a6ed172b8a00d3113 Author: Kemeng Shi Date: Sat Jun 3 23:03:17 2023 +0800 ext4: remove unused parameter from ext4_mb_new_blocks_simple() Two cleanups for ext4_mb_new_blocks_simple: Remove unused parameter handle of ext4_mb_new_blocks_simple. Move ext4_mb_new_blocks_simple definition before ext4_mb_new_blocks to remove unnecessary forward declaration of ext4_mb_new_blocks_simple. Signed-off-by: Kemeng Shi Reviewed-by: Ojaswin Mujoo Link: https://lore.kernel.org/r/20230603150327.3596033-10-shikemeng@huaweicloud.com Signed-off-by: Theodore Ts'o commit 5dfe7a7e52ccdf60dfd11ccbe509e4365ea721ca Merge: 36db314440502 94142c9d1bdf1 Author: Linus Torvalds Date: Mon Jun 26 16:32:47 2023 -0700 Merge tag 'x86_tdx_for_6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 tdx updates from Dave Hansen: - Fix a race window where load_unaligned_zeropad() could cause a fatal shutdown during TDX private<=>shared conversion The race has never been observed in practice but might allow load_unaligned_zeropad() to catch a TDX page in the middle of its conversion process which would lead to a fatal and unrecoverable guest shutdown. - Annotate sites where VM "exit reasons" are reused as hypercall numbers. * tag 'x86_tdx_for_6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Fix enc_status_change_finish_noop() x86/tdx: Fix race between set_memory_encrypted() and load_unaligned_zeropad() x86/mm: Allow guest.enc_status_change_prepare() to fail x86/tdx: Wrap exit reason with hcall_func() commit 1240dabe8d58b4eff09e7edf1560da0360f997aa Author: Masahiro Yamada Date: Mon Jun 26 03:16:23 2023 +0900 kbuild: deb-pkg: remove the CONFIG_MODULES check in buildeb When CONFIG_MODULES is disabled for ARCH=um, 'make (bin)deb-pkg' fails with an error like follows: cp: cannot create regular file 'debian/linux-image/usr/lib/uml/modules/6.4.0-rc2+/System.map': No such file or directory Remove the CONFIG_MODULES check completely so ${pdir}/usr/lib/uml/modules will always be created and modules.builtin.(modinfo) will be installed under it for ARCH=um. Fixes: b611daae5efc ("kbuild: deb-pkg: split image and debug objects staging out into functions") Signed-off-by: Masahiro Yamada commit 4243afdb932677a03770753be8c54b3190a512e8 Author: Josh Triplett Date: Thu Jun 22 12:19:53 2023 -0700 kbuild: builddeb: always make modules_install, to install modules.builtin* Even for a non-modular kernel, the kernel builds modules.builtin and modules.builtin.modinfo, with information about the built-in modules. Tools such as initramfs-tools need these files to build a working initramfs on some systems, such as those requiring firmware. Now that `make modules_install` works even in non-modular kernels and installs these files, unconditionally invoke it when building a Debian package. Signed-off-by: Josh Triplett Reviewed-by: Nicolas Schier Signed-off-by: Masahiro Yamada commit ff1c6c904c8dd265e62abd8adf301bf755e203de Merge: 3973bcc95e744 5619c2ddaf3ff Author: Stephen Boyd Date: Mon Jun 26 16:29:58 2023 -0700 Merge tag 'clk-microchip-6.5-2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into clk-microchip Pull Microchip clk driver updates from Claudiu Beznea: It contains support for parent_data, parent_hw in AT91 clock drivers used by SAMA7G5 SoC (e.g. main, master, generic, peripheral, programmable, system, utmi, slow clocks) and also the update of SAMA7G5 to use this new support. * tag 'clk-microchip-6.5-2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: clk: at91: sama7g5: s/ep_chg_chg_id/ep_chg_id clk: at91: sama7g5: switch to parent_hw and parent_data clk: at91: sckc: switch to parent_data/parent_hw clk: at91: clk-sam9x60-pll: add support for parent_hw clk: at91: clk-utmi: add support for parent_hw clk: at91: clk-system: add support for parent_hw clk: at91: clk-programmable: add support for parent_hw clk: at91: clk-peripheral: add support for parent_hw clk: at91: clk-master: add support for parent_hw clk: at91: clk-generated: add support for parent_hw clk: at91: clk-main: add support for parent_data/parent_hw commit 36db314440502c1a3a283ba5a16cb5075c19f3d9 Merge: a3d763f0b34d9 73b3108dfd9d5 Author: Linus Torvalds Date: Mon Jun 26 16:26:44 2023 -0700 Merge tag 'x86_platform_for_6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 platform updates from Dave Hansen: "Allow CPUs in SGX/HPE Ultraviolet to start using Sub-NUMA clustering (SNC) mode. SNC has been around outside the UV world for a while but evidently never worked on UV systems. SNC is rather notorious for breaking bad assumptions of a 1:1 relationship between physical sockets and NUMA nodes. The UV code was rather prolific with these assumptions and took quite a bit of refactoring to remove them" * tag 'x86_platform_for_6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/platform/uv: Update UV[23] platform code for SNC x86/platform/uv: Remove remaining BUG_ON() and BUG() calls x86/platform/uv: UV support for sub-NUMA clustering x86/platform/uv: Helper functions for allocating and freeing conversion tables x86/platform/uv: When searching for minimums, start at INT_MAX not 99999 x86/platform/uv: Fix printed information in calc_mmioh_map x86/platform/uv: Introduce helper function uv_pnode_to_socket. x86/platform/uv: Add platform resolving #defines for misc GAM_MMIOH_REDIRECT* commit a3d763f0b34d94a4f2b2e3075350a19d589630f3 Merge: 941d77c77339d 504dba50b0c3f Author: Linus Torvalds Date: Mon Jun 26 16:24:40 2023 -0700 Merge tag 'x86_irq_for_6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 irq updates from Dave Hansen: "Add Hyper-V interrupts to /proc/stat" * tag 'x86_irq_for_6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/irq: Add hardcoded hypervisor interrupts to /proc/stat commit 941d77c77339d2dd1cda8911da63da3c67e90860 Merge: 2c96136a3f8da f220125b999b2 Author: Linus Torvalds Date: Mon Jun 26 15:42:34 2023 -0700 Merge tag 'x86_cpu_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu updates from Borislav Petkov: - Compute the purposeful misalignment of zen_untrain_ret automatically and assert __x86_return_thunk's alignment so that future changes to the symbol macros do not accidentally break them. - Remove CONFIG_X86_FEATURE_NAMES Kconfig option as its existence is pointless * tag 'x86_cpu_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/retbleed: Add __x86_return_thunk alignment checks x86/cpu: Remove X86_FEATURE_NAMES x86/Kconfig: Make X86_FEATURE_NAMES non-configurable in prompt commit 2c96136a3f8dad6bfe35b003fb8b312f13a107e8 Merge: 3e5822e0f99e4 84b9b44b99780 Author: Linus Torvalds Date: Mon Jun 26 15:32:39 2023 -0700 Merge tag 'x86_cc_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 confidential computing update from Borislav Petkov: - Add support for unaccepted memory as specified in the UEFI spec v2.9. The gist of it all is that Intel TDX and AMD SEV-SNP confidential computing guests define the notion of accepting memory before using it and thus preventing a whole set of attacks against such guests like memory replay and the like. There are a couple of strategies of how memory should be accepted - the current implementation does an on-demand way of accepting. * tag 'x86_cc_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: virt: sevguest: Add CONFIG_CRYPTO dependency x86/efi: Safely enable unaccepted memory in UEFI x86/sev: Add SNP-specific unaccepted memory support x86/sev: Use large PSC requests if applicable x86/sev: Allow for use of the early boot GHCB for PSC requests x86/sev: Put PSC struct on the stack in prep for unaccepted memory support x86/sev: Fix calculation of end address based on number of pages x86/tdx: Add unaccepted memory support x86/tdx: Refactor try_accept_one() x86/tdx: Make _tdx_hypercall() and __tdx_module_call() available in boot stub efi/unaccepted: Avoid load_unaligned_zeropad() stepping into unaccepted memory efi: Add unaccepted memory support x86/boot/compressed: Handle unaccepted memory efi/libstub: Implement support for unaccepted memory efi/x86: Get full memory map in allocate_e820() mm: Add support for unaccepted memory commit 3e5822e0f99e429fa8b03c956dad890179b5b3b1 Merge: 59035135b3228 e0a6ede2dd884 Author: Linus Torvalds Date: Mon Jun 26 15:29:21 2023 -0700 Merge tag 'x86_cache_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 resource control updates from Borislav Petkov: - Implement a rename operation in resctrlfs to facilitate handling of application containers with dynamically changing task lists - When reading the tasks file, show the tasks' pid which are only in the current namespace as opposed to showing the pids from the init namespace too - Other fixes and improvements * tag 'x86_cache_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Documentation/x86: Documentation for MON group move feature x86/resctrl: Implement rename op for mon groups x86/resctrl: Factor rdtgroup lock for multi-file ops x86/resctrl: Only show tasks' pid in current pid namespace commit 59035135b32280fd394ba5765c6f4de24f48353e Merge: 8c69e7afe9588 9d9173e9ceb63 Author: Linus Torvalds Date: Mon Jun 26 15:25:07 2023 -0700 Merge tag 'x86_build_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 build update from Borislav Petkov: - Remove relocation information from vmlinux as it is not needed by other tooling and thus a slimmer binary is generated. This is important for distros who have to distribute vmlinux blobs with their kernel packages too and that extraneous unnecessary data bloats them for no good reason * tag 'x86_build_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/build: Avoid relocation information in final vmlinux commit bf4ed21778f2920ca91a32fd3a1e1130e843e98f Merge: feee70f456865 8c9cce9cb81b5 Author: Dmitry Torokhov Date: Mon Jun 26 15:18:13 2023 -0700 Merge branch 'next' into for-linus Prepare input updates for 6.5 merge window. commit 8c69e7afe9588f9259a6422c6619d7643c76d12c Merge: aa35a4835e4f4 2bd4aa9325821 Author: Linus Torvalds Date: Mon Jun 26 15:14:55 2023 -0700 Merge tag 'x86_alternatives_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 instruction alternatives updates from Borislav Petkov: - Up until now the Fast Short Rep Mov optimizations implied the presence of the ERMS CPUID flag. AMD decoupled them with a BIOS setting so decouple that dependency in the kernel code too - Teach the alternatives machinery to handle relocations - Make debug_alternative accept flags in order to see only that set of patching done one is interested in - Other fixes, cleanups and optimizations to the patching code * tag 'x86_alternatives_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/alternative: PAUSE is not a NOP x86/alternatives: Add cond_resched() to text_poke_bp_batch() x86/nospec: Shorten RESET_CALL_DEPTH x86/alternatives: Add longer 64-bit NOPs x86/alternatives: Fix section mismatch warnings x86/alternative: Optimize returns patching x86/alternative: Complicate optimize_nops() some more x86/alternative: Rewrite optimize_nops() some x86/lib/memmove: Decouple ERMS from FSRM x86/alternative: Support relocations in alternatives x86/alternative: Make debug-alternative selective commit 11b6890be0084ad4df0e06d89a9fdcc948472c65 Author: Kemeng Shi Date: Sat Jun 3 23:03:16 2023 +0800 ext4: get block from bh in ext4_free_blocks for fast commit replay ext4_free_blocks will retrieve block from bh if block parameter is zero. Retrieve block before ext4_free_blocks_simple to avoid potentially passing wrong block to ext4_free_blocks_simple. Signed-off-by: Kemeng Shi Cc: stable@kernel.org Reviewed-by: Ojaswin Mujoo Link: https://lore.kernel.org/r/20230603150327.3596033-9-shikemeng@huaweicloud.com Signed-off-by: Theodore Ts'o commit aa35a4835e4f4c113c29bc7ea64cfecb951d51b8 Merge: e5ce2f196fb9a 4251566ebc1cf Author: Linus Torvalds Date: Mon Jun 26 15:09:18 2023 -0700 Merge tag 'ras_core_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS updates from Borislav Petkov: - Add initial support for RAS hardware found on AMD server GPUs (MI200). Those GPUs and CPUs are connected together through the coherent fabric and the GPU memory controllers report errors through x86's MCA so EDAC needs to support them. The amd64_edac driver supports now HBM (High Bandwidth Memory) and thus such heterogeneous memory controller systems - Other small cleanups and improvements * tag 'ras_core_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: EDAC/amd64: Cache and use GPU node map EDAC/amd64: Add support for AMD heterogeneous Family 19h Model 30h-3Fh EDAC/amd64: Document heterogeneous system enumeration x86/MCE/AMD, EDAC/mce_amd: Decode UMC_V2 ECC errors x86/amd_nb: Re-sort and re-indent PCI defines x86/amd_nb: Add MI200 PCI IDs ras/debugfs: Fix error checking for debugfs_create_dir() x86/MCE: Check a hw error's address to determine proper recovery action commit e5ce2f196fb9ab35fe18dcfd2bc17883db7bbe33 Merge: 88afbb21d4b36 852667c317ae2 Author: Linus Torvalds Date: Mon Jun 26 15:06:42 2023 -0700 Merge tag 'edac_updates_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: - amd64_edac: Add support for Zen4 client hardware - amd64_edac: Remove the version string as it is useless and actively confusing when looking at backported versions of the driver - Add a driver for the Nuvoton NPCM memory controller - A debugfs error checking cleanup * tag 'edac_updates_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/npcm: Add NPCM memory controller driver dt-bindings: memory-controllers: nuvoton: Add NPCM memory controller EDAC/thunderx: Check debugfs file creation retval properly EDAC/amd64: Add support for ECC on family 19h model 60h-7Fh EDAC/amd64: Remove module version string commit 7ed1cefbf169367bae5b356ecd15928b040aeafc Merge: ac9a78681b921 e5d10d1d1aa4c Author: Stephen Boyd Date: Mon Jun 26 14:56:06 2023 -0700 Merge tag 'qcom-clk-for-6.5-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: This introduces Global Clock Controller for SDX75, LPASS clock controllers for SC8280XP, video clock controller for SM8350, SM8450 and SM8550, GPU clock controller for SM8450 and SM8550, RPMH clock support for SDX75 and IPQ9574 support in APSS IPQ PLL driver. Support for branch2 clocks with inverted off-bit is introduced and a couple of fixes to Alpha PLLs handling of TEST_CTL updates. The handling of active-only clocks in SMD RPM is improved, to ensure votes are appropriately placed. SC7180 camera GDSCs are made children of the titan_top GDSC. A couple of fixes to the display clocks on QCM2290 and shared RCGs in GCC are marked as such. SDCC clocks for IPQ6018 and IPQ5332 are corrected to use floor ops, and network-related resets on IPQ6018 are updated to cover all bits of each reset. Crypto clocks are added to IPQ9574 global clock controller, together with a few cleanups. Runtime PM is enabeld for SC8280XP GCC and GPUCC, and SM6375 GPUCC. A few fixes for MSM8974 multi-media clock controller. Support for some RCG clocks to be automatically controlled by downstream branches, and added to SM8450 GCC clocks. Further Kconfig depdenencies are introduce to avoid building Qualcomm clock drivers on unrelated architectures. Lastly, related DeviceTree binding updates are made. The tail of this is not bisectable, due to the missing DeviceTree binding include files. Rebase at this point in time is not desirable. * tag 'qcom-clk-for-6.5-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (63 commits) clk: qcom: gcc-sc8280xp: Add runtime PM clk: qcom: gpucc-sc8280xp: Add runtime PM clk: qcom: mmcc-msm8974: fix MDSS_GDSC power flags clk: qcom: gpucc-sm6375: Enable runtime pm dt-bindings: clock: sm6375-gpucc: Add VDD_GX clk: qcom: gcc-sm6115: Add missing PLL config properties clk: qcom: clk-alpha-pll: Add a way to update some bits of test_ctl(_hi) clk: qcom: gcc-ipq6018: remove duplicate initializers clk: qcom: gcc-ipq9574: Enable crypto clocks dt-bindings: clock: Add crypto clock and reset definitions clk: qcom: Add lpass audio clock controller driver for SC8280XP clk: qcom: Add lpass clock controller driver for SC8280XP dt-bindings: clock: Add LPASS AUDIOCC and reset controller for SC8280XP dt-bindings: clock: Add LPASSCC and reset controller for SC8280XP dt-bindings: clock: qcom,mmcc: define clocks/clock-names for MSM8226 clk: qcom: gpucc-sm8550: Add support for graphics clock controller clk: qcom: Add support for SM8450 GPUCC clk: qcom: gcc-sm8450: Enable hw_clk_ctrl clk: qcom: rcg2: Make hw_clk_ctrl toggleable dt-bindings: clock: qcom: Add SM8550 graphics clock controller ... commit 88afbb21d4b36fee6acaa167641f9f0fc122f01b Merge: cd336f6562d3d 45e34c8af58f2 Author: Linus Torvalds Date: Mon Jun 26 14:45:53 2023 -0700 Merge tag 'x86-core-2023-06-26' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 core updates from Thomas Gleixner: "A set of fixes for kexec(), reboot and shutdown issues: - Ensure that the WBINVD in stop_this_cpu() has been completed before the control CPU proceedes. stop_this_cpu() is used for kexec(), reboot and shutdown to park the APs in a HLT loop. The control CPU sends an IPI to the APs and waits for their CPU online bits to be cleared. Once they all are marked "offline" it proceeds. But stop_this_cpu() clears the CPU online bit before issuing WBINVD, which means there is no guarantee that the AP has reached the HLT loop. This was reported to cause intermittent reboot/shutdown failures due to some dubious interaction with the firmware. This is not only a problem of WBINVD. The code to actually "stop" the CPU which runs between clearing the online bit and reaching the HLT loop can cause large enough delays on its own (think virtualization). That's especially dangerous for kexec() as kexec() expects that all APs are in a safe state and not executing code while the boot CPU jumps to the new kernel. There are more issues vs kexec() which are addressed separately. Cure this by implementing an explicit synchronization point right before the AP reaches HLT. This guarantees that the AP has completed the full stop proceedure. - Fix the condition for WBINVD in stop_this_cpu(). The WBINVD in stop_this_cpu() is required for ensuring that when switching to or from memory encryption no dirty data is left in the cache lines which might cause a write back in the wrong more later. This checks CPUID directly because the feature bit might have been cleared due to a command line option. But that CPUID check accesses leaf 0x8000001f::EAX unconditionally. Intel CPUs return the content of the highest supported leaf when a non-existing leaf is read, while AMD CPUs return all zeros for unsupported leafs. So the result of the test on Intel CPUs is lottery and on AMD its just correct by chance. While harmless it's incorrect and causes the conditional wbinvd() to be issued where not required, which caused the above issue to be unearthed. - Make kexec() robust against AP code execution Ashok observed triple faults when doing kexec() on a system which had been booted with "nosmt". It turned out that the SMT siblings which had been brought up partially are parked in mwait_play_dead() to enable power savings. mwait_play_dead() is monitoring the thread flags of the AP's idle task, which has been chosen as it's unlikely to be written to. But kexec() can overwrite the previous kernel text and data including page tables etc. When it overwrites the cache lines monitored by an AP that AP resumes execution after the MWAIT on eventually overwritten text, stack and page tables, which obviously might end up in a triple fault easily. Make this more robust in several steps: 1) Use an explicit per CPU cache line for monitoring. 2) Write a command to these cache lines to kick APs out of MWAIT before proceeding with kexec(), shutdown or reboot. The APs confirm the wakeup by writing status back and then enter a HLT loop. 3) If the system uses INIT/INIT/STARTUP for AP bringup, park the APs in INIT state. HLT is not a guarantee that an AP won't wake up and resume execution. HLT is woken up by NMI and SMI. SMI puts the CPU back into HLT (+/- firmware bugs), but NMI is delivered to the CPU which executes the NMI handler. Same issue as the MWAIT scenario described above. Sending an INIT/INIT sequence to the APs puts them into wait for STARTUP state, which is safe against NMI. There is still an issue remaining which can't be fixed: #MCE If the AP sits in HLT and receives a broadcast #MCE it will try to handle it with the obvious consequences. INIT/INIT clears CR4.MCE in the AP which will cause a broadcast #MCE to shut down the machine. So there is a choice between fire (HLT) and frying pan (INIT). Frying pan has been chosen as it's at least preventing the NMI issue. On systems which are not using INIT/INIT/STARTUP there is not much which can be done right now, but at least the obvious and easy to trigger MWAIT issue has been addressed" * tag 'x86-core-2023-06-26' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/smp: Put CPUs into INIT on shutdown if possible x86/smp: Split sending INIT IPI out into a helper function x86/smp: Cure kexec() vs. mwait_play_dead() breakage x86/smp: Use dedicated cache-line for mwait_play_dead() x86/smp: Remove pointless wmb()s from native_stop_other_cpus() x86/smp: Dont access non-existing CPUID leaf x86/smp: Make stop_other_cpus() more robust commit cd336f6562d3d7646a9cf071b902db200a1dd77b Merge: 9244724fbf8ab d2b32be7debd6 Author: Linus Torvalds Date: Mon Jun 26 14:10:45 2023 -0700 Merge tag 'timers-core-2023-06-26' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer updates from Thomas Gleixner: "Time, timekeeping and related device driver updates: Core: - A set of fixes, cleanups and enhancements to the posix timer code: - Prevent another possible live lock scenario in the exit() path, which affects POSIX_CPU_TIMERS_TASK_WORK enabled architectures. - Fix a loop termination issue which was reported syzcaller/KSAN in the posix timer ID allocation code. That triggered a deeper look into the posix-timer code which unearthed more small issues. - Add missing READ/WRITE_ONCE() annotations - Fix or remove completely outdated comments - Document places which are subtle and completely undocumented. - Add missing hrtimer modes to the trace event decoder - Small cleanups and enhancements all over the place Drivers: - Rework the Hyper-V clocksource and sched clock setup code - Remove a deprecated clocksource driver - Small fixes and enhancements all over the place" * tag 'timers-core-2023-06-26' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tip/tip: (39 commits) clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe dt-bindings: timers: Add Ralink SoCs timer clocksource/drivers/hyper-v: Rework clocksource and sched clock setup dt-bindings: timer: brcm,kona-timer: convert to YAML clocksource/drivers/imx-gpt: Fold into its only user clk: imx: Drop inclusion of unused header hrtimer: Add missing sparse annotations to hrtimer locking clocksource/drivers/imx-gpt: Use only a single name for functions clocksource/drivers/loongson1: Move PWM timer to clocksource framework dt-bindings: timer: Add Loongson-1 clocksource MIPS: Loongson32: Remove deprecated PWM timer clocksource clocksource/drivers/ingenic-timer: Use pm_sleep_ptr() macro tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode(). posix-timers: Add sys_ni_posix_timers() prototype tick/rcu: Fix bogus ratelimit condition alarmtimer: Remove unnecessary (void *) cast alarmtimer: Remove unnecessary initialization of variable 'ret' posix-timers: Refer properly to CONFIG_HIGH_RES_TIMERS posix-timers: Polish coding style in a few places posix-timers: Remove pointless comments ... commit 9244724fbf8ab394a7210e8e93bf037abc859514 Merge: 7cffdbe3607a6 bf5a8c26ad7ca Author: Linus Torvalds Date: Mon Jun 26 13:59:56 2023 -0700 Merge tag 'smp-core-2023-06-26' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull SMP updates from Thomas Gleixner: "A large update for SMP management: - Parallel CPU bringup The reason why people are interested in parallel bringup is to shorten the (kexec) reboot time of cloud servers to reduce the downtime of the VM tenants. The current fully serialized bringup does the following per AP: 1) Prepare callbacks (allocate, intialize, create threads) 2) Kick the AP alive (e.g. INIT/SIPI on x86) 3) Wait for the AP to report alive state 4) Let the AP continue through the atomic bringup 5) Let the AP run the threaded bringup to full online state There are two significant delays: #3 The time for an AP to report alive state in start_secondary() on x86 has been measured in the range between 350us and 3.5ms depending on vendor and CPU type, BIOS microcode size etc. #4 The atomic bringup does the microcode update. This has been measured to take up to ~8ms on the primary threads depending on the microcode patch size to apply. On a two socket SKL server with 56 cores (112 threads) the boot CPU spends on current mainline about 800ms busy waiting for the APs to come up and apply microcode. That's more than 80% of the actual onlining procedure. This can be reduced significantly by splitting the bringup mechanism into two parts: 1) Run the prepare callbacks and kick the AP alive for each AP which needs to be brought up. The APs wake up, do their firmware initialization and run the low level kernel startup code including microcode loading in parallel up to the first synchronization point. (#1 and #2 above) 2) Run the rest of the bringup code strictly serialized per CPU (#3 - #5 above) as it's done today. Parallelizing that stage of the CPU bringup might be possible in theory, but it's questionable whether required surgery would be justified for a pretty small gain. If the system is large enough the first AP is already waiting at the first synchronization point when the boot CPU finished the wake-up of the last AP. That reduces the AP bringup time on that SKL from ~800ms to ~80ms, i.e. by a factor ~10x. The actual gain varies wildly depending on the system, CPU, microcode patch size and other factors. There are some opportunities to reduce the overhead further, but that needs some deep surgery in the x86 CPU bringup code. For now this is only enabled on x86, but the core functionality obviously works for all SMP capable architectures. - Enhancements for SMP function call tracing so it is possible to locate the scheduling and the actual execution points. That allows to measure IPI delivery time precisely" * tag 'smp-core-2023-06-26' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tip/tip: (45 commits) trace,smp: Add tracepoints for scheduling remotelly called functions trace,smp: Add tracepoints around remotelly called functions MAINTAINERS: Add CPU HOTPLUG entry x86/smpboot: Fix the parallel bringup decision x86/realmode: Make stack lock work in trampoline_compat() x86/smp: Initialize cpu_primary_thread_mask late cpu/hotplug: Fix off by one in cpuhp_bringup_mask() x86/apic: Fix use of X{,2}APIC_ENABLE in asm with older binutils x86/smpboot/64: Implement arch_cpuhp_init_parallel_bringup() and enable it x86/smpboot: Support parallel startup of secondary CPUs x86/smpboot: Implement a bit spinlock to protect the realmode stack x86/apic: Save the APIC virtual base address cpu/hotplug: Allow "parallel" bringup up to CPUHP_BP_KICK_AP_STATE x86/apic: Provide cpu_primary_thread mask x86/smpboot: Enable split CPU startup cpu/hotplug: Provide a split up CPUHP_BRINGUP mechanism cpu/hotplug: Reset task stack state in _cpu_up() cpu/hotplug: Remove unused state functions riscv: Switch to hotplug core state synchronization parisc: Switch to hotplug core state synchronization ... commit 7cffdbe3607a6cc2dc02d135e13732ec36bc4e28 Merge: 0017387938993 0a9567ac5e6a4 Author: Linus Torvalds Date: Mon Jun 26 13:39:10 2023 -0700 Merge tag 'x86-boot-2023-06-26' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 boot updates from Thomas Gleixner: "Initialize FPU late. Right now FPU is initialized very early during boot. There is no real requirement to do so. The only requirement is to have it done before alternatives are patched. That's done in check_bugs() which does way more than what the function name suggests. So first rename check_bugs() to arch_cpu_finalize_init() which makes it clear what this is about. Move the invocation of arch_cpu_finalize_init() earlier in start_kernel() as it has to be done before fork_init() which needs to know the FPU register buffer size. With those prerequisites the FPU initialization can be moved into arch_cpu_finalize_init(), which removes it from the early and fragile part of the x86 bringup" * tag 'x86-boot-2023-06-26' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mem_encrypt: Unbreak the AMD_MEM_ENCRYPT=n build x86/fpu: Move FPU initialization into arch_cpu_finalize_init() x86/fpu: Mark init functions __init x86/fpu: Remove cpuinfo argument from init functions x86/init: Initialize signal frame size late init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() init: Invoke arch_cpu_finalize_init() earlier init: Remove check_bugs() leftovers um/cpu: Switch to arch_cpu_finalize_init() sparc/cpu: Switch to arch_cpu_finalize_init() sh/cpu: Switch to arch_cpu_finalize_init() mips/cpu: Switch to arch_cpu_finalize_init() m68k/cpu: Switch to arch_cpu_finalize_init() loongarch/cpu: Switch to arch_cpu_finalize_init() ia64/cpu: Switch to arch_cpu_finalize_init() ARM: cpu: Switch to arch_cpu_finalize_init() x86/cpu: Switch to arch_cpu_finalize_init() init: Provide arch_cpu_finalize_init() commit 0017387938993553fe8e08bd9bcf398fb609d136 Merge: cef2dd76531fd f121ab7f4ac32 Author: Linus Torvalds Date: Mon Jun 26 13:34:39 2023 -0700 Merge tag 'irq-core-2023-06-26' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq updates from Thomas Gleixner: "Updates for the interrupt subsystem: Core: - Convert the interrupt descriptor storage to a maple tree to overcome the limitations of the radixtree + fixed size bitmap. This allows us to handle very large servers with a huge number of guests without imposing a huge memory overhead on everyone - Implement optional retriggering of interrupts which utilize the fasteoi handler to work around a GICv3 architecture issue Drivers: - A set of fixes and updates for the Loongson/Loongarch related drivers - Workaound for an ASR8601 integration hickup which ends up with CPU numbering which can't be represented in the GIC implementation - The usual set of boring fixes and updates all over the place" * tag 'irq-core-2023-06-26' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tip/tip: (27 commits) Revert "irqchip/mxs: Include linux/irqchip/mxs.h" irqchip/jcore-aic: Fix missing allocation of IRQ descriptors irqchip/stm32-exti: Fix warning on initialized field overwritten irqchip/stm32-exti: Add STM32MP15xx IWDG2 EXTI to GIC map irqchip/gicv3: Add a iort_pmsi_get_dev_id() prototype irqchip/mxs: Include linux/irqchip/mxs.h irqchip/clps711x: Remove unused clps711x_intc_init() function irqchip/mmp: Remove non-DT codepath irqchip/ftintc010: Mark all function static irqdomain: Include internals.h for function prototypes irqchip/loongson-eiointc: Add DT init support dt-bindings: interrupt-controller: Add Loongson EIOINTC irqchip/loongson-eiointc: Fix irq affinity setting during resume irqchip/loongson-liointc: Add IRQCHIP_SKIP_SET_WAKE flag irqchip/loongson-liointc: Fix IRQ trigger polarity irqchip/loongson-pch-pic: Fix potential incorrect hwirq assignment irqchip/loongson-pch-pic: Fix initialization of HT vector register irqchip/gic-v3-its: Enable RESEND_WHEN_IN_PROGRESS for LPIs genirq: Allow fasteoi handler to resend interrupts on concurrent handling genirq: Expand doc for PENDING and REPLAY flags ... commit cef2dd76531fda106fa698b6b7ee3e87b1622c08 Merge: a0433f8cae3ac 8b64d420fe245 Author: Linus Torvalds Date: Mon Jun 26 13:33:00 2023 -0700 Merge tag 'core-debugobjects-2023-06-26' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull debugobjects update from Thomas Gleixner: "A single update for debug objects: - Recheck whether debug objects is enabled before reporting a problem to avoid spamming the logs with messages which are caused by a concurrent OOM" * tag 'core-debugobjects-2023-06-26' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/tip/tip: debugobjects: Recheck debug_objects_enabled before reporting commit 61dc651cdfe85066e1371dd1bd8aee685bd6ec75 Merge: 771ca3de25028 a412dbf40ff37 Author: Jakub Kicinski Date: Mon Jun 26 12:59:18 2023 -0700 Merge tag 'nf-next-23-06-26' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next 1) Allow slightly larger IPVS connection table size from Kconfig for 64-bit arch, from Abhijeet Rastogi. 2) Since IPVS connection table might be larger than 2^20 after previous patch, allow to limit it depending on the available memory. Moreover, use kvmalloc. From Julian Anastasov. 3) Do not rebuild VLAN header in nft_payload when matching source and destination MAC address. 4) Remove nested rcu read lock side in ip_set_test(), from Florian Westphal. 5) Allow to update set size, also from Florian. 6) Improve NAT tuple selection when connection is closing, from Florian Westphal. 7) Support for resetting set element stateful expression, from Phil Sutter. 8) Use NLA_POLICY_MAX to narrow down maximum attribute value in nf_tables, from Florian Westphal. * tag 'nf-next-23-06-26' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nf_tables: limit allowed range via nla_policy netfilter: nf_tables: Introduce NFT_MSG_GETSETELEM_RESET netfilter: snat: evict closing tcp entries on reply tuple collision netfilter: nf_tables: permit update of set size netfilter: ipset: remove rcu_read_lock_bh pair from ip_set_test netfilter: nft_payload: rebuild vlan header when needed ipvs: dynamically limit the connection hash table ipvs: increase ip_vs_conn_tab_bits range for 64BIT ==================== Link: https://lore.kernel.org/r/20230626064749.75525-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit a0433f8cae3ac51f59b4b1863032822aaa2d8164 Merge: 0aa69d53ac7c3 fcaa174a9c995 Author: Linus Torvalds Date: Mon Jun 26 12:47:20 2023 -0700 Merge tag 'for-6.5/block-2023-06-23' of git://git.kernel.dk/linux Pull block updates from Jens Axboe: - NVMe pull request via Keith: - Various cleanups all around (Irvin, Chaitanya, Christophe) - Better struct packing (Christophe JAILLET) - Reduce controller error logs for optional commands (Keith) - Support for >=64KiB block sizes (Daniel Gomez) - Fabrics fixes and code organization (Max, Chaitanya, Daniel Wagner) - bcache updates via Coly: - Fix a race at init time (Mingzhe Zou) - Misc fixes and cleanups (Andrea, Thomas, Zheng, Ye) - use page pinning in the block layer for dio (David) - convert old block dio code to page pinning (David, Christoph) - cleanups for pktcdvd (Andy) - cleanups for rnbd (Guoqing) - use the unchecked __bio_add_page() for the initial single page additions (Johannes) - fix overflows in the Amiga partition handling code (Michael) - improve mq-deadline zoned device support (Bart) - keep passthrough requests out of the IO schedulers (Christoph, Ming) - improve support for flush requests, making them less special to deal with (Christoph) - add bdev holder ops and shutdown methods (Christoph) - fix the name_to_dev_t() situation and use cases (Christoph) - decouple the block open flags from fmode_t (Christoph) - ublk updates and cleanups, including adding user copy support (Ming) - BFQ sanity checking (Bart) - convert brd from radix to xarray (Pankaj) - constify various structures (Thomas, Ivan) - more fine grained persistent reservation ioctl capability checks (Jingbo) - misc fixes and cleanups (Arnd, Azeem, Demi, Ed, Hengqi, Hou, Jan, Jordy, Li, Min, Yu, Zhong, Waiman) * tag 'for-6.5/block-2023-06-23' of git://git.kernel.dk/linux: (266 commits) scsi/sg: don't grab scsi host module reference ext4: Fix warning in blkdev_put() block: don't return -EINVAL for not found names in devt_from_devname cdrom: Fix spectre-v1 gadget block: Improve kernel-doc headers blk-mq: don't insert passthrough request into sw queue bsg: make bsg_class a static const structure ublk: make ublk_chr_class a static const structure aoe: make aoe_class a static const structure block/rnbd: make all 'class' structures const block: fix the exclusive open mask in disk_scan_partitions block: add overflow checks for Amiga partition support block: change all __u32 annotations to __be32 in affs_hardblocks.h block: fix signed int overflow in Amiga partition support block: add capacity validation in bdev_add_partition() block: fine-granular CAP_SYS_ADMIN for Persistent Reservation block: disallow Persistent Reservation on partitions reiserfs: fix blkdev_put() warning from release_journal_dev() block: fix wrong mode for blkdev_get_by_dev() from disk_scan_partitions() block: document the holder argument to blkdev_get_by_path ... commit 0aa69d53ac7c30f6184f88f2e310d808b32b35a5 Merge: 3eccc0c886b17 c98c81a4ac37b Author: Linus Torvalds Date: Mon Jun 26 12:30:26 2023 -0700 Merge tag 'for-6.5/io_uring-2023-06-23' of git://git.kernel.dk/linux Pull io_uring updates from Jens Axboe: "Nothing major in this release, just a bunch of cleanups and some optimizations around networking mostly. - clean up file request flags handling (Christoph) - clean up request freeing and CQ locking (Pavel) - support for using pre-registering the io_uring fd at setup time (Josh) - Add support for user allocated ring memory, rather than having the kernel allocate it. Mostly for packing rings into a huge page (me) - avoid an unnecessary double retry on receive (me) - maintain ordering for task_work, which also improves performance (me) - misc cleanups/fixes (Pavel, me)" * tag 'for-6.5/io_uring-2023-06-23' of git://git.kernel.dk/linux: (39 commits) io_uring: merge conditional unlock flush helpers io_uring: make io_cq_unlock_post static io_uring: inline __io_cq_unlock io_uring: fix acquire/release annotations io_uring: kill io_cq_unlock() io_uring: remove IOU_F_TWQ_FORCE_NORMAL io_uring: don't batch task put on reqs free io_uring: move io_clean_op() io_uring: inline io_dismantle_req() io_uring: remove io_free_req_tw io_uring: open code io_put_req_find_next io_uring: add helpers to decode the fixed file file_ptr io_uring: use io_file_from_index in io_msg_grab_file io_uring: use io_file_from_index in __io_sync_cancel io_uring: return REQ_F_ flags from io_file_get_flags io_uring: remove io_req_ffs_set io_uring: remove a confusing comment above io_file_get_flags io_uring: remove the mode variable in io_file_get_flags io_uring: remove __io_file_supports_nowait io_uring: wait interruptibly for request completions on exit ... commit 3eccc0c886b1796f95a289c9d127c8ca1a254bd5 Merge: cc423f6337d0a 9eee8bd81421c Author: Linus Torvalds Date: Mon Jun 26 11:52:12 2023 -0700 Merge tag 'for-6.5/splice-2023-06-23' of git://git.kernel.dk/linux Pull splice updates from Jens Axboe: "This kills off ITER_PIPE to avoid a race between truncate, iov_iter_revert() on the pipe and an as-yet incomplete DMA to a bio with unpinned/unref'ed pages from an O_DIRECT splice read. This causes memory corruption. Instead, we either use (a) filemap_splice_read(), which invokes the buffered file reading code and splices from the pagecache into the pipe; (b) copy_splice_read(), which bulk-allocates a buffer, reads into it and then pushes the filled pages into the pipe; or (c) handle it in filesystem-specific code. Summary: - Rename direct_splice_read() to copy_splice_read() - Simplify the calculations for the number of pages to be reclaimed in copy_splice_read() - Turn do_splice_to() into a helper, vfs_splice_read(), so that it can be used by overlayfs and coda to perform the checks on the lower fs - Make vfs_splice_read() jump to copy_splice_read() to handle direct-I/O and DAX - Provide shmem with its own splice_read to handle non-existent pages in the pagecache. We don't want a ->read_folio() as we don't want to populate holes, but filemap_get_pages() requires it - Provide overlayfs with its own splice_read to call down to a lower layer as overlayfs doesn't provide ->read_folio() - Provide coda with its own splice_read to call down to a lower layer as coda doesn't provide ->read_folio() - Direct ->splice_read to copy_splice_read() in tty, procfs, kernfs and random files as they just copy to the output buffer and don't splice pages - Provide wrappers for afs, ceph, ecryptfs, ext4, f2fs, nfs, ntfs3, ocfs2, orangefs, xfs and zonefs to do locking and/or revalidation - Make cifs use filemap_splice_read() - Replace pointers to generic_file_splice_read() with pointers to filemap_splice_read() as DIO and DAX are handled in the caller; filesystems can still provide their own alternate ->splice_read() op - Remove generic_file_splice_read() - Remove ITER_PIPE and its paraphernalia as generic_file_splice_read was the only user" * tag 'for-6.5/splice-2023-06-23' of git://git.kernel.dk/linux: (31 commits) splice: kdoc for filemap_splice_read() and copy_splice_read() iov_iter: Kill ITER_PIPE splice: Remove generic_file_splice_read() splice: Use filemap_splice_read() instead of generic_file_splice_read() cifs: Use filemap_splice_read() trace: Convert trace/seq to use copy_splice_read() zonefs: Provide a splice-read wrapper xfs: Provide a splice-read wrapper orangefs: Provide a splice-read wrapper ocfs2: Provide a splice-read wrapper ntfs3: Provide a splice-read wrapper nfs: Provide a splice-read wrapper f2fs: Provide a splice-read wrapper ext4: Provide a splice-read wrapper ecryptfs: Provide a splice-read wrapper ceph: Provide a splice-read wrapper afs: Provide a splice-read wrapper 9p: Add splice_read wrapper net: Make sock_splice_read() use copy_splice_read() by default tty, proc, kernfs, random: Use copy_splice_read() ... commit cc423f6337d0a5ff1906f3b3d465d28c0d1705f6 Merge: e940efa936be6 8a4a0b2a3eaf7 Author: Linus Torvalds Date: Mon Jun 26 11:41:38 2023 -0700 Merge tag 'for-6.5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "Mainly core changes, refactoring and optimizations. Performance is improved in some areas, overall there may be a cumulative improvement due to refactoring that removed lookups in the IO path or simplified IO submission tracking. Core: - submit IO synchronously for fast checksums (crc32c and xxhash), remove high priority worker kthread - read extent buffer in one go, simplify IO tracking, bio submission and locking - remove additional tracking of redirtied extent buffers, originally added for zoned mode but actually not needed - track ordered extent pointer in bio to avoid rbtree lookups during IO - scrub, use recovered data stripes as cache to avoid unnecessary read - in zoned mode, optimize logical to physical mappings of extents - remove PageError handling, not set by VFS nor writeback - cleanups, refactoring, better structure packing - lots of error handling improvements - more assertions, lockdep annotations - print assertion failure with the exact line where it happens - tracepoint updates - more debugging prints Performance: - speedup in fsync(), better tracking of inode logged status can avoid transaction commit - IO path structures track logical offsets in data structures and does not need to look it up User visible changes: - don't commit transaction for every created subvolume, this can reduce time when many subvolumes are created in a batch - print affected files when relocation fails - trigger orphan file cleanup during START_SYNC ioctl Notable fixes: - fix crash when disabling quota and relocation - fix crashes when removing roots from drity list - fix transacion abort during relocation when converting from newer profiles not covered by fallback - in zoned mode, stop reclaiming block groups if filesystem becomes read-only - fix rare race condition in tree mod log rewind that can miss some btree node slots - with enabled fsverity, drop up-to-date page bit in case the verification fails" * tag 'for-6.5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (194 commits) btrfs: fix race between quota disable and relocation btrfs: add comment to struct btrfs_fs_info::dirty_cowonly_roots btrfs: fix race when deleting free space root from the dirty cow roots list btrfs: fix race when deleting quota root from the dirty cow roots list btrfs: tracepoints: also show actual number of the outstanding extents btrfs: update i_version in update_dev_time btrfs: make btrfs_compressed_bioset static btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile btrfs: scrub: remove btrfs_fs_info::scrub_wr_completion_workers btrfs: scrub: remove scrub_ctx::csum_list member btrfs: do not BUG_ON after failure to migrate space during truncation btrfs: do not BUG_ON on failure to get dir index for new snapshot btrfs: send: do not BUG_ON() on unexpected symlink data extent btrfs: do not BUG_ON() when dropping inode items from log root btrfs: replace BUG_ON() at split_item() with proper error handling btrfs: do not BUG_ON() on tree mod log failures at btrfs_del_ptr() btrfs: do not BUG_ON() on tree mod log failures at insert_ptr() btrfs: do not BUG_ON() on tree mod log failure at insert_new_root() btrfs: do not BUG_ON() on tree mod log failures at push_nodes_for_insert() btrfs: abort transaction at update_ref_for_cow() when ref count is zero ... commit e940efa936be65866db9ce20798b13fdc6b3891a Merge: 098c5dd9cf96f 8812387d05695 Author: Linus Torvalds Date: Mon Jun 26 11:29:29 2023 -0700 Merge tag 'zonefs-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs updates from Damien Le Moal: - Modify the synchronous direct write path to use iomap instead of manually coding issuing zone append write BIOs (me) - Use the FMODE_CAN_ODIRECT file flag to indicate support from direct IO instead of using the old way with noop direct_io methods (Christoph) * tag 'zonefs-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: set FMODE_CAN_ODIRECT instead of a dummy direct_IO method zonefs: use iomap for synchronous direct writes commit 7aa83fbd712a6f08ffa67890061f26d140c2a84f Author: Douglas Anderson Date: Tue Jun 13 06:58:13 2023 -0700 drm/bridge: ti-sn65dsi86: Fix auxiliary bus lifetime Memory for the "struct device" for any given device isn't supposed to be released until the device's release() is called. This is important because someone might be holding a kobject reference to the "struct device" and might try to access one of its members even after any other cleanup/uninitialization has happened. Code analysis of ti-sn65dsi86 shows that this isn't quite right. When the code was written, it was believed that we could rely on the fact that the child devices would all be freed before the parent devices and thus we didn't need to worry about a release() function. While I still believe that the parent's "struct device" is guaranteed to outlive the child's "struct device" (because the child holds a kobject reference to the parent), the parent's "devm" allocated memory is a different story. That appears to be freed much earlier. Let's make this better for ti-sn65dsi86 by allocating each auxiliary with kzalloc and then free that memory in the release(). Fixes: bf73537f411b ("drm/bridge: ti-sn65dsi86: Break GPIO and MIPI-to-eDP bridge into sub-drivers") Suggested-by: Stephen Boyd Reviewed-by: Stephen Boyd Signed-off-by: Douglas Anderson Link: https://patchwork.freedesktop.org/patch/msgid/20230613065812.v2.1.I24b838a5b4151fb32bccd6f36397998ea2df9fbb@changeid commit 098c5dd9cf96fc6d7f35429561ef58cd7c5fcecf Merge: 74774e243c5ff 8241fdd3cdfe8 Author: Linus Torvalds Date: Mon Jun 26 11:00:18 2023 -0700 Merge tag 'erofs-for-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: "No outstanding new feature for this cycle. Most of these commits are decompression cleanups which are part of the ongoing development for subpage/folio compression support as well as xattr cleanups for the upcoming xattr bloom filter optimization [1]. In addition, there are bugfixes to address some corner cases of compressed images due to global data de-duplication and arm64 16k pages. Summary: - Fix rare I/O hang on deduplicated compressed images due to loop hooked chains - Fix compact compression layout of 16k blocks on arm64 devices - Fix atomic context detection of async decompression - Decompression/Xattr code cleanups" Link: https://lore.kernel.org/r/20230621083209.116024-1-jefflexu@linux.alibaba.com [1] * tag 'erofs-for-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: clean up zmap.c erofs: remove unnecessary goto erofs: Fix detection of atomic context erofs: use separate xattr parsers for listxattr/getxattr erofs: unify inline/shared xattr iterators for listxattr/getxattr erofs: make the size of read data stored in buffer_ofs erofs: unify xattr_iter structures erofs: use absolute position in xattr iterator erofs: fix compact 4B support for 16k block size erofs: convert erofs_read_metabuf() to erofs_bread() for xattr erofs: use poison pointer to replace the hard-coded address erofs: use struct lockref to replace handcrafted approach erofs: adapt managed inode operations into folios erofs: kill hooked chains to avoid loops on deduplicated compressed images erofs: avoid on-stack pagepool directly passed by arguments erofs: allocate extra bvec pages directly instead of retrying erofs: clean up z_erofs_pcluster_readmore() erofs: remove the member readahead from struct z_erofs_decompress_frontend erofs: fold in z_erofs_decompress() commit 6ecac465eee887de7ceda7ffe3bccf538eb786bc Merge: d8c226ac1f748 afbb9130d2bf0 Author: Bjorn Helgaas Date: Mon Jun 26 13:00:00 2023 -0500 Merge branch 'pci/controller/remove-void-callbacks' - Convert platform_device .remove() callbacks to return void instead of a mostly useless int (Uwe Kleine-König) * pci/controller/remove-void-callbacks: PCI: xgene-msi: Convert to platform remove callback returning void PCI: tegra: Convert to platform remove callback returning void PCI: rockchip-host: Convert to platform remove callback returning void PCI: mvebu: Convert to platform remove callback returning void PCI: mt7621: Convert to platform remove callback returning void PCI: mediatek-gen3: Convert to platform remove callback returning void PCI: mediatek: Convert to platform remove callback returning void PCI: iproc: Convert to platform remove callback returning void PCI: hisi-error: Convert to platform remove callback returning void PCI: dwc: Convert to platform remove callback returning void PCI: j721e: Convert to platform remove callback returning void PCI: brcmstb: Convert to platform remove callback returning void PCI: altera-msi: Convert to platform remove callback returning void PCI: altera: Convert to platform remove callback returning void PCI: aardvark: Convert to platform remove callback returning void commit d8c226ac1f748d0eac54ef869a4f41b26bc4f825 Merge: b5abb12cdd297 061cbfab09fb3 Author: Bjorn Helgaas Date: Mon Jun 26 13:00:00 2023 -0500 Merge branch 'pci/controller/endpoint' - Change "PCI Endpoint Virtual NTB driver" Kconfig prompt to be different from "PCI Endpoint NTB driver" (Shunsuke Mie) - Automatically create a function specific attributes group for endpoint drivers to avoid reference counting issues (Damien Le Moal) - Move and unexport pci_epf_type_add_cfs() (Damien Le Moal) - Reinitialize EPF test DMA transfer completion before submitting it to avoid losing the completion notification (Damien Le Moal) - Fix EPF test DMA transfer completion detection (Damien Le Moal) - Submit EPF test DMA transfers with dmaengine_submit(), not tx_submit() (Damien Le Moal) - Simplify EPF test read/write/copy functions (Damien Le Moal) - Simplify EPF test "raise IRQ" interface (Damien Le Moal) - Simplify EPF test IRQ command execution (Damien Le Moal) - Improve EPF test command/status register handling (Damien Le Moal) - Free IRQs before removing device (Damien Le Moal) - Reinitialize IRQ completions for every test (Damien Le Moal) - Don't write status in IRQ handler to avoid race (Damien Le Moal) - Fix dma_chan direction in data transfer test (Yoshihiro Shimoda) - Return pci_epf_type_add_cfs() error if EPF has no driver (Damien Le Moal) - Add kernel-doc for pci_epc_raise_irq() and pci_epc_map_msi_irq() MSI vector parameters (Manivannan Sadhasivam) - Pass EPF device ID to driver probe functions (Manivannan Sadhasivam) - Return -EALREADY if EPC has already been started/stopped (Manivannan Sadhasivam) - Add linkdown notifier support and use it in qcom-ep (Manivannan Sadhasivam) - Add Bus Master Enable event support and use it in qcom-ep (Manivannan Sadhasivam) - Add Qualcomm Modem Host Interface (MHI) endpoint driver (Manivannan Sadhasivam) - Add Layerscape PME interrupt handling to manage link-up notification (Frank Li) * pci/controller/endpoint: PCI: layerscape: Add the endpoint linkup notifier support PCI: endpoint: pci-epf-vntb: Fix typo in comments MAINTAINERS: Add PCI MHI endpoint function driver under MHI bus PCI: endpoint: Add PCI Endpoint function driver for MHI bus PCI: qcom-ep: Add support for BME notification PCI: qcom-ep: Add support for Link down notification PCI: endpoint: Add BME notifier support PCI: endpoint: Add linkdown notifier support PCI: endpoint: Return error if EPC is started/stopped multiple times PCI: endpoint: Pass EPF device ID to the probe function PCI: endpoint: Add missing documentation about the MSI/MSI-X range PCI: endpoint: Improve pci_epf_type_add_cfs() PCI: endpoint: functions/pci-epf-test: Fix dma_chan direction misc: pci_endpoint_test: Simplify pci_endpoint_test_msi_irq() misc: pci_endpoint_test: Do not write status in IRQ handler misc: pci_endpoint_test: Re-init completion for every test misc: pci_endpoint_test: Free IRQs before removing the device PCI: epf-test: Simplify transfers result print PCI: epf-test: Simplify DMA support checks PCI: epf-test: Cleanup request result handling PCI: epf-test: Cleanup pci_epf_test_cmd_handler() PCI: epf-test: Improve handling of command and status registers PCI: epf-test: Simplify IRQ test commands execution PCI: epf-test: Simplify pci_epf_test_raise_irq() PCI: epf-test: Simplify read/write/copy test functions PCI: epf-test: Use dmaengine_submit() to initiate DMA transfer PCI: epf-test: Fix DMA transfer completion detection PCI: epf-test: Fix DMA transfer completion initialization PCI: endpoint: Move pci_epf_type_add_cfs() code PCI: endpoint: Automatically create a function specific attributes group PCI: endpoint: Fix a Kconfig prompt of vNTB driver commit b5abb12cdd297339b30e95bc3e5e8e26723cf923 Merge: 9f5eb1bf55121 0c0206dc4f5ba Author: Bjorn Helgaas Date: Mon Jun 26 12:59:59 2023 -0500 Merge branch 'pci/controller/vmd' - Reset VMD config register between soft reboots (Nirmal Patel) - Capture pci_reset_bus() return value instead of printing junk when it fails (Xinghui Li) * pci/controller/vmd: PCI: vmd: Fix uninitialized variable usage in vmd_enable_domain() PCI: vmd: Reset VMD config register between soft reboots commit 9f5eb1bf55121a5729c7ca27b4276b51d4ae3048 Merge: 9cd5f2cec7e51 7e6689b34a815 Author: Bjorn Helgaas Date: Mon Jun 26 12:59:59 2023 -0500 Merge branch 'pci/controller/rockchip' - Remove writes to unused registers (Rick Wertenbroek) - Write endpoint Device ID using correct register (Rick Wertenbroek) - Assert PCI Configuration Enable bit after probe so endpoint responds instead of generating Request Retry Status messages (Rick Wertenbroek) - Poll waiting for PHY PLLs to lock (Rick Wertenbroek) - Update RK3399 example DT binding to be valid (Rick Wertenbroek) - Use RK3399 PCIE_CLIENT_LEGACY_INT_CTRL to generate INTx instead of manually generating PCIe message (Rick Wertenbroek) - Use multiple windows to avoid address translation conflicts (Rick Wertenbroek) - Use u32 (not u16) when accessing 32-bit registers (Rick Wertenbroek) - Hide MSI-X Capability, since RK3399 can't generate MSI-X (Rick Wertenbroek) - Set endpoint controller required alignment to 256 (Damien Le Moal) * pci/controller/rockchip: PCI: rockchip: Set address alignment for endpoint mode PCI: rockchip: Don't advertise MSI-X in PCIe capabilities PCI: rockchip: Use u32 variable to access 32-bit registers PCI: rockchip: Fix window mapping and address translation for endpoint PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core dt-bindings: PCI: Update the RK3399 example to a valid one PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked PCI: rockchip: Assert PCI Configuration Enable bit after probe PCI: rockchip: Write PCI Device ID to correct register PCI: rockchip: Remove writes to unused registers commit 9cd5f2cec7e51c7254cda228e6b9950e994be401 Merge: 5c13b3c19a726 e28e75e9f5893 Author: Bjorn Helgaas Date: Mon Jun 26 12:59:59 2023 -0500 Merge branch 'pci/controller/rcar' - Remove unused static pcie_base and pcie_dev (Geert Uytterhoeven) * pci/controller/rcar: PCI: rcar: Use correct product family name for Renesas R-Car PCI: rcar-host: Remove unused static pcie_base and pcie_dev commit 5c13b3c19a726fc0918ef221759bd225dadb1923 Merge: 69fa3ef3d2699 1fdecc5bc8e81 Author: Bjorn Helgaas Date: Mon Jun 26 12:59:59 2023 -0500 Merge branch 'pci/controller/qcom' - Disable register write access after init for IP v2.3.3, v2.9.0 (Manivannan Sadhasivam) - Use DWC helpers for enabling/disabling writes to DBI registers (Manivannan Sadhasivam) - Hide slot hotplug capability for IP v1.0.0, v1.9.0, v2.1.0, v2.3.2, v2.3.3, v2.7.0, v2.9.0 (Manivannan Sadhasivam) - Reuse v2.3.2 post-init sequence for v2.4.0 (Manivannan Sadhasivam) - * pci/controller/qcom: PCI: qcom: Do not advertise hotplug capability for IP v2.1.0 PCI: qcom: Do not advertise hotplug capability for IP v1.0.0 PCI: qcom: Use post init sequence of IP v2.3.2 for v2.4.0 PCI: qcom: Do not advertise hotplug capability for IP v2.3.2 PCI: qcom: Do not advertise hotplug capability for IPs v2.3.3 and v2.9.0 PCI: qcom: Do not advertise hotplug capability for IPs v2.7.0 and v1.9.0 PCI: qcom: Disable write access to read only registers for IP v2.9.0 PCI: qcom: Use DWC helpers for modifying the read-only DBI registers PCI: qcom: Disable write access to read only registers for IP v2.3.3 commit 69fa3ef3d2699acdf0ac917cc070c0e9cfd61b74 Merge: 99f7b809067be c60738de85f40 Author: Bjorn Helgaas Date: Mon Jun 26 12:59:58 2023 -0500 Merge branch 'pci/pci/ftpci100' - Release clock resources on error paths (Junyan Ye) * pci/pci/ftpci100: PCI: ftpci100: Release the clock resources commit 99f7b809067be43141027f4bbb6af7b55f854554 Merge: 375328faa2c54 3bbc3c72c4b89 Author: Bjorn Helgaas Date: Mon Jun 26 12:59:58 2023 -0500 Merge branch 'pci/controller/dwc' - Wait for link to come up only if we've initiated link training (Ajay Agarwal) - Save and restore imx6 Root Port MSI control to work around hardware defect (Richard Zhu) * pci/controller/dwc: PCI: imx6: Save and restore root port MSI control in suspend and resume PCI: dwc: Wait for link up only if link is started commit 375328faa2c546f28719c68a3d88e043e878debd Merge: 41370553c01b4 0e12f83023692 Author: Bjorn Helgaas Date: Mon Jun 26 12:59:58 2023 -0500 Merge branch 'pci/controller/cadence' - Wait for link retrain to complete when working around the J721E i2085 erratum with Gen2 mode (Siddharth Vadapalli) * pci/controller/cadence: PCI: cadence: Fix Gen2 Link Retraining process commit 41370553c01b4a0ff8663db9badc9232262c55ea Merge: 30fec3b884589 c0aba9f328019 Author: Bjorn Helgaas Date: Mon Jun 26 12:59:57 2023 -0500 Merge branch 'pci/controller/dt' - Add Qualcomm SDX65 endpoint DT compatible string (Rohit Agarwal) * pci/controller/dt: dt-bindings: PCI: qcom: Add SDX65 SoC commit 30fec3b884589b6cd9f441c139220c5eb2ed55d3 Merge: 283810ac54a2b b58d6d89ae020 Author: Bjorn Helgaas Date: Mon Jun 26 12:59:57 2023 -0500 Merge branch 'pci/misc' - Add pci_clear_master() stub for non-CONFIG_PCI (Sui Jingfeng) - Correct documentation typos (Randy Dunlap) * pci/misc: Documentation: PCI: correct spelling PCI: Add pci_clear_master() stub for non-CONFIG_PCI PCI: Expand comment about sorting pci_ids.h entries commit 283810ac54a2b8a179fd4f30fd9f05907b397fcd Merge: d0b7b3a422f1f 88d341716b83a Author: Bjorn Helgaas Date: Mon Jun 26 12:59:57 2023 -0500 Merge branch 'pci/virtualization' - Delay extra 250ms after FLR of Solidigm P44 Pro NVMe to avoid KVM hang when guest is rebooted (Mike Pastore) - Add function 1 DMA alias quirk for Marvell 88SE9235 (Robin Murphy) * pci/virtualization: PCI: Add function 1 DMA alias quirk for Marvell 88SE9235 PCI: Delay after FLR of Solidigm P44 Pro NVMe commit d0b7b3a422f1f550a1bac9fc3404196c10232d14 Merge: 7e229f0e054b1 e54223275ba1b Author: Bjorn Helgaas Date: Mon Jun 26 12:59:57 2023 -0500 Merge branch 'pci/resource' - When we coalesce host bridge windows, remove invalidated resources from the resource tree so future allocations work correctly (Ross Lagerwall) * pci/resource: PCI: Release resource invalidated by coalescing commit 7e229f0e054b148f9bf8eb9f70b8b18ee4677936 Merge: db5ccb2eda47a 112a7f9c8edbf Author: Bjorn Helgaas Date: Mon Jun 26 12:59:56 2023 -0500 Merge branch 'pci/pm' - Reduce wait time for secondary bus to be ready to speed up resume (Mika Westerberg) - Avoid putting EloPOS E2/S2/H2 (as well as Elo i2) PCIe Ports in D3cold (Ondrej Zary) - Call _REG when transitioning D-states so AML that uses the PCI config space OpRegion works, which fixes some ASMedia GPIO controllers (Mario Limonciello) * pci/pm: PCI/ACPI: Call _REG when transitioning D-states PCI/ACPI: Validate acpi_pci_set_power_state() parameter PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold PCI/PM: Shorten pci_bridge_wait_for_secondary_bus() wait time for slow links commit db5ccb2eda47ab4ec5ac6cece0032d75a995d5a4 Merge: 1abb47390350a 40613da52b13f Author: Bjorn Helgaas Date: Mon Jun 26 12:59:56 2023 -0500 Merge branch 'pci/hotplug' - Simplify Attention Button logging (Bjorn Helgaas) - Cancel bringup sequence if card is not present, to keep from blinking Power Indicator indefinitely (Rongguang Wei) - Reassign bridge resources if necessary for ACPI hotplug (Igor Mammedov) * pci/hotplug: PCI: acpiphp: Reassign resources on bridge if necessary PCI: pciehp: Cancel bringup sequence if card is not present PCI: pciehp: Simplify Attention Button logging commit 1abb47390350a1bd5430390e296492e6248865b2 Merge: 0f32114ea0747 08e3ed12ca861 Author: Bjorn Helgaas Date: Mon Jun 26 12:59:56 2023 -0500 Merge branch 'pci/enumeration' - Add PCI_EXT_CAP_ID_PL_32GT define (Ben Dooks) - Propagate firmware node by calling device_set_node() for better modularity (Andy Shevchenko) - Discover Data Link Layer Link Active Reporting earlier so quirks can take advantage of it (Maciej W. Rozycki) - Use cached Data Link Layer Link Active Reporting capability in pciehp, powerpc/eeh, and mlx5 (Maciej W. Rozycki) - Run quirk for devices that require OS to clear Retrain Link earlier, so later quirks can rely on it (Maciej W. Rozycki) - Export pcie_retrain_link() for use outside ASPM (Maciej W. Rozycki) - Add Data Link Layer Link Active Reporting as another way for pcie_retrain_link() to determine the link is up (Maciej W. Rozycki) - Work around link training failures (especially on the ASMedia ASM2824 switch) by training first at 2.5GT/s and then attempting higher rates (Maciej W. Rozycki) * pci/enumeration: PCI: Add failed link recovery for device reset events PCI: Work around PCIe link training failures PCI: Use pcie_wait_for_link_status() in pcie_wait_for_link_delay() PCI: Add support for polling DLLLA to pcie_retrain_link() PCI: Export pcie_retrain_link() for use outside ASPM PCI: Export PCIe link retrain timeout PCI: Execute quirk_enable_clear_retrain_link() earlier PCI/ASPM: Factor out waiting for link training to complete PCI/ASPM: Avoid unnecessary pcie_link_state use PCI/ASPM: Use distinct local vars in pcie_retrain_link() net/mlx5: Rely on dev->link_active_reporting powerpc/eeh: Rely on dev->link_active_reporting PCI: pciehp: Rely on dev->link_active_reporting PCI: Initialize dev->link_active_reporting earlier PCI: of: Propagate firmware node by calling device_set_node() PCI: Add PCI_EXT_CAP_ID_PL_32GT define # Conflicts: # drivers/pci/pcie/aspm.c commit 0f32114ea0747ed94be2618cdfd073a90a026550 Merge: a274a4e65f78c e7e39756363ad Author: Bjorn Helgaas Date: Mon Jun 26 12:59:55 2023 -0500 Merge branch 'pci/aspm' - Disable ASPM on MFD function removal to avoid use-after-free (Ding Hui) - Tighten up pci_enable_link_state() and pci_disable_link_state() interfaces so they don't enable/disable states the driver didn't specify (Ajay Agarwal) - Avoid link retraining race that can happen if ASPM sets link control parameters while the link is in the midst of training for some other reason (Ilpo Järvinen) * pci/aspm: PCI/ASPM: Avoid link retraining race PCI/ASPM: Factor out pcie_wait_for_retrain() PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link() PCI/ASPM: Remove unnecessary ASPM_STATE_L1SS check PCI/ASPM: Rename L1.2-specific functions from 'l1ss' to 'l12' PCI/ASPM: Set ASPM_STATE_L1 when driver enables L1.1 or L1.2 PCI/ASPM: Set only ASPM_STATE_L1 when driver enables L1 PCI/ASPM: Disable only ASPM_STATE_L1 when driver disables L1 PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free commit a274a4e65f78cc892c207780b9d3a4fc560e88f1 Merge: ac9a78681b921 11502feab423c Author: Bjorn Helgaas Date: Mon Jun 26 12:59:55 2023 -0500 Merge branch 'pci/aer' - Unexport pci_save_aer_state() since it's only used in drivers/pci/ (Bjorn Helgaas) - Drop recommendation for drivers to configure AER Capability, since the PCI core does this for all devices (Dave Jiang, Bjorn Helgaas) * pci/aer: Documentation: PCI: Tidy AER documentation Documentation: PCI: Update cross references to .rst files Documentation: PCI: Drop recommendation to configure AER Capability PCI: Unexport pci_save_aer_state() commit 74774e243c5ff0903df22dff67be01f2d4a7f00c Merge: 4d483ab702c5c 672d6ef4c775c Author: Linus Torvalds Date: Mon Jun 26 10:56:13 2023 -0700 Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux Pull fsverity updates from Eric Biggers: "Several updates for fs/verity/: - Do all hashing with the shash API instead of with the ahash API. This simplifies the code and reduces API overhead. It should also make things slightly easier for XFS's upcoming support for fsverity. It does drop fsverity's support for off-CPU hash accelerators, but that support was incomplete and not known to be used - Update and export fsverity_get_digest() so that it's ready for overlayfs's upcoming support for fsverity checking of lowerdata - Improve the documentation for builtin signature support - Fix a bug in the large folio support" * tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux: fsverity: improve documentation for builtin signature support fsverity: rework fsverity_get_digest() again fsverity: simplify error handling in verify_data_block() fsverity: don't use bio_first_page_all() in fsverity_verify_bio() fsverity: constify fsverity_hash_alg fsverity: use shash API instead of ahash API commit 4d483ab702c5cd5e8953a123e0aab734af09cc77 Merge: f7976a6493b3f d617ef039fb8e Author: Linus Torvalds Date: Mon Jun 26 10:54:55 2023 -0700 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux Pull fscrypt update from Eric Biggers: "Just one flex array conversion patch" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: fscrypt: Replace 1-element array with flexible array commit f7976a6493b3f00c4d057a37d9e63c322154ef8c Merge: c0a572d9d32fe 75bfb70457a4c Author: Linus Torvalds Date: Mon Jun 26 10:48:57 2023 -0700 Merge tag 'nfsd-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: - Clean-ups in the READ path in anticipation of MSG_SPLICE_PAGES - Better NUMA awareness when allocating pages and other objects - A number of minor clean-ups to XDR encoding - Elimination of a race when accepting a TCP socket - Numerous observability enhancements * tag 'nfsd-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (46 commits) nfsd: remove redundant assignments to variable len svcrdma: Fix stale comment NFSD: Distinguish per-net namespace initialization nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net SUNRPC: Address RCU warning in net/sunrpc/svc.c SUNRPC: Use sysfs_emit in place of strlcpy/sprintf SUNRPC: Remove transport class dprintk call sites SUNRPC: Fix comments for transport class registration svcrdma: Remove an unused argument from __svc_rdma_put_rw_ctxt() svcrdma: trace cc_release calls svcrdma: Convert "might sleep" comment into a code annotation NFSD: Add an nfsd4_encode_nfstime4() helper SUNRPC: Move initialization of rq_stime SUNRPC: Optimize page release in svc_rdma_sendto() svcrdma: Prevent page release when nothing was received svcrdma: Revert 2a1e4f21d841 ("svcrdma: Normalize Send page handling") SUNRPC: Revert 579900670ac7 ("svcrdma: Remove unused sc_pages field") SUNRPC: Revert cc93ce9529a6 ("svcrdma: Retain the page backing rq_res.head[0].iov_base") NFSD: add encoding of op_recall flag for write delegation NFSD: Add "official" reviewers for this subsystem ... commit c0a572d9d32fe1e95672f24e860776dba0750a38 Merge: 1f2300a738211 6ac392815628f Author: Linus Torvalds Date: Mon Jun 26 10:27:04 2023 -0700 Merge tag 'v6.5/vfs.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs mount updates from Christian Brauner: "This contains the work to extend move_mount() to allow adding a mount beneath the topmost mount of a mount stack. There are two LWN articles about this. One covers the original patch series in [1]. The other in [2] summarizes the session and roughly the discussion between Al and me at LSFMM. The second article also goes into some good questions from attendees. Since all details are found in the relevant commit with a technical dive into semantics and locking at the end I'm only adding the motivation and core functionality for this from commit message and leave out the invasive details. The code is also heavily commented and annotated as well which was explicitly requested. TL;DR: > mount -t ext4 /dev/sda /mnt | └─/mnt /dev/sda ext4 > mount --beneath -t xfs /dev/sdb /mnt | └─/mnt /dev/sdb xfs └─/mnt /dev/sda ext4 > umount /mnt | └─/mnt /dev/sdb xfs The longer motivation is that various distributions are adding or are in the process of adding support for system extensions and in the future configuration extensions through various tools. A more detailed explanation on system and configuration extensions can be found on the manpage which is listed below at [3]. System extension images may – dynamically at runtime — extend the /usr/ and /opt/ directory hierarchies with additional files. This is particularly useful on immutable system images where a /usr/ and/or /opt/ hierarchy residing on a read-only file system shall be extended temporarily at runtime without making any persistent modifications. When one or more system extension images are activated, their /usr/ and /opt/ hierarchies are combined via overlayfs with the same hierarchies of the host OS, and the host /usr/ and /opt/ overmounted with it ("merging"). When they are deactivated, the mount point is disassembled — again revealing the unmodified original host version of the hierarchy ("unmerging"). Merging thus makes the extension's resources suddenly appear below the /usr/ and /opt/ hierarchies as if they were included in the base OS image itself. Unmerging makes them disappear again, leaving in place only the files that were shipped with the base OS image itself. System configuration images are similar but operate on directories containing system or service configuration. On nearly all modern distributions mount propagation plays a crucial role and the rootfs of the OS is a shared mount in a peer group (usually with peer group id 1): TARGET SOURCE FSTYPE PROPAGATION MNT_ID PARENT_ID / / ext4 shared:1 29 1 On such systems all services and containers run in a separate mount namespace and are pivot_root()ed into their rootfs. A separate mount namespace is almost always used as it is the minimal isolation mechanism services have. But usually they are even much more isolated up to the point where they almost become indistinguishable from containers. Mount propagation again plays a crucial role here. The rootfs of all these services is a slave mount to the peer group of the host rootfs. This is done so the service will receive mount propagation events from the host when certain files or directories are updated. In addition, the rootfs of each service, container, and sandbox is also a shared mount in its separate peer group: TARGET SOURCE FSTYPE PROPAGATION MNT_ID PARENT_ID / / ext4 shared:24 master:1 71 47 For people not too familiar with mount propagation, the master:1 means that this is a slave mount to peer group 1. Which as one can see is the host rootfs as indicated by shared:1 above. The shared:24 indicates that the service rootfs is a shared mount in a separate peer group with peer group id 24. A service may run other services. Such nested services will also have a rootfs mount that is a slave to the peer group of the outer service rootfs mount. For containers things are just slighly different. A container's rootfs isn't a slave to the service's or host rootfs' peer group. The rootfs mount of a container is simply a shared mount in its own peer group: TARGET SOURCE FSTYPE PROPAGATION MNT_ID PARENT_ID /home/ubuntu/debian-tree / ext4 shared:99 61 60 So whereas services are isolated OS components a container is treated like a separate world and mount propagation into it is restricted to a single well known mount that is a slave to the peer group of the shared mount /run on the host: TARGET SOURCE FSTYPE PROPAGATION MNT_ID PARENT_ID /propagate/debian-tree /run/host/incoming tmpfs master:5 71 68 Here, the master:5 indicates that this mount is a slave to the peer group with peer group id 5. This allows to propagate mounts into the container and served as a workaround for not being able to insert mounts into mount namespaces directly. But the new mount api does support inserting mounts directly. For the interested reader the blogpost in [4] might be worth reading where I explain the old and the new approach to inserting mounts into mount namespaces. Containers of course, can themselves be run as services. They often run full systems themselves which means they again run services and containers with the exact same propagation settings explained above. The whole system is designed so that it can be easily updated, including all services in various fine-grained ways without having to enter every single service's mount namespace which would be prohibitively expensive. The mount propagation layout has been carefully chosen so it is possible to propagate updates for system extensions and configurations from the host into all services. The simplest model to update the whole system is to mount on top of /usr, /opt, or /etc on the host. The new mount on /usr, /opt, or /etc will then propagate into every service. This works cleanly the first time. However, when the system is updated multiple times it becomes necessary to unmount the first update on /opt, /usr, /etc and then propagate the new update. But this means, there's an interval where the old base system is accessible. This has to be avoided to protect against downgrade attacks. The vfs already exposes a mechanism to userspace whereby mounts can be mounted beneath an existing mount. Such mounts are internally referred to as "tucked". The patch series exposes the ability to mount beneath a top mount through the new MOVE_MOUNT_BENEATH flag for the move_mount() system call. This allows userspace to seamlessly upgrade mounts. After this series the only thing that will have changed is that mounting beneath an existing mount can be done explicitly instead of just implicitly. The crux is that the proposed mechanism already exists and that it is so powerful as to cover cases where mounts are supposed to be updated with new versions. Crucially, it offers an important flexibility. Namely that updates to a system may either be forced or can be delayed and the umount of the top mount be left to a service if it is a cooperative one" Link: https://lwn.net/Articles/927491 [1] Link: https://lwn.net/Articles/934094 [2] Link: https://man7.org/linux/man-pages/man8/systemd-sysext.8.html [3] Link: https://brauner.io/2023/02/28/mounting-into-mount-namespaces.html [4] Link: https://github.com/flatcar/sysext-bakery Link: https://fedoraproject.org/wiki/Changes/Unified_Kernel_Support_Phase_1 Link: https://fedoraproject.org/wiki/Changes/Unified_Kernel_Support_Phase_2 Link: https://github.com/systemd/systemd/pull/26013 * tag 'v6.5/vfs.mount' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: allow to mount beneath top mount fs: use a for loop when locking a mount fs: properly document __lookup_mnt() fs: add path_mounted() commit 1f2300a7382119a857cc09e95db6e5d6fd813163 Merge: 2eedfa9e27ed7 bc2473c90fca5 Author: Linus Torvalds Date: Mon Jun 26 10:14:36 2023 -0700 Merge tag 'v6.5/vfs.file' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs file handling updates from Christian Brauner: "This contains Amir's work to fix a long-standing problem where an unprivileged overlayfs mount can be used to avoid fanotify permission events that were requested for an inode or superblock on the underlying filesystem. Some background about files opened in overlayfs. If a file is opened in overlayfs @file->f_path will refer to a "fake" path. What this means is that while @file->f_inode will refer to inode of the underlying layer, @file->f_path refers to an overlayfs {dentry,vfsmount} pair. The reasons for doing this are out of scope here but it is the reason why the vfs has been providing the open_with_fake_path() helper for overlayfs for very long time now. So nothing new here. This is for sure not very elegant and everyone including the overlayfs maintainers agree. Improving this significantly would involve more fragile and potentially rather invasive changes. In various codepaths access to the path of the underlying filesystem is needed for such hybrid file. The best example is fsnotify where this becomes security relevant. Passing the overlayfs @file->f_path->dentry will cause fsnotify to skip generating fsnotify events registered on the underlying inode or superblock. To fix this we extend the vfs provided open_with_fake_path() concept for overlayfs to create a backing file container that holds the real path and to expose a helper that can be used by relevant callers to get access to the path of the underlying filesystem through the new file_real_path() helper. This pattern is similar to what we do in d_real() and d_real_inode(). The first beneficiary is fsnotify and fixes the security sensitive problem mentioned above. There's a couple of nice cleanups included as well. Over time, the old open_with_fake_path() helper added specifically for overlayfs a long time ago started to get used in other places such as cachefiles. Even though cachefiles have nothing to do with hybrid files. The only reason cachefiles used that concept was that files opened with open_with_fake_path() aren't charged against the caller's open file limit by raising FMODE_NOACCOUNT. It's just mere coincidence that both overlayfs and cachefiles need to ensure to not overcharge the caller for their internal open calls. So this work disentangles FMODE_NOACCOUNT use cases and backing file use-cases by adding the FMODE_BACKING flag which indicates that the file can be used to retrieve the backing file of another filesystem. (Fyi, Jens will be sending you a really nice cleanup from Christoph that gets rid of 3 FMODE_* flags otherwise this would be the last fmode_t bit we'd be using.) So now overlayfs becomes the sole user of the renamed open_with_fake_path() helper which is now named backing_file_open(). For internal kernel users such as cachefiles that are only interested in FMODE_NOACCOUNT but not in FMODE_BACKING we add a new kernel_file_open() helper which opens a file without being charged against the caller's open file limit. All new helpers are properly documented and clearly annotated to mention their special uses. We also rename vfs_tmpfile_open() to kernel_tmpfile_open() to clearly distinguish it from vfs_tmpfile() and align it the other kernel_*() internal helpers" * tag 'v6.5/vfs.file' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: ovl: enable fsnotify events on underlying real files fs: use backing_file container for internal files with "fake" f_path fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers fs: use a helper for opening kernel internal files fs: rename {vfs,kernel}_tmpfile_open() commit 2eedfa9e27ed7b22d9c06d8d072ad2dbce4fd635 Merge: 64bf6ae93e087 2454ad83b90af Author: Linus Torvalds Date: Mon Jun 26 10:01:26 2023 -0700 Merge tag 'v6.5/vfs.rename.locking' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs rename locking updates from Christian Brauner: "This contains the work from Jan to fix problems with cross-directory renames originally reported in [1]. To quickly sum it up some filesystems (so far we know at least about ext4, udf, f2fs, ocfs2, likely also reiserfs, gfs2 and others) need to lock the directory when it is being renamed into another directory. This is because we need to update the parent pointer in the directory in that case and if that races with other operations on the directory, in particular a conversion from one directory format into another, bad things can happen. So far we've done the locking in the filesystem code but recently Darrick pointed out in [2] that the RENAME_EXCHANGE case was missing. That one is particularly nasty because RENAME_EXCHANGE can arbitrarily mix regular files and directories and proper lock ordering is not achievable in the filesystems alone. This patch set adds locking into vfs_rename() so that not only parent directories but also moved inodes, regardless of whether they are directories or not, are locked when calling into the filesystem. This means establishing a locking order for unrelated directories. New helpers are added for this purpose and our documentation is updated to cover this in detail. The locking is now actually easier to follow as we now always lock source and target. We've always locked the target independent of whether it was a directory or file and we've always locked source if it was a regular file. The exact details for why this came about can be found in [3] and [4]" Link: https://lore.kernel.org/all/20230117123735.un7wbamlbdihninm@quack3 [1] Link: https://lore.kernel.org/all/20230517045836.GA11594@frogsfrogsfrogs [2] Link: https://lore.kernel.org/all/20230526-schrebergarten-vortag-9cd89694517e@brauner [3] Link: https://lore.kernel.org/all/20230530-seenotrettung-allrad-44f4b00139d4@brauner [4] * tag 'v6.5/vfs.rename.locking' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: Restrict lock_two_nondirectories() to non-directory inodes fs: Lock moved directories fs: Establish locking order for unrelated directories Revert "f2fs: fix potential corruption when moving a directory" Revert "udf: Protect rename against modification of moved directory" ext4: Remove ext4 locking of moved directory commit a8460ba59464c038c817844f67a74fe847b56613 Merge: f46117bf9d641 57c9eaa4de537 Author: Rafael J. Wysocki Date: Mon Jun 26 18:56:58 2023 +0200 Merge tag 'thermal-v6.5-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux into thermal Pull thermal control updates for 6.5-rc1 from Daniel Lezcano: "- Add DT bindings for SM6375, MSM8226 and QCM2290 Qcom platforms (Konrad Dybcio) - Add DT bindings and support for QCom MSM8226 (Matti Lehtimäki) - Add DT bindings for QCom ipq9574 (Praveenkumar I) - Convert bcm2835 DT bindings to the yaml schema (Stefan Wahren) - Allow selecting the bang-bang governor as default (Thierry Reding) - Refactor and prepare the code to set the scene for RCar Gen4 (Wolfram Sang) - Cleanup and fixes for the QCom tsens drivers. Add DT bindings and calibration for the MSM8909 platform (Stephan Gerhold) - Revert a patch introducing a wrong usage of devm_of_iomap() on the Mediatek platform (Ricardo Cañuelo) - Fix the clock vs reset ordering in order to conform to the documentation on the sun8i (Christophe JAILLET) - Prevent setting up undocumented registers, enable the only described sensors and add the version 2.1 on the Qoriq sensor (Peng Fan) - Add DT bindings and support for the Armada AP807 (Alex Leibovich) - Update the mlx5 driver with the recent thermal changes (Daniel Lezcano) - Convert to platform remove callback returning void on STM32 (Uwe Kleine-König) - Add an error information printing for devm_thermal_add_hwmon_sysfs() and remove the error from the Sun8i, Amlogic, i.MX, TI, K3, Tegra, Qoriq, Mediateka and QCom (Yangtao Li) - Register as hwmon sensor for the Generic ADC (Chen-Yu Tsai) - Use the dev_err_probe() function in the QCom tsens alarm driver (Luca Weiss)" * tag 'thermal-v6.5-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: (38 commits) thermal/drivers/qcom/temp-alarm: Use dev_err_probe thermal/drivers/generic-adc: Register thermal zones as hwmon sensors thermal/drivers/mediatek/lvts_thermal: Remove redundant msg in lvts_ctrl_start() thermal/drivers/qcom: Remove redundant msg at probe time thermal/drivers/ti-soc: Remove redundant msg in ti_thermal_expose_sensor() thermal/drivers/qoriq: Remove redundant msg in qoriq_tmu_register_tmu_zone() thermal/drivers/tegra: Remove redundant msg in tegra_tsensor_register_channel() drivers/thermal/k3: Remove redundant msg in k3_bandgap_probe() thermal/drivers/imx: Remove redundant msg in imx8mm_tmu_probe() and imx_sc_thermal_probe() thermal/drivers/amlogic: Remove redundant msg in amlogic_thermal_probe() thermal/drivers/sun8i: Remove redundant msg in sun8i_ths_register() thermal/hwmon: Add error information printing for devm_thermal_add_hwmon_sysfs() thermal/drivers/stm32: Convert to platform remove callback returning void net/mlx5: Update the driver with the recent thermal changes thermal/drivers/armada: Add support for AP807 thermal data dt-bindings: armada-thermal: Add armada-ap807-thermal compatible thermal/drivers/qoriq: Support version 2.1 thermal/drivers/qoriq: Only enable supported sensors thermal/drivers/qoriq: No need to program site adjustment register thermal/drivers/mediatek/lvts_thermal: Register thermal zones as hwmon sensors ... commit 64bf6ae93e08787f4a6db8dddf671fd3a9c43916 Merge: 5c1c88cddb79d 2507135e4ff23 Author: Linus Torvalds Date: Mon Jun 26 09:50:21 2023 -0700 Merge tag 'v6.5/vfs.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull misc vfs updates from Christian Brauner: "Miscellaneous features, cleanups, and fixes for vfs and individual fs Features: - Use mode 0600 for file created by cachefilesd so it can be run by unprivileged users. This aligns them with directories which are already created with mode 0700 by cachefilesd - Reorder a few members in struct file to prevent some false sharing scenarios - Indicate that an eventfd is used a semaphore in the eventfd's fdinfo procfs file - Add a missing uapi header for eventfd exposing relevant uapi defines - Let the VFS protect transitions of a superblock from read-only to read-write in addition to the protection it already provides for transitions from read-write to read-only. Protecting read-only to read-write transitions allows filesystems such as ext4 to perform internal writes, keeping writers away until the transition is completed Cleanups: - Arnd removed the architecture specific arch_report_meminfo() prototypes and added a generic one into procfs.h. Note, we got a report about a warning in amdpgpu codepaths that suggested this was bisectable to this change but we concluded it was a false positive - Remove unused parameters from split_fs_names() - Rename put_and_unmap_page() to unmap_and_put_page() to let the name reflect the order of the cleanup operation that has to unmap before the actual put - Unexport buffer_check_dirty_writeback() as it is not used outside of block device aops - Stop allocating aio rings from highmem - Protecting read-{only,write} transitions in the VFS used open-coded barriers in various places. Replace them with proper little helpers and document both the helpers and all barrier interactions involved when transitioning between read-{only,write} states - Use flexible array members in old readdir codepaths Fixes: - Use the correct type __poll_t for epoll and eventfd - Replace all deprecated strlcpy() invocations, whose return value isn't checked with an equivalent strscpy() call - Fix some kernel-doc warnings in fs/open.c - Reduce the stack usage in jffs2's xattr codepaths finally getting rid of this: fs/jffs2/xattr.c:887:1: error: the frame size of 1088 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] royally annoying compilation warning - Use __FMODE_NONOTIFY instead of FMODE_NONOTIFY where an int and not fmode_t is required to avoid fmode_t to integer degradation warnings - Create coredumps with O_WRONLY instead of O_RDWR. There's a long explanation in that commit how O_RDWR is actually a bug which we found out with the help of Linus and git archeology - Fix "no previous prototype" warnings in the pipe codepaths - Add overflow calculations for remap_verify_area() as a signed addition overflow could be triggered in xfstests - Fix a null pointer dereference in sysv - Use an unsigned variable for length calculations in jfs avoiding compilation warnings with gcc 13 - Fix a dangling pipe pointer in the watch queue codepath - The legacy mount option parser provided as a fallback by the VFS for filesystems not yet converted to the new mount api did prefix the generated mount option string with a leading ',' causing issues for some filesystems - Fix a repeated word in a comment in fs.h - autofs: Update the ctime when mtime is updated as mandated by POSIX" * tag 'v6.5/vfs.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (27 commits) readdir: Replace one-element arrays with flexible-array members fs: Provide helpers for manipulating sb->s_readonly_remount fs: Protect reconfiguration of sb read-write from racing writes eventfd: add a uapi header for eventfd userspace APIs autofs: set ctime as well when mtime changes on a dir eventfd: show the EFD_SEMAPHORE flag in fdinfo fs/aio: Stop allocating aio rings from HIGHMEM fs: Fix comment typo fs: unexport buffer_check_dirty_writeback fs: avoid empty option when generating legacy mount string watch_queue: prevent dangling pipe pointer fs.h: Optimize file struct to prevent false sharing highmem: Rename put_and_unmap_page() to unmap_and_put_page() cachefiles: Allow the cache to be non-root init: remove unused names parameter in split_fs_names() jfs: Use unsigned variable for length calculations fs/sysv: Null check to prevent null-ptr-deref bug fs: use UB-safe check for signed addition overflow in remap_verify_area procfs: consolidate arch_report_meminfo declaration fs: pipe: reveal missing function protoypes ... commit 5c1c88cddb79d3ed3fb1d02a3eaf529eded76f05 Merge: 1f268d6d2c244 aa4b92c523487 Author: Linus Torvalds Date: Mon Jun 26 09:47:39 2023 -0700 Merge tag 'v6.5/fs.ntfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull ntfs updates from Christian Brauner: "A pile of various smaller fixes for ntfs" * tag 'v6.5/fs.ntfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: ntfs: do not dereference a null ctx on error ntfs: Remove unneeded semicolon ntfs: Correct spelling ntfs: remove redundant initialization to pointer cb_sb_start commit 1f268d6d2c244baf2c7769f33782ca532717723d Merge: a1257b5e3b7f8 def85dce1451e Author: Linus Torvalds Date: Mon Jun 26 09:42:03 2023 -0700 Merge tag 'auxdisplay-6.5' of https://github.com/ojeda/linux Pull auxdisplay update from Miguel Ojeda: "A single cleanup for i2c drivers to switch them back to use '.probe()'" * tag 'auxdisplay-6.5' of https://github.com/ojeda/linux: auxdisplay: Switch i2c drivers back to use .probe() commit a1257b5e3b7f8a21faf462d0118067fe31e71ffb Merge: 9d9a9bf07ed9b d2e3115d71719 Author: Linus Torvalds Date: Mon Jun 26 09:35:50 2023 -0700 Merge tag 'rust-6.5' of https://github.com/Rust-for-Linux/linux Pull rust updates from Miguel Ojeda: "A fairly small one in terms of feature additions. Most of the changes in terms of lines come from the upgrade to the new version of the toolchain (which in turn is big due to the vendored 'alloc' crate). Upgrade to Rust 1.68.2: - This is the first such upgrade, and we will try to update it often from now on, in order to remain close to the latest release, until a minimum version (which is "in the future") can be established. The upgrade brings the stabilization of 4 features we used (and 2 more that we used in our old 'rust' branch). Commit 3ed03f4da06e ("rust: upgrade to Rust 1.68.2") contains the details and rationale. pin-init API: - Several internal improvements and fixes to the pin-init API, e.g. allowing to use 'Self' in a struct definition with '#[pin_data]'. 'error' module: - New 'name()' method for the 'Error' type (with 'errname()' integration), used to implement the 'Debug' trait for 'Error'. - Add error codes from 'include/linux/errno.h' to the list of Rust 'Error' constants. - Allow specifying error type on the 'Result' type (with the default still being our usual 'Error' type). 'str' module: - 'TryFrom' implementation for 'CStr', and new 'to_cstring()' method based on it. 'sync' module: - Implement 'AsRef' trait for 'Arc', allowing to use 'Arc' in code that is generic over smart pointer types. - Add 'ptr_eq' method to 'Arc' for easier, less error prone comparison between two 'Arc' pointers. - Reword the 'Send' safety comment for 'Arc', and avoid referencing it from the 'Sync' one. 'task' module: - Implement 'Send' marker for 'Task'. 'types' module: - Implement 'Send' and 'Sync' markers for 'ARef' when 'T' is 'AlwaysRefCounted', 'Send' and 'Sync'. Other changes: - Documentation improvements and '.gitattributes' change to start using the Rust diff driver" * tag 'rust-6.5' of https://github.com/Rust-for-Linux/linux: rust: error: `impl Debug` for `Error` with `errname()` integration rust: task: add `Send` marker to `Task` rust: specify when `ARef` is thread safe rust: sync: reword the `Arc` safety comment for `Sync` rust: sync: reword the `Arc` safety comment for `Send` rust: sync: implement `AsRef` for `Arc` rust: sync: add `Arc::ptr_eq` rust: error: add missing error codes rust: str: add conversion from `CStr` to `CString` rust: error: allow specifying error type on `Result` rust: init: update macro expansion example in docs rust: macros: replace Self with the concrete type in #[pin_data] rust: macros: refactor generics parsing of `#[pin_data]` into its own function rust: macros: fix usage of `#[allow]` in `quote!` docs: rust: point directly to the standalone installers .gitattributes: set diff driver for Rust source code files rust: upgrade to Rust 1.68.2 rust: arc: fix intra-doc link in `Arc::init` rust: alloc: clarify what is the upstream version commit 9d9a9bf07ed9b09af3696997f02a557b428be092 Merge: be5b52dc14441 ad3d770b83aff Author: Linus Torvalds Date: Mon Jun 26 09:31:06 2023 -0700 Merge tag 's390-6.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Alexander Gordeev: - Use correct type for size of memory allocated for ELF core header on kernel crash. - Fix insecure W+X mapping warning when KASAN shadow memory range is not aligned on page boundary. - Avoid allocation of short by one page KASAN shadow memory when the original memory range is less than (PAGE_SIZE << 3). - Fix virtual vs physical address confusion in physical memory enumerator. It is not a real issue, since virtual and physical addresses are currently the same. - Set CONFIG_NET_TC_SKB_EXT=y in s390 config files as it is required for offloading TC as well as bridges on switchdev capable ConnectX devices. * tag 's390-6.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/defconfigs: set CONFIG_NET_TC_SKB_EXT=y s390/boot: fix physmem_info virtual vs physical address confusion s390/kasan: avoid short by one page shadow memory s390/kasan: fix insecure W+X mapping warning s390/crash: use the correct type for memory allocation commit 74f02dd73906f5a0e48dfc39b8f3adc03ad86274 Author: Rob Herring Date: Tue Jun 13 14:10:49 2023 -0600 dt-bindings: auxdisplay: holtek: Add missing type for "linux,no-autorepeat" "linux,no-autorepeat" is missing a type, add it. Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230613201049.2824028-1-robh@kernel.org Signed-off-by: Rob Herring commit f30e04303f3dd23e3adf175f7257c4fc504f73cf Author: Rob Herring Date: Tue Jun 13 14:10:40 2023 -0600 dt-bindings: input: mediatek,pmic-keys: Fix typo in "linux,keycodes" property name "linux-keycodes" is the wrong property name and is unused. It should be "linux,keycodes" instead. Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230613201040.2823802-1-robh@kernel.org Signed-off-by: Rob Herring commit e5d10d1d1aa4c7274bf7ff54660832004800655a Merge: 2a541abd98370 83da70da40c93 Author: Bjorn Andersson Date: Mon Jun 26 09:26:48 2023 -0700 Merge branch '20230608125315.11454-2-srinivas.kandagatla@linaro.org' into clk-for-6.5 Merge the missing SC8280XP LPASS DeviceTree changes, which where brought in through a topic branch in order to be shared with the DeviceTree source files, but not merged into the clock tree until now. commit be5b52dc144415a88ce785575ec9b6d989fc5ac6 Merge: 6995e2de6891c 6a22e017f952e Author: Linus Torvalds Date: Mon Jun 26 09:25:45 2023 -0700 Merge tag 'nios2_updates_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux Pull nios2 updates from Dinh Nguyen: - Convert pgtable constructor/destructors to ptdesc - Replace strlcpy with strscpy * tag 'nios2_updates_for_v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: nios2: Replace all non-returning strlcpy with strscpy nios2: Convert __pte_free_tlb() to use ptdescs commit f46117bf9d641aec96866bb6add83b4f34ee20e9 Merge: 0bb619f9227aa ea197ea2ba572 Author: Rafael J. Wysocki Date: Mon Jun 26 18:03:07 2023 +0200 Merge back earlier Intel thermal control material for 6.5. commit c89a27f4f8fbf4dcbaf1738b42b8c68e160d7cda Merge: 9b8f36398e528 49776c712eb6d Author: Rafael J. Wysocki Date: Mon Jun 26 17:56:05 2023 +0200 Merge branch 'powercap' Merge power capping updates for 6.5-rc1: - Introduce power capping core support for Intel TPMI (Topology Aware Register and PM Capsule Interface) and a TPMI interface driver for Intel RAPL (Zhang Rui, Dan Carpenter). - Fix CONFIG_IOSF_MBI dependency in the Intel RAPL power capping driver (Zhang Rui). - Fix invalid initialization for pl4_supported field in the Intel RAPL power capping driver (Sumeet Pawnikar). * powercap: powercap: RAPL: Fix a NULL vs IS_ERR() bug powercap: RAPL: Fix CONFIG_IOSF_MBI dependency powercap: RAPL: fix invalid initialization for pl4_supported field powercap: intel_rapl: Introduce RAPL TPMI interface driver powercap: intel_rapl: Introduce core support for TPMI interface powercap: intel_rapl: Introduce RAPL I/F type powercap: intel_rapl: Make cpu optional for rapl_package powercap: intel_rapl: Remove redundant cpu parameter powercap: intel_rapl: Add support for lock bit per Power Limit powercap: intel_rapl: Cleanup Power Limits support powercap: intel_rapl: Use bitmap for Power Limits powercap: intel_rapl: Change primitive order powercap: intel_rapl: Use index to initialize primitive information powercap: intel_rapl: Support per domain energy/power/time unit powercap: intel_rapl: Support per Interface primitive information powercap: intel_rapl: Support per Interface rapl_defaults powercap: intel_rapl: Allow probing without CPUID match powercap: intel_rapl: Remove unused field in struct rapl_if_priv commit b9a40506a2cb626da3f21c6d494a76879e3141d7 Merge: 6e11940ab392c 989e4659dc51b 3973bcc95e744 ebf51575c8418 f562514174a04 6acab96ee3370 b1356ed1a4461 Author: Stephen Boyd Date: Mon Jun 26 08:55:22 2023 -0700 Merge branches 'clk-imx', 'clk-microchip', 'clk-cleanup', 'clk-bindings', 'clk-ti' and 'clk-kasprintf' into clk-next - Handle allocation failures from kasprintf() and friends * clk-imx: clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() clk: imx93: fix memory leak and missing unwind goto in imx93_clocks_probe clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe dt-bindings: clock: imx8m: Add missing interrupt property clk: imx: clk-imxrt1050: fix memory leak in imxrt1050_clocks_probe clk: imx: composite-8m: Add imx8m_divider_determine_rate clk: imx: scu: use _safe list iterator to avoid a use after free clk: imx: drop imx_unregister_clocks clk: imx6ul: retain early UART clocks during kernel init clk: imx: imx6sx: Remove CLK_SET_RATE_PARENT from the LDB clocks * clk-microchip: dt-bindings: clocks: at91sam9x5-sckc: convert to yaml dt-bindings: clocks: atmel,at91rm9200-pmc: convert to yaml clk: microchip: Use of_property_read_bool() for boolean properties clk: microchip: convert SOC_MICROCHIP_POLARFIRE to ARCH_MICROCHIP_POLARFIRE * clk-cleanup: clk: fix typo in clk_hw_register_fixed_rate_parent_data() macro clk: Fix memory leak in devm_clk_notifier_register() clk: mvebu: Iterate over possible CPUs instead of DT CPU nodes clk: mvebu: Use of_get_cpu_hwid() to read CPU ID MAINTAINERS: Add Marvell mvebu clock drivers clk: mvebu: Use of_address_to_resource() clk: tegra: tegra124-emc: Fix potential memory leak clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider() clk: bcm: rpi: Fix off by one in raspberrypi_discover_clocks() clk: sifive: Use devm_platform_ioremap_resource() * clk-bindings: dt-bindings: clock: drop unneeded quotes and use absolute /schemas path dt-bindings: rcc: stm32: Sync with u-boot copy for STM32MP13 SoC * clk-ti: clk: keystone: syscon-clk: Add support for audio refclk dt-bindings: clock: Add binding documentation for TI Audio REFCLK dt-bindings: clock: ehrpwm: Remove unneeded syscon compatible clk: keystone: syscon-clk: Allow the clock node to not be of type syscon * clk-kasprintf: clk: clocking-wizard: check return value of devm_kasprintf() clk: ti: clkctrl: check return value of kasprintf() clk: keystone: sci-clk: check return value of kasprintf() clk: si5341: free unused memory on probe failure clk: si5341: check return value of {devm_}kasprintf() clk: si5341: return error if one synth clock registration fails clk: cdce925: check return value of kasprintf() clk: vc5: check memory returned by kasprintf() commit 6e11940ab392cf804c1f124cae960f2a3a5e079c Merge: e155a3660784b e90f15be2447d 587dd448d9fcf 29d7088810099 59374d08b2b0b 9390860900a30 Author: Stephen Boyd Date: Mon Jun 26 08:55:04 2023 -0700 Merge branches 'clk-renesas', 'clk-determine-rate', 'clk-allwinner', 'clk-samsung' and 'clk-amlogic' into clk-next - Make clk_ops::determine_rate mandatory for muxes * clk-renesas: clk: renesas: rzg2l: Convert to readl_poll_timeout_atomic() clk: renesas: mstp: Convert to readl_poll_timeout_atomic() clk: renesas: cpg-mssr: Convert to readl_poll_timeout_atomic() iopoll: Do not use timekeeping in read_poll_timeout_atomic() iopoll: Call cpu_relax() in busy loops clk: renesas: rzg2l: Fix CPG_SIPLL5_CLK1 register write clk: renesas: r8a779a0: Add PWM clock * clk-determine-rate: (71 commits) clk: sprd: composite: Simplify determine_rate implementation ASoC: tlv320aic32x4: pll: Remove impossible condition in clk_aic32x4_pll_determine_rate() clk: Fix best_parent_rate after moving code into a separate function clk: Forbid to register a mux without determine_rate ASoC: tlv320aic32x4: div: Switch to determine_rate ASoC: tlv320aic32x4: pll: Switch to determine_rate clk: tegra: super: Switch to determine_rate clk: tegra: periph: Switch to determine_rate clk: stm32: composite: Switch to determine_rate clk: st: flexgen: Switch to determine_rate clk: sprd: composite: Switch to determine_rate clk: ingenic: tcu: Switch to determine_rate clk: ingenic: cgu: Switch to determine_rate clk: imx: scu: Switch to determine_rate clk: da8xx: clk48: Switch to determine_rate clk: si5351: clkout: Switch to determine_rate clk: si5351: msynth: Switch to determine_rate clk: si5351: pll: Switch to determine_rate clk: si5341: Switch to determine_rate clk: cdce706: clkout: Switch to determine_rate ... * clk-allwinner: clk: sunxi-ng: a64: force select PLL_MIPI in TCON0 mux * clk-samsung: clk: samsung: add CONFIG_OF dependency clk: samsung: Re-add support for Exynos4212 CPU clock clk: samsung: Add Exynos4212 compatible to CLKOUT driver dt-bindings: clock: samsung,exynos: add Exynos4212 clock compatible * clk-amlogic: MAINTAINERS: repair pattern in ARM/Amlogic Meson SoC CLOCK FRAMEWORK clk: meson: pll: remove unneeded semicolon clk: meson: a1: Staticize rtc clk clk: meson: a1: add Amlogic A1 Peripherals clock controller driver clk: meson: a1: add Amlogic A1 PLL clock controller driver clk: meson: introduce new pll power-on sequence for A1 SoC family clk: meson: make pll rst bit as optional dt-bindings: clock: meson: add A1 Peripherals clock controller bindings dt-bindings: clock: meson: add A1 PLL clock controller bindings commit e155a3660784badaa48bd7bb868dd7da9e45ae7d Merge: a65615df5b458 16d4f5378d964 b270ae61730e0 ad527ca87e4ea 893911e657365 Author: Stephen Boyd Date: Mon Jun 26 08:54:19 2023 -0700 Merge branches 'clk-platform', 'clk-i2c', 'clk-mediatek', 'clk-i2cid' and 'clk-vc5' into clk-next - Migrate platform clk drivers to .remove_new() - Migrate i2c clk drivers to .probe() instead of .probe_new() - Remove CLK_SET_PARENT from all Mediatek MSDC core clocks - Add infra_ao reset support for Mediatek MT8188 SoCs - Align driver_data to i2c_device_id tables in some i2c clk drivers - Use device_get_match_data() in vc5 clk driver * clk-platform: clk: mediatek: Convert all remaining drivers to platform_driver's .remove_new() clk: mediatek: Make mtk_clk_pdev_remove() return void clk: mediatek: Make mtk_clk_simple_remove() return void * clk-i2c: clk: si521xx: Switch i2c driver back to use .probe() clk: Switch i2c drivers back to use .probe() * clk-mediatek: clk: mediatek: clk-mt8173-apmixedsys: Fix iomap not released issue clk: mediatek: clk-mt8173-apmixedsys: Fix return value for of_iomap() error clk: mediatek: clk-mtk: Grab iomem pointer for divider clocks clk: mediatek: fix of_iomap memory leak clk: mediatek: reset: add infra_ao reset support for MT8188 dt-bindings: reset: mt8188: add thermal reset control bit clk: mediatek: Remove CLK_SET_PARENT from all MSDC core clocks clk: mediatek: mux: Stop forcing CLK_SET_RATE_PARENT flag clk: mediatek: Enable all MT8192 clocks by default * clk-i2cid: clk: rs9: Fix .driver_data content in i2c_device_id clk: vc7: Fix .driver_data content in i2c_device_id clk: vc5: Fix .driver_data content in i2c_device_id * clk-vc5: clk: vc7: Use device_get_match_data() instead of of_device_get_match_data() clk: vc5: Use device_get_match_data() instead of of_device_get_match_data() commit 6d85ebf95c44e52337ca1d07f0db4b435d1e6762 Author: Yu Kuai Date: Sat May 27 09:06:44 2023 +0800 blk-sysfs: add a new attr_group for blk_mq Currently wbt sysfs entry is created for bio based device, and wbt can be enabled for such device through sysfs while it doesn't make sense because wbt can only work for rq based device. In the meantime, there are other similar sysfs entries. Fix this by adding a new attr_group for blk_mq, and sysfs entries will only be created when the device is rq based. Suggested-by: Christoph Hellwig Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230527010644.647900-6-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit eebc21d12f56c1e09a163abf91e351fa2a55a938 Author: Yu Kuai Date: Sat May 27 09:06:43 2023 +0800 blk-iocost: move wbt_enable/disable_default() out of spinlock There are following smatch warning: block/blk-wbt.c:843 wbt_init() warn: sleeping in atomic context ioc_qos_write() <- disables preempt -> wbt_enable_default() -> wbt_init() wbt_init() will be called from wbt_enable_default() if wbt is not initialized, currently this is only possible in blk_register_queue(), hence wbt_init() will never be called from iocost and this warning is false positive. However, we might support rq_qos destruction dynamically in the future, and it's better to prevent that, hence move wbt_enable_default() outside 'ioc->lock'. This is safe because queue is still freezed. Reported-by: Dan Carpenter Link: https://lore.kernel.org/lkml/Y+Ja5SRs886CEz7a@kadam/ Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230527010644.647900-5-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 06257fda83ebfd1c33fb992e41dba7be4e1184d4 Author: Yu Kuai Date: Sat May 27 09:06:42 2023 +0800 blk-wbt: cleanup rwb_enabled() and wbt_disabled() 'wb_normal' will set to 0 if 'min_lat_nsec' is 0, and 'min_lat_nsec' can only be set to 0 through sysfs configuration where 'WBT_STATE_OFF_MANUAL' is set together, in the meantime, they can only be cleared together through sysfs afterwards. Hence 'wb_normal != 0' is the same as 'rwb->enable_state != WBT_STATE_OFF_MANUAL'. The code is redundan, hence replace the checking of 'wb_normal' to 'enable_state' in rwb_enabled() and reuse rwb_enabled() for wbt_disabled(). Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230527010644.647900-4-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 71b8642e79f277459555629f2bea1a8d1fed307e Author: Yu Kuai Date: Sat May 27 09:06:41 2023 +0800 blk-wbt: remove dead code to handle wbt enable/disable with io inflight enable or disable wbt is always called with queue freezed, so that wbt can never be enabled or disabled while io is still inflight, and this behaviour should always hold to avoid io hang(There have been reported several times). Therefor, the code to handle wbt enable/diskble with io inflight is not and never will be used, hence remove such dead code. Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230527010644.647900-3-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 645a829e03384a235b3760959d4ebe420a0f2027 Author: Yu Kuai Date: Sat May 27 09:06:40 2023 +0800 blk-wbt: don't create wbt sysfs entry if CONFIG_BLK_WBT is disabled sysfs entry /sys/block/[device]/queue/wbt_lat_usec will be created even if CONFIG_BLK_WBT is disabled, while read and write will always fail. It doesn't make sense to create a sysfs entry that can't be accessed, so don't create such entry. Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230527010644.647900-2-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 9b8f36398e52840a6fe3a56d65be5f45bad4525a Merge: 4af191d60d221 b77505ed8a885 4384a70c8813e Author: Rafael J. Wysocki Date: Mon Jun 26 17:44:50 2023 +0200 Merge branches 'pm-sleep' and 'pm-domains' Merge updates related to system-wide power management and generic power domains (genpd) updates for 6.5-rc1: - Fix the handling of pm_suspend_target_state when CONFIG_PM is unset (Kai-Heng Feng). - Correct spelling mistake in a comment in the hibernation code (Wang Honghui). - Add arch_resume_nosmt() prototype to avoid a "missing prototypes" build warning (Arnd Bergmann). - Restrict pm_pr_dbg() to system-wide power transitions and use it in a few additional places (Mario Limonciello). - Drop verification of in-params from genpd_add_device() and ensure that all of its callers will do it (Ulf Hansson). - Prevent possible integer overflows from occurring in genpd_parse_state() (Nikita Zhandarovich). * pm-sleep: platform/x86/amd: pmc: Use pm_pr_dbg() for suspend related messages pinctrl: amd: Use pm_pr_dbg to show debugging messages ACPI: x86: Add pm_debug_messages for LPS0 _DSM state tracking include/linux/suspend.h: Only show pm_pr_dbg messages at suspend/resume PM: suspend: add a arch_resume_nosmt() prototype PM: hibernate: Correct spelling mistake in a comment PM: suspend: Fix pm_suspend_target_state handling for !CONFIG_PM * pm-domains: PM: domains: Move the verification of in-params from genpd_add_device() PM: domains: fix integer overflow issues in genpd_parse_state() commit a6b6790c020a01cc3e9353059d98bbe60c2fd105 Author: Uwe Kleine-König Date: Mon Jun 26 11:19:41 2023 +0200 mfd: Switch two more drivers back to use struct i2c_driver::probe struct i2c_driver::probe_new is about to go away. Switch the driver to use the probe callback with the same prototype. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230626091941.557733-1-u.kleine-koenig@pengutronix.de Signed-off-by: Lee Jones commit 4af191d60d22184e8c529068a8e9a6c77eee1706 Merge: 5d83a2b18b988 03f44ffb3d5be 0fac214bb75ee Author: Rafael J. Wysocki Date: Mon Jun 26 17:34:01 2023 +0200 Merge branches 'pm-cpufreq' and 'pm-cpuidle' Merge cpufreq and cpuidle updates for 6.5-rc1: - Prevent cpufreq drivers that provide the ->adjust_perf() callback without a ->fast_switch() one which is used as a fallback from the former in some cases (Wyes Karny). - Fix some issues related to the AMD P-state cpufreq driver (Mario Limonciello, Wyes Karny). - Fix the energy_performance_preference attribute handling in the intel_pstate driver in passive mode (Tero Kristo). - Clean up the intel_idle driver, make it work with VM guests that cannot use the MWAIT instruction and address the case in which the host may enter a deep idle state when the guest is idle (Arjan van de Ven). * pm-cpufreq: cpufreq: intel_pstate: Fix energy_performance_preference for passive cpufreq: amd-pstate: Add a kernel config option to set default mode cpufreq: amd-pstate: Set a fallback policy based on preferred_profile ACPI: CPPC: Add definition for undefined FADT preferred PM profile value cpufreq: amd-pstate: Set default governor to schedutil cpufreq: amd-pstate: Make amd-pstate EPP driver name hyphenated cpufreq: amd-pstate: Write CPPC enable bit per-socket cpufreq: Fail driver register if it has adjust_perf without fast_switch * pm-cpuidle: intel_idle: Add a "Long HLT" C1 state for the VM guest mode intel_idle: Add support for using intel_idle in a VM guest using just hlt intel_idle: clean up the (new) state_update_enter_method function intel_idle: refactor state->enter manipulation into its own function commit a33677b9211b6c328ad359b072043af94f7c9592 Author: Mans Rullgard Date: Mon Jun 19 17:02:49 2023 +0100 backlight: led_bl: Take led_access lock when required The led_access lock must be held when calling led_sysfs_enable() and led_sysfs_disable(). This fixes warnings such as this: [ 2.432495] ------------[ cut here ]------------ [ 2.437316] WARNING: CPU: 0 PID: 22 at drivers/leds/led-core.c:349 led_sysfs_disable+0x54/0x58 [ 2.446105] Modules linked in: [ 2.449218] CPU: 0 PID: 22 Comm: kworker/u2:1 Not tainted 6.3.8+ #1 [ 2.456268] Hardware name: Generic AM3517 (Flattened Device Tree) [ 2.462402] Workqueue: events_unbound deferred_probe_work_func [ 2.468353] unwind_backtrace from show_stack+0x10/0x14 [ 2.473632] show_stack from dump_stack_lvl+0x24/0x2c [ 2.478759] dump_stack_lvl from __warn+0x9c/0xc4 [ 2.483551] __warn from warn_slowpath_fmt+0x64/0xc0 [ 2.488586] warn_slowpath_fmt from led_sysfs_disable+0x54/0x58 [ 2.494567] led_sysfs_disable from led_bl_probe+0x20c/0x3b0 [ 2.500305] led_bl_probe from platform_probe+0x5c/0xb8 [ 2.505615] platform_probe from really_probe+0xc8/0x2a0 [ 2.510986] really_probe from __driver_probe_device+0x88/0x19c [ 2.516967] __driver_probe_device from driver_probe_device+0x30/0xcc [ 2.523498] driver_probe_device from __device_attach_driver+0x94/0xc4 [ 2.530090] __device_attach_driver from bus_for_each_drv+0x80/0xcc [ 2.536437] bus_for_each_drv from __device_attach+0xf8/0x19c [ 2.542236] __device_attach from bus_probe_device+0x8c/0x90 [ 2.547973] bus_probe_device from deferred_probe_work_func+0x80/0xb0 [ 2.554504] deferred_probe_work_func from process_one_work+0x228/0x4c0 [ 2.561187] process_one_work from worker_thread+0x1fc/0x4d0 [ 2.566925] worker_thread from kthread+0xb4/0xd0 [ 2.571685] kthread from ret_from_fork+0x14/0x2c [ 2.576446] Exception stack(0xd0079fb0 to 0xd0079ff8) [ 2.581573] 9fa0: 00000000 00000000 00000000 00000000 [ 2.589813] 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 2.598052] 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 2.604888] ---[ end trace 0000000000000000 ]--- Signed-off-by: Mans Rullgard Reviewed-by: Daniel Thompson Link: https://lore.kernel.org/r/20230619160249.10414-1-mans@mansr.com Signed-off-by: Lee Jones commit 01fee479846bb13139d339b11e04bf327200cac9 Merge: 0586d26339ed4 9368aa1882ac7 b72f301c5bdce 097e727b585a9 Author: Rafael J. Wysocki Date: Mon Jun 26 17:24:19 2023 +0200 Merge branches 'acpi-apei', 'acpi-pad' and 'acpi-misc' Merge ACPI APEI changes, an ACPI PAD driver update and an ACPI FFH handling cleanup related to ARM64 for 6.5-rc1: - Make ghes_get_devices() return NULL to indicate that there are no GHES devices so as to allow vendor-specific EDAC drivers to probe then (Li Yang). - Mark bert_disable() as __initdata and drop an unused function from the APEI GHES code (Miaohe Lin). - Make the ACPI PAD (Processor Aggregator Device) driver realize that Zhaoxin CPUs support nonstop TSC (Tony W Wang-oc). - Drop the certainly unnecessary and likely incorrect inclusion of linux/arm-smccc.h from acpi_ffh.c (Sudeep Holla). * acpi-apei: APEI: GHES: correctly return NULL for ghes_get_devices() ACPI: APEI: mark bert_disable as __initdata ACPI: APEI: GHES: Remove unused ghes_estatus_pool_size_request() * acpi-pad: ACPI: PAD: mark Zhaoxin CPUs NONSTOP TSC correctly * acpi-misc: ACPI: FFH: Drop the inclusion of linux/arm-smccc.h commit 0586d26339ed4a84cfd60333daadb853663066fd Merge: 9fc520a6fe14c c31b3a1b004c1 365eac5ef2feb Author: Rafael J. Wysocki Date: Mon Jun 26 17:20:28 2023 +0200 Merge branches 'acpi-thermal' and 'acpi-button' Merge ACPI thermal driver cleanups and ACPI button drivers rework for 6.5-rc1: - Clean up the ACPI thermal driver and drop some dead or otherwise unneded code from it (Rafael Wysocki). - Rework the handling of notifications in the ACPI button drivers so as to allow the common notification handling code for devices to be simplified (Rafael Wysocki). * acpi-thermal: ACPI: thermal: Drop struct acpi_thermal_flags ACPI: thermal: Drop struct acpi_thermal_state ACPI: thermal: Eliminate struct acpi_thermal_state_flags ACPI: thermal: Move acpi_thermal_driver definition ACPI: thermal: Move symbol definitions to one place ACPI: thermal: Drop redundant ACPI_TRIPS_REFRESH_DEVICES symbol ACPI: thermal: Use BIT() macro for defining flags * acpi-button: ACPI: bus: Simplify installation and removal of notify callback ACPI: tiny-power-button: Eliminate the driver notify callback ACPI: button: Use different notify handlers for lid and buttons ACPI: button: Eliminate the driver notify callback commit b389139f12f287b8ed2e2628b72df89a081f0b59 Author: Pablo Neira Ayuso Date: Mon Jun 26 00:42:19 2023 +0200 netfilter: nf_tables: fix underflow in chain reference counter Set element addition error path decrements reference counter on chains twice: once on element release and again via nft_data_release(). Then, d6b478666ffa ("netfilter: nf_tables: fix underflow in object reference counter") incorrectly fixed this by removing the stateful object reference count decrement. Restore the stateful object decrement as in b91d90368837 ("netfilter: nf_tables: fix leaking object reference count") and let nft_data_release() decrement the chain reference counter, so this is done only once. Fixes: d6b478666ffa ("netfilter: nf_tables: fix underflow in object reference counter") Fixes: 628bd3e49cba ("netfilter: nf_tables: drop map element references from preparation phase") Signed-off-by: Pablo Neira Ayuso commit 3e70489721b6c870252c9082c496703677240f53 Author: Pablo Neira Ayuso Date: Mon Jun 26 00:42:18 2023 +0200 netfilter: nf_tables: unbind non-anonymous set if rule construction fails Otherwise a dangling reference to a rule object that is gone remains in the set binding list. Fixes: 26b5a5712eb8 ("netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain") Signed-off-by: Pablo Neira Ayuso commit f188d30087480eab421cd8ca552fb15f55d57f4d Author: Ilia.Gavrilov Date: Fri Jun 23 11:23:46 2023 +0000 netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. ct_sip_parse_numerical_param() returns only 0 or 1 now. But process_register_request() and process_register_response() imply checking for a negative value if parsing of a numerical header parameter failed. The invocation in nf_nat_sip() looks correct: if (ct_sip_parse_numerical_param(...) > 0 && ...) { ... } Make the return value of the function ct_sip_parse_numerical_param() a tristate to fix all the cases a) return 1 if value is found; *val is set b) return 0 if value is not found; *val is unchanged c) return -1 on error; *val is undefined Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 0f32a40fc91a ("[NETFILTER]: nf_conntrack_sip: create signalling expectations") Signed-off-by: Ilia.Gavrilov Reviewed-by: Simon Horman Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 9fc520a6fe14cb7fadd64718375da1572f5acf6a Merge: 87b5374b49c3d f91280f35895d 23d28cc0444be fa578bf50e0b5 8f0e8597a7fa1 Author: Rafael J. Wysocki Date: Mon Jun 26 17:05:10 2023 +0200 Merge branches 'acpi-x86', 'acpi-video', 'acpi-soc' and 'acpi-tables' Merge x86-related ACPI changes, backlight-related ACPI changes, an Intel SoC (LPSS) ACPI driver update and a missing prototype warning fix related to ACPI NFIT for 6.5-rc1: - Add quirks to work around ACPI tables defects on Lenovo Yoga Book yb1-x90f/l and Nextbook Ares 8A (Hans de Goede). - Add ACPi backlight quirks for Dell Studio 1569, Lenovo ThinkPad X131e (3371 AMD version) and Apple iMac11,3 and stop trying to use vendor backlight control on relatively recent systems (Hans de Goede). - Add pwm_lookup_table entry for second PWM on CHT/BSW devices in the ACPI LPSS (Intel SoC) driver (Hans de Goede). - Add nfit_intel_shutdown_status() declaration to a local header to avoid a "missing prototypes" build warning (Arnd Bergmann). * acpi-x86: ACPI: x86: Add ACPI_QUIRK_UART1_SKIP for Lenovo Yoga Book yb1-x90f/l ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A ACPI: x86: Add skip i2c clients quirk for Nextbook Ares 8A * acpi-video: ACPI: video: Add backlight=native DMI quirk for Dell Studio 1569 ACPI: video: Stop trying to use vendor backlight control on laptops from after ~2012 ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version) ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3 * acpi-soc: ACPI: LPSS: Add pwm_lookup_table entry for second PWM on CHT/BSW devices * acpi-tables: ACPI: NFIT: Add declaration in a local header commit 87b5374b49c3d99f9c581c59e5ad47d13294b66d Merge: e660abd551f11 3ba12d8de3faa f198478cfdc81 a9c4a912b7dc7 896e97bf99ecf Author: Rafael J. Wysocki Date: Mon Jun 26 16:54:10 2023 +0200 Merge branches 'acpi-scan', 'acpi-pm', 'acpi-resource' and 'acpi-ec' Merge ACPI device enumeration changes, ACPI power management update, ACPI resources management updates and an EC driver update for 6.5-rc1: - Reduce ACPI device enumeration overhead related to devices with dependencies (Rafael Wysocki). - Fix the handling of Microsoft LPS0 _DSM for suspend-to-idle (Mario Limonciello). - Fix section mismatch warning in the ACPI suspend-to-idle code (Arnd Bergmann). - Drop several ACPI resource management quirks related to IRQ ovverides on AMD "Zen" systems (Mario Limonciello). - Modify the ACPI EC driver to make it only clear the EC GPE status when handling the GPE (Jeremy Compostella). * acpi-scan: ACPI: scan: Reduce overhead related to devices with dependencies * acpi-pm: ACPI: x86: s2idle: Adjust Microsoft LPS0 _DSM handling sequence ACPI: PM: s2idle: fix section mismatch warning * acpi-resource: ACPI: resource: Remove "Zen" specific match and quirks * acpi-ec: ACPI: EC: Clear GPE on interrupt handling only commit 9a6c0e28e215535b2938c61ded54603b4e5814c5 Author: Jason Gerecke Date: Thu Jun 8 14:38:28 2023 -0700 HID: wacom: Use ktime_t rather than int when dealing with timestamps Code which interacts with timestamps needs to use the ktime_t type returned by functions like ktime_get. The int type does not offer enough space to store these values, and attempting to use it is a recipe for problems. In this particular case, overflows would occur when calculating/storing timestamps leading to incorrect values being reported to userspace. In some cases these bad timestamps cause input handling in userspace to appear hung. Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/901 Fixes: 17d793f3ed53 ("HID: wacom: insert timestamp to packed Bluetooth (BT) events") CC: stable@vger.kernel.org Signed-off-by: Jason Gerecke Reviewed-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20230608213828.2108-1-jason.gerecke@wacom.com Signed-off-by: Benjamin Tissoires commit 1ea7ca1b090145519aad998679222f0a14ab8fce Author: Jane Chu Date: Thu Jun 15 12:13:25 2023 -0600 dax: enable dax fault handler to report VM_FAULT_HWPOISON When multiple processes mmap() a dax file, then at some point, a process issues a 'load' and consumes a hwpoison, the process receives a SIGBUS with si_code = BUS_MCEERR_AR and with si_lsb set for the poison scope. Soon after, any other process issues a 'load' to the poisoned page (that is unmapped from the kernel side by memory_failure), it receives a SIGBUS with si_code = BUS_ADRERR and without valid si_lsb. This is confusing to user, and is different from page fault due to poison in RAM memory, also some helpful information is lost. Channel dax backend driver's poison detection to the filesystem such that instead of reporting VM_FAULT_SIGBUS, it could report VM_FAULT_HWPOISON. If user level block IO syscalls fail due to poison, the errno will be converted to EIO to maintain block API consistency. Signed-off-by: Jane Chu Link: https://lore.kernel.org/r/20230615181325.1327259-2-jane.chu@oracle.com Reviewed-by: Dan Williams Signed-off-by: Vishal Verma commit 90fc660e8479c5da5bb99a4fb3e0d266fa041b15 Author: Uwe Kleine-König Date: Mon Jun 26 10:51:45 2023 +0200 hwmon: max31827: Switch back to use struct i2c_driver::probe struct i2c_driver::probe_new is about to go away. Switch the driver to use the probe callback with the same prototype. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230626085145.554616-1-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck commit d6048fdc870240e5020343f8af0c825829c232bd Merge: a15b51375684c 2d0cad0473bd1 Author: Takashi Iwai Date: Mon Jun 26 15:38:02 2023 +0200 Merge tag 'asoc-v6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v6.5 A fairly quiet release from a core and framework point of view, but a very big one from the point of view of new drivers: - More refectoring from Morimoto-san, this time mainly around DAI links and how we control the ordering of trigger() callbacks. - Convert a lot of drivers to use maple tree based caches. - Lots of work on the x86 driver stack. - Compressed audio support for Qualcomm. - Support for AMD SoundWire, Analog Devices SSM3515, Google Chameleon, Ingenic X1000, Intel systems with various CODECs, Longsoon platforms, Maxim MAX98388, Mediatek MT8188, Nuvoton NAU8825C, NXP platforms with NAU8822, Qualcomm WSA884x, StarFive JH7110, Texas Instruments TAS2781. commit d1d7fc3bf6d2e6fb5d81a24dbb4120779a447b33 Author: Colin Ian King Date: Mon Jun 26 09:35:35 2023 +0100 RDMA/bnxt_re: Fix spelling mistake "priviledged" -> "privileged" There is a spelling mistake in a comment and in a dev_err error message. Fix them. Link: https://lore.kernel.org/r/20230626083535.53303-1-colin.i.king@gmail.com Signed-off-by: Colin Ian King Signed-off-by: Jason Gunthorpe commit 0ab83a6459604c566a745875c4df1aec8e8866c0 Author: Yang Li Date: Mon Jun 26 08:36:32 2023 +0800 RDMA/bnxt_re: Remove duplicated include in bnxt_re/main.c ./drivers/infiniband/hw/bnxt_re/main.c: ib_verbs.h is included more than once. Link: https://lore.kernel.org/r/20230626003632.60435-1-yang.lee@linux.alibaba.com Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=5588 Signed-off-by: Yang Li Acked-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit a15b51375684c2bfa6017bb185139477e7a3b96c Merge: e94f1f96f108b 4e0871333661d Author: Takashi Iwai Date: Mon Jun 26 15:23:15 2023 +0200 Merge branch 'for-next' into for-linus Pull the 6.5-devel branch for upstreaming. Signed-off-by: Takashi Iwai commit e94f1f96f108ba96c0ed8bf3fbdd8ee6a6703880 Author: Andy Chi Date: Mon Jun 26 21:03:00 2023 +0800 ALSA: hda/realtek: Enable mute/micmute LEDs and limit mic boost on EliteBook On HP EliteBook 835/845/845W G10, the audio LEDs can be enabled by ALC285_FIXUP_HP_MUTE_LED. So use it accordingly. Signed-off-by: Andy Chi Cc: Fixes: 3e10f6ca76c4 ("ALSA: hda/realtek: Add quirk for HP EliteBook G10 laptops") Link: https://lore.kernel.org/r/20230626130301.301712-1-andy.chi@canonical.com Signed-off-by: Takashi Iwai commit cf2423a7555c4b012576c7282fb495ce739d50d4 Author: Yunlei He Date: Mon Jun 19 23:13:53 2023 +0800 f2fs: remove unneeded page uptodate check/set This patch remove unneeded page uptodate check/set in f2fs_vm_page_mkwrite, which already done in set_page_dirty. Signed-off-by: Yunlei He Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 396d0a28836d42bef595a8843533285abaf64ff7 Author: Yunlei He Date: Fri Jun 23 00:16:46 2023 +0800 f2fs: update mtime and ctime in move file range method Mtime and ctime stay old value without update after move file range ioctl. This patch add time update. Signed-off-by: Yunlei He Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 2724daf6c24c58099a758d1e842d39b10133b065 Author: Jaegeuk Kim Date: Tue Jun 6 10:17:47 2023 -0700 f2fs: compress tmp files given extension Let's compress tmp files for the given extension list. This patch does not change the previous behavior, but allow the cases as below. Extention example: "ext" - abc.ext : allow - abc.ext.abc : allow - abc.extm : not allow Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 6201c478dedcf7c50361b23b5c4d4f41a68921ac Author: Yangtao Li Date: Sat May 6 23:16:03 2023 +0800 f2fs: refactor struct f2fs_attr macro This patch provides a large number of variants of F2FS_RW_ATTR and F2FS_RO_ATTR macros, reducing the number of parameters required to initialize the f2fs_attr structure. Reported-by: kernel test robot Link: https://lore.kernel.org/oe-kbuild-all/202304152234.wjaY3IYm-lkp@intel.com/ Signed-off-by: Yangtao Li Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit c3355ea9d82fe6b1a4226c9a7d311f9c5715b456 Author: Yangtao Li Date: Tue Jun 13 15:51:57 2023 +0800 f2fs: convert to use sbi directly F2FS_I_SB(inode) is redundant. Signed-off-by: Yangtao Li Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 3f8ac7da8c6efd72908e0a16d4a149e79f356a00 Author: Colin Ian King Date: Fri Jun 16 15:20:09 2023 +0100 f2fs: remove redundant assignment to variable err The assignment to variable err is redundant since the code jumps to label next and err is then re-assigned a new value on the call to sanity_check_node_chain. Remove the assignment. Cleans up clang scan build warning: fs/f2fs/recovery.c:464:6: warning: Value stored to 'err' is never read [deadcode.DeadStores] Signed-off-by: Colin Ian King Signed-off-by: Jaegeuk Kim commit 9ac00e7cef106b66611e131f59f61f5ae35cf726 Author: Jaegeuk Kim Date: Tue Jun 13 13:35:31 2023 -0700 f2fs: do not issue small discard commands during checkpoint If there're huge # of small discards, this will increase checkpoint latency insanely. Let's issue small discards only by trim. Signed-off-by: Jaegeuk Kim commit c9667b19e2cf13735fe2620f9d97b788897cd4af Author: Daeho Jeong Date: Mon Jun 12 16:32:03 2023 -0700 f2fs: check zone write pointer points to the end of zone We don't need to report an issue, when the zone write pointer already points to the end of the zone, since the zone mismatch is already taken care. Signed-off-by: Daeho Jeong Signed-off-by: Jaegeuk Kim commit ac1ee161dec5801d9bbd874ef69cd0ff1e8053b6 Author: Sheng Yong Date: Mon Jun 12 11:01:19 2023 +0800 f2fs: add f2fs_ioc_get_compress_blocks This patch adds f2fs_ioc_get_compress_blocks() to provide a common f2fs_get_compress_blocks(). Signed-off-by: Sheng Yong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit dde38c03b351749f682db087df5202b55c7c1b40 Author: Sheng Yong Date: Mon Jun 12 11:01:17 2023 +0800 f2fs: cleanup MIN_INLINE_XATTR_SIZE Signed-off-by: Sheng Yong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit c571fbb5b59a3741e48014faa92c2f14bc59fe50 Author: Sheng Yong Date: Mon Jun 12 11:01:16 2023 +0800 f2fs: add helper to check compression level This patch adds a helper function to check if compression level is valid. Signed-off-by: Sheng Yong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 94c8431fb46bfbe51bd3eb68687334797af0a221 Author: Christoph Hellwig Date: Mon Jun 12 07:37:11 2023 +0200 f2fs: set FMODE_CAN_ODIRECT instead of a dummy direct_IO method Since commit a2ad63daa88b ("VFS: add FMODE_CAN_ODIRECT file flag") file systems can just set the FMODE_CAN_ODIRECT flag at open time instead of wiring up a dummy direct_IO method to indicate support for direct I/O. Do that for f2fs so that noop_direct_IO can eventually be removed. Signed-off-by: Christoph Hellwig Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit f240d3aaf5a1552ecb75445b47b1ca957d5151d2 Author: Chao Yu Date: Wed May 31 09:40:55 2023 +0800 f2fs: do more sanity check on inode There are several issues in sanity_check_inode(): - The code looks not clean, it checks extra_attr related condition dispersively. - It missed to check i_extra_isize w/ lower boundary - It missed to check feature dependency: prjquota, inode_chksum, inode_crtime, compression features rely on extra_attr feature. - It's not necessary to check i_extra_isize due to it will only be assigned to non-zero value if f2fs_has_extra_attr() is true in do_read_inode(). Fix them all in this patch. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 64ee9163fe1b911aa0476af06ee0afd23fdf7388 Author: Chao Yu Date: Wed May 17 11:41:39 2023 +0800 f2fs: compress: fix to check validity of i_compress_flag field The last valid compress related field is i_compress_flag, check its validity instead of i_log_cluster_size. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 698a5c8c8e05590d92629ad5796a421e14218e20 Author: Yangtao Li Date: Sat Apr 8 02:31:47 2023 +0800 f2fs: add sanity compress level check for compressed file Commit 3fde13f817e2 ("f2fs: compress: support compress level") forgot to do basic compress level check, let's add it. Signed-off-by: Yangtao Li Signed-off-by: Jaegeuk Kim commit 00e120b5e4b5638cf19eee96d4332f2d100746ba Author: Jaegeuk Kim Date: Mon Jun 12 12:58:34 2023 -0700 f2fs: assign default compression level Let's avoid any confusion from assigning compress_level=0 for LZ4HC and ZSTD. Signed-off-by: Jaegeuk Kim commit ccf3ff2b30edd52fb54e239da25758fb22acfb78 Author: Chao Yu Date: Tue Jun 6 14:18:22 2023 +0800 f2fs: introduce F2FS_QUOTA_DEFAULT_FL for cleanup This patch adds F2FS_QUOTA_DEFAULT_FL to include two default flags: F2FS_NOATIME_FL and F2FS_IMMUTABLE_FL, and use it to clean up codes. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 8bec7dd1b3f7d7769d433d67bde404de948a2d95 Author: Chao Yu Date: Tue Jun 6 14:19:01 2023 +0800 f2fs: check return value of freeze_super() freeze_super() can fail, it needs to check its return value and do error handling in f2fs_resize_fs(). Fixes: 04f0b2eaa3b3 ("f2fs: ioctl for removing a range from F2FS") Fixes: b4b10061ef98 ("f2fs: refactor resize_fs to avoid meta updates in progress") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 25ed2d409f5ff73f1bde8e9b2863f686364cbc7f Author: Kashyap Desai Date: Fri Jun 16 11:47:00 2023 +0530 RDMA/bnxt_re: Refactor code around bnxt_qplib_map_rc() Update function comment of bnxt_qplib_map_rc() Remove intermediate return value ENXIO and directly called bnxt_qplib_map_rc() from __send_message_basic_sanity(). Link: https://lore.kernel.org/r/20230616061700.741769-2-kashyap.desai@broadcom.com Reported-by: Dan Carpenter Signed-off-by: Kashyap Desai Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit c8dce4e7438be24be7a5b8477555ba03c0fb16ae Author: Kashyap Desai Date: Fri Jun 16 11:46:59 2023 +0530 RDMA/bnxt_re: Remove incorrect return check from slow path The commit 691eb7c6110f ("RDMA/bnxt_re: handle command completions after driver detect a timedout") introduced code resulting in below warning issued by the smatch static checker. drivers/infiniband/hw/bnxt_re/qplib_rcfw.c:513 __bnxt_qplib_rcfw_send_message() warn: duplicate check 'rc' (previous on line 506) Fix the warning by removing incorrect code block. Fixes: 691eb7c6110f ("RDMA/bnxt_re: handle command completions after driver detect a timedout") Link: https://lore.kernel.org/r/20230616061700.741769-1-kashyap.desai@broadcom.com Reported-by: Dan Carpenter Signed-off-by: Kashyap Desai Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 009637de1f65cff452ad49554d1e8ef9fda99e43 Author: Yuechao Zhao Date: Mon Jun 12 11:19:07 2023 +0800 watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub) Add PCI_VENDOR_ID_HYGON(Hygon vendor id [0x1d94]) in this driver Signed-off-by: Yuechao Zhao Reviewed-by: Guenter Roeck Link: https://lkml.kernel.org/r/20230612031907.796461-1-a345351830@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit f4dc5290c0289d6958e185deeba47ea91c2c9cfb Author: Krzysztof Kozlowski Date: Tue May 30 16:48:51 2023 +0200 dt-bindings: watchdog: restrict node name suffixes Make the pattern matching node names a bit stricter to improve DTS consistency. The pattern is restricted to -N suffixes to decimal numbers. Suggested-by: Rob Herring Signed-off-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Reviewed-by: Tony Lindgren Acked-by: Rob Herring Link: https://lkml.kernel.org/r/20230530144851.92059-8-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit e62c63ffd06c376fcfd885c610d5228425627d7a Author: Srinivas Neeli Date: Thu Apr 20 16:12:31 2023 +0530 MAINTAINERS: Add support for Xilinx versal watchdog Added entry for Xilinx versal watchdog driver. Signed-off-by: Srinivas Neeli Reviewed-by: Guenter Roeck Link: https://lkml.kernel.org/r/20230420104231.2243079-5-srinivas.neeli@amd.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 12984cea1b8c54104f8ac7f5609dfcc0752ad741 Author: Srinivas Neeli Date: Thu Apr 20 16:12:30 2023 +0530 watchdog: xilinx_wwdt: Add Versal window watchdog support Versal watchdog driver uses window watchdog mode. Window watchdog timer(WWDT) contains closed(first) and open(second) window with 32 bit width. Write to the watchdog timer within predefined window periods of time. This means a period that is not too soon and a period that is not too late. The WWDT has to be restarted within the open window time. If software tries to restart WWDT outside of the open window time period, it generates a reset. Signed-off-by: Srinivas Neeli Reviewed-by: Guenter Roeck Link: https://lkml.kernel.org/r/20230420104231.2243079-4-srinivas.neeli@amd.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit be0d0ab1c704c8f93ee6c6d4b13a1e54ae927e3a Author: Srinivas Neeli Date: Thu Apr 20 16:12:29 2023 +0530 dt-bindings: watchdog: xlnx,versal-wwdt: Add versal watchdog Versal watchdog IP uses window watchdog mode. Window watchdog timer(WWDT) contains closed(first) and open(second) window with 32 bit width. Write to the watchdog timer within predefined window periods of time. This means a period that is not too soon and a period that is not too late. Add devicetree bindings for versal window watchdog device. Signed-off-by: Srinivas Neeli Reviewed-by: Krzysztof Kozlowski Reviewed-by: Guenter Roeck Link: https://lkml.kernel.org/r/20230420104231.2243079-3-srinivas.neeli@amd.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 6cf2cc304fd9c37ea1a09b5c10279074e940f5f1 Author: Uwe Kleine-König Date: Thu May 25 23:08:37 2023 +0200 watchdog: ziirave_wdt: Switch i2c driver back to use .probe() After commit b8a1a4cd5a98 ("i2c: Provide a temporary .probe_new() call-back type"), all drivers being converted to .probe_new() and then 03c835f498b5 ("i2c: Switch .probe() to not take an id parameter") convert back to (the new) .probe() to be able to eventually drop .probe_new() from struct i2c_driver. Signed-off-by: Uwe Kleine-König Reviewed-by: Guenter Roeck Link: https://lkml.kernel.org/r/20230525210837.735447-1-u.kleine-koenig@pengutronix.de Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 8d2e149ed61f5c0a49c36a81a09ff5808f4f17ad Author: Bagas Sanjaya Date: Wed May 17 14:21:40 2023 +0700 watchdog: ibmasr: Replace GPL license notice with SPDX identifier Replace unversioned GPL license notice with appropriate SPDX license identifier, which is GPL 1.0+. Cc: Andrey Panin Signed-off-by: Bagas Sanjaya Reviewed-by: Guenter Roeck Link: https://lkml.kernel.org/r/20230517072140.1086660-3-bagasdotme@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit a0d261ccd7eeb93accb4784e153315814a7656aa Author: Bagas Sanjaya Date: Wed May 17 14:21:39 2023 +0700 watchdog: Convert GPL 2.0 notice to SPDX identifier Convert the boilerplate to SPDX license identifier. While at it, also move SPDX identifier for drivers/watchdog/rtd119x_wdt.c to the top of file (as in other files). Cc: Ray Lehtiniemi , Cc: Alessandro Zummo Cc: H Hartley Sweeten Cc: Deepak Saxena Cc: Marc Zyngier Cc: Jonas Jensen Cc: Sylver Bruneau Cc: Denis Turischev Cc: Mika Westerberg Acked-by: Andreas Färber Signed-off-by: Bagas Sanjaya Acked-by: Mika Westerberg Acked-by: Ray Lehtiniemi Reviewed-by: Guenter Roeck Link: https://lkml.kernel.org/r/20230517072140.1086660-2-bagasdotme@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 20fbe6291e54739beb905e0b7fc45ba534cf644d Author: Keguang Zhang Date: Thu May 11 20:11:59 2023 +0800 watchdog: loongson1_wdt: Add DT support This patch adds the of_match_table to enable DT support of Loongson-1 watchdog driver. And modify the parameter of devm_clk_get_enabled() accordingly. Signed-off-by: Keguang Zhang Reviewed-by: Guenter Roeck Link: https://lkml.kernel.org/r/20230511121159.463645-3-keguang.zhang@gmail.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 85aeab362201cf52c34cd429e4f6c75a0b42f9a3 Author: Vijendar Mukunda Date: Mon Jun 26 16:23:54 2023 +0530 ASoC: amd: acp: fix for invalid dai id handling in acp_get_byte_count() For invalid dai id, instead of returning -EINVAL return bytes count as zero in acp_get_byte_count() function. Fixes: 623621a9f9e1 ("ASoC: amd: Add common framework to support I2S on ACP SOC") Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230626105356.2580125-6-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 68a653ab864ccf7874fe622f3af20fe7345c39be Author: Vijendar Mukunda Date: Mon Jun 26 16:23:53 2023 +0530 ASoC: amd: ps: fix byte count return value for invalid SoundWire manager instance acp_get_byte_count() function should return zero bytes instead of -EINVAL for invalid SoundWire manager instance. Fixes: f722917350ee ("ASoC: amd: ps: add SoundWire dma driver dma ops") Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230626105356.2580125-5-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 46b50e514b191ae15789cccabace5b6040c9278e Author: Vijendar Mukunda Date: Mon Jun 26 16:23:52 2023 +0530 ASoC: amd: ps: add comments for DMA register mapping Add comments for DMA register mapping for both the SoundWire manager instances. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230626105356.2580125-4-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit f15f6b294dde506bd4902db3262e9b4ab7e9e5a9 Author: Vijendar Mukunda Date: Mon Jun 26 16:23:51 2023 +0530 ASoC: amd: ps: fix for position register set for AUDIO0 RX stream For AUDIO0 RX stream, AUDIO0_RX position registers should be used. DMA error is reported due to referring wrong position register set for AUDIO0 RX stream. Correct the position register set for AUDIO0 RX stream. Fixes: f722917350ee ("ASoC: amd: ps: add SoundWire dma driver dma ops") Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230626105356.2580125-3-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 322a163ea6a38f63555d824c5b66c7df5a595c2d Author: Vijendar Mukunda Date: Mon Jun 26 16:23:50 2023 +0530 ASoC: amd: ps: add fix for dma irq mask for rx streams for SDW0 instance Correct the DMA irq mask macro to program DMA irq bits correctly for SDW0 instance rx streams. Fixes: 298d4f7b1765 ("ASoC: amd: ps: add support for SoundWire DMA interrupts") Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230626105356.2580125-2-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 7beda6a256ed10e74dc00fcd0fc8da0ad8fea78d Author: Vijendar Mukunda Date: Mon Jun 26 16:23:49 2023 +0530 ASoC: amd: ps: add comments for DMA irq bits mapping Add comments for DMA stream id and IRQ bit mapping in ACP_EXTERNAL_CNTL & ACP_EXTERNAL_CNTL1 registers for SDW0 and SDW1 manager instances. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230626105356.2580125-1-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 7b5162080174ae50e8288574379d339b0fcd1760 Author: Matthias Reichl Date: Sat Jun 24 18:52:32 2023 +0200 ASoC: hdmi-codec: fix channel info for compressed formats According to CTA 861 the channel/speaker allocation info in the audio infoframe only applies to uncompressed (PCM) audio streams. The channel count info should indicate the number of channels in the transmitted audio, which usually won't match the number of channels used to transmit the compressed bitstream. Some devices (eg some Sony TVs) will refuse to decode compressed audio if these values are not set correctly. To fix this we can simply set the channel count to 0 (which means "refer to stream header") and set the channel/speaker allocation to 0 as well (which would mean stereo FL/FR for PCM, a safe value all sinks will support) when transmitting compressed audio. Signed-off-by: Matthias Reichl Link: https://lore.kernel.org/r/20230624165232.5751-1-hias@horus.com Signed-off-by: Mark Brown commit dbe245cdf5189e88d680379ed13901356628b650 Author: Jason Gunthorpe Date: Tue Jun 20 11:11:24 2023 -0300 iommufd: Call iopt_area_contig_done() under the lock The iter internally holds a pointer to the area and iopt_area_contig_done() will dereference it. The pointer is not valid outside the iova_rwsem. syzkaller reports: BUG: KASAN: slab-use-after-free in iommufd_access_unpin_pages+0x363/0x370 Read of size 8 at addr ffff888022286e20 by task syz-executor669/5771 CPU: 0 PID: 5771 Comm: syz-executor669 Not tainted 6.4.0-rc5-syzkaller-00313-g4c605260bc60 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 Call Trace: dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11c/0x130 iommufd_access_unpin_pages+0x363/0x370 iommufd_test_access_unmap+0x24b/0x390 iommufd_access_notify_unmap+0x24c/0x3a0 iopt_unmap_iova_range+0x4c4/0x5f0 iopt_unmap_all+0x27/0x50 iommufd_ioas_unmap+0x3d0/0x490 iommufd_fops_ioctl+0x317/0x4b0 __x64_sys_ioctl+0x197/0x210 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fec1dae3b19 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fec1da74308 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fec1db6b438 RCX: 00007fec1dae3b19 RDX: 0000000020000100 RSI: 0000000000003b86 RDI: 0000000000000003 RBP: 00007fec1db6b430 R08: 00007fec1da74700 R09: 0000000000000000 R10: 00007fec1da74700 R11: 0000000000000246 R12: 00007fec1db6b43c R13: 00007fec1db39074 R14: 6d6f692f7665642f R15: 0000000000022000 Allocated by task 5770: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_kmalloc+0xa2/0xb0 iopt_alloc_area_pages+0x94/0x560 iopt_map_user_pages+0x205/0x4e0 iommufd_ioas_map+0x329/0x5f0 iommufd_fops_ioctl+0x317/0x4b0 __x64_sys_ioctl+0x197/0x210 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 5770: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x40 ____kasan_slab_free+0x160/0x1c0 slab_free_freelist_hook+0x8b/0x1c0 __kmem_cache_free+0xaf/0x2d0 iopt_unmap_iova_range+0x288/0x5f0 iopt_unmap_all+0x27/0x50 iommufd_ioas_unmap+0x3d0/0x490 iommufd_fops_ioctl+0x317/0x4b0 __x64_sys_ioctl+0x197/0x210 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The parallel unmap free'd iter->area the instant the lock was released. Fixes: 51fe6141f0f6 ("iommufd: Data structure to provide IOVA to PFN mapping") Link: https://lore.kernel.org/r/2-v2-9a03761d445d+54-iommufd_syz2_jgg@nvidia.com Reviewed-by: Kevin Tian Reported-by: syzbot+6c8d756f238a75fc3eb8@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/000000000000905eba05fe38e9f2@google.com Signed-off-by: Jason Gunthorpe commit 804ca14d04df09bf7924bacc5ad22a4bed80c94f Author: Jason Gunthorpe Date: Tue Jun 20 11:11:23 2023 -0300 iommufd: Do not access the area pointer after unlocking A concurrent unmap can trigger freeing of the area pointers while we are generating an unmapping notification for accesses. syzkaller reports: BUG: KASAN: slab-use-after-free in iopt_unmap_iova_range+0x5ba/0x5f0 Read of size 4 at addr ffff888075996184 by task syz-executor.2/31160 CPU: 1 PID: 31160 Comm: syz-executor.2 Not tainted 6.4.0-rc5-syzkaller-00313-g4c605260bc60 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 Call Trace: dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11c/0x130 iopt_unmap_iova_range+0x5ba/0x5f0 iopt_unmap_all+0x27/0x50 iommufd_ioas_unmap+0x3d0/0x490 iommufd_fops_ioctl+0x317/0x4b0 __x64_sys_ioctl+0x197/0x210 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f0812c8c169 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f0813914168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f0812dabf80 RCX: 00007f0812c8c169 RDX: 0000000020000100 RSI: 0000000000003b86 RDI: 0000000000000005 RBP: 00007f0812ce7ca1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f0812ecfb1f R14: 00007f0813914300 R15: 0000000000022000 Allocated by task 31160: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_kmalloc+0xa2/0xb0 iopt_alloc_area_pages+0x94/0x560 iopt_map_user_pages+0x205/0x4e0 iommufd_ioas_map+0x329/0x5f0 iommufd_fops_ioctl+0x317/0x4b0 __x64_sys_ioctl+0x197/0x210 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 31161: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x40 ____kasan_slab_free+0x160/0x1c0 slab_free_freelist_hook+0x8b/0x1c0 __kmem_cache_free+0xaf/0x2d0 iopt_unmap_iova_range+0x288/0x5f0 iopt_unmap_all+0x27/0x50 iommufd_ioas_unmap+0x3d0/0x490 iommufd_fops_ioctl+0x317/0x4b0 __x64_sys_ioctl+0x197/0x210 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff888075996100 which belongs to the cache kmalloc-cg-192 of size 192 The buggy address is located 132 bytes inside of freed 192-byte region [ffff888075996100, ffff8880759961c0) The buggy address belongs to the physical page: page:ffffea0001d66580 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x75996 memcg:ffff88801f1c2701 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000200 ffff88801244ddc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000001ffffffff ffff88801f1c2701 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 31157, tgid 31154 (syz-executor.0), ts 1984547323469, free_ts 1983933451331 post_alloc_hook+0x2db/0x350 get_page_from_freelist+0xf41/0x2c00 __alloc_pages+0x1cb/0x4a0 alloc_pages+0x1aa/0x270 allocate_slab+0x25f/0x390 ___slab_alloc+0xa91/0x1400 __slab_alloc.constprop.0+0x56/0xa0 __kmem_cache_alloc_node+0x136/0x320 kmalloc_trace+0x26/0xe0 iommufd_test+0x1328/0x2c20 iommufd_fops_ioctl+0x317/0x4b0 __x64_sys_ioctl+0x197/0x210 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd page last free stack trace: free_unref_page_prepare+0x62e/0xcb0 free_unref_page_list+0xe3/0xa70 release_pages+0xcd8/0x1380 tlb_batch_pages_flush+0xa8/0x1a0 tlb_finish_mmu+0x14b/0x7e0 exit_mmap+0x2b2/0x930 __mmput+0x128/0x4c0 mmput+0x60/0x70 do_exit+0x9b0/0x29b0 do_group_exit+0xd4/0x2a0 get_signal+0x2318/0x25b0 arch_do_signal_or_restart+0x79/0x5c0 exit_to_user_mode_prepare+0x11f/0x240 syscall_exit_to_user_mode+0x1d/0x50 do_syscall_64+0x46/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Precompute what is needed to call the access function and do not check the area's num_accesses again as the pointer may not be valid anymore. Use a counter instead. Fixes: 51fe6141f0f6 ("iommufd: Data structure to provide IOVA to PFN mapping") Link: https://lore.kernel.org/r/1-v2-9a03761d445d+54-iommufd_syz2_jgg@nvidia.com Reviewed-by: Kevin Tian Reported-by: syzbot+1ad12d16afca0e7d2dde@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/0000000000001d40fc05fe385332@google.com Signed-off-by: Jason Gunthorpe commit f18e7122cc73d9218930156fa38f050a2e37de57 Author: Randy Dunlap Date: Thu Jun 22 23:11:01 2023 -0700 linux/netfilter.h: fix kernel-doc warnings kernel-doc does not support DECLARE_PER_CPU(), so don't mark it with kernel-doc notation. One comment block is not kernel-doc notation, so just use "/*" to begin the comment. Quietens these warnings: netfilter.h:493: warning: Function parameter or member 'bool' not described in 'DECLARE_PER_CPU' netfilter.h:493: warning: Function parameter or member 'nf_skb_duplicated' not described in 'DECLARE_PER_CPU' netfilter.h:493: warning: expecting prototype for nf_skb_duplicated(). Prototype was for DECLARE_PER_CPU() instead netfilter.h:496: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Contains bitmask of ctnetlink event subscribers, if any. Fixes: e7c8899f3e6f ("netfilter: move tee_active to core") Fixes: fdf6491193e4 ("netfilter: ctnetlink: make event listener tracking global") Signed-off-by: Randy Dunlap Reviewed-by: Simon Horman Signed-off-by: Pablo Neira Ayuso commit ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30 Author: Florian Westphal Date: Wed Jun 21 17:56:53 2023 +0200 netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one Eric Dumazet says: nf_conntrack_dccp_packet() has an unique: dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); And nothing more is 'pulled' from the packet, depending on the content. dh->dccph_doff, and/or dh->dccph_x ...) So dccp_ack_seq() is happily reading stuff past the _dh buffer. BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0 Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 [..] Fix this by increasing the stack buffer to also include room for the extra sequence numbers and all the known dccp packet type headers, then pull again after the initial validation of the basic header. While at it, mark packets invalid that lack 48bit sequence bit but where RFC says the type MUST use them. Compile tested only. v2: first skb_header_pointer() now needs to adjust the size to only pull the generic header. (Eric) Heads-up: I intend to remove dccp conntrack support later this year. Fixes: 2bc780499aa3 ("[NETFILTER]: nf_conntrack: add DCCP protocol support") Reported-by: Eric Dumazet Signed-off-by: Florian Westphal Reviewed-by: Eric Dumazet Signed-off-by: Pablo Neira Ayuso commit 6f67fbf8192da80c4db01a1800c7fceaca9cf1f9 Author: Jeremy Sowden Date: Mon Jun 19 20:06:57 2023 +0100 lib/ts_bm: reset initial match offset for every block of text The `shift` variable which indicates the offset in the string at which to start matching the pattern is initialized to `bm->patlen - 1`, but it is not reset when a new block is retrieved. This means the implemen- tation may start looking at later and later positions in each successive block and miss occurrences of the pattern at the beginning. E.g., consider a HTTP packet held in a non-linear skb, where the HTTP request line occurs in the second block: [... 52 bytes of packet headers ...] GET /bmtest HTTP/1.1\r\nHost: www.example.com\r\n\r\n and the pattern is "GET /bmtest". Once the first block comprising the packet headers has been examined, `shift` will be pointing to somewhere near the end of the block, and so when the second block is examined the request line at the beginning will be missed. Reinitialize the variable for each new block. Fixes: 8082e4ed0a61 ("[LIB]: Boyer-Moore extension for textsearch infrastructure strike #2") Link: https://bugzilla.netfilter.org/show_bug.cgi?id=1390 Signed-off-by: Jeremy Sowden Signed-off-by: Pablo Neira Ayuso commit 57c9eaa4de537e6f08819d9214de502cac5a989c Author: Luca Weiss Date: Sun Jun 25 13:11:33 2023 +0200 thermal/drivers/qcom/temp-alarm: Use dev_err_probe Use the dev_err_probe function instead of dev_err in the probe function so that the printed message includes the return value and also handles -EPROBE_DEFER nicely. Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230625-spmi-temp-alarm-defer-v1-1-2d57acf36855@z3ntu.xyz commit 85b21fdec906ecd46856618910f8762afecbf1e9 Author: Chen-Yu Tsai Date: Tue Jun 20 17:07:32 2023 +0800 thermal/drivers/generic-adc: Register thermal zones as hwmon sensors Register thermal zones as hwmon sensors to let userspace read temperatures using standard hwmon interface. Signed-off-by: Chen-Yu Tsai [Yangtao: only keep devm_thermal_add_hwmon_sysfs] Signed-off-by: Yangtao Li Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230620090732.50025-11-frank.li@vivo.com commit 27cc5be110fe76666bb1902d473b302dd09b6cbb Author: Yangtao Li Date: Tue Jun 20 17:07:31 2023 +0800 thermal/drivers/mediatek/lvts_thermal: Remove redundant msg in lvts_ctrl_start() The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230620090732.50025-10-frank.li@vivo.com commit 7adbbb3b7b2a5bc413425fe001f8e237163c435f Author: Yangtao Li Date: Tue Jun 20 17:07:30 2023 +0800 thermal/drivers/qcom: Remove redundant msg at probe time The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li Reviewed-by: Dmitry Baryshkov Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230620090732.50025-9-frank.li@vivo.com commit a4ebd423749f4d5660533e451adf20585a236b1a Author: Yangtao Li Date: Tue Jun 20 17:07:29 2023 +0800 thermal/drivers/ti-soc: Remove redundant msg in ti_thermal_expose_sensor() The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li Acked-by: Keerthy Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230620090732.50025-8-frank.li@vivo.com commit f13582a42de70e5acf72c6ccd2b1472fb764d1d9 Author: Yangtao Li Date: Tue Jun 20 17:07:28 2023 +0800 thermal/drivers/qoriq: Remove redundant msg in qoriq_tmu_register_tmu_zone() The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230620090732.50025-7-frank.li@vivo.com commit 2279e8f9275cb6e440c432716a1a29899c8d27c8 Author: Yangtao Li Date: Tue Jun 20 17:07:27 2023 +0800 thermal/drivers/tegra: Remove redundant msg in tegra_tsensor_register_channel() The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230620090732.50025-6-frank.li@vivo.com commit 7c673ef5199dddb83d2b778cf6e71c1d183506e7 Author: Yangtao Li Date: Tue Jun 20 17:07:26 2023 +0800 drivers/thermal/k3: Remove redundant msg in k3_bandgap_probe() The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230620090732.50025-5-frank.li@vivo.com commit b0526e02c60467b7f2b3b7660deba595d6d3d3d8 Author: Yangtao Li Date: Tue Jun 20 17:07:25 2023 +0800 thermal/drivers/imx: Remove redundant msg in imx8mm_tmu_probe() and imx_sc_thermal_probe() The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230620090732.50025-4-frank.li@vivo.com commit c32719ace7909ae18547fa5a12e9dac2c92911d1 Author: Yangtao Li Date: Tue Jun 20 17:07:24 2023 +0800 thermal/drivers/amlogic: Remove redundant msg in amlogic_thermal_probe() The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li Reviewed-by: Martin Blumenstingl Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230620090732.50025-3-frank.li@vivo.com commit 07130d1da81138bd15b6b25cb8527a8191c73033 Author: Yangtao Li Date: Tue Jun 20 17:07:23 2023 +0800 thermal/drivers/sun8i: Remove redundant msg in sun8i_ths_register() The upper-layer devm_thermal_add_hwmon_sysfs() function can directly print error information. Signed-off-by: Yangtao Li Acked-by: Jernej Skrabec Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230620090732.50025-2-frank.li@vivo.com commit 8416ecfb3292321c55719c7c1a69dec7769bfbc1 Author: Yangtao Li Date: Tue Jun 20 17:07:22 2023 +0800 thermal/hwmon: Add error information printing for devm_thermal_add_hwmon_sysfs() Ensure that all error handling branches print error information. In this way, when this function fails, the upper-layer functions can directly return an error code without missing debugging information. Otherwise, the error message will be printed redundantly or missing. Signed-off-by: Yangtao Li Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230620090732.50025-1-frank.li@vivo.com commit 2ef9533134fe8e0011e6d3532aa8ef071c34c5e4 Author: Uwe Kleine-König Date: Fri Jun 16 18:56:41 2023 +0200 thermal/drivers/stm32: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. st_thermal_unregister() always returned zero, so convert it to return void without any loss and then just drop the return from st_mmap_remove(). Signed-off-by: Uwe Kleine-König Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230616165641.1055854-1-u.kleine-koenig@pengutronix.de commit a5639fade0cfe5a45584f2770811034dab43baaa Author: Daniel Lezcano Date: Thu May 25 16:01:28 2023 +0200 net/mlx5: Update the driver with the recent thermal changes The thermal framework is migrating to the generic trip points. The set of changes also implies a self-encapsulation of the thermal zone device structure where the internals are no longer directly accessible but with accessors. Use the new API instead, so the next changes can be pushed in the thermal framework without this driver failing to compile. No functional changes intended. Cc: Sandipan Patra Cc: Gal Pressman Cc: Saeed Mahameed Cc: Jakub Kicinski Signed-off-by: Daniel Lezcano Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230525140135.3589917-2-daniel.lezcano@linaro.org commit 62a094e757a75b5d0a63dfe17a7c17ab2da330fd Author: Alex Leibovich Date: Fri Jun 16 12:50:42 2023 +0100 thermal/drivers/armada: Add support for AP807 thermal data Add support for the AP807 die thermal data. This is the same as AP806, except for the coefficients. ap807 values taken from TSENSE_ADC_16FFC spec, which says: T(in Celsius) = T(code)*TSENE_GAIN+TSENE_OFFSET where in default: TSENE_OFFSET = 128.9 TSENE_GAIN = 0.394 Signed-off-by: Alex Leibovich Tested-by: sa_ip-sw-jenkins Reviewed-by: Stefan Chulski Signed-off-by: Russell King (Oracle) Reviewed-by: Miquel Raynal Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/E1qA7yU-00Ea4u-Je@rmk-PC.armlinux.org.uk commit 705fd8f189124eae20f746a374d1cb63856d06b7 Author: Alex Leibovich Date: Fri Jun 16 12:50:37 2023 +0100 dt-bindings: armada-thermal: Add armada-ap807-thermal compatible Add marvell,armada-ap807-thermal compatible for the AP807 die. Signed-off-by: Alex Leibovich Reviewed-by: Stefan Chulski Signed-off-by: Russell King (Oracle) Acked-by: Krzysztof Kozlowski Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/E1qA7yP-00Ea4o-FS@rmk-PC.armlinux.org.uk commit f12d60c81fceccddc012c746085f6cd87832d6ff Author: Peng Fan Date: Tue May 16 16:37:46 2023 +0800 thermal/drivers/qoriq: Support version 2.1 i.MX93 use TMU version 2.1, which supports: - TRITSR_TP5(When this field is 1, you must add 0.5 K to the temperature that TEMP reports. For example, if TEMP is 300 K and TP5=1, then the final temperature is 300.5 K.) - Has 16 TTRCR register: Temperature Range Control (TTRCR0 - TTRCR15) This patch is to add this support. Signed-off-by: Peng Fan Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230516083746.63436-4-peng.fan@oss.nxp.com commit 9301575df2509ecf8bd66f601046afaff606b1d5 Author: Peng Fan Date: Tue May 16 16:37:45 2023 +0800 thermal/drivers/qoriq: Only enable supported sensors There are MAX 16 sensors, but not all of them supported. Such as i.MX8MQ, there are only 3 sensors. Enabling all 16 sensors will touch reserved bits from i.MX8MQ reference mannual, and TMU will stuck, temperature will not update anymore. Fixes: 45038e03d633 ("thermal: qoriq: Enable all sensors before registering them") Signed-off-by: Peng Fan Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230516083746.63436-3-peng.fan@oss.nxp.com commit 5474e98b3e28918f77c10787f6ce9e1937e4fb78 Author: Pankit Garg Date: Tue May 16 16:37:44 2023 +0800 thermal/drivers/qoriq: No need to program site adjustment register No need to program site adjustment register, as programming these registers do not give accurate value and also these registers are not mentioned in Reference Manual. Signed-off-by: Pankit Garg Signed-off-by: Peng Fan Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230516083746.63436-2-peng.fan@oss.nxp.com commit 51c8e119335a2a0c7fa6156ecd18a729e2aa3693 Author: Chen-Yu Tsai Date: Tue Jun 13 17:13:16 2023 +0800 thermal/drivers/mediatek/lvts_thermal: Register thermal zones as hwmon sensors Register thermal zones as hwmon sensors to let userspace read temperatures using standard hwmon interface. Signed-off-by: Chen-Yu Tsai Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230613091317.1691247-1-wenst@chromium.org commit 89382022b370dfd34eaae9c863baa123fcd4d132 Author: Christophe JAILLET Date: Sun May 14 20:46:05 2023 +0200 thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe() Should an error occur after calling sun8i_ths_resource_init() in the probe function, some resources need to be released, as already done in the .remove() function. Switch to the devm_clk_get_enabled() helper and add a new devm_action to turn sun8i_ths_resource_init() into a fully managed function. Move the place where reset_control_deassert() is called so that the recommended order of reset release/clock enable steps is kept. A64 manual states that: 3.3.6.4. Gating and reset Make sure that the reset signal has been released before the release of module clock gating; This fixes the issue and removes some LoC at the same time. Fixes: dccc5c3b6f30 ("thermal/drivers/sun8i: Add thermal driver for H6/H5/H3/A64/A83T/R40") Signed-off-by: Christophe JAILLET Acked-by: Maxime Ripard Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/a8ae84bd2dc4b55fe428f8e20f31438bf8bb6762.1684089931.git.christophe.jaillet@wanadoo.fr commit 86edac7d3888c715fe3a81bd61f3617ecfe2e1dd Author: Ricardo Cañuelo Date: Thu May 25 14:18:11 2023 +0200 Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe" This reverts commit f05c7b7d9ea9477fcc388476c6f4ade8c66d2d26. That change was causing a regression in the generic-adc-thermal-probed bootrr test as reported in the kernelci-results list [1]. A proper rework will take longer, so revert it for now. [1] https://groups.io/g/kernelci-results/message/42660 Fixes: f05c7b7d9ea9 ("thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe") Signed-off-by: Ricardo Cañuelo Suggested-by: AngeloGioacchino Del Regno Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230525121811.3360268-1-ricardo.canuelo@collabora.com commit 4af164c1c11895adcf0181a6c627fbcacf439107 Author: Stephan Gerhold Date: Wed Jun 7 12:47:49 2023 +0200 thermal/drivers/qcom/tsens-v0_1: Add MSM8909 data The MSM8909 SoC has 5 thermal sensors in a TSENS v0.1 block. Like MDM9607 it uses a non-standard default slope value of 3000 [1] and needs per-sensor "correction factors" to workaround issues with the factory calibration [2]. [1]: https://git.codelinaro.org/clo/la/kernel/msm-3.18/-/blob/LA.UM.7.7.c26-09100-8x09.0/arch/arm/boot/dts/qcom/msm8909.dtsi#L476 [2]: https://git.codelinaro.org/clo/la/kernel/msm-3.18/-/commit/6df022c6d0c2c1b4a5a6c2124dba4d57910c0911 Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Stephan Gerhold Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230508-msm8909-tsens-v5-6-5eb632235ba7@kernkonzept.com commit ba3bcfebea97311a0f1f9167f584c0df32409d90 Author: Stephan Gerhold Date: Wed Jun 7 12:47:48 2023 +0200 dt-bindings: thermal: qcom-tsens: Add MSM8909 compatible MSM8909 uses the TSENS v0.1 block similar to other SoCs like MDM9607. Document the "qcom,msm8909-tsens" compatible in the existing schema. Acked-by: Krzysztof Kozlowski Signed-off-by: Stephan Gerhold Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230508-msm8909-tsens-v5-5-5eb632235ba7@kernkonzept.com commit a06027820da7d480cc24b82a977953a5c4e01df4 Author: Stephan Gerhold Date: Wed Jun 7 12:47:47 2023 +0200 dt-bindings: thermal: qcom-tsens: Drop redundant compatibles Since the SoC compatibles must be followed by the IP version compatible (e.g. compatible = "qcom,msm8916-tsens", "qcom,tsens-v0_1";) it is redundant to list all the SoC compatibles again in the if statement. It will already match the IP-version compatible. The list has already become inconsistent since for example "qcom,msm8939-tsens" is covered by the if statement but is not listed there explicitly like the other SoCs. Simplify this by dropping the redundant SoC compatibles. ipq8064 and msm8960 are still needed because they do not have an IP-version compatible. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Stephan Gerhold Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230508-msm8909-tsens-v5-4-5eb632235ba7@kernkonzept.com commit b6f739da0070c36655118618a173a59fa14c7adc Author: Stephan Gerhold Date: Wed Jun 7 12:47:46 2023 +0200 thermal/drivers/qcom/tsens-v0_1: Add mdm9607 correction offsets According to the msm-3.18 vendor kernel from Qualcomm, mdm9607 needs "correction factors" to adjust for additional offsets observed after the factory calibration values in the fuses [1, 2]. The fixed offsets should be applied unless there is a special calibration mode value that indicates that no offsets are needed [3]. Note that the new calibration mode values are called differently in this patch compared to the vendor kernel: - TSENS_TWO_POINT_CALIB_N_WA -> ONE_PT_CALIB2_NO_OFFSET - TSENS_TWO_POINT_CALIB_N_OFFSET_WA -> TWO_PT_CALIB_NO_OFFSET This is because close inspection of the calibration function [3] reveals that TSENS_TWO_POINT_CALIB_N_WA is actually a "one point" calibration because the if statements skip all "point2" related code for it. [1]: https://git.codelinaro.org/clo/la/kernel/msm-3.18/-/commit/d9d2db1b82bf3f72f5de0803d55e6849eb5b671e [2]: https://git.codelinaro.org/clo/la/kernel/msm-3.18/-/commit/d75aef53a760e8ff7bac54049d00c8b2ee1b193e [3]: https://git.codelinaro.org/clo/la/kernel/msm-3.18/-/blob/LE.UM.4.3.2.r1-04200-9x07/drivers/thermal/msm-tsens.c#L2987-3136 Fixes: a2149ab815fc ("thermal/drivers/qcom/tsens-v0_1: Add support for MDM9607") Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Stephan Gerhold Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230508-msm8909-tsens-v5-3-5eb632235ba7@kernkonzept.com commit 6812d1dfbca99cd5032683354bf50e0002b2aa02 Author: Stephan Gerhold Date: Wed Jun 7 12:47:45 2023 +0200 thermal/drivers/qcom/tsens-v0_1: Fix mdm9607 slope values According to the msm-3.18 vendor kernel from Qualcomm [1], mdm9607 uses a non-standard slope value of 3000 (instead of 3200) for all sensors. Fill it properly similar to the 8939 code added recently. [1]: https://git.codelinaro.org/clo/la/kernel/msm-3.18/-/blob/LE.UM.4.3.2.r1-04200-9x07/arch/arm/boot/dts/qcom/mdm9607.dtsi#L875 Fixes: a2149ab815fc ("thermal/drivers/qcom/tsens-v0_1: Add support for MDM9607") Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Stephan Gerhold Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230508-msm8909-tsens-v5-2-5eb632235ba7@kernkonzept.com commit c631da1f19263969fcdc04a98b14401466756e8d Author: Stephan Gerhold Date: Wed Jun 7 12:47:44 2023 +0200 thermal/drivers/qcom/tsens: Drop unused legacy structs The old single-cell parsing code was removed for MSM8939, MDM9607 and MSM8976 but for some reason the structs defining the bit positions etc were kept around (unused). Drop them now. Cc: Dmitry Baryshkov Fixes: 51d78b8b1beb ("thermal/drivers/tsens: Drop single-cell code for mdm9607") Fixes: dfadb4599ab0 ("thermal/drivers/tsens: Drop single-cell code for msm8939") Fixes: 3a908971f7cb ("thermal/drivers/tsens: Drop single-cell code for msm8976/msm8956") Reviewed-by: Konrad Dybcio Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230508-msm8909-tsens-v5-1-5eb632235ba7@kernkonzept.com commit 074ccf8d6ce9f344d3099d9a24d762e0e2ef8b99 Author: Praveenkumar I Date: Wed Jun 7 14:23:08 2023 +0530 dt-bindings: thermal: tsens: Add ipq9574 compatible Qualcomm IPQ9574 has tsens v2.3.1 block, which is similar to IPQ8074 tsens. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Praveenkumar I Signed-off-by: Varadarajan Narayanan Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/ec9799504fe5a141e107bb78955d8d427f00553f.1686125196.git.quic_varada@quicinc.com commit e74491dee6216144ef1d25b0ad5d028cadfcf8c1 Author: Stefan Wahren Date: Sun Jun 4 14:12:22 2023 +0200 dt-bindings: thermal: convert bcm2835-thermal bindings to YAML Convert the DT binding document for bcm2835-thermal from .txt to YAML. Signed-off-by: Stefan Wahren Reviewed-by: Rob Herring Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230604121223.9625-10-stefan.wahren@i2se.com commit 04bf1fe478d81868308bc91b4a1bce50d693f203 Author: Thierry Reding Date: Fri Jun 9 14:44:08 2023 +0200 thermal: Allow selecting the bang-bang governor as default For many setups the bang-bang governor is exactly what we want. Many ARM SoC-based devices use fans to cool down the entire SoC and that works well only with the bang-bang governor because it uses the hysteresis in order to let the fan run for a while to cool the SoC down below the trip point before switching it off again. The step-wise governor will behave strangely in these situations. It doesn't use the hysteresis, so it can lead to situations where the fan is turned on for only a very brief period and then is switched back off, only to get switched back on again very quickly because the SoC hasn't cooled down very much. Signed-off-by: Thierry Reding Link: https://lore.kernel.org/r/20230609124408.3788680-1-thierry.reding@gmail.com Signed-off-by: Daniel Lezcano commit 598e1afca47fdbb302ce8d288b06bcc8728efc6c Author: Matti Lehtimäki Date: Sun May 7 23:12:21 2023 +0300 thermal/drivers/qcom/tsens-v0_1: Add support for MSM8226 The MSM8226 TSENS IP has 6 thermal sensors in a TSENS v0.1 block. The thermal sensors use non-standard slope values. Signed-off-by: Matti Lehtimäki Reviewed-by: Dmitry Baryshkov Reviewed-by: Luca Weiss Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230507201225.89694-4-matti.lehtimaki@gmail.com commit 065ab3abf97a3f26fdd2e05bc6b09e41ced36826 Author: Matti Lehtimäki Date: Sun May 7 23:12:20 2023 +0300 dt-bindings: thermal: tsens: Add compatible for MSM8226 Qualcomm MSM8226 has tsens v0.1 block. Signed-off-by: Matti Lehtimäki Reviewed-by: Krzysztof Kozlowski Reviewed-by: Luca Weiss Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230507201225.89694-3-matti.lehtimaki@gmail.com commit edeab75b13c0d4c7373c9624ab35361a5c9b3f0c Author: Wolfram Sang Date: Thu May 11 21:22:19 2023 +0200 drivers/thermal/rcar_gen3_thermal: add reading fuses for Gen4 The registers are differently named and at different offsets, but their functionality is the same as for Gen3. Signed-off-by: Wolfram Sang Reviewed-by: Niklas Söderlund Reviewed-by: Yoshihiro Shimoda Tested-by: Yoshihiro Shimoda Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230511192220.7523-4-wsa+renesas@sang-engineering.com commit a216261d2495c4539ddff3740f3a2c0932981d4d Author: Wolfram Sang Date: Thu May 11 21:22:18 2023 +0200 drivers/thermal/rcar_gen3_thermal: refactor reading fuses into seprarate function Gen4 will be very different, so refactor Gen3 access into separate call first. Signed-off-by: Wolfram Sang Reviewed-by: Niklas Söderlund Reviewed-by: Yoshihiro Shimoda Tested-by: Yoshihiro Shimoda Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230511192220.7523-3-wsa+renesas@sang-engineering.com commit fe3bfa7539b834f38487f8b5a8c350f99721e7b8 Author: Wolfram Sang Date: Thu May 11 21:22:17 2023 +0200 drivers/thermal/rcar_gen3_thermal: introduce 'info' structure More items to describe the TSCs are needed soon, so encapsulate the current 'ths_tj_1' item into a struct. Signed-off-by: Wolfram Sang Reviewed-by: Niklas Söderlund Reviewed-by: Yoshihiro Shimoda Tested-by: Yoshihiro Shimoda Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230511192220.7523-2-wsa+renesas@sang-engineering.com commit 0849027b093b370f4b2b91e36f5fb2ce2051b1b5 Author: Konrad Dybcio Date: Tue May 16 13:53:59 2023 +0200 dt-bindings: thermal: tsens: Add compatible for SM6375 The Qualcomm SM6375 platform has two instances of the tsens v2.8.0 block, add a compatible for these instances. Acked-by: Krzysztof Kozlowski Signed-off-by: Konrad Dybcio Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230516-topic-lost_tsens_bindings-v1-2-99715746ddb1@linaro.org commit 05570560d2d43381861f704e648ab88d3960e46f Author: Konrad Dybcio Date: Tue May 16 13:53:58 2023 +0200 dt-bindings: thermal: tsens: Add QCM2290 Add the TSENS v2.x controller found on QCM2290. Acked-by: Krzysztof Kozlowski Signed-off-by: Konrad Dybcio Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230516-topic-lost_tsens_bindings-v1-1-99715746ddb1@linaro.org commit 6709d4b7bc2e079241fdef15d1160581c5261c10 Author: Lin Ma Date: Sun Jun 25 17:10:07 2023 +0800 net: nfc: Fix use-after-free caused by nfc_llcp_find_local This commit fixes several use-after-free that caused by function nfc_llcp_find_local(). For example, one UAF can happen when below buggy time window occurs. // nfc_genl_llc_get_params | // nfc_unregister_device | dev = nfc_get_device(idx); | device_lock(...) if (!dev) | dev->shutting_down = true; return -ENODEV; | device_unlock(...); | device_lock(...); | // nfc_llcp_unregister_device | nfc_llcp_find_local() nfc_llcp_find_local(...); | | local_cleanup() if (!local) { | rc = -ENODEV; | // nfc_llcp_local_put goto exit; | kref_put(.., local_release) } | | // local_release | list_del(&local->list) // nfc_genl_send_params | kfree() local->dev->idx !!!UAF!!! | | and the crash trace for the one of the discussed UAF like: BUG: KASAN: slab-use-after-free in nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045 Read of size 8 at addr ffff888105b0e410 by task 20114 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:319 [inline] print_report+0xcc/0x620 mm/kasan/report.c:430 kasan_report+0xb2/0xe0 mm/kasan/report.c:536 nfc_genl_send_params net/nfc/netlink.c:999 [inline] nfc_genl_llc_get_params+0x72f/0x780 net/nfc/netlink.c:1045 genl_family_rcv_msg_doit.isra.0+0x1ee/0x2e0 net/netlink/genetlink.c:968 genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline] genl_rcv_msg+0x503/0x7d0 net/netlink/genetlink.c:1065 netlink_rcv_skb+0x161/0x430 net/netlink/af_netlink.c:2548 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x644/0x900 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x934/0xe70 net/netlink/af_netlink.c:1913 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0x1b6/0x200 net/socket.c:747 ____sys_sendmsg+0x6e9/0x890 net/socket.c:2501 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2555 __sys_sendmsg+0xf7/0x1d0 net/socket.c:2584 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f34640a2389 RSP: 002b:00007f3463415168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f34641c1f80 RCX: 00007f34640a2389 RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000006 RBP: 00007f34640ed493 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe38449ecf R14: 00007f3463415300 R15: 0000000000022000 Allocated by task 20116: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0x7f/0x90 mm/kasan/common.c:383 kmalloc include/linux/slab.h:580 [inline] kzalloc include/linux/slab.h:720 [inline] nfc_llcp_register_device+0x49/0xa40 net/nfc/llcp_core.c:1567 nfc_register_device+0x61/0x260 net/nfc/core.c:1124 nci_register_device+0x776/0xb20 net/nfc/nci/core.c:1257 virtual_ncidev_open+0x147/0x230 drivers/nfc/virtual_ncidev.c:148 misc_open+0x379/0x4a0 drivers/char/misc.c:165 chrdev_open+0x26c/0x780 fs/char_dev.c:414 do_dentry_open+0x6c4/0x12a0 fs/open.c:920 do_open fs/namei.c:3560 [inline] path_openat+0x24fe/0x37e0 fs/namei.c:3715 do_filp_open+0x1ba/0x410 fs/namei.c:3742 do_sys_openat2+0x171/0x4c0 fs/open.c:1356 do_sys_open fs/open.c:1372 [inline] __do_sys_openat fs/open.c:1388 [inline] __se_sys_openat fs/open.c:1383 [inline] __x64_sys_openat+0x143/0x200 fs/open.c:1383 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 20115: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free mm/kasan/common.c:200 [inline] __kasan_slab_free+0x10a/0x190 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook mm/slub.c:1807 [inline] slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0x7a/0x190 mm/slub.c:3800 local_release net/nfc/llcp_core.c:174 [inline] kref_put include/linux/kref.h:65 [inline] nfc_llcp_local_put net/nfc/llcp_core.c:182 [inline] nfc_llcp_local_put net/nfc/llcp_core.c:177 [inline] nfc_llcp_unregister_device+0x206/0x290 net/nfc/llcp_core.c:1620 nfc_unregister_device+0x160/0x1d0 net/nfc/core.c:1179 virtual_ncidev_close+0x52/0xa0 drivers/nfc/virtual_ncidev.c:163 __fput+0x252/0xa20 fs/file_table.c:321 task_work_run+0x174/0x270 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x108/0x110 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x21/0x50 kernel/entry/common.c:297 do_syscall_64+0x4c/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc Last potentially related work creation: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 __kasan_record_aux_stack+0x95/0xb0 mm/kasan/generic.c:491 kvfree_call_rcu+0x29/0xa80 kernel/rcu/tree.c:3328 drop_sysctl_table+0x3be/0x4e0 fs/proc/proc_sysctl.c:1735 unregister_sysctl_table.part.0+0x9c/0x190 fs/proc/proc_sysctl.c:1773 unregister_sysctl_table+0x24/0x30 fs/proc/proc_sysctl.c:1753 neigh_sysctl_unregister+0x5f/0x80 net/core/neighbour.c:3895 addrconf_notify+0x140/0x17b0 net/ipv6/addrconf.c:3684 notifier_call_chain+0xbe/0x210 kernel/notifier.c:87 call_netdevice_notifiers_info+0xb5/0x150 net/core/dev.c:1937 call_netdevice_notifiers_extack net/core/dev.c:1975 [inline] call_netdevice_notifiers net/core/dev.c:1989 [inline] dev_change_name+0x3c3/0x870 net/core/dev.c:1211 dev_ifsioc+0x800/0xf70 net/core/dev_ioctl.c:376 dev_ioctl+0x3d9/0xf80 net/core/dev_ioctl.c:542 sock_do_ioctl+0x160/0x260 net/socket.c:1213 sock_ioctl+0x3f9/0x670 net/socket.c:1316 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x19e/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc The buggy address belongs to the object at ffff888105b0e400 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 16 bytes inside of freed 1024-byte region [ffff888105b0e400, ffff888105b0e800) The buggy address belongs to the physical page: head:ffffea000416c200 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000010200(slab|head|node=0|zone=2) raw: 0200000000010200 ffff8881000430c0 ffffea00044c7010 ffffea0004510e10 raw: 0000000000000000 00000000000a000a 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888105b0e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888105b0e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888105b0e400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888105b0e480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888105b0e500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb In summary, this patch solves those use-after-free by 1. Re-implement the nfc_llcp_find_local(). The current version does not grab the reference when getting the local from the linked list. For example, the llcp_sock_bind() gets the reference like below: // llcp_sock_bind() local = nfc_llcp_find_local(dev); // A ..... \ | raceable ..... / llcp_sock->local = nfc_llcp_local_get(local); // B There is an apparent race window that one can drop the reference and free the local object fetched in (A) before (B) gets the reference. 2. Some callers of the nfc_llcp_find_local() do not grab the reference at all. For example, the nfc_genl_llc_{{get/set}_params/sdreq} functions. We add the nfc_llcp_local_put() for them. Moreover, we add the necessary error handling function to put the reference. 3. Add the nfc_llcp_remove_local() helper. The local object is removed from the linked list in local_release() when all reference is gone. This patch removes it when nfc_llcp_unregister_device() is called. Therefore, every caller of nfc_llcp_find_local() will get a reference even when the nfc_llcp_unregister_device() is called. This promises no use-after-free for the local object is ever possible. Fixes: 52feb444a903 ("NFC: Extend netlink interface for LTO, RW, and MIUX parameters support") Fixes: c7aa12252f51 ("NFC: Take a reference on the LLCP local pointer when creating a socket") Signed-off-by: Lin Ma Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 771ca3de25028c477332bf8b8c2db3a4dd769de2 Merge: 9ae440b8fdd67 1186c6b31ee14 Author: David S. Miller Date: Mon Jun 26 10:36:48 2023 +0100 Merge branch 'sfc-next' Edward Cree says: ==================== sfc: fix unaligned access in loopback selftests Arnd reported that the sfc drivers each define a packed loopback_payload structure with an ethernet header followed by an IP header, whereas the kernel definition of iphdr specifies that this is 4-byte aligned, causing a W=1 warning. Fix this in each case by adding two bytes of leading padding to the struct, taking care that these are not sent on the wire. Tested on EF10; build-tested on Siena and Falcon. Changed in v2: * added __aligned(4) to payload struct definitions (Arnd) * fixed dodgy whitespace (checkpatch) ==================== Signed-off-by: David S. Miller commit 1186c6b31ee14fa1e83f5a94be0daa9bc99f9b30 Author: Edward Cree Date: Fri Jun 23 19:38:06 2023 +0100 sfc: falcon: use padding to fix alignment in loopback test Add two bytes of padding to the start of struct ef4_loopback_payload, which are not sent on the wire. This ensures the 'ip' member is 4-byte aligned, preventing the following W=1 warning: net/ethernet/sfc/falcon/selftest.c:43:15: error: field ip within 'struct ef4_loopback_payload' is less aligned than 'struct iphdr' and is usually due to 'struct ef4_loopback_payload' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] struct iphdr ip; Reported-by: Arnd Bergmann Signed-off-by: Edward Cree Signed-off-by: David S. Miller commit 30c24dd87f3f4640ee3dc693230f343023227c1c Author: Edward Cree Date: Fri Jun 23 19:38:05 2023 +0100 sfc: siena: use padding to fix alignment in loopback test Add two bytes of padding to the start of struct efx_loopback_payload, which are not sent on the wire. This ensures the 'ip' member is 4-byte aligned, preventing the following W=1 warning: net/ethernet/sfc/siena/selftest.c:46:15: error: field ip within 'struct efx_loopback_payload' is less aligned than 'struct iphdr' and is usually due to 'struct efx_loopback_payload' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] struct iphdr ip; Reported-by: Arnd Bergmann Signed-off-by: Edward Cree Signed-off-by: David S. Miller commit cf60ed469629927fe43c2f4b4ef28a563d991935 Author: Edward Cree Date: Fri Jun 23 19:38:04 2023 +0100 sfc: use padding to fix alignment in loopback test Add two bytes of padding to the start of struct efx_loopback_payload, which are not sent on the wire. This ensures the 'ip' member is 4-byte aligned, preventing the following W=1 warning: net/ethernet/sfc/selftest.c:46:15: error: field ip within 'struct efx_loopback_payload' is less aligned than 'struct iphdr' and is usually due to 'struct efx_loopback_payload' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] struct iphdr ip; Reported-by: Arnd Bergmann Signed-off-by: Edward Cree Signed-off-by: David S. Miller commit b5ec6fd286dfa466f64cb0e56ed768092d0342ae Author: Peter Zijlstra Date: Fri Jun 9 11:28:30 2023 +0200 kbuild: Drop -Wdeclaration-after-statement With the advent on scope-based resource management it comes really tedious to abide by the contraints of -Wdeclaration-after-statement. It will still be recommeneded to place declarations at the start of a scope where possible, but it will no longer be enforced. Suggested-by: Linus Torvalds Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/CAHk-%3Dwi-RyoUhbChiVaJZoZXheAwnJ7OO%3DGxe85BkPAd93TwDA%40mail.gmail.com commit 54da6a0924311c7cf5015533991e44fb8eb12773 Author: Peter Zijlstra Date: Fri May 26 12:23:48 2023 +0200 locking: Introduce __cleanup() based infrastructure Use __attribute__((__cleanup__(func))) to build: - simple auto-release pointers using __free() - 'classes' with constructor and destructor semantics for scope-based resource management. - lock guards based on the above classes. Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20230612093537.614161713%40infradead.org commit 9a1f37ebcfe061721564042254719dc8fd5c9fa0 Author: Peter Zijlstra Date: Fri Jun 9 09:48:59 2023 +0200 apparmor: Free up __cleanup() name In order to use __cleanup for __attribute__((__cleanup__(func))) the name must not be used for anything else. Avoid the conflict. Signed-off-by: Peter Zijlstra (Intel) Acked-by: John Johansen Link: https://lkml.kernel.org/r/20230612093537.536441207%40infradead.org commit f62141ac730d6fe73a05750cb4482aabb681cfb9 Author: Peter Zijlstra Date: Tue Sep 27 11:32:41 2022 +0200 dmaengine: ioat: Free up __cleanup() name In order to use __cleanup for __attribute__((__cleanup__(func))) the name must not be used for anything else. Avoid the conflict. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Dave Jiang Link: https://lkml.kernel.org/r/20230612093537.467120754%40infradead.org commit f121ab7f4ac32ed2aa51035534926f9507a8308b Merge: 721255b9826bd a82f3119d5434 Author: Thomas Gleixner Date: Mon Jun 26 11:05:49 2023 +0200 Merge tag 'irqchip-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/core Pull irqchip updates from Marc Zyngier: - A number of Loogson/Loogarch fixes - Allow the core code to retrigger an interrupt that has fired while the same interrupt is being handled on another CPU, papering over a GICv3 architecture issue - Work around an integration problem on ASR8601, where the CPU numbering isn't representable in the GIC implementation... - Add some missing interrupt to the STM32 irqchip - A bunch of warning squashing triggered by W=1 builds Link: https://lore.kernel.org/r/20230623224345.3577134-1-maz@kernel.org commit adfdaf81f9d48d8618a4d8296567248170fe7bcc Author: Greg Kroah-Hartman Date: Mon Jun 26 11:03:21 2023 +0200 bsr: fix build problem with bsr_class static cleanup In commit e55ce9fd3d8f ("bsr: make bsr_class a static const structure"), the bsr_init function was converted to handle a static class structure, but the conversion got a variable name wrong, which caused build errors so fix that up. Cc: Arnd Bergmann Cc: Ivan Orlov Reported-by: Stephen Rothwell Link: https://lore.kernel.org/r/20230626142537.755ec782@canb.auug.org.au Fixes: e55ce9fd3d8f ("bsr: make bsr_class a static const structure") Signed-off-by: Greg Kroah-Hartman commit d2b32be7debd6c0deeae95844997bd89fbe4769d Merge: ccaa4926c2264 8b5bf64c89c71 Author: Thomas Gleixner Date: Mon Jun 26 11:04:01 2023 +0200 Merge tag 'timers-v6.5-rc1' of https://git.linaro.org/people/daniel.lezcano/linux into timers/core Pull clockevent/source updates from Daniel Lezcano: - Fix memory leak on Cadence TTC at probe time (Feng Mingxi) - Use the pm_sleep_ptr macro for the Ingenic driver (Paul Cercueil) - Relocate the PMW timer Loongson from the mips arch directory to the drivers/clocksource (Keguang Zhang) - Use the same function names instead of using aliases and move data defined in the header to the driver directly as this one is the only user of the header file and remove this one on i.MX GPT (Uwe Kleine-König) - Convert Broadcom Kona family timer bindings to DT schema (Michael Kelley) - Add DT bindings for Ralink SoCs timer (Sergio Paracuellos) commit d1b355438b8325a486f087e506d412c4e852f37b Author: Edward Cree Date: Fri Jun 23 15:34:48 2023 +0100 sfc: fix crash when reading stats while NIC is resetting efx_net_stats() (.ndo_get_stats64) can be called during an ethtool selftest, during which time nic_data->mc_stats is NULL as the NIC has been fini'd. In this case do not attempt to fetch the latest stats from the hardware, else we will crash on a NULL dereference: BUG: kernel NULL pointer dereference, address: 0000000000000038 RIP efx_nic_update_stats abridged calltrace: efx_ef10_update_stats_pf efx_net_stats dev_get_stats dev_seq_printf_stats Skipping the read is safe, we will simply give out stale stats. To ensure that the free in efx_ef10_fini_nic() does not race against efx_ef10_update_stats_pf(), which could cause a TOCTTOU bug, take the efx->stats_lock in fini_nic (it is already held across update_stats). Fixes: d3142c193dca ("sfc: refactor EF10 stats handling") Reviewed-by: Pieter Jansen van Vuuren Signed-off-by: Edward Cree Signed-off-by: David S. Miller commit 49ad6e913786fad6dd6209ef812437dc3009ebc4 Author: Suraj Kandpal Date: Thu Jun 22 14:02:53 2023 +0530 drm/i915/hdcp: Assign correct hdcp content type Currently hdcp->content_type is being assigned the content_type field in drm_connector_state which is wrong and instead it needs to be assigned hdcp_content_type field from drm_connector_state Fixes: 4c4279a8d58d ("drm/i915/hdcp: add intel_atomic_state argument to hdcp_enable function") Cc: Jani Nikula Cc: Ankit Nautiyal Cc: Animesh Manna Signed-off-by: Suraj Kandpal Reviewed-by: Ankit Nautiyal Signed-off-by: Ankit Nautiyal Link: https://patchwork.freedesktop.org/patch/msgid/20230622083254.2057102-1-suraj.kandpal@intel.com (cherry picked from commit 86a124424efce353778c4fab355e185e4781b63e) Signed-off-by: Tvrtko Ursulin commit 3e49de73fb89272dea01ba420c7ccbcf6b96aed7 Author: Vinay Belgaumkar Date: Tue Jun 20 18:42:57 2023 -0700 drm/i915/guc/slpc: Apply min softlimit correctly The scenario being fixed here is depicted in the following sequence- modprobe i915 echo 1 > /sys/class/drm/card0/gt/gt0/slpc_ignore_eff_freq echo 300 > /sys/class/drm/card0/gt_min_freq_mhz (RPn) cat /sys/class/drm/card0/gt_cur_freq_mhz --> cur == RPn as expected echo 1 > /sys/kernel/debug/dri/0/gt0/reset --> reset cat /sys/class/drm/card0/gt_min_freq_mhz --> cached freq is RPn cat /sys/class/drm/card0/gt_cur_freq_mhz --> it's not RPn, but RPe!! When SLPC reinitializes, it sets SLPC min freq to efficient frequency. Even if we disable efficient freq post that, we should restore the cached min freq (via H2G) for it to take effect. v2: Clarify commit message (Ashutosh) Fixes: 95ccf312a1e4 ("drm/i915/guc/slpc: Allow SLPC to use efficient frequency") Reviewed-by: Ashutosh Dixit Signed-off-by: Vinay Belgaumkar Signed-off-by: Daniele Ceraolo Spurio Link: https://patchwork.freedesktop.org/patch/msgid/20230621014257.1769564-1-vinay.belgaumkar@intel.com (cherry picked from commit da86b2b13f1d1ca26745b951ac94421f3137539a) Signed-off-by: Tvrtko Ursulin commit 5311892a0ad1d301aafd53ca0154091b3eb407ea Author: Jouni Högander Date: Tue Jun 20 14:17:45 2023 +0300 drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake times Encoder compute config is changing hw.adjusted mode. Uapi.adjusted mode doesn't get updated before psr compute config gets called. This causes io and fast wake line calculation using adjusted mode containing values before encoder adjustments. Fix this by using hw.adjusted mode instead of uapi.adjusted mode. Cc: Stanislav Lisovskiy Signed-off-by: Jouni Högander Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8475 Fixes: cb42e8ede5b4 ("drm/i915/psr: Use calculated io and fast wake lines") Reviewed-by: Mika Kahola Link: https://patchwork.freedesktop.org/patch/msgid/20230620111745.2870706-1-jouni.hogander@intel.com (cherry picked from commit ef0af9db2a21257885116949f471fe5565b2f0ab) Signed-off-by: Tvrtko Ursulin commit 86b53032b180cc2cb6ec1460885f0769c47bff3f Author: Radhakrishna Sripada Date: Thu Jun 15 21:39:50 2023 -0700 drm/i915/mtl: Fix SSC selection for MPLLA Driver does not clear the default SSC for MPLLA. This causes link training failure when trying to use 10G and 20G rates. Fix the behaviour and enable ssc only when we really want. Fixes: 237e7be0bf57 ("drm/i915/mtl: For DP2.0 10G and 20G rates use MPLLA") Cc: Mika Kahola Cc: Clint Taylor Cc: Khaled Almahallawy Cc: Arun R Murthy Signed-off-by: Radhakrishna Sripada Tested-by: Khaled Almahallawy Reviewed-by: Mika Kahola Link: https://patchwork.freedesktop.org/patch/msgid/20230616043950.1576836-1-radhakrishna.sripada@intel.com (cherry picked from commit 7e8d87e2da3b359ad73246233673a84c4dabfa07) Signed-off-by: Tvrtko Ursulin commit a6b4229d858ed4db6ad68854bb8a2f7d5ac9f138 Author: Imre Deak Date: Tue Jun 6 20:28:22 2023 +0300 drm/i915/adlp+: Allow DC states along with PW2 only for PWB functionality A recent bspec update added a restriction on when DC states can be enabled: [Before enabling DC states:] """ PG2 can be kept enabled only because PGB requires PG2. Do not use PG2 functions, such as type-C DDIs. DMC will dynamically control PG1, PGA, PG2, PGB. """ Accordingly prevent DC states if PW2 (aka PG2) is enabled for any other functionality. Bpsec: 49193 Fixes: 88c487938414 ("drm/i915: Use separate "DC off" power well for ADL-P and DG2") Reported-by: Kai Vehmanen Tested-by: Ambica Pramod Reviewed-by: Uma Shankar Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/20230606172822.1891897-1-imre.deak@intel.com (cherry picked from commit f4e498eb1247d25231198856b57bbae00f403c85) Signed-off-by: Tvrtko Ursulin commit 3867caee497edf6ce6b6117aac1c0b87c0a2cb5f Author: Herbert Xu Date: Sat Jun 24 13:19:56 2023 +0800 crypto: sm2 - Provide sm2_compute_z_digest when sm2 is disabled When sm2 is disabled we need to provide an implementation of sm2_compute_z_digest. Fixes: e5221fa6a355 ("KEYS: asymmetric: Move sm2 code into x509_public_key") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306231917.utO12sx8-lkp@intel.com/ Signed-off-by: Herbert Xu commit db8b4968a8d0e86c0f8bd7541359a4111a5b39ad Author: Boris Brezillon Date: Fri Jun 23 09:52:04 2023 +0200 drm/sched: Call drm_sched_fence_set_parent() from drm_sched_fence_scheduled() Drivers that can delegate waits to the firmware/GPU pass the scheduled fence to drm_sched_job_add_dependency(), and issue wait commands to the firmware/GPU at job submission time. For this to be possible, they need all their 'native' dependencies to have a valid parent since this is where the actual HW fence information are encoded. In drm_sched_main(), we currently call drm_sched_fence_set_parent() after drm_sched_fence_scheduled(), leaving a short period of time during which the job depending on this fence can be submitted. Since setting parent and signaling the fence are two things that are kinda related (you can't have a parent if the job hasn't been scheduled), it probably makes sense to pass the parent fence to drm_sched_fence_scheduled() and let it call drm_sched_fence_set_parent() before it signals the scheduled fence. Here is a detailed description of the race we are fixing here: Thread A Thread B - calls drm_sched_fence_scheduled() - signals s_fence->scheduled which wakes up thread B - entity dep signaled, checking the next dep - no more deps waiting - entity is picked for job submission by drm_gpu_scheduler - run_job() is called - run_job() tries to collect native fence info from s_fence->parent, but it's NULL => BOOM, we can't do our native wait - calls drm_sched_fence_set_parent() v2: * Fix commit message v3: * Add a detailed description of the race to the commit message * Add Luben's R-b Signed-off-by: Boris Brezillon Cc: Frank Binns Cc: Sarah Walker Cc: Donald Robson Cc: Luben Tuikov Cc: David Airlie Cc: Daniel Vetter Cc: Sumit Semwal Cc: "Christian König" Reviewed-by: Luben Tuikov Link: https://patchwork.freedesktop.org/patch/msgid/20230623075204.382350-1-boris.brezillon@collabora.com commit e47084e116fccaa43644360d7c0b997979abce3e Author: Binbin Zhou Date: Fri Jun 2 17:50:50 2023 +0800 MIPS: Loongson64: DTS: Add RTC support to Loongson-2K1000 The module is now supported, enable it. Acked-by: Jiaxun Yang Signed-off-by: Binbin Zhou Signed-off-by: WANG Xuerui Signed-off-by: Thomas Bogendoerfer commit 8a649e33f48e08be20c51541d9184645892ec370 Author: Binbin Zhou Date: Fri Jun 2 17:50:49 2023 +0800 MIPS: Loongson64: DTS: Add RTC support to LS7A PCH The RTC module is now supported, enable it. Acked-by: Jiaxun Yang Signed-off-by: Binbin Zhou Signed-off-by: WANG Xuerui Signed-off-by: Thomas Bogendoerfer commit b58d6d89ae020b107b2afa945a873dcadab44062 Author: Randy Dunlap Date: Wed Feb 8 23:13:49 2023 -0800 Documentation: PCI: correct spelling Correct spelling problems for Documentation/PCI/ as reported by codespell. Link: https://lore.kernel.org/linux-pci/20230209071400.31476-14-rdunlap@infradead.org Signed-off-by: Randy Dunlap Signed-off-by: Krzysztof Wilczyński Acked-by: Bjorn Helgaas commit fa155f4f834882a79788218aea4914568b41dd0f Author: Andrew Halaney Date: Fri Jun 23 10:53:38 2023 -0500 OPP: Use dev_err_probe() when failing to get icc_path This, in tandem with dynamic debug, can print useful information about -EPROBE_DEFFER like below, and keeps similar behavior for other errors: [ 16.561072] cpu cpu0: error -EPROBE_DEFER: dev_pm_opp_of_find_icc_paths: Unable to get path0 [ 16.575777] platform 18591000.cpufreq: deferred probe pending Signed-off-by: Andrew Halaney Signed-off-by: Viresh Kumar commit 5ee64250286e8c5162808667a9a8668488d9f577 Author: Andrew Halaney Date: Fri Jun 23 10:57:07 2023 -0500 cpufreq: qcom-cpufreq-hw: Use dev_err_probe() when failing to get icc paths This way, if there's an issue (in this case a -EPROBE_DEFER), you can get useful output: [root@dhcp19-243-150 ~]# cat /sys/kernel/debug/devices_deferred 18591000.cpufreq qcom-cpufreq-hw: Failed to find icc paths Signed-off-by: Andrew Halaney Reviewed-by: Bjorn Andersson Signed-off-by: Viresh Kumar commit a412dbf40ff37515acca4bba666f5386aa37246e Author: Florian Westphal Date: Wed Jun 21 21:11:03 2023 +0200 netfilter: nf_tables: limit allowed range via nla_policy These NLA_U32 types get stored in u8 fields, reject invalid values instead of silently casting to u8. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 079cd633219d7298d087cd115c17682264244c18 Author: Phil Sutter Date: Thu Jun 15 16:31:40 2023 +0200 netfilter: nf_tables: Introduce NFT_MSG_GETSETELEM_RESET Analogous to NFT_MSG_GETOBJ_RESET, but for set elements with a timeout or attached stateful expressions like counters or quotas - reset them all at once. Respect a per element timeout value if present to reset the 'expires' value to. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 4589725502871e77d06464f731f92fd9173e2be6 Author: Florian Westphal Date: Tue Jun 6 22:59:30 2023 +0200 netfilter: snat: evict closing tcp entries on reply tuple collision When all tried source tuples are in use, the connection request (skb) and the new conntrack will be dropped in nf_confirm() due to the non-recoverable clash. Make it so that the last 32 attempts are allowed to evict a colliding entry if this connection is already closing and the new sequence number has advanced past the old one. Such "all tuples taken" secenario can happen with tcp-rpc workloads where same dst:dport gets queried repeatedly. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 96b2ef9b16cb302d0b47c5670d30a05963e0e1e3 Author: Florian Westphal Date: Tue Jun 6 14:08:49 2023 +0200 netfilter: nf_tables: permit update of set size Now that set->nelems is always updated permit update of the sets max size. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 78aa23d0081b2029a5763c4f7d396bf2666c0c87 Author: Florian Westphal Date: Tue Jun 6 13:58:27 2023 +0200 netfilter: ipset: remove rcu_read_lock_bh pair from ip_set_test Callers already hold rcu_read_lock. Prior to RCU conversion this used to be a read_lock_bh(), but now the bh-disable isn't needed anymore. Cc: Jozsef Kadlecsik Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit de6843be3082d416eaf2a00b72dad95c784ca980 Author: Pablo Neira Ayuso Date: Tue Jun 6 09:38:42 2023 +0200 netfilter: nft_payload: rebuild vlan header when needed Skip rebuilding the vlan header when accessing destination and source mac address. Signed-off-by: Pablo Neira Ayuso commit fb9b7b4b2b82d72031bff6d615215c1c74064bb3 Author: Arnd Bergmann Date: Wed Jun 14 09:35:01 2023 +0200 x86: xen: add missing prototypes These function are all called from assembler files, or from inline assembler, so there is no immediate need for a prototype in a header, but if -Wmissing-prototypes is enabled, the compiler warns about them: arch/x86/xen/efi.c:130:13: error: no previous prototype for 'xen_efi_init' [-Werror=missing-prototypes] arch/x86/platform/pvh/enlighten.c:120:13: error: no previous prototype for 'xen_prepare_pvh' [-Werror=missing-prototypes] arch/x86/xen/enlighten_pv.c:1233:34: error: no previous prototype for 'xen_start_kernel' [-Werror=missing-prototypes] arch/x86/xen/irq.c:22:14: error: no previous prototype for 'xen_force_evtchn_callback' [-Werror=missing-prototypes] arch/x86/entry/common.c:302:24: error: no previous prototype for 'xen_pv_evtchn_do_upcall' [-Werror=missing-prototypes] Declare all of them in an appropriate header file to avoid the warnings. For consistency, also move the asm_cpu_bringup_and_idle() declaration out of smp_pv.c. Signed-off-by: Arnd Bergmann Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20230614073501.10101-3-jgross@suse.com Signed-off-by: Juergen Gross commit 3d013424de1efc2c9e68c6c06e76159e467c7ba8 Author: Juergen Gross Date: Wed Jun 14 09:35:00 2023 +0200 x86/xen: add prototypes for paravirt mmu functions The paravirt MMU functions called via the PV_CALLEE_SAVE_REGS_THUNK() macro can't be defined to be static, as the macro is generating a function via asm() statement calling the paravirt MMU function. In order to avoid warnings when specifying "-Wmissing-prototypes" for the build, add local prototypes (there should never be any external caller of those functions). Reported-by: Arnd Bergmann Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/20230614073501.10101-2-jgross@suse.com Signed-off-by: Juergen Gross commit 9338c2233b97f97aa68bc42f53b06e90def129d7 Author: Ross Lagerwall Date: Mon Jun 5 11:28:40 2023 +0100 iscsi_ibft: Fix finding the iBFT under Xen Dom 0 To facilitate diskless iSCSI boot, the firmware can place a table of configuration details in memory called the iBFT. The presence of this table is not specified, nor is the precise location (and it's not in the E820) so the kernel has to search for a magic marker to find it. When running under Xen, Dom 0 does not have access to the entire host's memory, only certain regions which are identity-mapped which means that the pseudo-physical address in Dom0 == real host physical address. Add the iBFT search bounds as a reserved region which causes it to be identity-mapped in xen_set_identity_and_remap_chunk() which allows Dom0 access to the specific physical memory to correctly search for the iBFT magic marker (and later access the full table). This necessitates moving the call to reserve_ibft_region() somewhat later so that it is called after e820__memory_setup() which is when the Xen identity mapping adjustments are applied. The precise location of the call is not too important so I've put it alongside dmi_setup() which does similar scanning of memory for configuration tables. Finally in the iBFT find code, instead of using isa_bus_to_virt() which doesn't do the right thing under Xen, use early_memremap() like the dmi_setup() code does. The result of these changes is that it is possible to boot a diskless Xen + Dom0 running off an iSCSI disk whereas previously it would fail to find the iBFT and consequently, the iSCSI root disk. Signed-off-by: Ross Lagerwall Reviewed-by: Juergen Gross Acked-by: Konrad Rzeszutek Wilk Acked-by: Dave Hansen # for x86 Link: https://lore.kernel.org/r/20230605102840.1521549-1-ross.lagerwall@citrix.com Signed-off-by: Juergen Gross commit 04d684875b30393c3e5cd0daf2fa737b562a7ad9 Author: Arnd Bergmann Date: Wed May 17 14:45:07 2023 +0200 xen: xen_debug_interrupt prototype to global header The xen_debug_interrupt() function is only called on x86, which has a prototype in an architecture specific header, but the definition also exists on others, where the lack of a prototype causes a W=1 warning: drivers/xen/events/events_2l.c:264:13: error: no previous prototype for 'xen_debug_interrupt' [-Werror=missing-prototypes] Move the prototype into a global header instead to avoid this warning. Signed-off-by: Arnd Bergmann Reviewed-by: Stefano Stabellini Link: https://lore.kernel.org/r/20230517124525.929201-1-arnd@kernel.org Signed-off-by: Juergen Gross commit 11d5e2061e973a8d4ff2b95a114b4b8ef8652633 Author: Gustavo A. R. Silva Date: Wed Jun 21 15:12:42 2023 -0600 ksmbd: Replace one-element array with flexible-array member One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element array with flexible-array member in struct smb_negotiate_req. This results in no differences in binary output. Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/KSPP/linux/issues/317 Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Acked-by: Namjae Jeon Reviewed-by: Sergey Senozhatsky Signed-off-by: Steve French commit 5211cc8727ed9701b04976ab47602955e5641bda Author: Gustavo A. R. Silva Date: Wed Jun 21 15:29:22 2023 -0600 ksmbd: Use struct_size() helper in ksmbd_negotiate_smb_dialect() Prefer struct_size() over open-coded versions. Link: https://github.com/KSPP/linux/issues/160 Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Acked-by: Namjae Jeon Reviewed-by: Sergey Senozhatsky Signed-off-by: Steve French commit 7b7d709ef7cf285309157fb94c33f625dd22c5e1 Author: Namjae Jeon Date: Sat Jun 24 12:35:39 2023 +0900 ksmbd: add missing compound request handing in some commands This patch add the compound request handling to the some commands. Existing clients do not send these commands as compound requests, but ksmbd should consider that they may come. Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 98422bdd4cb3ca4d08844046f6507d7ec2c2b8d8 Author: Namjae Jeon Date: Sat Jun 24 12:33:09 2023 +0900 ksmbd: fix out of bounds read in smb2_sess_setup ksmbd does not consider the case of that smb2 session setup is in compound request. If this is the second payload of the compound, OOB read issue occurs while processing the first payload in the smb2_sess_setup(). Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-21355 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit f65fadb0422537d73f9a6472861852dc2f7a6a5b Author: Lu Hongfei Date: Fri Jun 9 13:06:36 2023 +0800 ksmbd: Replace the ternary conditional operator with min() It would be better to replace the traditional ternary conditional operator with min() in compare_sids. Signed-off-by: Lu Hongfei Acked-by: Namjae Jeon Signed-off-by: Steve French commit 81a94b27847f7d2e499415db14dd9dc7c22b19b0 Author: Namjae Jeon Date: Wed May 31 15:23:19 2023 +0900 ksmbd: use kvzalloc instead of kvmalloc Use kvzalloc instead of kvmalloc. Reported-by: kernel test robot Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit ccb5889af97c03c67a83fcd649602034578c0d61 Author: Lu Hongfei Date: Wed May 31 10:10:43 2023 +0800 ksmbd: Change the return value of ksmbd_vfs_query_maximal_access to void The return value of ksmbd_vfs_query_maximal_access is meaningless, it is better to modify it to void. Signed-off-by: Lu Hongfei Acked-by: Namjae Jeon Signed-off-by: Steve French commit cf5e7f734f445588a30350591360bca2f6bf016f Author: Namjae Jeon Date: Tue May 30 21:43:17 2023 +0900 ksmbd: return a literal instead of 'err' in ksmbd_vfs_kern_path_locked() Return a literal instead of 'err' in ksmbd_vfs_kern_path_locked(). Reported-by: Dan Carpenter Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit f87d4f85f43f0d4b12ef64b015478d8053e1a33e Author: Namjae Jeon Date: Sat May 6 00:07:45 2023 +0900 ksmbd: use kzalloc() instead of __GFP_ZERO Use kzalloc() instead of __GFP_ZERO. Reported-by: Dan Carpenter Signed-off-by: Namjae Jeon Reviewed-by: Sergey Senozhatsky Signed-off-by: Steve French commit 7bd9f0876fdef00f4e155be35e6b304981a53f80 Author: Namjae Jeon Date: Sat May 6 00:06:56 2023 +0900 ksmbd: remove unused ksmbd_tree_conn_share function Remove unused ksmbd_tree_conn_share function. Signed-off-by: Namjae Jeon Reviewed-by: Sergey Senozhatsky Signed-off-by: Steve French commit d61cd13e732c0eaa7d66b45edb2d0de8eab65a1e Author: Gaurav Batra Date: Tue Jun 13 12:16:41 2023 -0500 powerpc/iommu: TCEs are incorrectly manipulated with DLPAR add/remove of memory When memory is dynamically added/removed, iommu_mem_notifier() is invoked. This routine traverses through all the DMA windows (DDW only, not default windows) to add/remove "direct" TCE mappings. The routines for this purpose are tce_clearrange_multi_pSeriesLP() and tce_clearrange_multi_pSeriesLP(). Both these routines are designed for Direct mapped DMA windows only. The issue is that there could be some DMA windows in the list which are not "direct" mapped. Calling these routines will either, 1) remove some dynamically mapped TCEs, Or 2) try to add TCEs which are out of bounds and HCALL returns H_PARAMETER Here are the side affects when these routines are incorrectly invoked for "dynamically" mapped DMA windows. tce_setrange_multi_pSeriesLP() This adds direct mapped TCEs. Now, this could invoke HCALL to add TCEs with out-of-bound range. In this scenario, HCALL will return H_PARAMETER and DLAR ADD of memory will fail. tce_clearrange_multi_pSeriesLP() This will remove range of TCEs. The TCE range that is calculated, depending on the memory range being added, could infact be mapping some other memory address (for dynamic DMA window scenario). This will wipe out those TCEs. The solution is for iommu_mem_notifier() to only invoke these routines for "direct" mapped DMA windows. Signed-off-by: Gaurav Batra Reviewed-by: Brian King [mpe: Initialise direct at allocation time in ddw_list_new_entry()] Signed-off-by: Michael Ellerman Link: https://msgid.link/20230613171641.15641-1-gbatra@linux.vnet.ibm.com commit 0c0df63177e37ae826d803280eb2c5b6b6a7a9a4 Merge: d2f9fe695313b 5d2ffbe4b81a3 Author: Dan Williams Date: Sun Jun 25 18:56:13 2023 -0700 Merge branch 'for-6.5/cxl-rch-eh' into for-6.5/cxl Pick up the first half of the RCH error handling series. The back half needs some fixups for test regressions. Small conflicts with the PMU work around register enumeration and setup helpers. commit d2f9fe695313b1e50028c1ec4cd09bea67152a60 Merge: e2c18eb50c7bb c2b34d442226b Author: Dan Williams Date: Sun Jun 25 17:53:18 2023 -0700 Merge branch 'for-6.5/cxl-perf' into for-6.5/cxl Pick up initial support for the CXL 3.0 performance monitoring definition. Small conflicts with the firmware update work as they both placed their init code in the same location. commit c2b34d442226b69e519eb0ba61939a74d91712d4 Author: Jonathan Cameron Date: Fri May 26 10:58:24 2023 +0100 docs: perf: Minimal introduction the the CXL PMU device and driver Very basic introduction to the device and the current driver support provided. I expect to expand on this in future versions of this patch set. Reviewed-by: Dave Jiang Reviewed-by: Kan Liang Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230526095824.16336-6-Jonathan.Cameron@huawei.com Signed-off-by: Dan Williams commit 5d7107c72796df3be2ba574f1cf6eca75c60d5ef Author: Jonathan Cameron Date: Fri May 26 10:58:23 2023 +0100 perf: CXL Performance Monitoring Unit driver CXL rev 3.0 introduces a standard performance monitoring hardware block to CXL. Instances are discovered using CXL Register Locator DVSEC entries. Each CXL component may have multiple PMUs. This initial driver supports a subset of types of counter. It supports counters that are either fixed or configurable, but requires that they support the ability to freeze and write value whilst frozen. Development done with QEMU model which will be posted shortly. Example: $ perf stat -a -e cxl_pmu_mem0.0/h2d_req_snpcur/ -e cxl_pmu_mem0.0/h2d_req_snpdata/ -e cxl_pmu_mem0.0/clock_ticks/ sleep 1 Performance counter stats for 'system wide': 96,757,023,244,321 cxl_pmu_mem0.0/h2d_req_snpcur/ 96,757,023,244,365 cxl_pmu_mem0.0/h2d_req_snpdata/ 193,514,046,488,653 cxl_pmu_mem0.0/clock_ticks/ 1.090539600 seconds time elapsed Reviewed-by: Dave Jiang Reviewed-by: Kan Liang Signed-off-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230526095824.16336-5-Jonathan.Cameron@huawei.com Signed-off-by: Dan Williams commit e2c18eb50c7bb191d1ebfed973c2ec3e0066ad37 Merge: aeaefabc59ec3 adfe19738b71a Author: Dan Williams Date: Sun Jun 25 17:23:50 2023 -0700 Merge branch 'for-6.5/cxl-region-fixes' into for-6.5/cxl Pick up the recent fixes to how CPU caches are managed relative to region setup / teardown, and make sure that all decoders transition successfully before updating the region state from COMMIT => ACTIVE. commit aeaefabc59ec3c7edd6d0ca7add7aff2ff6f59d0 Merge: 867eab655d3b3 8f0220af58c3b Author: Dan Williams Date: Sun Jun 25 17:16:51 2023 -0700 Merge branch 'for-6.5/cxl-type-2' into for-6.5/cxl Pick up the driver cleanups identified in preparation for CXL "type-2" (accelerator) device support. The major change here from a conflict generation perspective is the split of 'struct cxl_memdev_state' from the core 'struct cxl_dev_state'. Since an accelerator may not care about all the optional features that are standard on a CXL "type-3" (host-only memory expander) device. A silent conflict also occurs with the move of the endpoint port to be a formal property of a 'struct cxl_memdev' rather than drvdata. commit f7584322e4fef794b290e5fdb290fa92a925236e Author: Nick Desaulniers Date: Fri Jun 23 10:06:17 2023 -0700 riscv: disable HAVE_LD_DEAD_CODE_DATA_ELIMINATION for LLD Linking allyesconfig with ld.lld-17 with CONFIG_DEAD_CODE_ELIMINATION=y takes hours. Assuming this is a performance regression that can be fixed, tentatively disable this for now so that allyesconfig builds don't start timing out. If and when there's a fix to ld.lld, this can be converted to a version check instead so that users of older but still supported versions of ld.lld don't hurt themselves by enabling CONFIG_LD_DEAD_CODE_DATA_ELIMINATION=y. Link: https://github.com/ClangBuiltLinux/linux/issues/1881 Link: https://lore.kernel.org/linux-riscv/ZJXTwqZIkXLxXaSi@google.com/ Reported-by: Palmer Dabbelt Suggested-by: Nathan Chancellor Signed-off-by: Nick Desaulniers Signed-off-by: Palmer Dabbelt commit c828856b51bb4180c0803c12ffaeb86c41336c11 Author: Zhangjin Wu Date: Wed May 24 00:55:02 2023 +0800 riscv: enable HAVE_LD_DEAD_CODE_DATA_ELIMINATION Select CONFIG_HAVE_LD_DEAD_CODE_DATA_ELIMINATION for RISC-V, allowing the user to enable dead code elimination. In order for this to work, ensure that we keep the alternative table by annotating them with KEEP. This boots well on qemu with both rv32_defconfig & rv64 defconfig, but it only shrinks their builds by ~1%, a smaller config is thereforce customized to test this feature: | rv32 | rv64 --------|------------------------|--------------------- No DCE | 4460684 | 4893488 DCE | 3986716 | 4376400 Shrink | 473968 (~10.6%) | 517088 (~10.5%) The config used above only reserves necessary options to boot on qemu with serial console, more like the size-critical embedded scenes: - rv64 config: https://pastebin.com/crz82T0s - rv32 config: rv64 config + 32-bit.config Here is Jisheng's original commit-msg: When trying to run linux with various opensource riscv core on resource limited FPGA platforms, for example, those FPGAs with less than 16MB SDRAM, I want to save mem as much as possible. One of the major technologies is kernel size optimizations, I found that riscv does not currently support HAVE_LD_DEAD_CODE_DATA_ELIMINATION, which passes -fdata-sections, -ffunction-sections to CFLAGS and passes the --gc-sections flag to the linker. This not only benefits my case on FPGA but also benefits defconfigs. Here are some notable improvements from enabling this with defconfigs: nommu_k210_defconfig: text data bss dec hex 1112009 410288 59837 1582134 182436 before 962838 376656 51285 1390779 1538bb after rv32_defconfig: text data bss dec hex 8804455 2816544 290577 11911576 b5c198 before 8692295 2779872 288977 11761144 b375f8 after defconfig: text data bss dec hex 9438267 3391332 485333 13314932 cb2b74 before 9285914 3350052 483349 13119315 c82f53 after Signed-off-by: Zhangjin Wu Co-developed-by: Jisheng Zhang Signed-off-by: Jisheng Zhang Reviewed-by: Guo Ren Tested-by: Bin Meng Reviewed-by: Kefeng Wang Tested-by: Nick Desaulniers # build Link: https://lore.kernel.org/r/20230523165502.2592-5-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit d4035ff16bfa73915f74cb3d28f878aff1da510a Author: Jisheng Zhang Date: Wed May 24 00:55:01 2023 +0800 vmlinux.lds.h: use correct .init.data.* section name If building with -fdata-sections on riscv, LD_ORPHAN_WARN will warn similar as below: riscv64-linux-gnu-ld: warning: orphan section `.init.data.efi_loglevel' from `./drivers/firmware/efi/libstub/printk.stub.o' being placed in section `.init.data.efi_loglevel' I believe this is caused by a a typo: init.data.* should be .init.data.* Signed-off-by: Jisheng Zhang Reviewed-by: Kefeng Wang Tested-by: Nick Desaulniers # build Link: https://lore.kernel.org/r/20230523165502.2592-4-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit cead443a306262a16056d84d63b5a6a10908eb62 Author: Jisheng Zhang Date: Wed May 24 00:55:00 2023 +0800 riscv: vmlinux-xip.lds.S: remove .alternative section ALTERNATIVE mechanism can't work on XIP, and this is also reflected by below Kconfig dependency: RISCV_ALTERNATIVE ... depends on !XIP_KERNEL ... So there's no .alternative section at all for XIP case, remove it. Signed-off-by: Jisheng Zhang Reviewed-by: Conor Dooley Reviewed-by: Guo Ren Tested-by: Nick Desaulniers # build Link: https://lore.kernel.org/r/20230523165502.2592-3-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit ab7fa6b05ebbe2a8cc07114014f14fd2326fb80a Author: Jisheng Zhang Date: Wed May 24 00:54:59 2023 +0800 riscv: move options to keep entries sorted Recently, some commits break the entries order. Properly move their locations to keep entries sorted. Signed-off-by: Jisheng Zhang Reviewed-by: Conor Dooley Acked-by: Guo Ren Tested-by: Nick Desaulniers # build Link: https://lore.kernel.org/r/20230523165502.2592-2-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit 1b733a9ebc3d8011ca66ec6ff17f55a440358794 Author: Binbin Zhou Date: Fri Jun 2 17:50:48 2023 +0800 rtc: Add rtc driver for the Loongson family chips The Loongson family chips use an on-chip counter 0 (Time Of Year counter) as the RTC. We will refer to them as rtc-loongson. Cc: Keguang Zhang Cc: Yang Ling Cc: Jiaxun Yang Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen Signed-off-by: WANG Xuerui Reviewed-by: Keguang Zhang Tested-by: Keguang Zhang Reviewed-by: Jiaxun Yang Tested-by: Jiaxun Yang # LS7A Link: https://lore.kernel.org/r/0c5171156390f614d72f36ceb04a20f432ca639e.1685693501.git.zhoubinbin@loongson.cn Signed-off-by: Alexandre Belloni commit 9fb23090658adbd7f8f44bf5c38aa3fc4b1699bd Author: Binbin Zhou Date: Fri Jun 2 17:50:21 2023 +0800 rtc: Remove the Loongson-1 RTC driver Remove the ls1x-rtc driver as it is obsolete. We will continue to support the ls1x RTC in the upcoming Loongson unified RTC driver rtc-loongson. Cc: Keguang Zhang Cc: zhao zhang Cc: Yang Ling Signed-off-by: Binbin Zhou Acked-by: Keguang Zhang Link: https://lore.kernel.org/r/c38c666015a162d7031b20a48209ce577bab62cd.1685693501.git.zhoubinbin@loongson.cn Signed-off-by: Alexandre Belloni commit 487ef32caebe010f0ff0f17267230ebaf2177e67 Author: Binbin Zhou Date: Fri Jun 2 17:50:20 2023 +0800 dt-bindings: rtc: Split loongson,ls2x-rtc into SoC-based compatibles Move Loongson RTC bindings from trivial-rtc.yaml into loongson,rtc.yaml. The architectures associated with this driver use the built-in DTB, so we can just drop the compatible(rtc-ls2x) with wildcards. Also, soc-based compatible is more accurate for hardware differences between chips. Signed-off-by: Binbin Zhou Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/1b0bb443bd74647c17b7902f3d719700f81a1dba.1685693501.git.zhoubinbin@loongson.cn Signed-off-by: Alexandre Belloni commit 867eab655d3b38740d8d6c24705af25e0b1dbdb6 Merge: dcfb70610d407 f6448cb5f2f37 Author: Dan Williams Date: Sun Jun 25 16:12:26 2023 -0700 Merge branch 'for-6.5/cxl-fwupd' into for-6.5/cxl Add the first typical (non-sanitization) consumer of the new background command infrastructure, firmware update. Given both firmware-update and sanitization were developed in parallel from the common background-command baseline, resolve some minor context conflicts. commit 7e2a60efab8ad901c4743137857c1c5e18e27ed8 Author: Johannes Kirchmair Date: Mon Mar 27 10:55:50 2023 +0200 rtc: rv3028: make rv3028 probeable from userspace With this commit, it will be possible to bind a rv3028 device from userspace This is done by: echo rtc-rv3028 0x52 > /sys/bus/i2c/devices/i2c-XX/new_device Signed-off-by: Johannes Kirchmair Link: https://lore.kernel.org/r/20230327085550.1721861-1-johannes.kirchmair@sigmatek.at Signed-off-by: Alexandre Belloni commit dcfb70610d40704d929d824db36b1444c8f37f7a Merge: 858fd168a95c5 f337043b56e0e Author: Dan Williams Date: Sun Jun 25 16:01:45 2023 -0700 Merge branch 'for-6.5/cxl-background' into for-6.5/cxl Pick up the sanitization work and the infrastructure for other background commands for 6.5. Sanitization has a different completion path than typical background commands so it was important to have both thought out and implemented before either went upstream. commit f6448cb5f2f378c70d280581590e062f13ff52b3 Author: Vishal Verma Date: Wed Jun 14 11:17:43 2023 -0600 tools/testing/cxl: add firmware update emulation to CXL memdevs Add emulation for the 'Get FW Info', 'Transfer FW', and 'Activate FW' CXL mailbox commands to the cxl_test emulated memdevs to enable end-to-end unit testing of a firmware update flow. For now, only advertise an 'offline activation' capability as that is all the CXL memdev driver currently implements. Add some canned values for the serial number fields, and create a platform device sysfs knob to calculate the sha256sum of the firmware image that was received, so a unit test can compare it with the original file that was uploaded. Cc: Davidlohr Bueso Cc: Jonathan Cameron Cc: Russ Weight Cc: Alison Schofield Cc: Ira Weiny Cc: Dave Jiang Cc: Ben Widawsky Cc: Dan Williams Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Signed-off-by: Vishal Verma Link: https://lore.kernel.org/r/20230602-vv-fw_update-v4-4-c6265bd7343b@intel.com Signed-off-by: Dan Williams commit 6e4ca04af73e689bcfdad9047cd248ed93491e95 Author: Vishal Verma Date: Wed Jun 14 11:17:42 2023 -0600 tools/testing/cxl: Use named effects for the Command Effect Log As more emulated mailbox commands are added to cxl_test, it is a pain point to look up command effect numbers for each effect. Replace the bare numbers in the mock driver with an enum that lists all possible effects. Cc: Davidlohr Bueso Cc: Jonathan Cameron Cc: Russ Weight Cc: Alison Schofield Cc: Ira Weiny Cc: Dave Jiang Cc: Ben Widawsky Cc: Dan Williams Suggested-by: Jonathan Cameron Reviewed-by: Alison Schofield Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Signed-off-by: Vishal Verma Link: https://lore.kernel.org/r/20230602-vv-fw_update-v4-3-c6265bd7343b@intel.com Signed-off-by: Dan Williams commit b46c5fa57cc60692412f616ac66ab624a941fdb3 Author: Vishal Verma Date: Wed Jun 14 11:17:41 2023 -0600 tools/testing/cxl: Fix command effects for inject/clear poison The CXL spec (3.0, section 8.2.9.8.4) Lists Inject Poison and Clear Poison as having the effects of "Immediate Data Change". Fix this in the mock driver so that the command effect log is populated correctly. Fixes: 371c16101ee8 ("tools/testing/cxl: Mock the Inject Poison mailbox command") Cc: Alison Schofield Cc: Dan Williams Reviewed-by: Alison Schofield Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Signed-off-by: Vishal Verma Link: https://lore.kernel.org/r/20230602-vv-fw_update-v4-2-c6265bd7343b@intel.com Signed-off-by: Dan Williams commit 9521875bbe0055805557fff0b08fd9a29d02b7bc Author: Vishal Verma Date: Wed Jun 14 11:17:40 2023 -0600 cxl: add a firmware update mechanism using the sysfs firmware loader The sysfs based firmware loader mechanism was created to easily allow userspace to upload firmware images to FPGA cards. This also happens to be pretty suitable to create a user-initiated but kernel-controlled firmware update mechanism for CXL devices, using the CXL specified mailbox commands. Since firmware update commands can be long-running, and can be processed in the background by the endpoint device, it is desirable to have the ability to chunk the firmware transfer down to smaller pieces, so that one operation does not monopolize the mailbox, locking out any other long running background commands entirely - e.g. security commands like 'sanitize' or poison scanning operations. The firmware loader mechanism allows a natural way to perform this chunking, as after each mailbox command, that is restricted to the maximum mailbox payload size, the cxl memdev driver relinquishes control back to the fw_loader system and awaits the next chunk of data to transfer. This opens opportunities for other background commands to access the mailbox and send their own slices of background commands. Add the necessary helpers and state tracking to be able to perform the 'Get FW Info', 'Transfer FW', and 'Activate FW' mailbox commands as described in the CXL spec. Wire these up to the firmware loader callbacks, and register with that system to create the memX/firmware/ sysfs ABI. Cc: Davidlohr Bueso Cc: Jonathan Cameron Cc: Russ Weight Cc: Alison Schofield Cc: Ira Weiny Cc: Dave Jiang Cc: Ben Widawsky Cc: Dan Williams Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Signed-off-by: Vishal Verma Link: https://lore.kernel.org/r/20230602-vv-fw_update-v4-1-c6265bd7343b@intel.com Signed-off-by: Dan Williams commit fdd63f65ac25d0851dade4c7ba94a7a882b8d9c2 Author: Biju Das Date: Fri Jun 23 15:09:48 2023 +0100 rtc: isl1208: Add support for the built-in RTC on the PMIC RAA215300 The built-in RTC found on PMIC RAA215300 is the same as ISL1208. However, the external oscillator bit is inverted on PMIC version 0x11. The PMIC driver detects PMIC version and instantiates the RTC device based on i2c_device_id. Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230623140948.384762-11-biju.das.jz@bp.renesas.com Signed-off-by: Alexandre Belloni commit 262f72b4656e182eefaab91ab24a7575dda5524f Author: Biju Das Date: Fri Jun 23 15:09:47 2023 +0100 rtc: isl1208: Add isl1208_set_xtoscb() As per the HW manual, set the XTOSCB bit as follows: If using an external clock signal, set the XTOSCB bit as 1 to disable the crystal oscillator. If using an external crystal, the XTOSCB bit needs to be set at 0 to enable the crystal oscillator. Add isl1208_set_xtoscb() to set XTOSCB bit based on the clock-names property. Fallback is enabling the internal crystal oscillator. While at it, introduce a variable "sr" for reading the status register in probe() as it is reused for writing and also remove the unnecessary blank line. Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20230623140948.384762-10-biju.das.jz@bp.renesas.com Signed-off-by: Alexandre Belloni commit 5923fc75d0dfcebce53894ddada7e2440d756f8b Author: Biju Das Date: Fri Jun 23 15:09:46 2023 +0100 rtc: isl1208: Drop enum isl1208_id and split isl1208_configs[] Drop enum isl1208_id and split the array isl1208_configs[] as individual variables, and make lines shorter by referring to e.g. &config_isl1219 instead of &isl1208_configs[TYPE_ISL1219]. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230623140948.384762-9-biju.das.jz@bp.renesas.com Signed-off-by: Alexandre Belloni commit fbc06a53561c64ec6d7f9a1b3bc04597de4cbb2d Author: Biju Das Date: Fri Jun 23 15:09:45 2023 +0100 rtc: isl1208: Make similar I2C and DT-based matching table The isl1208_id[].driver_data could store a pointer to the config, like for DT-based matching, making I2C and DT-based matching more similar. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230623140948.384762-8-biju.das.jz@bp.renesas.com Signed-off-by: Alexandre Belloni commit 380960c40a1d106bba3476c9a010eaf28195115d Author: Biju Das Date: Fri Jun 23 15:09:44 2023 +0100 rtc: isl1208: Drop name variable Drop unused name variable from struct isl1208_config. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230623140948.384762-7-biju.das.jz@bp.renesas.com Signed-off-by: Alexandre Belloni commit 138f352556d791d7e0ca3ac9a4f4815123af8c82 Author: Biju Das Date: Fri Jun 23 15:09:43 2023 +0100 dt-bindings: rtc: isil,isl1208: Document clock and clock-names properties As per the HW manual, XTOSCB bit setting is as follows If using an external clock signal, set the XTOSCB bit as 1 to disable the crystal oscillator. If using an external crystal, the XTOSCB bit needs to be set at 0 to enable the crystal oscillator. Document clock and clock-names properties. Signed-off-by: Biju Das Reviewed-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230623140948.384762-6-biju.das.jz@bp.renesas.com Signed-off-by: Alexandre Belloni commit ac739bac5201d4308cba2525dacb5da654b3ff31 Author: Biju Das Date: Fri Jun 23 15:09:42 2023 +0100 dt-bindings: rtc: isl1208: Convert to json-schema Convert the isl1208 RTC device tree binding documentation to json-schema. Update the example to match reality. Signed-off-by: Biju Das Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230623140948.384762-5-biju.das.jz@bp.renesas.com Signed-off-by: Alexandre Belloni commit 0e6f36cca1bd3f5257315b55d9f31519ea4cc059 Author: Christophe JAILLET Date: Thu Jun 8 21:12:00 2023 +0200 rtc: st-lpc: Simplify clk handling in st_rtc_probe() Use devm_clk_get_enabled() instead of hand writing it. This simplifies error handling and removes some lines of code. Also use dev_err_probe() which filters -EPROBE_DEFER. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/992dd8c31be0bb5b8a9d8b5e8e94807ab0848a66.1686251455.git.christophe.jaillet@wanadoo.fr Signed-off-by: Alexandre Belloni commit 06c6e1b01d9261f03629cefd1f3553503291e6cf Author: Christophe JAILLET Date: Thu Jun 8 21:11:42 2023 +0200 rtc: st-lpc: Release some resources in st_rtc_probe() in case of error If an error occurs after clk_get(), the corresponding resources should be released. Use devm_clk_get() to fix it. Fixes: b5b2bdfc2893 ("rtc: st: Add new driver for ST's LPC RTC") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/866af6adbc7454a7b4505eb6c28fbdc86ccff39e.1686251455.git.christophe.jaillet@wanadoo.fr Signed-off-by: Alexandre Belloni commit f337043b56e0e97c5c67b95ea32886b95b049181 Author: Davidlohr Bueso Date: Mon Jun 12 11:10:38 2023 -0700 cxl/test: Add Secure Erase opcode support Add support to emulate the CXL the "Secure Erase" operation. Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: Davidlohr Bueso Link: https://lore.kernel.org/r/20230612181038.14421-8-dave@stgolabs.net Signed-off-by: Dan Williams commit 180ffd338c35057c3e8521d55555ae3b36b67fa6 Author: Davidlohr Bueso Date: Mon Jun 12 11:10:37 2023 -0700 cxl/mem: Support Secure Erase Implement support for the non-pmem exclusive secure erase, per CXL specs. Create a write-only 'security/erase' sysfs file to perform the requested operation. As with the sanitation this requires the device being offline and thus no active HPA-DPA decoding. The expectation is that userspace can use it such as: cxl disable-memdev memX echo 1 > /sys/bus/cxl/devices/memX/security/erase cxl enable-memdev memX Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Reviewed-by: Fan Ni Signed-off-by: Davidlohr Bueso Link: https://lore.kernel.org/r/20230612181038.14421-7-dave@stgolabs.net Signed-off-by: Dan Williams commit c5c39217ff49ffb8494a671c9521c43006f87f1a Author: Davidlohr Bueso Date: Mon Jun 12 11:10:36 2023 -0700 cxl/test: Add Sanitize opcode support Add support to emulate the "Sanitize" operation, without incurring in the background. Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: Davidlohr Bueso Link: https://lore.kernel.org/r/20230612181038.14421-6-dave@stgolabs.net Signed-off-by: Dan Williams commit 48dcdbb16e5dc0947f949ce17bc2d09a625a0d5c Author: Davidlohr Bueso Date: Mon Jun 12 11:10:35 2023 -0700 cxl/mem: Wire up Sanitization support Implement support for CXL 3.0 8.2.9.8.5.1 Sanitize. This is done by adding a security/sanitize' memdev sysfs file to trigger the operation and extend the status file to make it poll(2)-capable for completion. Unlike all other background commands, this is the only operation that is special and monopolizes the device for long periods of time. In addition to the traditional pmem security requirements, all regions must also be offline in order to perform the operation. This permits avoiding explicit global CPU cache management, relying instead on the implict cache management when a region transitions between CXL_CONFIG_ACTIVE and CXL_CONFIG_COMMIT. The expectation is that userspace can use it such as: cxl disable-memdev memX echo 1 > /sys/bus/cxl/devices/memX/security/sanitize cxl wait-sanitize memX cxl enable-memdev memX Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: Davidlohr Bueso Link: https://lore.kernel.org/r/20230612181038.14421-5-dave@stgolabs.net Signed-off-by: Dan Williams commit 0c36b6ad436a38b167af16e6c690c890b8b2df62 Author: Davidlohr Bueso Date: Mon Jun 12 11:10:34 2023 -0700 cxl/mbox: Add sanitization handling machinery Sanitization is by definition a device-monopolizing operation, and thus the timeslicing rules for other background commands do not apply. As such handle this special case asynchronously and return immediately. Subsequent changes will allow completion to be pollable from userspace via a sysfs file interface. For devices that don't support interrupts for notifying background command completion, self-poll with the caveat that the poller can be out of sync with the ready hardware, and therefore care must be taken to not allow any new commands to go through until the poller sees the hw completion. The poller takes the mbox_mutex to stabilize the flagging, minimizing any runtime overhead in the send path to check for 'sanitize_tmo' for uncommon poll scenarios. The irq case is much simpler as hardware will serialize/error appropriately. Reviewed-by: Dave Jiang Signed-off-by: Davidlohr Bueso Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230612181038.14421-4-dave@stgolabs.net Signed-off-by: Dan Williams commit 9968c9dd568e83f57fdc1f6127f8b369a0594991 Author: Davidlohr Bueso Date: Mon Jun 12 11:10:33 2023 -0700 cxl/mem: Introduce security state sysfs file Add a read-only sysfs file to display the security state of a device (currently only pmem): /sys/bus/cxl/devices/memX/security/state This introduces a cxl_security_state structure that is to be the placeholder for common CXL security features. Reviewed-by: Jonathan Cameron Reviewed-by: Fan Ni Signed-off-by: Davidlohr Bueso Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20230612181038.14421-3-dave@stgolabs.net Signed-off-by: Dan Williams commit 8ea9c33d48f20479e87b5fc3a97cd25e656d30dc Author: Davidlohr Bueso Date: Mon Jun 12 11:10:32 2023 -0700 cxl/mbox: Allow for IRQ_NONE case in the isr For cases when the mailbox background operation is not complete, do not "handle" the interrupt, as it was not from this device. And furthermore there are no racy scenarios such as the hw being out of sync with the driver and starting a new background op behind its back. Reported-by: Jonathan Cameron Fixes: ccadf1310fb (cxl/mbox: Add background cmd handling machinery) Signed-off-by: Davidlohr Bueso Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230612181038.14421-2-dave@stgolabs.net Signed-off-by: Dan Williams commit 8f0220af58c3b73e9041377a23708d37600b33c1 Author: Dan Williams Date: Thu Jun 15 12:53:40 2023 -0700 Revert "cxl/port: Enable the HDM decoder capability for switch ports" commit eb0764b822b9 ("cxl/port: Enable the HDM decoder capability for switch ports") ...was added on the observation of CXL memory not being accessible after setting up a region on a "cold-plugged" device. A "cold-plugged" CXL device is one that was not present at boot, so platform-firmware/BIOS has no chance to set it up. While it is true that the debug found the enable bit clear in the host-bridge's instance of the global control register (CXL 3.0 8.2.4.19.2 CXL HDM Decoder Global Control Register), that bit is described as: "This bit is only applicable to CXL.mem devices and shall return 0 on CXL Host Bridges and Upstream Switch Ports." So it is meant to be zero, and further testing confirmed that this "fix" had no effect on the failure. Revert it, and be more vigilant about proposed fixes in the future. Since the original copied stable@, flag this revert for stable@ as well. Cc: Fixes: eb0764b822b9 ("cxl/port: Enable the HDM decoder capability for switch ports") Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168685882012.3475336.16733084892658264991.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 516b300c4ca86aa7953b75ce79b5c5eea5779b22 Author: Dan Williams Date: Wed Jun 14 18:30:43 2023 -0700 cxl/memdev: Formalize endpoint port linkage Move the endpoint port that the cxl_mem driver establishes from drvdata to a first class attribute. This is in preparation for device-memory drivers reusing the CXL core for memory region management. Those drivers need a type-safe method to retrieve their CXL port linkage. Leave drvdata for private usage of the cxl_mem driver not external consumers of a 'struct cxl_memdev' object. Reviewed-by: Fan Ni Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168679264292.3436160.3901392135863405807.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit f3c8a37a432e65dda1384929198dd12c1df3ea38 Author: Dan Williams Date: Wed Jun 14 18:30:31 2023 -0700 cxl/pci: Unconditionally unmask 256B Flit errors The current check for 256B Flit mode is incomplete and unnecessary. It is incomplete because it fails to consider the link speed, or check for CXL link capabilities. It is unnecessary because unconditionally unmasking 256B Flit errors is a nop when 256B Flit operation is not available. Remove this check in preparation for creating a cxl_probe_link() helper to centralize this detection. Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168679263124.3436160.6228910132469454346.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 8c897b366cda9c7e5ebbb6e8e3da238ecec84535 Author: Dan Williams Date: Wed Jun 14 18:30:25 2023 -0700 cxl/region: Manage decoder target_type at decoder-attach time Switch-level (mid-level) decoders between the platform root and an endpoint can dynamically switch modes between HDM-H and HDM-D[B] depending on which region they target. Use the region type to fixup each decoder that gets allocated to map the given region. Note that endpoint decoders are meant to determine the region type, so warn if those ever need to be fixed up, but since it is possible to continue do so. Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168679262543.3436160.13053831955768440312.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit cecbb5da921231aa0933667fba85bea5b91d6a46 Author: Dan Williams Date: Wed Jun 14 18:30:19 2023 -0700 cxl/hdm: Default CXL_DEVTYPE_DEVMEM decoders to CXL_DECODER_DEVMEM In preparation for device-memory region creation, arrange for decoders of CXL_DEVTYPE_DEVMEM memdevs to default to CXL_DECODER_DEVMEM for their target type. Revisit this if a device ever shows up that wants to offer mixed HDM-H (Host-Only Memory) and HDM-DB support, or an CXL_DEVTYPE_DEVMEM device that supports HDM-H. Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168679261945.3436160.11673393474107374595.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 5aa39a9165cfc80d37f1db8ba8fee798a3ecf74f Author: Dan Williams Date: Wed Jun 14 18:30:13 2023 -0700 cxl/port: Rename CXL_DECODER_{EXPANDER, ACCELERATOR} => {HOSTONLYMEM, DEVMEM} In preparation for support for HDM-D and HDM-DB configuration (device-memory, and device-memory with back-invalidate). Rename the current type designators to use HOSTONLYMEM and DEVMEM as a suffix. HDM-DB can be supported by devices that are not accelerators, so DEVMEM is a more generic term for that case. Fixup one location where this type value was open coded. Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168679261369.3436160.7042443847605280593.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit f6b8ab32e3ec48ecc02d1b4a42ee03576040ddd2 Author: Dan Williams Date: Wed Jun 14 18:30:07 2023 -0700 cxl/memdev: Make mailbox functionality optional In support of the Linux CXL core scaling for a wider set of CXL devices, allow for the creation of memdevs with some memory device capabilities disabled. Specifically, allow for CXL devices outside of those claiming to be compliant with the generic CXL memory device class code, like vendor specific Type-2/3 devices that host CXL.mem. This implies, allow for the creation of memdevs that only support component-registers, not necessarily memory-device-registers (like mailbox registers). A memdev derived from a CXL endpoint that does not support generic class code expectations is tagged "CXL_DEVTYPE_DEVMEM", while a memdev derived from a class-code compliant endpoint is tagged "CXL_DEVTYPE_CLASSMEM". The primary assumption of a CXL_DEVTYPE_DEVMEM memdev is that it optionally may not host a mailbox. Disable the command passthrough ioctl for memdevs that are not CXL_DEVTYPE_CLASSMEM, and return empty strings from memdev attributes associated with data retrieved via the class-device-standard IDENTIFY command. Note that empty strings were chosen over attribute visibility to maintain compatibility with shipping versions of cxl-cli that expect those attributes to always be present. Once cxl-cli has dropped that requirement this workaround can be deprecated. Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168679260782.3436160.7587293613945445365.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 59f8d1510739e92135df62d52e8c29bc075c46ad Author: Dan Williams Date: Wed Jun 14 18:30:02 2023 -0700 cxl/mbox: Move mailbox related driver state to its own data structure 'struct cxl_dev_state' makes too many assumptions about the capabilities of a CXL device. In particular it assumes a CXL device has a mailbox and all of the infrastructure and state that comes along with that. In preparation for supporting accelerator / Type-2 devices that may not have a mailbox and in general maintain a minimal core context structure, make mailbox functionality a super-set of 'struct cxl_dev_state' with 'struct cxl_memdev_state'. With this reorganization it allows for CXL devices that support HDM decoder mapping, but not other general-expander / Type-3 capabilities, to only enable that subset without the rest of the mailbox infrastructure coming along for the ride. Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168679260240.3436160.15520641540463704524.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 3fe7feb0f37e4dcbd51b9a4019866dc55b965a55 Author: Dan Williams Date: Wed Jun 14 18:29:57 2023 -0700 cxl: Remove leftover attribute documentation in 'struct cxl_dev_state' commit 14d788740774 ("cxl/mem: Consolidate CXL DVSEC Range enumeration in the core") ...removed @info from 'struct cxl_dev_state', but neglected to remove the corresponding kernel-doc entry. Complete the removal. Reported-by: Jonathan Cameron Closes: http://lore.kernel.org/r/20230606121054.000069e1@Huawei.com Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168679259703.3436160.12583306507362357946.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit c192e5432f2519c8016af126076a5be1e5befbf5 Author: Dan Williams Date: Wed Jun 14 18:29:51 2023 -0700 cxl: Fix kernel-doc warnings After Jonathan noticed [1] that 'struct cxl_dev_state' had a kernel-doc entry without a corresponding struct attribute I ran the kernel-doc script to see what else might be broken. Fix these warnings: drivers/cxl/cxlmem.h:199: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Event Interrupt Policy drivers/cxl/cxlmem.h:224: warning: Function parameter or member 'buf' not described in 'cxl_event_state' drivers/cxl/cxlmem.h:224: warning: Function parameter or member 'log_lock' not described in 'cxl_event_state' Note that scripts/kernel-doc only finds missing kernel-doc entries. It does not warn on too many kernel-doc entries, i.e. it did not catch the fact that @info refers to a not present member. Link: http://lore.kernel.org/r/20230606121054.000069e1@Huawei.com [1] Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168679259170.3436160.3686460404739136336.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 4c77cfcfe1afd1d8f5247cd26e53fa2e30c4c23f Author: Dan Williams Date: Wed Jun 14 18:29:46 2023 -0700 tools/testing/cxl: Remove unused @cxlds argument In preparation for plumbing a 'struct cxl_memdev_state' as a superset of a 'struct cxl_dev_state' cleanup the usage of @cxlds in the unit test infrastructure. Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168679258640.3436160.7641308222525246728.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 688baac1097d30a51d6469efdc8707fdac80eab6 Author: Dan Williams Date: Wed Jun 14 18:29:41 2023 -0700 cxl/regs: Clarify when a 'struct cxl_register_map' is input vs output The @map parameter to cxl_probe_X_registers() is filled in with the mapping parameters of the register block. The @map parameter to cxl_map_X_registers() only reads that information to perform the mapping. Mark @map const for cxl_map_X_registers() to clarify that it is only an input to those helpers. Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168679258103.3436160.4941603739448763855.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit adfe19738b71a893da62cb2e30bd6bdb4299ea67 Author: Dan Williams Date: Fri Jun 16 18:24:39 2023 -0700 cxl/region: Fix state transitions after reset failure Jonathan reports that failed attempts to reset a region (teardown its HDM decoder configuration) mistakenly advance the state of the region to "not committed". Revert to the previous state of the region on reset failure so that the reset can be re-attempted. Reported-by: Jonathan Cameron Closes: http://lore.kernel.org/r/20230316171441.0000205b@Huawei.com Fixes: 176baefb2eb5 ("cxl/hdm: Commit decoder state to hardware") Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168696507968.3590522.14484000711718573626.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 2ab47045ac96a605e3037d479a7d5854570ee5bf Author: Dan Williams Date: Fri Jun 16 18:24:34 2023 -0700 cxl/region: Flag partially torn down regions as unusable cxl_region_decode_reset() walks all the decoders associated with a given region and disables them. Due to decoder ordering rules it is possible that a switch in the topology notices that a given decoder can not be shutdown before another region with a higher HPA is shutdown first. That can leave the region in a partially committed state. Capture that state in a new CXL_REGION_F_NEEDS_RESET flag and require that a successful cxl_region_decode_reset() attempt must be completed before cxl_region_probe() accepts the region. This is a corollary for the bug that Jonathan identified in "CXL/region : commit reset of out of order region appears to succeed." [1]. Cc: Jonathan Cameron Link: http://lore.kernel.org/r/20230316171441.0000205b@Huawei.com [1] Fixes: 176baefb2eb5 ("cxl/hdm: Commit decoder state to hardware") Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168696507423.3590522.16254212607926684429.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit d1257d098a5a38753a0736a50db0a26a62377ad7 Author: Dan Williams Date: Fri Jun 16 18:24:28 2023 -0700 cxl/region: Move cache invalidation before region teardown, and before setup Vikram raised a concern with the theoretical case of a CPU sending MemClnEvict to a device that is not prepared to receive. MemClnEvict is a message that is sent after a CPU has taken ownership of a cacheline from accelerator memory (HDM-DB). In the case of hotplug or HDM decoder reconfiguration it is possible that the CPU is holding old contents for a new device that has taken over the physical address range being cached by the CPU. To avoid this scenario, invalidate caches prior to tearing down an HDM decoder configuration. Now, this poses another problem that it is possible for something to speculate into that space while the decode configuration is still up, so to close that gap also invalidate prior to establish new contents behind a given physical address range. With this change the cache invalidation is now explicit and need not be checked in cxl_region_probe(), and that obviates the need for CXL_REGION_F_INCOHERENT. Cc: Jonathan Cameron Fixes: d18bc74aced6 ("cxl/region: Manage CPU caches relative to DPA invalidation events") Reported-by: Vikram Sethi Closes: http://lore.kernel.org/r/BYAPR12MB33364B5EB908BF7239BB996BBD53A@BYAPR12MB3336.namprd12.prod.outlook.com Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/168696506886.3590522.4597053660991916591.stgit@dwillia2-xfh.jf.intel.com Signed-off-by: Dan Williams commit 5d2ffbe4b81a3b6353bf888a523e7e5d4fec47ad Author: Robert Richter Date: Thu Jun 22 15:55:11 2023 -0500 cxl/port: Store the downstream port's Component Register mappings in struct cxl_dport Same as for ports, also store the downstream port's Component Register mappings, use struct cxl_dport for that. Signed-off-by: Robert Richter Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230622205523.85375-16-terry.bowman@amd.com Signed-off-by: Dan Williams commit 19ab69a60e3ba58b4942b9ab5095cf90477a54ce Author: Robert Richter Date: Thu Jun 22 15:55:10 2023 -0500 cxl/port: Store the port's Component Register mappings in struct cxl_port CXL capabilities are stored in the Component Registers. To use them, the specific I/O ranges of the capabilities must be determined by probing the registers. For this, the whole Component Register range needs to be mapped temporarily to detect the offset and length of a capability range. In order to use more than one capability of a component (e.g. RAS and HDM) the Component Register are probed and its mappings created multiple times. This also causes overlapping I/O ranges as the whole Component Register range must be mapped again while a capability's I/O range is already mapped. Different capabilities cannot be setup at the same time. E.g. the RAS capability must be made available as soon as the PCI driver is bound, the HDM decoder is setup later during port enumeration. Moreover, during early setup it is still unknown if a certain capability is needed. A central capability setup is therefore not possible, capabilities must be individually enabled once needed during initialization. To avoid a duplicate register probe and overlapping I/O mappings, only probe the Component Registers one time and store the Component Register mapping in struct port. The stored mappings can be used later to iomap the capability register range when enabling the capability, which will be implemented in a follow-on patch. Signed-off-by: Robert Richter Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230622205523.85375-15-terry.bowman@amd.com Signed-off-by: Dan Williams commit 733b57f262b0e9f05ffeac102fe5bd729e263170 Author: Robert Richter Date: Thu Jun 22 15:55:09 2023 -0500 cxl/pci: Early setup RCH dport component registers from RCRB CXL RAS capabilities must be enabled and accessible as soon as the CXL endpoint is detected in the PCI hierarchy and bound to the cxl_pci driver. This needs to be independent of other modules such as cxl_port or cxl_mem. CXL RAS capabilities reside in the Component Registers. For an RCH this is determined by probing RCRB which is implemented very late once the CXL Memory Device is created. Change this by moving the RCRB probe to the cxl_pci driver. Do this by using a new introduced function cxl_pci_find_port() similar to cxl_mem_find_port() to determine the involved dport by the endpoint's PCI handle. Plug this into the existing cxl_pci_setup_regs() function to setup Component Registers. Probe the RCRB in case the Component Registers cannot be located through the CXL Register Locator capability. This unifies code and early sets up the Component Registers at the same time for both, VH and RCH mode. Only the cxl_pci driver is involved for this. This allows an early mapping of the CXL RAS capability registers. Signed-off-by: Robert Richter Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230622205523.85375-14-terry.bowman@amd.com Signed-off-by: Dan Williams commit 86917c560dcf29270093768d947387ca00f729b4 Author: Robert Richter Date: Thu Jun 22 15:55:08 2023 -0500 cxl/mem: Prepare for early RCH dport component register setup In order to move the RCH dport component register setup to cxl_pci the base address must be stored in CXL device state (cxlds) for both modes, RCH and VH. Store it in cxlds->component_reg_phys and use it for endpoint creation. Signed-off-by: Robert Richter Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230622205523.85375-13-terry.bowman@amd.com Signed-off-by: Dan Williams commit f1d0525effc4fffe821905671ea24c30a4bfa393 Author: Robert Richter Date: Thu Jun 22 15:55:07 2023 -0500 cxl/regs: Remove early capability checks in Component Register setup When probing the Component Registers in function cxl_probe_regs() there are also checks for the existence of the HDM and RAS capabilities. The checks may fail for components that do not implement the HDM capability causing the Component Registers setup to fail too. Remove the checks for a generalized use of cxl_probe_regs() and check them directly before mapping the RAS or HDM capabilities. This allows it to setup other Component Registers esp. of an RCH Downstream Port, which will be implemented in a follow-on patch. Signed-off-by: Robert Richter Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230622205523.85375-12-terry.bowman@amd.com Signed-off-by: Dan Williams commit d8bffff2016f7aef1c1dbe01125720475507b6f2 Author: Robert Richter Date: Thu Jun 22 15:55:06 2023 -0500 cxl/port: Remove Component Register base address from struct cxl_dport The Component Register base address @component_reg_phys is no longer used after the rework of the Component Register setup which now uses struct member @comp_map instead. Remove the base address. Signed-off-by: Robert Richter Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230622205523.85375-11-terry.bowman@amd.com Signed-off-by: Dan Williams commit d02034b4025a086b1294bfd4a2e77525e816cea4 Author: Robert Richter Date: Thu Jun 22 15:55:05 2023 -0500 cxl/acpi: Directly bind the CEDT detected CHBCR to the Host Bridge's port During a Host Bridge's downstream port enumeration the CHBS entries in the CEDT table are parsed, its Component Register base address extracted and then stored in struct cxl_dport. The CHBS may contain either the RCRB (RCH mode) or the Host Bridge's Component Registers (CHBCR, VH mode). The RCRB further contains the CXL downstream port register base address, while in VH mode the CXL Downstream Switch Ports are visible in the PCI hierarchy and the DP's component regs are disovered using the CXL DVSEC register locator capability. The Component Registers derived from the CHBS for both modes are different and thus also must be treated differently. That is, in RCH mode, the component regs base should be bound to the dport, but in VH mode to the CXL host bridge's port object. The current implementation stores the CHBCR in addition in struct cxl_dport and copies it later from there to struct cxl_port. As a result, the dport contains the wrong Component Registers base address and, e.g. the RAS capability of a CXL Root Port cannot be detected. To fix the CHBCR binding, attach it directly to the Host Bridge's @cxl_port structure. Do this during port creation of the Host Bridge in add_host_bridge_uport(). Factor out CHBS parsing code in add_host_bridge_dport() and use it in both functions. Co-developed-by: Dan Williams Signed-off-by: Robert Richter Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230622205523.85375-10-terry.bowman@amd.com Signed-off-by: Dan Williams commit f44c7b7ad9b8def769ba709e369fe92906250c02 Author: Robert Richter Date: Thu Jun 22 15:55:04 2023 -0500 cxl/acpi: Move add_host_bridge_uport() after cxl_get_chbs() Just moving code to reorder functions to later share cxl_get_chbs() with add_host_bridge_uport(). This makes changes in the next patch visible. No other changes at all. Signed-off-by: Robert Richter Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230622205523.85375-9-terry.bowman@amd.com Signed-off-by: Dan Williams commit d076bb8c4cee23fa1ddeae36f72a4695529c9198 Author: Terry Bowman Date: Thu Jun 22 15:55:03 2023 -0500 cxl/pci: Refactor component register discovery for reuse The endpoint implements component register setup code. Refactor it for reuse with RCRB, downstream port, and upstream port setup. Move PCI specifics from cxl_setup_regs() into cxl_pci_setup_regs(). Move cxl_setup_regs() into cxl/core/regs.c and export it. This also includes supporting static functions cxl_map_registerblock(), cxl_unmap_register_block() and cxl_probe_regs(). Co-developed-by: Robert Richter Signed-off-by: Robert Richter Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230622205523.85375-8-terry.bowman@amd.com Signed-off-by: Dan Williams commit 573408049b7598a7c4ef6981b70b1275447d28e4 Author: Robert Richter Date: Thu Jun 22 15:55:02 2023 -0500 cxl/core/regs: Add @dev to cxl_register_map The corresponding device of a register mapping is used for devm operations and logging. For operations with struct cxl_register_map the device needs to be kept track separately. To simpify the involved function interfaces, add @dev to cxl_register_map. While at it also reorder function arguments of cxl_map_device_regs() and cxl_map_component_regs() to have the object @cxl_register_map first. As a result a bunch of functions are available to be used with a @cxl_register_map object. This patch is in preparation of reworking the component register setup code. Signed-off-by: Robert Richter Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230622205523.85375-7-terry.bowman@amd.com Signed-off-by: Dan Williams commit 7481653deef24fb9a030339430d2f5723e0ccf78 Author: Dan Williams Date: Thu Jun 22 15:55:01 2023 -0500 cxl: Rename 'uport' to 'uport_dev' For symmetry with the recent rename of ->dport_dev for a 'struct cxl_dport', add the "_dev" suffix to the ->uport property of a 'struct cxl_port'. These devices represent the downstream-port-device and upstream-port-device respectively in the CXL/PCIe topology. Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230622205523.85375-6-terry.bowman@amd.com Signed-off-by: Dan Williams commit 227db57459e8b6dce33c071020b0c05b1f9fa8d6 Author: Robert Richter Date: Thu Jun 22 15:55:00 2023 -0500 cxl: Rename member @dport of struct cxl_dport to @dport_dev Reading code like dport->dport does not immediately suggest that this points to the corresponding device structure of the dport. Rename struct member @dport to @dport_dev. While at it, also rename @new argument of add_dport() to @dport. This better describes the variable as a dport (e.g. new->dport becomes to dport->dport_dev). Co-developed-by: Terry Bowman Signed-off-by: Terry Bowman Signed-off-by: Robert Richter Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230622205523.85375-5-terry.bowman@amd.com Signed-off-by: Dan Williams commit 0619337856c9a1cb999417be38c4049a6b0235a0 Author: Dan Williams Date: Thu Jun 22 15:54:59 2023 -0500 cxl/rch: Prepare for caching the MMIO mapped PCIe AER capability Prepare cxl_probe_rcrb() for retrieving more than just the component register block. The RCH AER handling code wants to get back to the AER capability that happens to be MMIO mapped rather then configuration cycles. Move RCRB specific downstream port data, like the RCRB base and the AER capability offset, into its own data structure ('struct cxl_rcrb_info') for cxl_probe_rcrb() to fill. Extend 'struct cxl_dport' to include a 'struct cxl_rcrb_info' attribute. This centralizes all RCRB scanning in one routine. Co-developed-by: Robert Richter Signed-off-by: Robert Richter Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230622205523.85375-4-terry.bowman@amd.com Signed-off-by: Dan Williams commit eb4663b07e13bc138aad9e2a93ee9893c7139f51 Author: Robert Richter Date: Sun Jun 25 11:35:20 2023 -0700 cxl/acpi: Probe RCRB later during RCH downstream port creation The RCRB is extracted already during ACPI CEDT table parsing while the data of this is needed not earlier than dport creation. This implementation comes with drawbacks: During ACPI table scan there is already MMIO access including mapping and unmapping, but only ACPI data should be collected here. The collected data must be transferred through a couple of interfaces until it is finally consumed when creating the dport. This causes complex data structures and function interfaces. Additionally, RCRB parsing will be extended to also extract AER data, it would be much easier do this at a later point during port and dport creation when the data structures are available to hold that data. To simplify all that, probe the RCRB at a later point during RCH downstream port creation. Change ACPI table parser to only extract the base address of either the component registers or the RCRB. Parse and extract the RCRB in devm_cxl_add_rch_dport(). This is in preparation to centralize all RCRB scanning. Signed-off-by: Robert Richter Signed-off-by: Terry Bowman Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20230622205523.85375-2-terry.bowman@amd.com Co-developed-by: Dan Williams Link: https://lore.kernel.org/r/20230622205523.85375-3-terry.bowman@amd.com Signed-off-by: Dan Williams commit 8e86ebefdd5ca15458fcb3a03da89ab9cad6382b Author: Masahiro Yamada Date: Tue Jun 20 21:05:21 2023 +0900 modpost: continue even with unknown relocation type Currently, unknown relocation types are just skipped. The value of r_addend is only needed to get the symbol name in case is_valid_name(elf, sym) returns false. Even if we do not know how to calculate r_addend, we should continue. At worst, we will get "(unknown)" as the symbol name, but it is better than failing to detect section mismatches. Signed-off-by: Masahiro Yamada commit 8aa00e2c3da470c82148f64b6a3cac2d79bb9d16 Author: Masahiro Yamada Date: Tue Jun 20 21:05:20 2023 +0900 modpost: factor out Elf_Sym pointer calculation to section_rel() Pass the Elf_Sym pointer to addend_arm_rel() as well as to check_section_mismatch(). Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit b31db651f745604371e4d3304f5b16fc3d9d0110 Author: Masahiro Yamada Date: Tue Jun 20 21:05:19 2023 +0900 modpost: factor out inst location calculation to section_rel() All the addend_*_rel() functions calculate the instruction location in the same way. Factor out the similar code to the caller. Squash reloc_location() too. Signed-off-by: Masahiro Yamada commit 25a21fbb934a0d989e1858f83c2ddf4cfb2ebe30 Author: Sami Tolvanen Date: Fri Jun 23 00:11:43 2023 +0000 kbuild: Disable GCOV for *.mod.o With GCOV_PROFILE_ALL, Clang injects __llvm_gcov_* functions to each object file, including the *.mod.o. As we filter out CC_FLAGS_CFI for *.mod.o, the compiler won't generate type hashes for the injected functions, and therefore indirectly calling them during module loading trips indirect call checking. Enabling CFI for *.mod.o isn't sufficient to fix this issue after commit 0c3e806ec0f9 ("x86/cfi: Add boot time hash randomization"), as *.mod.o aren't processed by objtool, which means any hashes emitted there won't be randomized. Therefore, in addition to disabling CFI for *.mod.o, also disable GCOV, as the object files don't otherwise contain any executable code. Fixes: cf68fffb66d6 ("add support for Clang CFI") Reported-by: Joe Fradley Signed-off-by: Sami Tolvanen Acked-by: Peter Zijlstra (Intel) Reviewed-by: Kees Cook Reviewed-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit ddf56288eebd1fe82c46fc9f693b5b18045cddb6 Author: Sami Tolvanen Date: Fri Jun 23 00:11:42 2023 +0000 kbuild: Fix CFI failures with GCOV With GCOV_PROFILE_ALL, Clang injects __llvm_gcov_* functions to each object file, and the functions are indirectly called during boot. However, when code is injected to object files that are not part of vmlinux.o, it's also not processed by objtool, which breaks CFI hash randomization as the hashes in these files won't be included in the .cfi_sites section and thus won't be randomized. Similarly to commit 42633ed852de ("kbuild: Fix CFI hash randomization with KASAN"), disable GCOV for .vmlinux.export.o and init/version-timestamp.o to avoid emitting unnecessary functions to object files that don't otherwise have executable code. Fixes: 0c3e806ec0f9 ("x86/cfi: Add boot time hash randomization") Reported-by: Joe Fradley Signed-off-by: Sami Tolvanen Acked-by: Peter Zijlstra (Intel) Reviewed-by: Kees Cook Reviewed-by: Nick Desaulniers Signed-off-by: Masahiro Yamada commit 3602906019a68c340b69991bb4020e10374fb0d0 Author: Masahiro Yamada Date: Sun Jun 18 00:30:25 2023 +0900 kbuild: make clean rule robust against too long argument error Commit cd968b97c492 ("kbuild: make built-in.a rule robust against too long argument error") made a build rule robust against "Argument list too long" error. Eugeniu Rosca reported the same error occurred when cleaning an external module. The $(obj)/ prefix can be a very long path for external modules. Apply a similar solution to 'make clean'. Reported-by: Eugeniu Rosca Signed-off-by: Masahiro Yamada Reviewed-by: Eugeniu Rosca Tested-by: Eugeniu Rosca commit c6b7a3a26e809c9d2a51ae303764c1d2994f31cf Author: Ming Lei Date: Sat Jun 24 21:01:05 2023 +0800 blk-mq: fix two misuses on RQF_USE_SCHED Request allocated from sched tags can't be issued via ->queue_rqs() directly, since driver tag isn't allocated yet. This is the 1st misuse of RQF_USE_SCHED for figuring out plug->has_elevator. Request allocated from sched tags can't be ended by blk_mq_end_request_batch() too, fix the 2nd RQF_USE_SCHED misuse in blk_mq_add_to_batch(). Without this patch, NVMe uring cmd passthrough IO workload can run into hang easily with real io scheduler. Fixes: dd6216bb16e8 ("blk-mq: make sure elevator callbacks aren't called for passthrough request") Reported-by: Guangwu Zhang Closes: https://lore.kernel.org/linux-block/CAGS2=YrBjpLPOKa-gzcKuuOG60AGth5794PNCDwatdnnscB9ug@mail.gmail.com/ Cc: Christoph Hellwig Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20230624130105.1443879-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit ad7c3b41e86b59943a903d23c7b037d820e6270c Author: Jinke Han Date: Mon May 8 01:06:31 2023 +0800 blk-throttle: Fix io statistics for cgroup v1 After commit f382fb0bcef4 ("block: remove legacy IO schedulers"), blkio.throttle.io_serviced and blkio.throttle.io_service_bytes become the only stable io stats interface of cgroup v1, and these statistics are done in the blk-throttle code. But the current code only counts the bios that are actually throttled. When the user does not add the throttle limit, the io stats for cgroup v1 has nothing. I fix it according to the statistical method of v2, and made it count all ios accurately. Fixes: a7b36ee6ba29 ("block: move blk-throtl fast path inline") Tested-by: Andrea Righi Signed-off-by: Jinke Han Acked-by: Muchun Song Acked-by: Tejun Heo Link: https://lore.kernel.org/r/20230507170631.89607-1-hanjinke.666@bytedance.com Signed-off-by: Jens Axboe commit 4e0871333661d2ec0ed3dc00a945c2160eccae77 Author: Matthias Reichl Date: Sat Jun 24 18:52:32 2023 +0200 ASoC: hdmi-codec: fix channel info for compressed formats According to CTA 861 the channel/speaker allocation info in the audio infoframe only applies to uncompressed (PCM) audio streams. The channel count info should indicate the number of channels in the transmitted audio, which usually won't match the number of channels used to transmit the compressed bitstream. Some devices (eg some Sony TVs) will refuse to decode compressed audio if these values are not set correctly. To fix this we can simply set the channel count to 0 (which means "refer to stream header") and set the channel/speaker allocation to 0 as well (which would mean stereo FL/FR for PCM, a safe value all sinks will support) when transmitting compressed audio. Signed-off-by: Matthias Reichl Link: https://lore.kernel.org/r/20230624165232.5751-1-hias@horus.com Signed-off-by: Takashi Iwai commit 04b49b90caeed0b5544ff616d654900d27d403b6 Author: Matthias Reichl Date: Sat Jun 24 18:52:16 2023 +0200 ALSA: pcm: fix ELD constraints for (E)AC3, DTS(-HD) and MLP formats The SADs of compressed formats contain the channel and sample rate info of the audio data inside the compressed stream, but when building constraints we must use the rates and channels used to transport the compressed streams. eg 48kHz 6ch EAC3 needs to be transmitted as a 2ch 192kHz stream. This patch fixes the constraints for the common AC3 and DTS formats, the constraints for the less common MPEG, DSD etc formats are copied directly from the info in the SADs as before as I don't have the specs and equipment to test those. Signed-off-by: Matthias Reichl Link: https://lore.kernel.org/r/20230624165216.5719-1-hias@horus.com Signed-off-by: Takashi Iwai commit 4dbbaf8fbdbd13adc80731b2452257857e4c2d8b Author: Jerrod Frost Date: Sat Jun 24 22:23:44 2023 -0300 hwmon: (oxp-sensors) Add support for AOKZOE A1 PRO This device is an iteration over the AOKZOE A1 with the same EC mapping and features. It also has support for tt_toggle. Signed-off-by: Jerrod Frost Signed-off-by: Joaquín Ignacio Aramendía Link: https://lore.kernel.org/r/20230625012347.121352-2-samsagax@gmail.com Signed-off-by: Guenter Roeck commit 9ae440b8fdd6772b6c007fa3d3766530a09c9045 Merge: b545a13ca9b20 b848b26c6672c Author: Jakub Kicinski Date: Sat Jun 24 15:50:21 2023 -0700 Merge branch 'splice-net-switch-over-users-of-sendpage-and-remove-it' David Howells says: ==================== splice, net: Switch over users of sendpage() and remove it Here's the final set of patches towards the removal of sendpage. All the drivers that use sendpage() get switched over to using sendmsg() with MSG_SPLICE_PAGES. The following changes are made: (1) Make the protocol drivers behave according to MSG_MORE, not MSG_SENDPAGE_NOTLAST. The latter is restricted to turning on MSG_MORE in the sendpage() wrappers. (2) Fix ocfs2 to allocate its global protocol buffers with folio_alloc() rather than kzalloc() so as not to invoke the !sendpage_ok warning in skb_splice_from_iter(). (3) Make ceph/rds, skb_send_sock, dlm, nvme, smc, ocfs2, drbd and iscsi use sendmsg(), not sendpage and make them specify MSG_MORE instead of MSG_SENDPAGE_NOTLAST. (4) Kill off sendpage and clean up MSG_SENDPAGE_NOTLAST. Link: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=51c78a4d532efe9543a4df019ff405f05c6157f6 # part 1 Link: https://lore.kernel.org/r/20230616161301.622169-1-dhowells@redhat.com/ # v1 Link: https://lore.kernel.org/r/20230617121146.716077-1-dhowells@redhat.com/ # v2 Link: https://lore.kernel.org/r/20230620145338.1300897-1-dhowells@redhat.com/ # v3 ==================== Link: https://lore.kernel.org/r/20230623225513.2732256-1-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit b848b26c6672c9b977890ba85f5a155e5eb221f0 Author: David Howells Date: Fri Jun 23 23:55:13 2023 +0100 net: Kill MSG_SENDPAGE_NOTLAST Now that ->sendpage() has been removed, MSG_SENDPAGE_NOTLAST can be cleaned up. Things were converted to use MSG_MORE instead, but the protocol sendpage stubs still convert MSG_SENDPAGE_NOTLAST to MSG_MORE, which is now unnecessary. Signed-off-by: David Howells cc: Jens Axboe cc: Matthew Wilcox cc: linux-afs@lists.infradead.org cc: mptcp@lists.linux.dev cc: rds-devel@oss.oracle.com cc: tipc-discussion@lists.sourceforge.net cc: virtualization@lists.linux-foundation.org Link: https://lore.kernel.org/r/20230623225513.2732256-17-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit dc97391e661009eab46783030d2404c9b6e6f2e7 Author: David Howells Date: Fri Jun 23 23:55:12 2023 +0100 sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES) Remove ->sendpage() and ->sendpage_locked(). sendmsg() with MSG_SPLICE_PAGES should be used instead. This allows multiple pages and multipage folios to be passed through. Signed-off-by: David Howells Acked-by: Marc Kleine-Budde # for net/can cc: Jens Axboe cc: Matthew Wilcox cc: linux-afs@lists.infradead.org cc: mptcp@lists.linux.dev cc: rds-devel@oss.oracle.com cc: tipc-discussion@lists.sourceforge.net cc: virtualization@lists.linux-foundation.org Link: https://lore.kernel.org/r/20230623225513.2732256-16-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit e52828cc0109f511bba1dfb41292833c2fd3b6e6 Author: David Howells Date: Fri Jun 23 23:55:11 2023 +0100 ocfs2: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage() Switch ocfs2 from using sendpage() to using sendmsg() + MSG_SPLICE_PAGES so that sendpage can be phased out. Signed-off-by: David Howells cc: Mark Fasheh cc: Joel Becker cc: Joseph Qi cc: ocfs2-devel@oss.oracle.com Link: https://lore.kernel.org/r/20230623225513.2732256-15-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 86d7bd6e66e9925f0f04a7bcf3c92c05fdfefb5a Author: David Howells Date: Fri Jun 23 23:55:10 2023 +0100 ocfs2: Fix use of slab data with sendpage ocfs2 uses kzalloc() to allocate buffers for o2net_hand, o2net_keep_req and o2net_keep_resp and then passes these to sendpage. This isn't really allowed as the lifetime of slab objects is not controlled by page ref - though in this case it will probably work. sendmsg() with MSG_SPLICE_PAGES will, however, print a warning and give an error. Fix it to use folio_alloc() instead to allocate a buffer for the handshake message, keepalive request and reply messages. Fixes: 98211489d414 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem") Signed-off-by: David Howells cc: Mark Fasheh cc: Kurt Hackel cc: Joel Becker cc: Joseph Qi cc: ocfs2-devel@oss.oracle.com Link: https://lore.kernel.org/r/20230623225513.2732256-14-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit d2fe21077d6d4687ecab642ffe97c2e4acf3a547 Author: David Howells Date: Fri Jun 23 23:55:09 2023 +0100 scsi: target: iscsi: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage Use sendmsg() with MSG_SPLICE_PAGES rather than sendpage. This allows multiple pages and multipage folios to be passed through. TODO: iscsit_fe_sendpage_sg() should perhaps set up a bio_vec array for the entire set of pages it's going to transfer plus two for the header and trailer and page fragments to hold the header and trailer - and then call sendmsg once for the entire message. Signed-off-by: David Howells cc: Mike Christie cc: Maurizio Lombardi cc: "James E.J. Bottomley" cc: "Martin K. Petersen" cc: Jens Axboe cc: Matthew Wilcox cc: Al Viro cc: open-iscsi@googlegroups.com Link: https://lore.kernel.org/r/20230623225513.2732256-13-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit fa8df3435727a7b398760ef5e2ac95457a62ae1b Author: David Howells Date: Fri Jun 23 23:55:08 2023 +0100 scsi: iscsi_tcp: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage Use sendmsg() with MSG_SPLICE_PAGES rather than sendpage. This allows multiple pages and multipage folios to be passed through. Signed-off-by: David Howells Reviewed-by: Mike Christie cc: Lee Duncan cc: Chris Leech cc: "James E.J. Bottomley" cc: "Martin K. Petersen" cc: Jens Axboe cc: Matthew Wilcox cc: Al Viro cc: open-iscsi@googlegroups.com Link: https://lore.kernel.org/r/20230623225513.2732256-12-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit eeac7405c735acde8ec78869489a5aa25a141c13 Author: David Howells Date: Fri Jun 23 23:55:07 2023 +0100 drbd: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage() Use sendmsg() conditionally with MSG_SPLICE_PAGES in _drbd_send_page() rather than calling sendpage() or _drbd_no_send_page(). Signed-off-by: David Howells cc: Philipp Reisner cc: Lars Ellenberg cc: "Christoph Böhmwalder" cc: Jens Axboe cc: drbd-dev@lists.linbit.com Link: https://lore.kernel.org/r/20230623225513.2732256-11-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 2f8bc2bbb0fa87bcf7fb9eeb65eb6d79c5a08895 Author: David Howells Date: Fri Jun 23 23:55:06 2023 +0100 smc: Drop smc_sendpage() in favour of smc_sendmsg() + MSG_SPLICE_PAGES Drop the smc_sendpage() code as smc_sendmsg() just passes the call down to the underlying TCP socket and smc_tx_sendpage() is just a wrapper around its sendmsg implementation. Signed-off-by: David Howells cc: Karsten Graul cc: Wenjia Zhang cc: Jan Karcher cc: "D. Wythe" cc: Tony Lu cc: Wen Gu cc: Jens Axboe cc: Matthew Wilcox Link: https://lore.kernel.org/r/20230623225513.2732256-10-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit c336a79983c7e67a0a163ab4feafa3c273d915be Author: David Howells Date: Fri Jun 23 23:55:05 2023 +0100 nvmet-tcp: Use sendmsg(MSG_SPLICE_PAGES) rather then sendpage When transmitting data, call down into TCP using a single sendmsg with MSG_SPLICE_PAGES to indicate that content should be spliced rather than copied instead of calling sendpage. Signed-off-by: David Howells Tested-by: Sagi Grimberg Acked-by: Willem de Bruijn cc: Keith Busch cc: Jens Axboe cc: Christoph Hellwig cc: Chaitanya Kulkarni cc: Jens Axboe cc: Matthew Wilcox cc: linux-nvme@lists.infradead.org Link: https://lore.kernel.org/r/20230623225513.2732256-9-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 7769887817c3dc49b55957badcbd515cf925728b Author: David Howells Date: Fri Jun 23 23:55:04 2023 +0100 nvme-tcp: Use sendmsg(MSG_SPLICE_PAGES) rather then sendpage When transmitting data, call down into TCP using a sendmsg with MSG_SPLICE_PAGES instead of sendpage. Signed-off-by: David Howells Tested-by: Sagi Grimberg Acked-by: Willem de Bruijn cc: Keith Busch cc: Jens Axboe cc: Christoph Hellwig cc: Chaitanya Kulkarni cc: Jens Axboe cc: Matthew Wilcox cc: linux-nvme@lists.infradead.org Link: https://lore.kernel.org/r/20230623225513.2732256-8-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit a1a5e8752786b2f7c5699fb99e3a641936297d69 Author: David Howells Date: Fri Jun 23 23:55:03 2023 +0100 dlm: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage When transmitting data, call down a layer using a single sendmsg with MSG_SPLICE_PAGES to indicate that content should be spliced rather using sendpage. This allows ->sendpage() to be replaced by something that can handle multiple multipage folios in a single transaction. Signed-off-by: David Howells cc: Christine Caulfield cc: David Teigland cc: Jens Axboe cc: Matthew Wilcox cc: cluster-devel@redhat.com Link: https://lore.kernel.org/r/20230623225513.2732256-7-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 572efade27c55f11436ed10bbb59ef10c6d83d93 Author: David Howells Date: Fri Jun 23 23:55:02 2023 +0100 rds: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage When transmitting data, call down into TCP using a single sendmsg with MSG_SPLICE_PAGES to indicate that content should be spliced. To make this work, the data is assembled in a bio_vec array and attached to a BVEC-type iterator. Signed-off-by: David Howells cc: Santosh Shilimkar cc: Jens Axboe cc: Matthew Wilcox cc: rds-devel@oss.oracle.com Link: https://lore.kernel.org/r/20230623225513.2732256-6-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit fa094ccae1e7904d9fa7bb1bc44c9873eec7baf4 Author: David Howells Date: Fri Jun 23 23:55:01 2023 +0100 ceph: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage() Use sendmsg() and MSG_SPLICE_PAGES rather than sendpage in ceph when transmitting data. For the moment, this can only transmit one page at a time because of the architecture of net/ceph/, but if write_partial_message_data() can be given a bvec[] at a time by the iteration code, this would allow pages to be sent in a batch. Signed-off-by: David Howells cc: Ilya Dryomov cc: Xiubo Li cc: Jeff Layton cc: Jens Axboe cc: Matthew Wilcox Link: https://lore.kernel.org/r/20230623225513.2732256-5-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit 40a8c17aa7709caaeb9c6945297a98fe8699ca1b Author: David Howells Date: Fri Jun 23 23:55:00 2023 +0100 ceph: Use sendmsg(MSG_SPLICE_PAGES) rather than sendpage Use sendmsg() and MSG_SPLICE_PAGES rather than sendpage in ceph when transmitting data. For the moment, this can only transmit one page at a time because of the architecture of net/ceph/, but if write_partial_message_data() can be given a bvec[] at a time by the iteration code, this would allow pages to be sent in a batch. Signed-off-by: David Howells cc: Ilya Dryomov cc: Xiubo Li cc: Jeff Layton cc: Jens Axboe cc: Matthew Wilcox Link: https://lore.kernel.org/r/20230623225513.2732256-4-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit c729ed6f5be57b4d164dbbc415554c066e29306b Author: David Howells Date: Fri Jun 23 23:54:59 2023 +0100 net: Use sendmsg(MSG_SPLICE_PAGES) not sendpage in skb_send_sock() Use sendmsg() with MSG_SPLICE_PAGES rather than sendpage in skb_send_sock(). This causes pages to be spliced from the source iterator if possible. This allows ->sendpage() to be replaced by something that can handle multiple multipage folios in a single transaction. Note that this could perhaps be improved to fill out a bvec array with all the frags and then make a single sendmsg call, possibly sticking the header on the front also. Signed-off-by: David Howells cc: Jens Axboe cc: Matthew Wilcox Link: https://lore.kernel.org/r/20230623225513.2732256-3-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit f8dd95b29d7ef08c19ec9720564acf72243ddcf6 Author: David Howells Date: Fri Jun 23 23:54:58 2023 +0100 tcp_bpf, smc, tls, espintcp, siw: Reduce MSG_SENDPAGE_NOTLAST usage As MSG_SENDPAGE_NOTLAST is being phased out along with sendpage(), don't use it further in than the sendpage methods, but rather translate it to MSG_MORE and use that instead. Signed-off-by: David Howells cc: Willem de Bruijn cc: Bernard Metzler cc: Jason Gunthorpe cc: Leon Romanovsky cc: John Fastabend cc: Jakub Sitnicki cc: David Ahern cc: Karsten Graul cc: Wenjia Zhang cc: Jan Karcher cc: "D. Wythe" cc: Tony Lu cc: Wen Gu cc: Boris Pismenny cc: Steffen Klassert cc: Herbert Xu Link: https://lore.kernel.org/r/20230623225513.2732256-2-dhowells@redhat.com Signed-off-by: Jakub Kicinski commit b545a13ca9b203eacce1e52ae2e32f99b860347c Merge: 35bf34b07808e 29e4c95faee52 Author: Jakub Kicinski Date: Sat Jun 24 15:48:04 2023 -0700 Merge tag 'mlx5-updates-2023-06-21' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-updates-2023-06-21 mlx5 driver minor cleanup and fixes to net-next * tag 'mlx5-updates-2023-06-21' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5: Remove pointless vport lookup from mlx5_esw_check_port_type() net/mlx5: Remove redundant check from mlx5_esw_query_vport_vhca_id() net/mlx5: Remove redundant is_mdev_switchdev_mode() check from is_ib_rep_supported() net/mlx5: Remove redundant MLX5_ESWITCH_MANAGER() check from is_ib_rep_supported() net/mlx5e: E-Switch, Fix shared fdb error flow net/mlx5e: Remove redundant comment net/mlx5e: E-Switch, Pass other_vport flag if vport is not 0 net/mlx5e: E-Switch, Use xarray for devcom paired device index net/mlx5e: E-Switch, Add peer fdb miss rules for vport manager or ecpf net/mlx5e: Use vhca_id for device index in vport rx rules net/mlx5: Lag, Remove duplicate code checking lag is supported net/mlx5: Fix error code in mlx5_is_reset_now_capable() net/mlx5: Fix reserved at offset in hca_cap register net/mlx5: Fix SFs kernel documentation error net/mlx5: Fix UAF in mlx5_eswitch_cleanup() ==================== Link: https://lore.kernel.org/r/20230623192907.39033-1-saeed@kernel.org Signed-off-by: Jakub Kicinski commit 35bf34b07808e4ff405b8c87aae049d5ca4219c6 Merge: 2ffecf1a42ccd 334f39ce17eff Author: Jakub Kicinski Date: Sat Jun 24 15:45:51 2023 -0700 Merge branch 'netlink-add-display-hint-to-ynl' Donald Hunter says: ==================== netlink: add display-hint to ynl Add a display-hint property to the netlink schema, to be used by generic netlink clients as hints about how to display attribute values. A display-hint on an attribute definition is intended for letting a client such as ynl know that, for example, a u32 should be rendered as an ipv4 address. The display-hint enumeration includes a small number of networking domain-specific value types. ==================== Link: https://lore.kernel.org/r/20230623201928.14275-1-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit 334f39ce17eff255f243ab5998af27ae40f9f04c Author: Donald Hunter Date: Fri Jun 23 21:19:28 2023 +0100 netlink: specs: add display hints to ovs_flow Add display hints for mac, ipv4, ipv6, hex and uuid to the ovs_flow schema. Signed-off-by: Donald Hunter Link: https://lore.kernel.org/r/20230623201928.14275-4-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit d8eea68d913c20aabb3a97bc1e9ba61407a9e872 Author: Donald Hunter Date: Fri Jun 23 21:19:27 2023 +0100 tools: ynl: add display-hint support to ynl Add support to the ynl tool for rendering output based on display-hint properties. Signed-off-by: Donald Hunter Link: https://lore.kernel.org/r/20230623201928.14275-3-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit 737eab775d367b0ba6575d8aa2073c607a9bcf9e Author: Donald Hunter Date: Fri Jun 23 21:19:26 2023 +0100 netlink: specs: add display-hint to schema definitions Add a display-hint property to the netlink schema that is for providing optional hints to generic netlink clients about how to display attribute values. A display-hint on an attribute definition is intended for letting a client such as ynl know that, for example, a u32 should be rendered as an ipv4 address. The display-hint enumeration includes a small number of networking domain-specific value types. Signed-off-by: Donald Hunter Link: https://lore.kernel.org/r/20230623201928.14275-2-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit 2ffecf1a42ccd67e4b2fec7a613e375014869d60 Merge: 14fd5e0d484a0 18b849f12dcc3 Author: Jakub Kicinski Date: Sat Jun 24 15:41:46 2023 -0700 Merge tag 'ieee802154-for-net-next-2023-06-23' of gitolite.kernel.org:pub/scm/linux/kernel/git/wpan/wpan-next Miquel Raynal says: ==================== Core WPAN changes: - Support for active scans - Support for answering BEACON_REQ - Specific MLME handling for limited devices WPAN driver changes: - ca8210: - Flag the devices as limited - Remove stray gpiod_unexport() call * tag 'ieee802154-for-net-next-2023-06-23' of gitolite.kernel.org:pub/scm/linux/kernel/git/wpan/wpan-next: ieee802154: ca8210: Remove stray gpiod_unexport() call ieee802154: ca8210: Flag the driver as being limited net: ieee802154: Handle limited devices with only datagram support mac802154: Handle received BEACON_REQ ieee802154: Add support for allowing to answer BEACON_REQ mac802154: Handle active scanning ieee802154: Add support for user active scan requests ==================== Link: https://lore.kernel.org/r/20230623195506.40b87b5f@xps-13 Signed-off-by: Jakub Kicinski commit f1bc9fc4a06de0108e0dca2a9a7e99ba1fc632f9 Author: Maxim Kochetkov Date: Thu Jun 22 22:22:45 2023 +0300 net: axienet: Move reset before 64-bit DMA detection 64-bit DMA detection will fail if axienet was started before (by boot loader, boot ROM, etc). In this state axienet will not start properly. XAXIDMA_TX_CDESC_OFFSET + 4 register (MM2S_CURDESC_MSB) is used to detect 64-bit DMA capability here. But datasheet says: When DMACR.RS is 1 (axienet is in enabled state), CURDESC_PTR becomes Read Only (RO) and is used to fetch the first descriptor. So iowrite32()/ioread32() trick to this register to detect 64-bit DMA will not work. So move axienet reset before 64-bit DMA detection. Fixes: f735c40ed93c ("net: axienet: Autodetect 64-bit DMA capability") Signed-off-by: Maxim Kochetkov Reviewed-by: Robert Hancock Reviewed-by: Radhey Shyam Pandey Link: https://lore.kernel.org/r/20230622192245.116864-1-fido_max@inbox.ru Signed-off-by: Jakub Kicinski commit 14fd5e0d484a0e17e8e012d44b5af80d76ac8672 Merge: c4015bbee9c09 e6b8a78ea266a Author: Jakub Kicinski Date: Sat Jun 24 15:38:02 2023 -0700 Merge branch 'selftests-mptcp-refactoring-and-minor-fixes' Mat Martineau says: ==================== selftests: mptcp: Refactoring and minor fixes Patch 1 moves code around for clarity and improved code reuse. Patch 2 makes use of new MPTCP info that consolidates MPTCP-level and subflow-level information. Patches 3-7 refactor code to favor limited-scope environment vars over optional parameters. Patch 8: typo fix ==================== Link: https://lore.kernel.org/r/20230623-send-net-next-20230623-v1-0-a883213c8ba9@kernel.org Signed-off-by: Jakub Kicinski commit e6b8a78ea266a2feeb3ac8cc6ed45bf667f6e405 Author: Yueh-Shun Li Date: Fri Jun 23 10:34:14 2023 -0700 selftests: mptcp: connect: fix comment typo Spell "transmissions" properly. Found by searching for keyword "tranm". Reviewed-by: Matthieu Baerts Signed-off-by: Yueh-Shun Li Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20230623-send-net-next-20230623-v1-8-a883213c8ba9@kernel.org Signed-off-by: Jakub Kicinski commit 9e9d176df8e9aa74c9efc09ac1b4d348261cb630 Author: Geliang Tang Date: Fri Jun 23 10:34:13 2023 -0700 selftests: mptcp: add pm_nl_set_endpoint helper This patch moves endpoint settings out of do_transfer() into a new helper pm_nl_set_endpoint(). And invoke this helper in do_transfer(). This makes the code much more clearer. Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20230623-send-net-next-20230623-v1-7-a883213c8ba9@kernel.org Signed-off-by: Jakub Kicinski commit 1534f87ee0dc1328043f7d0872fbf34937185682 Author: Geliang Tang Date: Fri Jun 23 10:34:12 2023 -0700 selftests: mptcp: drop sflags parameter run_tests() accepts too many optional parameters. Before this modification, it was required to set all of then when only the last one had to be changed. That's not clear to see all these 0 and it makes the maintenance harder: run_tests $ns1 $ns2 10.0.1.1 1 2 3 slow Instead, the parameter can be set as an env var with a limited scope: foo=1 bar=2 next=3 \ run_tests $ns1 $ns2 10.0.1.1 slow This patch switches to key/value "sflags=*" instead of positional parameter sflags of do_transfer() and run_tests(). Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20230623-send-net-next-20230623-v1-6-a883213c8ba9@kernel.org Signed-off-by: Jakub Kicinski commit 595ef566a2ef9af9e799491580e57c09c64c4e6d Author: Geliang Tang Date: Fri Jun 23 10:34:11 2023 -0700 selftests: mptcp: drop addr_nr_ns1/2 parameters run_tests() accepts too many optional parameters. Before this modification, it was required to set all of then when only the last one had to be changed. That's not clear to see all these 0 and it makes the maintenance harder: run_tests $ns1 $ns2 10.0.1.1 1 2 3 slow Instead, the parameter can be set as an env var with a limited scope: foo=1 bar=2 next=3 \ run_tests $ns1 $ns2 10.0.1.1 slow This patch switches to key/value "addr_nr_ns1=*, addr_nr_ns2=*" instead of positional parameters addr_nr_ns1 and addr_nr_ns2 of do_transfer() and run_tests(). Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20230623-send-net-next-20230623-v1-5-a883213c8ba9@kernel.org Signed-off-by: Jakub Kicinski commit 0c93af1f8907902692014fd7072d54e275034800 Author: Geliang Tang Date: Fri Jun 23 10:34:10 2023 -0700 selftests: mptcp: drop test_linkfail parameter run_tests() accepts too many optional parameters. Before this modification, it was required to set all of then when only the last one had to be changed. That's not clear to see all these 0 and it makes the maintenance harder: run_tests $ns1 $ns2 10.0.1.1 1 2 3 slow Instead, the parameter can be set as an env var with a limited scope: foo=1 bar=2 next=3 \ run_tests $ns1 $ns2 10.0.1.1 slow This patch switches to key/value "test_linkfail=*" instead of positional parameter test_linkfail of do_transfer() and run_tests(). Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20230623-send-net-next-20230623-v1-4-a883213c8ba9@kernel.org Signed-off-by: Jakub Kicinski commit be7e9786c9155c2942cd53b813e4723be67e07c4 Author: Geliang Tang Date: Fri Jun 23 10:34:09 2023 -0700 selftests: mptcp: set FAILING_LINKS in run_tests Set FAILING_LINKS as an env var with a limited scope only when calling run_tests(). Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20230623-send-net-next-20230623-v1-3-a883213c8ba9@kernel.org Signed-off-by: Jakub Kicinski commit d7ced753aa851f54735d20ca49ddf4710e43f1d1 Author: Geliang Tang Date: Fri Jun 23 10:34:08 2023 -0700 selftests: mptcp: check subflow and addr infos New MPTCP info are being checked in multiple places to improve the code coverage when using the userspace PM. This patch makes chk_mptcp_info() more generic to be able to check subflows, add_addr_signal and add_addr_accepted info (and even more later). New arguments are now required to get different infos from the two namespaces because some counters are specific to the client or the server. Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20230623-send-net-next-20230623-v1-2-a883213c8ba9@kernel.org Signed-off-by: Jakub Kicinski commit 4369c198e5990ee077b97c979d678b5abd8a91ba Author: Geliang Tang Date: Fri Jun 23 10:34:07 2023 -0700 selftests: mptcp: test userspace pm out of transfer This patch moves userspace pm tests out of do_transfer(). Move add address test into a new function userspace_pm_add_addr(), and remove address test into userspace_pm_rm_sf_addr_ns1(). Move add subflow test into userspace_pm_add_sf() and remove subflow into userspace_pm_rm_sf_addr_ns2(). Reviewed-by: Matthieu Baerts Signed-off-by: Geliang Tang Signed-off-by: Mat Martineau Link: https://lore.kernel.org/r/20230623-send-net-next-20230623-v1-1-a883213c8ba9@kernel.org Signed-off-by: Jakub Kicinski commit c4015bbee9c0973fb98e2f357a20d1f8266bdf27 Merge: cfd40b82a50f8 4194f32a4b2b1 Author: Jakub Kicinski Date: Sat Jun 24 15:36:05 2023 -0700 Merge branch 'net-stmmac-introduce-devres-helpers-for-stmmac-platform-drivers' Bartosz Golaszewski says: ==================== net: stmmac: introduce devres helpers for stmmac platform drivers The goal of this series is two-fold: to make the API for stmmac platforms more logically correct (by providing functions that acquire resources with release counterparts that undo only their actions and nothing more) and to provide devres variants of commonly use registration functions that allows to significantly simplify the platform drivers. The current pattern for stmmac platform drivers is to call stmmac_probe_config_dt(), possibly the platform's init() callback and then call stmmac_drv_probe(). The resources allocated by these calls will then be released by calling stmmac_pltfr_remove(). This goes against the commonly accepted way of providing each function that allocated a resource with a function that frees it. First: provide wrappers around platform's init() and exit() callbacks that allow users to skip checking if the callbacks exist manually. Second: provide stmmac_pltfr_probe() which calls the platform init() callback and then calls stmmac_drv_probe() together with a variant of stmmac_pltfr_remove() that DOES NOT call stmmac_remove_config_dt(). For now this variant is called stmmac_pltfr_remove_no_dt() but once all users of the old stmmac_pltfr_remove() are converted to the devres helper, it will be renamed back to stmmac_pltfr_remove() and the no_dt function removed. Finally use the devres helpers in dwmac-qco-ethqos to show how much simplier the driver's probe() becomes. This series obviously just starts the conversion process and other platform drivers will need to be converted once the helpers land in net/. ==================== Link: https://lore.kernel.org/r/20230623100417.93592-1-brgl@bgdev.pl Signed-off-by: Jakub Kicinski commit 4194f32a4b2b1e41c00fac7a1f5f63375a94ba11 Author: Bartosz Golaszewski Date: Fri Jun 23 12:04:17 2023 +0200 net: stmmac: dwmac-qcom-ethqos: use devm_stmmac_pltfr_probe() Use the devres variant of stmmac_pltfr_probe() and finally drop the remove() callback entirely. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20230623100417.93592-12-brgl@bgdev.pl Signed-off-by: Jakub Kicinski commit fc9ee2ac4f9c366d92e6bb4c89f316c47d3a8de6 Author: Bartosz Golaszewski Date: Fri Jun 23 12:04:16 2023 +0200 net: stmmac: platform: provide devm_stmmac_pltfr_probe() Provide a devres variant of stmmac_pltfr_probe() which allows users to skip calling stmmac_pltfr_remove() at driver detach. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20230623100417.93592-11-brgl@bgdev.pl Signed-off-by: Jakub Kicinski commit 061425d933ef9259dbe3789a3a3c63063f53202d Author: Bartosz Golaszewski Date: Fri Jun 23 12:04:15 2023 +0200 net: stmmac: dwmac-qco-ethqos: use devm_stmmac_probe_config_dt() Significantly simplify the driver's probe() function by using the devres variant of stmmac_probe_config_dt(). This allows to drop the goto jumps entirely. The remove_new() callback now needs to be switched to stmmac_pltfr_remove_no_dt(). Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20230623100417.93592-10-brgl@bgdev.pl Signed-off-by: Jakub Kicinski commit d74065427374da6659a2d7fad4ec55c8926d43c4 Author: Bartosz Golaszewski Date: Fri Jun 23 12:04:14 2023 +0200 net: stmmac: platform: provide devm_stmmac_probe_config_dt() Provide a devres variant of stmmac_probe_config_dt() that allows users to skip calling stmmac_remove_config_dt() at driver detach. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20230623100417.93592-9-brgl@bgdev.pl Signed-off-by: Jakub Kicinski commit 1be0c9d65e17684865d9ed039ac20eeb21019652 Author: Bartosz Golaszewski Date: Fri Jun 23 12:04:13 2023 +0200 net: stmmac: platform: provide stmmac_pltfr_remove_no_dt() Add a variant of stmmac_pltfr_remove() that only frees resources allocated by stmmac_pltfr_probe() and - unlike stmmac_pltfr_remove() - does not call stmmac_remove_config_dt(). Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20230623100417.93592-8-brgl@bgdev.pl Signed-off-by: Jakub Kicinski commit 0a68a59493e043170be1a064558bae6a30fea39d Author: Bartosz Golaszewski Date: Fri Jun 23 12:04:12 2023 +0200 net: stmmac: dwmac-generic: use stmmac_pltfr_probe() Shrink the code and remove labels by using the new stmmac_pltfr_probe() function. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20230623100417.93592-7-brgl@bgdev.pl Signed-off-by: Jakub Kicinski commit 3d5bf75d76ea8c6bfcffd1b6aa76686d86f9ea34 Author: Bartosz Golaszewski Date: Fri Jun 23 12:04:11 2023 +0200 net: stmmac: platform: provide stmmac_pltfr_probe() Implement stmmac_pltfr_probe() which is the logical API counterpart for stmmac_pltfr_remove(). It calls the platform's init() callback and then probes the stmmac device. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20230623100417.93592-6-brgl@bgdev.pl Signed-off-by: Jakub Kicinski commit 40db9f1ddfcc97425433a609e1f829dde74aa157 Author: Bartosz Golaszewski Date: Fri Jun 23 12:04:10 2023 +0200 net: stmmac: dwmac-generic: use stmmac_pltfr_exit() Shrink the code in dwmac-generic by using the new stmmac_pltfr_exit() helper. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20230623100417.93592-5-brgl@bgdev.pl Signed-off-by: Jakub Kicinski commit 5b0acf8dd2c1bf3349257daad36dc34a8b62571e Author: Bartosz Golaszewski Date: Fri Jun 23 12:04:09 2023 +0200 net: stmmac: platform: provide stmmac_pltfr_exit() Provide a helper wrapper around calling the platform's exit() callback. This allows users to skip checking if the callback exists. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20230623100417.93592-4-brgl@bgdev.pl Signed-off-by: Jakub Kicinski commit 4450e7d4231af63027009967b01c8e258966801c Author: Bartosz Golaszewski Date: Fri Jun 23 12:04:08 2023 +0200 net: stmmac: dwmac-generic: use stmmac_pltfr_init() Shrink the code in dwmac-generic by using the new stmmac_pltfr_init() helper. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20230623100417.93592-3-brgl@bgdev.pl Signed-off-by: Jakub Kicinski commit 97117eb51ec8e9c397a0baa0b9d62acb51250a83 Author: Bartosz Golaszewski Date: Fri Jun 23 12:04:07 2023 +0200 net: stmmac: platform: provide stmmac_pltfr_init() Provide a helper wrapper around calling the platform's init() callback. This allows users to skip checking if the callback exists. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20230623100417.93592-2-brgl@bgdev.pl Signed-off-by: Jakub Kicinski commit cfd40b82a50f8c7af7e18c4b207521f7bfce01dc Merge: 2fe11c9d36ee2 b7a0345723385 Author: Jakub Kicinski Date: Sat Jun 24 15:32:18 2023 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-06-22 (ice) This series contains updates to ice driver only. Jake adds a slight wait on control queue send to reduce wait time for responses that occur within normal times. Maciej allows for hot-swapping XDP programs. Przemek removes unnecessary checks when enabling SR-IOV and freeing allocated memory. Christophe Jaillet converts a managed memory allocation to a regular one. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ice: use ice_down_up() where applicable ice: Remove managed memory usage in ice_get_fw_log_cfg() ice: remove null checks before devm_kfree() calls ice: clean up freeing SR-IOV VFs ice: allow hot-swapping XDP programs ice: reduce initial wait for control queue messages ==================== Link: https://lore.kernel.org/r/20230622183601.2406499-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 2fe11c9d36ee2f3dc3c642588c5d9a22190674c9 Author: Pavel Begunkov Date: Fri Jun 23 13:38:55 2023 +0100 net/tcp: optimise locking for blocking splice Even when tcp_splice_read() reads all it was asked for, for blocking sockets it'll release and immediately regrab the socket lock, loop around and break on the while check. Check tss.len right after we adjust it, and return if we're done. That saves us one release_sock(); lock_sock(); pair per successful blocking splice read. Signed-off-by: Pavel Begunkov Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/80736a2cc6d478c383ea565ba825eaf4d1abd876.1687523671.git.asml.silence@gmail.com Signed-off-by: Jakub Kicinski commit ce3aee7114c575fab32a5e9e939d4bbb3dcca79f Author: Kuniyuki Iwashima Date: Thu Jun 22 14:32:31 2023 -0700 gtp: Fix use-after-free in __gtp_encap_destroy(). syzkaller reported use-after-free in __gtp_encap_destroy(). [0] It shows the same process freed sk and touched it illegally. Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock() and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data, but release_sock() is called after sock_put() releases the last refcnt. [0]: BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline] BUG: KASAN: slab-use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:111 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock include/linux/spinlock.h:186 [inline] BUG: KASAN: slab-use-after-free in __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline] BUG: KASAN: slab-use-after-free in _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178 Write of size 4 at addr ffff88800dbef398 by task syz-executor.2/2401 CPU: 1 PID: 2401 Comm: syz-executor.2 Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:351 [inline] print_report+0xcc/0x620 mm/kasan/report.c:462 kasan_report+0xb2/0xe0 mm/kasan/report.c:572 check_region_inline mm/kasan/generic.c:181 [inline] kasan_check_range+0x39/0x1c0 mm/kasan/generic.c:187 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline] queued_spin_lock include/asm-generic/qspinlock.h:111 [inline] do_raw_spin_lock include/linux/spinlock.h:186 [inline] __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline] _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:355 [inline] release_sock+0x1f/0x1a0 net/core/sock.c:3526 gtp_encap_disable_sock drivers/net/gtp.c:651 [inline] gtp_encap_disable+0xb9/0x220 drivers/net/gtp.c:664 gtp_dev_uninit+0x19/0x50 drivers/net/gtp.c:728 unregister_netdevice_many_notify+0x97e/0x1520 net/core/dev.c:10841 rtnl_delete_link net/core/rtnetlink.c:3216 [inline] rtnl_dellink+0x3c0/0xb30 net/core/rtnetlink.c:3268 rtnetlink_rcv_msg+0x450/0xb10 net/core/rtnetlink.c:6423 netlink_rcv_skb+0x15d/0x450 net/netlink/af_netlink.c:2548 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x700/0x930 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x91c/0xe30 net/netlink/af_netlink.c:1913 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0x1b7/0x200 net/socket.c:747 ____sys_sendmsg+0x75a/0x990 net/socket.c:2493 ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2547 __sys_sendmsg+0xfe/0x1d0 net/socket.c:2576 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f1168b1fe5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007f1167edccc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f1168b1fe5d RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f1168b80530 R15: 0000000000000000 Allocated by task 1483: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x59/0x70 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:186 [inline] slab_post_alloc_hook mm/slab.h:711 [inline] slab_alloc_node mm/slub.c:3451 [inline] slab_alloc mm/slub.c:3459 [inline] __kmem_cache_alloc_lru mm/slub.c:3466 [inline] kmem_cache_alloc+0x16d/0x340 mm/slub.c:3475 sk_prot_alloc+0x5f/0x280 net/core/sock.c:2073 sk_alloc+0x34/0x6c0 net/core/sock.c:2132 inet6_create net/ipv6/af_inet6.c:192 [inline] inet6_create+0x2c7/0xf20 net/ipv6/af_inet6.c:119 __sock_create+0x2a1/0x530 net/socket.c:1535 sock_create net/socket.c:1586 [inline] __sys_socket_create net/socket.c:1623 [inline] __sys_socket_create net/socket.c:1608 [inline] __sys_socket+0x137/0x250 net/socket.c:1651 __do_sys_socket net/socket.c:1664 [inline] __se_sys_socket net/socket.c:1662 [inline] __x64_sys_socket+0x72/0xb0 net/socket.c:1662 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 2401: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:521 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free mm/kasan/common.c:200 [inline] __kasan_slab_free+0x10c/0x1b0 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook mm/slub.c:1807 [inline] slab_free mm/slub.c:3786 [inline] kmem_cache_free+0xb4/0x490 mm/slub.c:3808 sk_prot_free net/core/sock.c:2113 [inline] __sk_destruct+0x500/0x720 net/core/sock.c:2207 sk_destruct+0xc1/0xe0 net/core/sock.c:2222 __sk_free+0xed/0x3d0 net/core/sock.c:2233 sk_free+0x7c/0xa0 net/core/sock.c:2244 sock_put include/net/sock.h:1981 [inline] __gtp_encap_destroy+0x165/0x1b0 drivers/net/gtp.c:634 gtp_encap_disable_sock drivers/net/gtp.c:651 [inline] gtp_encap_disable+0xb9/0x220 drivers/net/gtp.c:664 gtp_dev_uninit+0x19/0x50 drivers/net/gtp.c:728 unregister_netdevice_many_notify+0x97e/0x1520 net/core/dev.c:10841 rtnl_delete_link net/core/rtnetlink.c:3216 [inline] rtnl_dellink+0x3c0/0xb30 net/core/rtnetlink.c:3268 rtnetlink_rcv_msg+0x450/0xb10 net/core/rtnetlink.c:6423 netlink_rcv_skb+0x15d/0x450 net/netlink/af_netlink.c:2548 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x700/0x930 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x91c/0xe30 net/netlink/af_netlink.c:1913 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0x1b7/0x200 net/socket.c:747 ____sys_sendmsg+0x75a/0x990 net/socket.c:2493 ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2547 __sys_sendmsg+0xfe/0x1d0 net/socket.c:2576 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc The buggy address belongs to the object at ffff88800dbef300 which belongs to the cache UDPv6 of size 1344 The buggy address is located 152 bytes inside of freed 1344-byte region [ffff88800dbef300, ffff88800dbef840) The buggy address belongs to the physical page: page:00000000d31bfed5 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800dbeed40 pfn:0xdbe8 head:00000000d31bfed5 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff888008ee0801 flags: 0x100000000010200(slab|head|node=0|zone=1) page_type: 0xffffffff() raw: 0100000000010200 ffff88800c7a3000 dead000000000122 0000000000000000 raw: ffff88800dbeed40 0000000080160015 00000001ffffffff ffff888008ee0801 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88800dbef280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88800dbef300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88800dbef380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88800dbef400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88800dbef480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: e198987e7dd7 ("gtp: fix suspicious RCU usage") Reported-by: syzkaller Signed-off-by: Kuniyuki Iwashima Reviewed-by: Pablo Neira Ayuso Link: https://lore.kernel.org/r/20230622213231.24651-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit 5f789f103671fec3733ebe756e56adf15c90c21d Author: Sabrina Dubroca Date: Thu Jun 22 23:03:34 2023 +0200 selftests: rtnetlink: remove netdevsim device after ipsec offload test On systems where netdevsim is built-in or loaded before the test starts, kci_test_ipsec_offload doesn't remove the netdevsim device it created during the test. Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe") Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/e1cb94f4f82f4eca4a444feec4488a1323396357.1687466906.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 3f5f118bb657f94641ea383c7c1b8c09a5d46ea2 Author: Kuniyuki Iwashima Date: Thu Jun 22 11:43:51 2023 -0700 af_unix: Call scm_recv() only after scm_set_cred(). syzkaller hit a WARN_ON_ONCE(!scm->pid) in scm_pidfd_recv(). In unix_stream_read_generic(), if there is no skb in the queue, we could bail out the do-while loop without calling scm_set_cred(): 1. No skb in the queue 2. sk is non-blocking or shutdown(sk, RCV_SHUTDOWN) is called concurrently or peer calls close() If the socket is configured with SO_PASSCRED or SO_PASSPIDFD, scm_recv() would populate cmsg with garbage. Let's not call scm_recv() unless there is skb to receive. WARNING: CPU: 1 PID: 3245 at include/net/scm.h:138 scm_pidfd_recv include/net/scm.h:138 [inline] WARNING: CPU: 1 PID: 3245 at include/net/scm.h:138 scm_recv.constprop.0+0x754/0x850 include/net/scm.h:177 Modules linked in: CPU: 1 PID: 3245 Comm: syz-executor.1 Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:scm_pidfd_recv include/net/scm.h:138 [inline] RIP: 0010:scm_recv.constprop.0+0x754/0x850 include/net/scm.h:177 Code: 67 fd e9 55 fd ff ff e8 4a 70 67 fd e9 7f fd ff ff e8 40 70 67 fd e9 3e fb ff ff e8 36 70 67 fd e9 02 fd ff ff e8 8c 3a 20 fd <0f> 0b e9 fe fb ff ff e8 50 70 67 fd e9 2e f9 ff ff e8 46 70 67 fd RSP: 0018:ffffc90009af7660 EFLAGS: 00010216 RAX: 00000000000000a1 RBX: ffff888041e58a80 RCX: ffffc90003852000 RDX: 0000000000040000 RSI: ffffffff842675b4 RDI: 0000000000000007 RBP: ffffc90009af7810 R08: 0000000000000007 R09: 0000000000000013 R10: 00000000000000f8 R11: 0000000000000001 R12: ffffc90009af7db0 R13: 0000000000000000 R14: ffff888041e58a88 R15: 1ffff9200135eecc FS: 00007f6b7113f640(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6b7111de38 CR3: 0000000012a6e002 CR4: 0000000000770ee0 PKRU: 55555554 Call Trace: unix_stream_read_generic+0x5fe/0x1f50 net/unix/af_unix.c:2830 unix_stream_recvmsg+0x194/0x1c0 net/unix/af_unix.c:2880 sock_recvmsg_nosec net/socket.c:1019 [inline] sock_recvmsg+0x188/0x1d0 net/socket.c:1040 ____sys_recvmsg+0x210/0x610 net/socket.c:2712 ___sys_recvmsg+0xff/0x190 net/socket.c:2754 do_recvmmsg+0x25d/0x6c0 net/socket.c:2848 __sys_recvmmsg net/socket.c:2927 [inline] __do_sys_recvmmsg net/socket.c:2950 [inline] __se_sys_recvmmsg net/socket.c:2943 [inline] __x64_sys_recvmmsg+0x224/0x290 net/socket.c:2943 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f6b71da2e5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007f6b7113ecc8 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00000000004bc050 RCX: 00007f6b71da2e5d RDX: 0000000000000007 RSI: 0000000020006600 RDI: 000000000000000b RBP: 00000000004bc050 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000120 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007f6b71e03530 R15: 0000000000000000 Fixes: 5e2ff6704a27 ("scm: add SO_PASSPIDFD and SCM_PIDFD") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzkaller Signed-off-by: Kuniyuki Iwashima Reviewed-by: Alexander Mikhalitsyn Link: https://lore.kernel.org/r/20230622184351.91544-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski commit 11b73313c12403f617b47752db0ab3deef201af7 Author: Eric Dumazet Date: Thu Jun 22 18:15:03 2023 +0000 sch_netem: fix issues in netem_change() vs get_dist_table() In blamed commit, I missed that get_dist_table() was allocating memory using GFP_KERNEL, and acquiring qdisc lock to perform the swap of newly allocated table with current one. In this patch, get_dist_table() is allocating memory and copy user data before we acquire the qdisc lock. Then we perform swap operations while being protected by the lock. Note that after this patch netem_change() no longer can do partial changes. If an error is returned, qdisc conf is left unchanged. Fixes: 2174a08db80d ("sch_netem: acquire qdisc lock in netem_change()") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Stephen Hemminger Acked-by: Jamal Hadi Salim Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230622181503.2327695-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1c78eb8760c46e5dc2c43937196f745075953428 Merge: 6a11af7c21da0 a4aadf0f59056 Author: Jakub Kicinski Date: Sat Jun 24 15:12:05 2023 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2023-06-22 (iavf) This series contains updates to iavf driver only. Przemek defers removing, previous, primary MAC address until after getting result of adding its replacement. He also does some cleanup by removing unused functions and making applicable functions static. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: iavf: make functions static where possible iavf: remove some unused functions and pointless wrappers iavf: fix err handling for MAC replace ==================== Link: https://lore.kernel.org/r/20230622165914.2203081-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 6a11af7c21da0fdbba101452ddeec2dbe289b174 Author: Randy Dunlap Date: Thu Jun 22 08:54:09 2023 -0700 revert "s390/net: lcs: use IS_ENABLED() for kconfig detection" The referenced patch is causing build errors when ETHERNET=y and FDDI=m. While we work out the preferred patch(es), revert this patch to make the pain go away. Fixes: 128272336120 ("s390/net: lcs: use IS_ENABLED() for kconfig detection") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Link: lore.kernel.org/r/202306202129.pl0AqK8G-lkp@intel.com Cc: Alexandra Winter Cc: Wenjia Zhang Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Alexander Gordeev Cc: Christian Borntraeger Cc: Sven Schnelle Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230622155409.27311-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit 28e219aea0b9ec374de27179c3d45b2d86bfe562 Author: Giulio Benetti Date: Thu Jun 22 20:47:21 2023 +0200 net: phy: broadcom: drop brcm_phy_setbits() and use phy_set_bits() instead Linux provides phy_set_bits() helper so let's drop brcm_phy_setbits() and use phy_set_bits() in its place. Signed-off-by: Giulio Benetti Reviewed-by: Simon Horman Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20230622184721.24368-1-giulio.benetti@benettiengineering.com Signed-off-by: Jakub Kicinski commit eb441289f940c86df47db95044820fa5cf90c21f Merge: 6a940abdef316 c789ad7cbebca Author: Jakub Kicinski Date: Sat Jun 24 15:04:12 2023 -0700 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== igc: TX timestamping fixes This is the fixes part of the series intended to add support for using the 4 timestamp registers present in i225/i226. Moving the timestamp handling to be inline with the interrupt handling has the advantage of improving the TX timestamping retrieval latency, here are some numbers using ntpperf: Before: $ sudo ./ntpperf -i enp3s0 -m 10:22:22:22:22:21 -d 192.168.1.3 -s 172.18.0.0/16 -I -H -o -37 | responses | TX timestamp offset (ns) rate clients | lost invalid basic xleave | min mean max stddev 1000 100 0.00% 0.00% 0.00% 100.00% -56 +9 +52 19 1500 150 0.00% 0.00% 0.00% 100.00% -40 +30 +75 22 2250 225 0.00% 0.00% 0.00% 100.00% -11 +29 +72 15 3375 337 0.00% 0.00% 0.00% 100.00% -18 +40 +88 22 5062 506 0.00% 0.00% 0.00% 100.00% -19 +23 +77 15 7593 759 0.00% 0.00% 0.00% 100.00% +7 +47 +5168 43 11389 1138 0.00% 0.00% 0.00% 100.00% -11 +41 +5240 39 17083 1708 0.00% 0.00% 0.00% 100.00% +19 +60 +5288 50 25624 2562 0.00% 0.00% 0.00% 100.00% +1 +56 +5368 58 38436 3843 0.00% 0.00% 0.00% 100.00% -84 +12 +8847 66 57654 5765 0.00% 0.00% 100.00% 0.00% 86481 8648 0.00% 0.00% 100.00% 0.00% 129721 12972 0.00% 0.00% 100.00% 0.00% 194581 16384 0.00% 0.00% 100.00% 0.00% 291871 16384 27.35% 0.00% 72.65% 0.00% 437806 16384 50.05% 0.00% 49.95% 0.00% After: $ sudo ./ntpperf -i enp3s0 -m 10:22:22:22:22:21 -d 192.168.1.3 -s 172.18.0.0/16 -I -H -o -37 | responses | TX timestamp offset (ns) rate clients | lost invalid basic xleave | min mean max stddev 1000 100 0.00% 0.00% 0.00% 100.00% -44 +0 +61 19 1500 150 0.00% 0.00% 0.00% 100.00% -6 +39 +81 16 2250 225 0.00% 0.00% 0.00% 100.00% -22 +25 +69 15 3375 337 0.00% 0.00% 0.00% 100.00% -28 +15 +56 14 5062 506 0.00% 0.00% 0.00% 100.00% +7 +78 +143 27 7593 759 0.00% 0.00% 0.00% 100.00% -54 +24 +144 47 11389 1138 0.00% 0.00% 0.00% 100.00% -90 -33 +28 21 17083 1708 0.00% 0.00% 0.00% 100.00% -50 -2 +35 14 25624 2562 0.00% 0.00% 0.00% 100.00% -62 +7 +66 23 38436 3843 0.00% 0.00% 0.00% 100.00% -33 +30 +5395 36 57654 5765 0.00% 0.00% 100.00% 0.00% 86481 8648 0.00% 0.00% 100.00% 0.00% 129721 12972 0.00% 0.00% 100.00% 0.00% 194581 16384 19.50% 0.00% 80.50% 0.00% 291871 16384 35.81% 0.00% 64.19% 0.00% 437806 16384 55.40% 0.00% 44.60% 0.00% During this series, and to show that as is always the case, things are never easy as they should be, a hardware issue was found, and it took some time to find the workaround(s). The bug and workaround are better explained in patch 4/4. Note: the workaround has a simpler alternative, but it would involve adding support for the other timestamp registers, and only using the TXSTMP{H/L}_0 as a way to clear the interrupt. But I feel bad about throwing this kind of resources away. Didn't test this extensively but it should work. Also, as Marc Kleine-Budde suggested, after some consensus is reached on this series, most parts of it will be proposed for igb. * '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: igc: Work around HW bug causing missing timestamps igc: Retrieve TX timestamp during interrupt handling igc: Check if hardware TX timestamping is enabled earlier igc: Fix race condition in PTP tx code ==================== Link: https://lore.kernel.org/r/20230622165244.2202786-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit a685d0df75b0357bf0720cafa30c27634063be0a Merge: d1d29a42f7acd fbc5669de62a4 Author: Jakub Kicinski Date: Sat Jun 24 14:52:28 2023 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== pull-request: bpf-next 2023-06-23 We've added 49 non-merge commits during the last 24 day(s) which contain a total of 70 files changed, 1935 insertions(+), 442 deletions(-). The main changes are: 1) Extend bpf_fib_lookup helper to allow passing the route table ID, from Louis DeLosSantos. 2) Fix regsafe() in verifier to call check_ids() for scalar registers, from Eduard Zingerman. 3) Extend the set of cpumask kfuncs with bpf_cpumask_first_and() and a rework of bpf_cpumask_any*() kfuncs. Additionally, add selftests, from David Vernet. 4) Fix socket lookup BPF helpers for tc/XDP to respect VRF bindings, from Gilad Sever. 5) Change bpf_link_put() to use workqueue unconditionally to fix it under PREEMPT_RT, from Sebastian Andrzej Siewior. 6) Follow-ups to address issues in the bpf_refcount shared ownership implementation, from Dave Marchevsky. 7) A few general refactorings to BPF map and program creation permissions checks which were part of the BPF token series, from Andrii Nakryiko. 8) Various fixes for benchmark framework and add a new benchmark for BPF memory allocator to BPF selftests, from Hou Tao. 9) Documentation improvements around iterators and trusted pointers, from Anton Protopopov. 10) Small cleanup in verifier to improve allocated object check, from Daniel T. Lee. 11) Improve performance of bpf_xdp_pointer() by avoiding access to shared_info when XDP packet does not have frags, from Jesper Dangaard Brouer. 12) Silence a harmless syzbot-reported warning in btf_type_id_size(), from Yonghong Song. 13) Remove duplicate bpfilter_umh_cleanup in favor of umd_cleanup_helper, from Jarkko Sakkinen. 14) Fix BPF selftests build for resolve_btfids under custom HOSTCFLAGS, from Viktor Malik. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (49 commits) bpf, docs: Document existing macros instead of deprecated bpf, docs: BPF Iterator Document selftests/bpf: Fix compilation failure for prog vrf_socket_lookup selftests/bpf: Add vrf_socket_lookup tests bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC hookpoint bpf: Factor out socket lookup functions for the TC hookpoint. selftests/bpf: Set the default value of consumer_cnt as 0 selftests/bpf: Ensure that next_cpu() returns a valid CPU number selftests/bpf: Output the correct error code for pthread APIs selftests/bpf: Use producer_cnt to allocate local counter array xsk: Remove unused inline function xsk_buff_discard() bpf: Keep BPF_PROG_LOAD permission checks clear of validations bpf: Centralize permissions checks for all BPF map types bpf: Inline map creation logic in map_create() function bpf: Move unprivileged checks into map_create() and bpf_prog_load() bpf: Remove in_atomic() from bpf_link_put(). selftests/bpf: Verify that check_ids() is used for scalars in regsafe() bpf: Verify scalar ids mapping in regsafe() using check_ids() selftests/bpf: Check if mark_chain_precision() follows scalar ids ... ==================== Link: https://lore.kernel.org/r/20230623211256.8409-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit f313c51d26aa87e69633c9b46efb37a930faca71 Author: Linus Torvalds Date: Mon Jun 19 11:34:15 2023 -0700 execve: expand new process stack manually ahead of time This is a small step towards a model where GUP itself would not expand the stack, and any user that needs GUP to not look up existing mappings, but actually expand on them, would have to do so manually before-hand, and with the mm lock held for writing. It turns out that execve() already did almost exactly that, except it didn't take the mm lock at all (it's single-threaded so no locking technically needed, but it could cause lockdep errors). And it only did it for the CONFIG_STACK_GROWSUP case, since in that case GUP has obviously never expanded the stack downwards. So just make that CONFIG_STACK_GROWSUP case do the right thing with locking, and enable it generally. This will eventually help GUP, and in the meantime avoids a special case and the lockdep issue. Signed-off-by: Linus Torvalds commit f440fa1ac955e2898893f9301568435eb5cdfc4b Author: Liam R. Howlett Date: Fri Jun 16 15:58:54 2023 -0700 mm: make find_extend_vma() fail if write lock not held Make calls to extend_vma() and find_extend_vma() fail if the write lock is required. To avoid making this a flag-day event, this still allows the old read-locking case for the trivial situations, and passes in a flag to say "is it write-locked". That way write-lockers can say "yes, I'm being careful", and legacy users will continue to work in all the common cases until they have been fully converted to the new world order. Co-Developed-by: Matthew Wilcox (Oracle) Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Liam R. Howlett Signed-off-by: Linus Torvalds commit 2cd76c50d0b41cec5c87abfcdf25b236a2793fb6 Author: Linus Torvalds Date: Sat Jun 24 11:17:05 2023 -0700 powerpc/mm: convert coprocessor fault to lock_mm_and_find_vma() This is one of the simple cases, except there's no pt_regs pointer. Which is fine, as lock_mm_and_find_vma() is set up to work fine with a NULL pt_regs. Powerpc already enabled LOCK_MM_AND_FIND_VMA for the main CPU faulting, so we can just use the helper without any extra work. Signed-off-by: Linus Torvalds commit a050ba1e7422f2cc60ff8bfde3f96d34d00cb585 Author: Linus Torvalds Date: Sat Jun 24 10:55:38 2023 -0700 mm/fault: convert remaining simple cases to lock_mm_and_find_vma() This does the simple pattern conversion of alpha, arc, csky, hexagon, loongarch, nios2, sh, sparc32, and xtensa to the lock_mm_and_find_vma() helper. They all have the regular fault handling pattern without odd special cases. The remaining architectures all have something that keeps us from a straightforward conversion: ia64 and parisc have stacks that can grow both up as well as down (and ia64 has special address region checks). And m68k, microblaze, openrisc, sparc64, and um end up having extra rules about only expanding the stack down a limited amount below the user space stack pointer. That is something that x86 used to do too (long long ago), and it probably could just be skipped, but it still makes the conversion less than trivial. Note that this conversion was done manually and with the exception of alpha without any build testing, because I have a fairly limited cross- building environment. The cases are all simple, and I went through the changes several times, but... Signed-off-by: Linus Torvalds commit 8b35ca3e45e35a26a21427f35d4093606e93ad0a Author: Ben Hutchings Date: Thu Jun 22 21:24:30 2023 +0200 arm/mm: Convert to using lock_mm_and_find_vma() arm has an additional check for address < FIRST_USER_ADDRESS before expanding the stack. Since FIRST_USER_ADDRESS is defined everywhere (generally as 0), move that check to the generic expand_downwards(). Signed-off-by: Ben Hutchings Signed-off-by: Linus Torvalds commit 7267ef7b0b77f4ed23b7b3c87d8eca7bd9c2d007 Author: Ben Hutchings Date: Thu Jun 22 20:18:18 2023 +0200 riscv/mm: Convert to using lock_mm_and_find_vma() Signed-off-by: Ben Hutchings Signed-off-by: Linus Torvalds commit 4bce37a68ff884e821a02a731897a8119e0c37b7 Author: Ben Hutchings Date: Thu Jun 22 18:47:40 2023 +0200 mips/mm: Convert to using lock_mm_and_find_vma() Signed-off-by: Ben Hutchings Signed-off-by: Linus Torvalds commit e6fe228c4ffafdfc970cf6d46883a1f481baf7ea Author: Michael Ellerman Date: Fri Jun 16 15:51:29 2023 +1000 powerpc/mm: Convert to using lock_mm_and_find_vma() Signed-off-by: Michael Ellerman Signed-off-by: Linus Torvalds commit ae870a68b5d13d67cf4f18d47bb01ee3fee40acb Author: Linus Torvalds Date: Thu Jun 15 17:11:44 2023 -0700 arm64/mm: Convert to using lock_mm_and_find_vma() This converts arm64 to use the new page fault helper. It was very straightforward, but still needed a fix for the "obvious" conversion I initially did. Thanks to Suren for the fix and testing. Fixed-and-tested-by: Suren Baghdasaryan Unnecessary-code-removal-by: Liam R. Howlett Signed-off-by: Linus Torvalds commit eda0047296a16d65a7f2bc60a408f70d178b2014 Author: Linus Torvalds Date: Thu Jun 15 16:17:48 2023 -0700 mm: make the page fault mmap locking killable This is done as a separate patch from introducing the new lock_mm_and_find_vma() helper, because while it's an obvious change, it's not what x86 used to do in this area. We already abort the page fault on fatal signals anyway, so why should we wait for the mmap lock only to then abort later? With the new helper function that returns without the lock held on failure anyway, this is particularly easy and straightforward. Signed-off-by: Linus Torvalds commit c2508ec5a58db67093f4fb8bf89a9a7c53a109e9 Author: Linus Torvalds Date: Thu Jun 15 15:17:36 2023 -0700 mm: introduce new 'lock_mm_and_find_vma()' page fault helper .. and make x86 use it. This basically extracts the existing x86 "find and expand faulting vma" code, but extends it to also take the mmap lock for writing in case we actually do need to expand the vma. We've historically short-circuited that case, and have some rather ugly special logic to serialize the stack segment expansion (since we only hold the mmap lock for reading) that doesn't match the normal VM locking. That slight violation of locking worked well, right up until it didn't: the maple tree code really does want proper locking even for simple extension of an existing vma. So extract the code for "look up the vma of the fault" from x86, fix it up to do the necessary write locking, and make it available as a helper function for other architectures that can use the common helper. Note: I say "common helper", but it really only handles the normal stack-grows-down case. Which is all architectures except for PA-RISC and IA64. So some rare architectures can't use the helper, but if they care they'll just need to open-code this logic. It's also worth pointing out that this code really would like to have an optimistic "mmap_upgrade_trylock()" to make it quicker to go from a read-lock (for the common case) to taking the write lock (for having to extend the vma) in the normal single-threaded situation where there is no other locking activity. But that _is_ all the very uncommon special case, so while it would be nice to have such an operation, it probably doesn't matter in reality. I did put in the skeleton code for such a possible future expansion, even if it only acts as pseudo-documentation for what we're doing. Signed-off-by: Linus Torvalds commit c2d22806aecb24e2de55c30a06e5d6eb297d161d Author: Zhang Shurong Date: Sun Jun 25 00:16:49 2023 +0800 fbdev: fix potential OOB read in fast_imageblit() There is a potential OOB read at fast_imageblit, for "colortab[(*src >> 4)]" can become a negative value due to "const char *s = image->data, *src". This change makes sure the index for colortab always positive or zero. Similar commit: https://patchwork.kernel.org/patch/11746067 Potential bug report: https://groups.google.com/g/syzkaller-bugs/c/9ubBXKeKXf4/m/k-QXy4UgAAAJ Signed-off-by: Zhang Shurong Cc: stable@vger.kernel.org Signed-off-by: Helge Deller commit 0c0206dc4f5ba2d18b15e24d2047487d6f73916b Author: Xinghui Li Date: Thu Apr 20 17:43:31 2023 +0800 PCI: vmd: Fix uninitialized variable usage in vmd_enable_domain() The ret variable in the vmd_enable_domain() function was used uninitialized when printing a warning message upon failure of the pci_reset_bus() function. Thus, fix the issue by assigning ret with the value returned from pci_reset_bus() before referencing it in the warning message. This was detected by Smatch: drivers/pci/controller/vmd.c:931 vmd_enable_domain() error: uninitialized symbol 'ret'. [kwilczynski: drop the second patch from the series, add missing reported by tag, commit log] Fixes: 0a584655ef89 ("PCI: vmd: Fix secondary bus reset for Intel bridges") Link: https://lore.kernel.org/all/202305270219.B96IiIfv-lkp@intel.com Link: https://lore.kernel.org/linux-pci/20230420094332.1507900-2-korantwork@gmail.com Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Xinghui Li Signed-off-by: Krzysztof Wilczyński Reviewed-by: Nirmal Patel commit 741ed0856d5ef94c2dbdbf58cb13d262d89505bb Author: Wilken Gottwalt Date: Sat Jun 24 10:14:07 2023 +0000 hwmon: (corsair-psu) update Series 2022 and 2023 support The series 2022/2023 reports slightly longer vendor/product strings and shares USB ids. Technically the reply size is the USB HID packet size (64 bytes) but all the supported commands do not use more than 8 bytes and replies reporting back strings do not use more then 24 bytes (vendor and product are in one string in the newer devices now). The rest of the reply is always filled with '\0'. Also update comments and documentation accordingly. Signed-off-by: Wilken Gottwalt Link: https://lore.kernel.org/r/ZJbB72CAPmLflhHG@monster.localdomain Signed-off-by: Guenter Roeck commit afbb9130d2bf04888e91bddc4127d7121b9aee3d Author: Uwe Kleine-König Date: Tue Mar 21 20:32:08 2023 +0100 PCI: xgene-msi: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Link: https://lore.kernel.org/linux-pci/20230321193208.366561-16-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Krzysztof Wilczyński commit c7fd95cda648a0df45b9748bbbef1a62099f3f32 Author: Uwe Kleine-König Date: Tue Mar 21 20:32:07 2023 +0100 PCI: tegra: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Link: https://lore.kernel.org/linux-pci/20230321193208.366561-15-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Krzysztof Wilczyński commit 2998efcd8e73e5ab0ac82b79a087fc3747cd4d03 Author: Uwe Kleine-König Date: Tue Mar 21 20:32:06 2023 +0100 PCI: rockchip-host: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Link: https://lore.kernel.org/linux-pci/20230321193208.366561-14-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Krzysztof Wilczyński commit 4c3bc1b41b8f9f96a75eacff8582ee811aeda83c Author: Uwe Kleine-König Date: Tue Mar 21 20:32:05 2023 +0100 PCI: mvebu: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Link: https://lore.kernel.org/linux-pci/20230321193208.366561-13-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Krzysztof Wilczyński commit 8c47ac2a66c4a8372ecee4a5f0cc7c03c14de353 Author: Uwe Kleine-König Date: Tue Mar 21 20:32:04 2023 +0100 PCI: mt7621: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Link: https://lore.kernel.org/linux-pci/20230321193208.366561-12-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Krzysztof Wilczyński Reviewed-by: Sergio Paracuellos commit 22626c46bb32a7953995637a3f062b0f0d74cc80 Author: Uwe Kleine-König Date: Tue Mar 21 20:32:03 2023 +0100 PCI: mediatek-gen3: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Link: https://lore.kernel.org/linux-pci/20230321193208.366561-11-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Krzysztof Wilczyński commit 5e0005409427ec7ca988c6315ebf746f8fb24139 Author: Uwe Kleine-König Date: Tue Mar 21 20:32:02 2023 +0100 PCI: mediatek: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Link: https://lore.kernel.org/linux-pci/20230321193208.366561-10-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Krzysztof Wilczyński commit 6f1c0a046048ec647299c5f9a135002393941c99 Author: Uwe Kleine-König Date: Tue Mar 21 20:32:01 2023 +0100 PCI: iproc: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. The iproc driver always returns 0, it's just a bit hidden. So make iproc_pcie_remove() return void instead of always zero and convert the platform driver to the alternative remove callback that returns void and eventually replaces the int returning callback. Link: https://lore.kernel.org/linux-pci/20230321193208.366561-9-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Krzysztof Wilczyński Acked-by: Florian Fainelli commit 9a285fbbb591428de0cde7f553130e7c728a2e19 Author: Uwe Kleine-König Date: Tue Mar 21 20:32:00 2023 +0100 PCI: hisi-error: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Link: https://lore.kernel.org/linux-pci/20230321193208.366561-8-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Krzysztof Wilczyński commit 221879c986980c04923cd6a202a1aafb51e0bc7d Author: Uwe Kleine-König Date: Tue Mar 21 20:31:59 2023 +0100 PCI: dwc: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert the dwc drivers from always returning zero in the remove callback to the void returning variant. [kwilczynski: commit log] Link: https://lore.kernel.org/linux-pci/20230321193208.366561-7-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Krzysztof Wilczyński Acked-by: Serge Semin commit c86f4bd6008e7e9bd561e1f1ec3889cc0a5925e8 Author: Uwe Kleine-König Date: Tue Mar 21 20:31:58 2023 +0100 PCI: j721e: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. [kwilczynski: commit log] Link: https://lore.kernel.org/linux-pci/20230321193208.366561-6-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Krzysztof Wilczyński commit b169c576ad0cd341badb866d0808ae32c7bf8c2c Author: Uwe Kleine-König Date: Tue Mar 21 20:31:57 2023 +0100 PCI: brcmstb: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Link: https://lore.kernel.org/linux-pci/20230321193208.366561-5-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Krzysztof Wilczyński Acked-by: Florian Fainelli commit 60d03f70455c7704cb76737ff947b75391934954 Author: Uwe Kleine-König Date: Tue Mar 21 20:31:56 2023 +0100 PCI: altera-msi: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Link: https://lore.kernel.org/linux-pci/20230321193208.366561-4-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Krzysztof Wilczyński commit 3a610560aa4fc8f2afe606d3314aeb20c167ff26 Author: Uwe Kleine-König Date: Tue Mar 21 20:31:55 2023 +0100 PCI: altera: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Link: https://lore.kernel.org/linux-pci/20230321193208.366561-3-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Krzysztof Wilczyński commit b11c76db97e76f2160c0f7d523e788c0327521b7 Author: Uwe Kleine-König Date: Tue Mar 21 20:31:54 2023 +0100 PCI: aardvark: Convert to platform remove callback returning void The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void. Trivially convert this driver from always returning zero in the remove callback to the void returning variant. Link: https://lore.kernel.org/linux-pci/20230321193208.366561-2-u.kleine-koenig@pengutronix.de Signed-off-by: Uwe Kleine-König Signed-off-by: Krzysztof Wilczyński commit f7667ca106df50ff8b776db54f85074dc9c52e1b Author: Max Filippov Date: Sun May 7 16:18:17 2023 -0700 xtensa: dump userspace code around the exception PC In the absence of other debug facilities dumping user code around the unhandled exception address may help debugging the issue. Signed-off-by: Max Filippov commit e28e75e9f589324a76bf31e2b2bbdc264549f86b Author: Wolfram Sang Date: Wed Jun 7 22:47:50 2023 +0200 PCI: rcar: Use correct product family name for Renesas R-Car Renesas uses "R-Car" as the name for their product family and development platform. Thus, correct other variants such as "rcar", "RCar", "Rcar", etc., to the preferred spelling. [kwilczynski: commit log] Link: https://lore.kernel.org/linux-pci/20230607204750.27837-1-wsa+renesas@sang-engineering.com Signed-off-by: Wolfram Sang Signed-off-by: Krzysztof Wilczyński Reviewed-by: Yoshihiro Shimoda Reviewed-by: Geert Uytterhoeven commit e884a133340a470070b2c59833c9ff87aa6517ba Author: Krzysztof Kozlowski Date: Sat Jun 24 10:20:54 2023 +0200 spi: dt-bindings: atmel,at91rm9200-spi: fix broken sam9x7 compatible Commit a3eb95484f27 ("spi: dt-bindings: atmel,at91rm9200-spi: add sam9x7 compatible") adding sam9x7 compatible did not make any sense as it added new compatible into middle of existing compatible list. The intention was probably to add new set of compatibles with sam9x7 as first one. Fixes: a3eb95484f27 ("spi: dt-bindings: atmel,at91rm9200-spi: add sam9x7 compatible") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/Message-Id: <20230624082054.37697-1-krzysztof.kozlowski@linaro.org> Signed-off-by: Mark Brown commit 1fffe7a34c89b12b58f88b280bc10ce034477c3a Author: Vincenzo Palazzo Date: Fri Jun 16 01:40:37 2023 +0200 script: modpost: emit a warning when the description is missing Emit a warning when the mod description is missed and only when the W=1 is enabled. Reported-by: Roland Kletzing Link: https://bugzilla.kernel.org/show_bug.cgi?id=10770 Signed-off-by: Vincenzo Palazzo Tested-by: Nicolas Schier Signed-off-by: Masahiro Yamada commit 8ae071fc216a25f4f797f33c56857f4dd6b4408e Author: Masahiro Yamada Date: Thu Jun 15 20:17:43 2023 +0900 kbuild: make modules_install copy modules.builtin(.modinfo) Josh Triplett reports that initramfs-tools needs modules.builtin and modules.builtin.modinfo to create a working initramfs for a non-modular kernel. If this is a general tooling issue not limited to Debian, I think it makes sense to change modules_install. This commit changes the targets as follows when CONFIG_MODULES=n. In-tree builds: make modules -> no-op make modules_install -> install modules.builtin(.modinfo) External module builds: make modules -> show error message like before make modules_install -> show error message like before Link: https://lore.kernel.org/lkml/36a4014c73a52af27d930d3ca31d362b60f4461c.1686356364.git.josh@joshtriplett.org/ Reported-by: Josh Triplett Signed-off-by: Masahiro Yamada Reviewed-by: Nicolas Schier Tested-by: Nicolas Schier Reviewed-by: Josh Triplett Tested-by: Josh Triplett commit 29c171de52bcef23a7593a890cbcb6761be0123c Author: Lukas Bulwahn Date: Fri Jun 23 06:07:36 2023 +0200 MAINTAINERS: adjust entry in VIA UNICHROME(PRO)/CHROME9 FRAMEBUFFER DRIVER Commit d4313a68ec91 ("fbdev/media: Use GPIO descriptors for VIA GPIO") moves via-gpio.h from include/linux to drivers/video/fbdev/via, but misses to adjust the file entry for the VIA UNICHROME(PRO)/CHROME9 FRAMEBUFFER DRIVER section. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. Remove the file entry in VIA UNICHROME(PRO)/CHROME9 FRAMEBUFFER DRIVER, as the new location of the header is already covered by the file entry drivers/video/fbdev/via/. Signed-off-by: Lukas Bulwahn Fixes: d4313a68ec91 ("fbdev/media: Use GPIO descriptors for VIA GPIO") Signed-off-by: Helge Deller commit 929ff679b694f0f9656aec38b3a7d5c440c5ca24 Author: Yang Jihong Date: Fri Jun 23 05:44:16 2023 +0000 perf tools: Add printing perf_event_attr config symbol in perf_event_attr__fprintf() When printing perf_event_attr, always display perf_event_attr config and its symbol to improve the readability of debugging information. Before: # perf --debug verbose=2 record -e cycles,cpu-clock,sched:sched_switch,branch-load-misses,r101,mem:0x0 -C 0 true ------------------------------------------------------------ perf_event_attr: size 136 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 5 ------------------------------------------------------------ perf_event_attr: type 1 size 136 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 6 ------------------------------------------------------------ perf_event_attr: type 2 size 136 config 0x143 { sample_period, sample_freq } 1 sample_type IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER read_format ID disabled 1 inherit 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 7 ------------------------------------------------------------ perf_event_attr: type 3 size 136 config 0x10005 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 9 ------------------------------------------------------------ perf_event_attr: type 4 size 136 config 0x101 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 10 ------------------------------------------------------------ perf_event_attr: type 5 size 136 { sample_period, sample_freq } 1 sample_type IP|TID|TIME|CPU|IDENTIFIER read_format ID disabled 1 inherit 1 sample_id_all 1 exclude_guest 1 bp_type 3 { bp_len, config2 } 0x4 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 11 After: # perf --debug verbose=2 record -e cycles,cpu-clock,sched:sched_switch,branch-load-misses,r101,mem:0x0 -C 0 true ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) size 136 config 0 (PERF_COUNT_HW_CPU_CYCLES) { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 5 ------------------------------------------------------------ perf_event_attr: type 1 (PERF_TYPE_SOFTWARE) size 136 config 0 (PERF_COUNT_SW_CPU_CLOCK) { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 6 ------------------------------------------------------------ perf_event_attr: type 2 (PERF_TYPE_TRACEPOINT) size 136 config 0x143 (sched:sched_switch) { sample_period, sample_freq } 1 sample_type IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER read_format ID disabled 1 inherit 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 7 ------------------------------------------------------------ perf_event_attr: type 3 (PERF_TYPE_HW_CACHE) size 136 config 0x10005 (PERF_COUNT_HW_CACHE_RESULT_MISS | PERF_COUNT_HW_CACHE_OP_READ | PERF_COUNT_HW_CACHE_BPU) { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 9 ------------------------------------------------------------ perf_event_attr: type 4 (PERF_TYPE_RAW) size 136 config 0x101 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 10 ------------------------------------------------------------ perf_event_attr: type 5 (PERF_TYPE_BREAKPOINT) size 136 config 0 { sample_period, sample_freq } 1 sample_type IP|TID|TIME|CPU|IDENTIFIER read_format ID disabled 1 inherit 1 sample_id_all 1 exclude_guest 1 bp_type 3 { bp_len, config2 } 0x4 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 11 ------------------------------------------------------------ perf_event_attr: type 1 (PERF_TYPE_SOFTWARE) size 136 config 0x9 (PERF_COUNT_SW_DUMMY) { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID inherit 1 mmap 1 comm 1 freq 1 task 1 sample_id_all 1 mmap2 1 comm_exec 1 ksymbol 1 bpf_event 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 12 Signed-off-by: Yang Jihong Acked-by: Adrian Hunter Cc: anshuman.khandual@arm.com Cc: mark.rutland@arm.com Cc: irogers@google.com Cc: jesussanp@google.com Cc: peterz@infradead.org Cc: acme@kernel.org Cc: jolsa@kernel.org Cc: alexander.shishkin@linux.intel.com Cc: mingo@redhat.com Link: https://lore.kernel.org/r/20230623054416.160858-5-yangjihong1@huawei.com [ fix perf import test by adding a dummy tracepoint_id__to_name() ] Signed-off-by: Namhyung Kim commit 2e4dd65d7d0c73451e2f8b575884b35c90ba058a Author: Yang Jihong Date: Fri Jun 23 05:44:15 2023 +0000 perf tools: Add printing perf_event_attr type symbol in perf_event_attr__fprintf() When printing perf_event_attr, always display perf_event_attr type and its symbol to improve the readability of debugging information. Before: # perf --debug verbose=2 record -e cycles,cpu-clock,sched:sched_switch,branch-load-misses,r101,mem:0x0 -C 0 true ------------------------------------------------------------ perf_event_attr: size 136 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 5 ------------------------------------------------------------ perf_event_attr: type 1 size 136 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 6 ------------------------------------------------------------ perf_event_attr: type 2 size 136 config 0x143 { sample_period, sample_freq } 1 sample_type IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER read_format ID disabled 1 inherit 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 7 ------------------------------------------------------------ perf_event_attr: type 3 size 136 config 0x10005 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 9 ------------------------------------------------------------ perf_event_attr: type 4 size 136 config 0x101 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 10 ------------------------------------------------------------ perf_event_attr: type 5 size 136 { sample_period, sample_freq } 1 sample_type IP|TID|TIME|CPU|IDENTIFIER read_format ID disabled 1 inherit 1 sample_id_all 1 exclude_guest 1 bp_type 3 { bp_len, config2 } 0x4 ------------------------------------------------------------ After: # perf --debug verbose=2 record -e cycles,cpu-clock,sched:sched_switch,branch-load-misses,r101,mem:0x0 -C 0 true ------------------------------------------------------------ perf_event_attr: type 0 (PERF_TYPE_HARDWARE) size 136 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 5 ------------------------------------------------------------ perf_event_attr: type 1 (PERF_TYPE_SOFTWARE) size 136 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 6 ------------------------------------------------------------ perf_event_attr: type 2 (PERF_TYPE_TRACEPOINT) size 136 config 0x143 { sample_period, sample_freq } 1 sample_type IP|TID|TIME|CPU|PERIOD|RAW|IDENTIFIER read_format ID disabled 1 inherit 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 7 ------------------------------------------------------------ perf_event_attr: type 3 (PERF_TYPE_HW_CACHE) size 136 config 0x10005 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 9 ------------------------------------------------------------ perf_event_attr: type 4 (PERF_TYPE_RAW) size 136 config 0x101 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|CPU|PERIOD|IDENTIFIER read_format ID disabled 1 inherit 1 freq 1 sample_id_all 1 exclude_guest 1 ------------------------------------------------------------ sys_perf_event_open: pid -1 cpu 0 group_fd -1 flags 0x8 = 10 ------------------------------------------------------------ perf_event_attr: type 5 (PERF_TYPE_BREAKPOINT) size 136 { sample_period, sample_freq } 1 sample_type IP|TID|TIME|CPU|IDENTIFIER read_format ID disabled 1 inherit 1 sample_id_all 1 exclude_guest 1 bp_type 3 { bp_len, config2 } 0x4 ------------------------------------------------------------ Signed-off-by: Yang Jihong Acked-by: Adrian Hunter Cc: anshuman.khandual@arm.com Cc: mark.rutland@arm.com Cc: irogers@google.com Cc: jesussanp@google.com Cc: peterz@infradead.org Cc: acme@kernel.org Cc: jolsa@kernel.org Cc: alexander.shishkin@linux.intel.com Cc: mingo@redhat.com Link: https://lore.kernel.org/r/20230623054416.160858-4-yangjihong1@huawei.com Signed-off-by: Namhyung Kim commit 5492e72500646170cd409b14fe273e6d067b9fae Author: Yang Jihong Date: Fri Jun 23 05:44:14 2023 +0000 perf tools: Extend PRINT_ATTRf to support printing of members with a value of 0 When printing attr, members whose value is 0 will not be printed, we want to print the case where attr->type is 0(PERF_TYPE_HARDWARE), add `_a` param to PRINT_ATTRf macro to always print member when it is true No functional change. Signed-off-by: Yang Jihong Acked-by: Adrian Hunter Cc: anshuman.khandual@arm.com Cc: mark.rutland@arm.com Cc: irogers@google.com Cc: jesussanp@google.com Cc: peterz@infradead.org Cc: acme@kernel.org Cc: jolsa@kernel.org Cc: alexander.shishkin@linux.intel.com Cc: mingo@redhat.com Link: https://lore.kernel.org/r/20230623054416.160858-3-yangjihong1@huawei.com Signed-off-by: Namhyung Kim commit 220f88b5a11a88539fbc44d2740c41bf995ecb45 Author: Yang Jihong Date: Fri Jun 23 05:44:13 2023 +0000 perf trace-event-info: Add tracepoint_id_to_name() helper Add tracepoint_id_to_name() helper to search for the trace events directory by given event id and return the corresponding tracepoint. Signed-off-by: Yang Jihong Acked-by: Adrian Hunter Cc: anshuman.khandual@arm.com Cc: mark.rutland@arm.com Cc: irogers@google.com Cc: jesussanp@google.com Cc: peterz@infradead.org Cc: acme@kernel.org Cc: jolsa@kernel.org Cc: alexander.shishkin@linux.intel.com Cc: mingo@redhat.com Link: https://lore.kernel.org/r/20230623054416.160858-2-yangjihong1@huawei.com Signed-off-by: Namhyung Kim commit 3ff256751a2853e1ffaa36958ff933ccc98c6cb5 Author: Zhang Shurong Date: Fri Jun 23 13:39:35 2023 +0800 firewire: net: fix use after free in fwnet_finish_incoming_packet() The netif_rx() function frees the skb so we can't dereference it to save the skb->len. Signed-off-by: Zhang Shurong Link: https://lore.kernel.org/r/tencent_3B3D24B66ED66A6BB73CC0E63C6A14E45109@qq.com Signed-off-by: Takashi Sakamoto commit d82257d7f604ba6e714c9f1087a6dc599ccb1879 Author: Ian Rogers Date: Thu Jun 22 22:45:20 2023 -0700 perf symbol: Remove now unused symbol_conf.sort_by_name Previously used to specify symbol_name_rb_node was in use. Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Carsten Haitzler Cc: Mark Rutland Cc: Jason Wang Cc: Changbin Du Cc: Yang Jihong Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Alexander Shishkin Cc: Kan Liang Cc: Athira Rajeev Cc: Ingo Molnar Cc: Christophe JAILLET Link: https://lore.kernel.org/r/20230623054520.4118442-4-irogers@google.com Signed-off-by: Namhyung Kim commit 259dce914e93482a0e25a6ddef88f5b6d85df9bd Author: Ian Rogers Date: Thu Jun 22 22:45:19 2023 -0700 perf symbol: Remove symbol_name_rb_node Most perf commands want to sort symbols by name and this is done via an invasive rbtree that on 64-bit systems costs 24 bytes. Sorting the symbols in a DSO by name is optional and not done by default, however, if sorting is requested the 24 bytes is allocated for every symbol. This change removes the rbtree and uses a sorted array of symbol pointers instead (costing 8 bytes per symbol). As the array is created on demand then there are further memory savings. The complexity of sorting the array and using the rbtree are the same. To support going to the next symbol, the index of the current symbol needs to be passed around as a pair with the current symbol. This requires some API changes. Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Carsten Haitzler Cc: Mark Rutland Cc: Jason Wang Cc: Changbin Du Cc: Yang Jihong Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Alexander Shishkin Cc: Kan Liang Cc: Athira Rajeev Cc: Ingo Molnar Cc: Christophe JAILLET Link: https://lore.kernel.org/r/20230623054520.4118442-3-irogers@google.com [ minimize change in symbols__sort_by_name() ] Signed-off-by: Namhyung Kim commit ce5b293405fda0f80c803b6c838f51ec7f618f90 Author: Ian Rogers Date: Thu Jun 22 22:45:18 2023 -0700 perf dso: Sort symbols under lock Determine if symbols are sorted, set the sorted flag and sort under the dso lock. Done in the interest of thread safety. Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Carsten Haitzler Cc: Mark Rutland Cc: Jason Wang Cc: Changbin Du Cc: Yang Jihong Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Alexander Shishkin Cc: Kan Liang Cc: Athira Rajeev Cc: Ingo Molnar Cc: Christophe JAILLET Link: https://lore.kernel.org/r/20230623054520.4118442-2-irogers@google.com [ handle the similar code in util/probe-event.c ] Signed-off-by: Namhyung Kim commit ae7eb5baad3fd5f9ff69a3721fdaa0324731cf8d Author: Ian Rogers Date: Thu Jun 22 21:14:05 2023 -0700 perf build: Filter out BTF sources without a .BTF section If generating vmlinux.h, make the code to generate it more tolerant by filtering out paths to kernels that lack a .BTF section. Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Acked-by: Jiri Olsa Cc: James Clark Cc: Mark Rutland Cc: Yang Jihong Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Tiezhu Yang Cc: Ingo Molnar Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20230623041405.4039475-5-irogers@google.com Signed-off-by: Namhyung Kim commit 06c39e742d46eb0a360563f0888ac8c3a9539f47 Author: Ian Rogers Date: Thu Jun 22 21:14:04 2023 -0700 perf test: Add build tests for BUILD_BPF_SKEL Add tests with and without generating vmlinux.h. Signed-off-by: Ian Rogers Acked-by: Andrii Nakryiko Acked-by: Namhyung Kim Acked-by: Jiri Olsa Cc: James Clark Cc: Mark Rutland Cc: Yang Jihong Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Tiezhu Yang Cc: Ingo Molnar Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20230623041405.4039475-4-irogers@google.com Signed-off-by: Namhyung Kim commit 5c45b210479bffe068d38902fcdcb52c4c60a264 Author: Ian Rogers Date: Thu Jun 22 21:14:03 2023 -0700 perf bpf: Move the declaration of struct rq struct rq is defined in vmlinux.h when the vmlinux.h is generated, this causes a redefinition failure if it is declared in lock_contention.bpf.c. Move the definition to vmlinux.h for consistency with the generated version. Fixes: 760ebc45746b ("perf lock contention: Add empty 'struct rq' to satisfy libbpf 'runqueue' type verification") Signed-off-by: Ian Rogers Acked-by: Andrii Nakryiko Acked-by: Namhyung Kim Acked-by: Jiri Olsa Cc: James Clark Cc: Mark Rutland Cc: Yang Jihong Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Tiezhu Yang Cc: Ingo Molnar Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20230623041405.4039475-3-irogers@google.com Signed-off-by: Namhyung Kim commit 4d60e83dfcee794213878155463d8f7353a80864 Author: Namhyung Kim Date: Fri Jun 23 16:01:39 2023 -0700 perf test: Skip metrics w/o event name in stat STD output linter This test checks if the output of perf stat to match event names and metrics. So it wants the output lines to have both event name and metric. Otherwise it should skip the line. On AMD machines, the instruction event has two metrics and they are printed in separate lines. It makes the line without event name like below: # perf stat -a sleep 1 Performance counter stats for 'system wide': 64,383.34 msec cpu-clock # 64.048 CPUs utilized 14,526 context-switches # 225.617 /sec 112 cpu-migrations # 1.740 /sec 190 page-faults # 2.951 /sec 807,558,652 cycles # 0.013 GHz (83.30%) 69,809,799 stalled-cycles-frontend # 8.64% frontend cycles idle (83.30%) 196,983,266 stalled-cycles-backend # 24.39% backend cycles idle (83.30%) 424,876,008 instructions # 0.53 insn per cycle (here) ---> # 0.46 stalled cycles per insn (83.30%) 97,788,321 branches # 1.519 M/sec (83.34%) 4,147,377 branch-misses # 4.24% of all branches (83.46%) 1.005241409 seconds time elapsed Also modern Intel machines have TopDown metrics which also don't have event names. # perf stat -a sleep 1 Performance counter stats for 'system wide': 8,015.39 msec cpu-clock # 7.996 CPUs utilized 5,823 context-switches # 726.477 /sec 189 cpu-migrations # 23.580 /sec 139 page-faults # 17.342 /sec 435,139,308 cycles # 0.054 GHz 193,891,345 instructions # 0.45 insn per cycle 42,773,028 branches # 5.336 M/sec 2,298,113 branch-misses # 5.37% of all branches TopdownL1 # 25.5 % tma_backend_bound /--> # 7.9 % tma_bad_speculation (here) --+ # 55.7 % tma_frontend_bound \--> # 10.9 % tma_retiring 1.002395924 seconds time elapsed There is a check to skip TopdownL1 and TopdownL2 specifically but it does not cover every affected lines. So there is another check to skip the line if it has nothing on the left side of # sign. Well.. it seems ok but that's not enough too. When aggregation mode (like --per-socket or --per-thread) is used, it adds some prefix (e.g. CPU socket, task name and PID) in the output line. So the test code ignores them to normalize result. A problem can happen for per-thread mode when task name contains one or more spaces. It'd only ignore the first part of the task name, and it thinks there's something more in the line so it would not skip. # perf stat -a --perf-thread sleep 1 ... perf-21276 # 70.2 % tma_backend_bound perf-21276 # 3.9 % tma_bad_speculation perf-21276 # 10.5 % tma_frontend_bound perf-21276 # 15.3 % tma_retiring ^^^^^^^^^^ (ignored) my task-21328 # 70.2 % tma_backend_bound my task-21328 # 3.9 % tma_bad_speculation my task-21328 # 10.5 % tma_frontend_bound my task-21328 # 15.3 % tma_retiring ^^ (ignored) So I think it should look at the metric names instead. Add skip_metric to hold the list of names to skip. It would contain 'stalled cycles per insn' and metrics started by 'tma_'. Fixes: 99a04a48f225 ("perf test: Add test case for the standard 'perf stat' output") Acked-by: Ian Rogers Cc: Kan Liang Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230623230139.985594-2-namhyung@kernel.org Signed-off-by: Namhyung Kim commit b7a2d774c9c5a9a3228c6169ecf32f05b96609cf Author: Ian Rogers Date: Thu Jun 22 21:14:02 2023 -0700 perf build: Add ability to build with a generated vmlinux.h Commit a887466562b4 ("perf bpf skels: Stop using vmlinux.h generated from BTF, use subset of used structs + CO-RE") made it so that vmlinux.h was uncondtionally included from tools/perf/util/vmlinux.h. This change reverts part of that change (so that vmlinux.h is once again generated) and makes it so that the vmlinux.h used at build time is selected from the VMLINUX_H variable. By default the VMLINUX_H variable is set to the vmlinux.h added in change a887466562b4, but if GEN_VMLINUX_H=1 is passed on the build command line then the previous generation behavior kicks in. The build with GEN_VMLINUX_H=1 currently fails with: util/bpf_skel/lock_contention.bpf.c:419:8: error: redefinition of 'rq' struct rq {}; ^ /tmp/perf/util/bpf_skel/.tmp/../vmlinux.h:45630:8: note: previous definition is here struct rq { ^ 1 error generated. Signed-off-by: Ian Rogers Acked-by: Andrii Nakryiko Acked-by: Namhyung Kim Acked-by: Jiri Olsa Cc: James Clark Cc: Mark Rutland Cc: Yang Jihong Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Tiezhu Yang Cc: Ingo Molnar Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20230623041405.4039475-2-irogers@google.com [ Format the error message and add a comment for GEN_VMLINUX_H ] Signed-off-by: Namhyung Kim commit 8d3df7c39b10d4ff24a605f7b80bb6fefb990798 Author: Namhyung Kim Date: Fri Jun 23 16:01:38 2023 -0700 perf test: Reorder event name checks in stat STD output linter On AMD machines, the perf stat STD output test failed like below: $ sudo ./perf test -v 98 98: perf stat STD output linter : --- start --- test child forked, pid 1841901 Checking STD output: no argswrong event metric. expected 'GHz' in 108,121 stalled-cycles-frontend # 10.88% frontend cycles idle test child finished with -1 ---- end ---- perf stat STD output linter: FAILED! This is because there are stalled-cycles-{frontend,backend} events are used by default. The current logic checks the event_name array to find which event it's running. But 'cycles' event comes before those stalled cycles event and it matches first. So it tries to find 'GHz' metric in the output (which is for the 'cycles') and fails. Move the stalled-cycles-{frontend,backend} events before 'cycles' so that it can find the stalled cycles events first. Also add a space after 'no args' test name for consistency. Fixes: 99a04a48f225 ("perf test: Add test case for the standard 'perf stat' output") Acked-by: Ian Rogers Cc: Kan Liang Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230623230139.985594-1-namhyung@kernel.org Signed-off-by: Namhyung Kim commit d1d29a42f7acde2fe618cf66b6bfbe047dc51b6b Merge: faaa5fd30344f 9464a3d68ea99 Author: Jakub Kicinski Date: Fri Jun 23 18:59:16 2023 -0700 Merge branch 'mlxsw-maintain-candidate-rifs' Petr Machata says: ==================== mlxsw: Maintain candidate RIFs The mlxsw driver currently makes the assumption that the user applies configuration in a bottom-up manner. Thus netdevices need to be added to the bridge before IP addresses are configured on that bridge or SVI added on top of it. Enslaving a netdevice to another netdevice that already has uppers is in fact forbidden by mlxsw for this reason. Despite this safety, it is rather easy to get into situations where the offloaded configuration is just plain wrong. As an example, take a front panel port, configure an IP address: it gets a RIF. Now enslave the port to the bridge, and the RIF is gone. Remove the port from the bridge again, but the RIF never comes back. There is a number of similar situations, where changing the configuration there and back utterly breaks the offload. The situation is going to be made better by implementing a range of replays and post-hoc offloads. This patch set lays the ground for replay of next hops. The particular issue that it deals with is that currently, driver-specific bookkeeping for next hops is hooked off RIF objects, which come and go across the lifetime of a netdevice. We would rather keep these objects at an entity that mirrors the lifetime of the netdevice itself. That way they are at hand and can be offloaded when a RIF is eventually created. To that end, with this patchset, mlxsw keeps a hash table of CRIFs: candidate RIFs, persistent handles for netdevices that mlxsw deems potentially interesting. The lifetime of a CRIF matches that of the underlying netdevice, and thus a RIF can always assume a CRIF exists. A CRIF is where next hops are kept, and when RIF is created, these next hops can be easily offloaded. (Previously only the next hops created after the RIF was created were offloaded.) - Patches #1 and #2 are minor adjustments. - In patches #3 and #4, add CRIF bookkeeping. - In patch #5, link CRIFs to RIFs such that given a netdevice-backed RIF, the corresponding CRIF is easy to look up. - Patch #6 is a clean-up allowed by the previous patches - Patches #7 and #8 move next hop tracking to CRIFs No observable effects are intended as of yet. This will be useful once there is support for RIF creation for netdevices that become mlxsw uppers, which will come in following patch sets. ==================== Link: https://lore.kernel.org/r/cover.1687438411.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 9464a3d68ea99ccac7e3518e1dfd366ac80bbc90 Author: Petr Machata Date: Thu Jun 22 15:33:09 2023 +0200 mlxsw: spectrum_router: Track next hops at CRIFs Move the list of next hops from struct mlxsw_sp_rif to mlxsw_sp_crif. The reason is that eventually, next hops for mlxsw uppers should be offloaded and unoffloaded on demand as a netdevice becomes an upper, or stops being one. Currently, next hops are tracked at RIFs, but RIFs do not exist when a netdevice is not an mlxsw uppers. CRIFs are kept track of throughout the netdevice lifetime. Correspondingly, track at each next hop not its RIF, but its CRIF (from which a RIF can always be deduced). Note that now that next hops are tracked at a CRIF, it is not necessary to move each over to a new RIF when it is necessary to edit a RIF. Therefore drop mlxsw_sp_nexthop_rif_migrate() and have mlxsw_sp_rif_migrate_destroy() call mlxsw_sp_nexthop_rif_update() directly. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Link: https://lore.kernel.org/r/e7c1c0a7dd13883b0f09aeda12c4fcf4d63a70e3.1687438411.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit a285d664236eb0655eea0ceb97095ad4b07fcbae Author: Petr Machata Date: Thu Jun 22 15:33:08 2023 +0200 mlxsw: spectrum_router: Split nexthop finalization to two stages Nexthop finalization consists of two steps: the part where the offload is removed, because the backing RIF is now gone; and the part where the association to the RIF is severed. Extract from mlxsw_sp_nexthop_type_fini() a helper that covers the unoffloading part, mlxsw_sp_nexthop_type_rif_gone(), so that it can later be called independently. Note that this swaps around the ordering of mlxsw_sp_nexthop_ipip_fini() vs. mlxsw_sp_nexthop_rif_fini(). The current ordering is more of a historical happenstance than a conscious decision. The two cleanups do not depend on each other, and this change should have no observable effects. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Link: https://lore.kernel.org/r/7134559534c5f5c4807c3a1569fae56f8887e763.1687438411.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit bdc0b78e79a641fbbb928a9e5da56dbdd42ff674 Author: Petr Machata Date: Thu Jun 22 15:33:07 2023 +0200 mlxsw: spectrum_router: Use router.lb_crif instead of .lb_rif_index A previous patch added a pointer to loopback CRIF to the router data structure. That makes the loopback RIF index redundant, as everything necessary can be derived from the CRIF. Drop the field and adjust the code accordingly. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Link: https://lore.kernel.org/r/8637bf959bc5b6c9d5184b9bd8a0cd53c5132835.1687438411.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit aa21242b07a8cde689bb6aedcbc224eda9646d9f Author: Petr Machata Date: Thu Jun 22 15:33:06 2023 +0200 mlxsw: spectrum_router: Link CRIFs to RIFs When a RIF is about to be created, the registration of the netdevice that it should be associated with must have been seen in the past, and a CRIF created. Therefore make this a hard requirement by looking up the CRIF during RIF creation, and complaining loudly when there isn't one. This then allows to keep a link between a RIF and its corresponding CRIF (and back, as the relationship is one-to-at-most-one), which do. The CRIF will later be useful as the objects tracked there will be offloaded lazily as a result of RIF creation. CRIFs are created when an "interesting" netdevice is registered, and destroyed after such device is unregistered. CRIFs are supposed to already exist when a RIF creation request arises, and exist at least as long as that RIF exists. This makes for a simple invariant: it is always safe to dereference CRIF pointer from "its" RIF. To guarantee this, CRIFs cannot be removed immediately when the UNREGISTER event is delivered. The reason is that if a RIF's netdevices has an IPv6 address, removal of this address is notified in an atomic block. To remove the RIF, the IPv6 removal handler schedules a work item. It must be safe for this work item to access the associated CRIF as well. Thus when a netdevice that backs the CRIF is removed, if it still has a RIF, do not actually free the CRIF, only toggle its can_destroy flag, which this patch adds. Later on, mlxsw_sp_rif_destroy() collects the CRIF. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Link: https://lore.kernel.org/r/68c8e33afa6b8c03c431b435e1685ffdff752e63.1687438411.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 78126cfd5dc97da7baf66415374452e3f8805faf Author: Petr Machata Date: Thu Jun 22 15:33:05 2023 +0200 mlxsw: spectrum_router: Maintain CRIF for fallback loopback RIF CRIFs are generally not maintained for loopback RIFs. However, the RIF for the default VRF is used for offloading of blackhole nexthops. Nexthops expect to have a valid CRIF. Therefore in this patch, add code to maintain CRIF for the loopback RIF as well. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Link: https://lore.kernel.org/r/7f2b2fcc98770167ed1254a904c3f7f585ba43f0.1687438411.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 4796c287b70a0f60fbc6a5df2ab33d92e8971732 Author: Petr Machata Date: Thu Jun 22 15:33:04 2023 +0200 mlxsw: spectrum_router: Maintain a hash table of CRIFs CRIFs are objects that mlxsw maintains for netdevices that may not have an associated RIF (i.e. they may not have been instantiated in the ASIC), but if indeed they do not, it is quite possible they will in the future. These netdevices are candidate RIFs, hence CRIFs. Netdevices for which CRIFs are created include e.g. bridges, LAGs, or front panel ports. The idea is that next hops would be kept at CRIFs, not RIFs, and thus it would be easier to offload and unoffload the entities that have been added before the RIF was created. In this patch, add the code for low-level CRIF maintenance: create and destroy, and keep in a table keyed by the netdevice pointer for easy recall. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Link: https://lore.kernel.org/r/186d44e399c475159da20689f2c540719f2d1ed0.1687438411.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit f3c85eed1ac364ae2cb2729959c6150813cc9c20 Author: Petr Machata Date: Thu Jun 22 15:33:03 2023 +0200 mlxsw: spectrum_router: Use mlxsw_sp_ul_rif_get() to get main VRF LB RIF The current function, mlxsw_sp_router_ul_rif_get(), is a wrapper around the function mentioned in the subject. As such it forms an external interface of the router code. In future patches we will want to maintain connection between RIFs and the CRIFs (introduced in the next patch) that back them. That will not hold for the VRF-based loopback netdevices, so the whole CRIF business can be kept hidden from the rest of mlxsw. But for the main VRF loopback RIF we do want to keep the RIF-CRIF connection, because that RIF is used for blackhole next hops, and the next hop code can be kept simpler for assuming rif->crif is valid. Hence, instead, call mlxsw_sp_ul_rif_get() to create the main VRF loopback RIF. This being an internal function will take the CRIF argument anyway. Furthermore, the function does not lock, which is not necessary at this point in code yet. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Link: https://lore.kernel.org/r/7a39a011a02a84164cd7f5da7985ec5b2ae01ba5.1687438411.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit ebbd17ce297a3f367ca20058272063eaeeced63a Author: Petr Machata Date: Thu Jun 22 15:33:02 2023 +0200 mlxsw: spectrum_router: Add extack argument to mlxsw_sp_lb_rif_init() The extack will be handy in later patches. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Link: https://lore.kernel.org/r/e87ba300121010d580b80a281877573a7b1377ca.1687438411.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 6a940abdef3162e5723f1495b8a49859d1708f79 Author: Eric Dumazet Date: Thu Jun 22 15:23:04 2023 +0000 bonding: do not assume skb mac_header is set Drivers must not assume in their ndo_start_xmit() that skbs have their mac_header set. skb->data is all what is needed. bonding seems to be one of the last offender as caught by syzbot: WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 skb_mac_offset include/linux/skbuff.h:2913 [inline] WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline] WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline] WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline] WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 __bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline] WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470 Modules linked in: CPU: 1 PID: 12155 Comm: syz-executor.3 Not tainted 6.1.30-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 RIP: 0010:skb_mac_header include/linux/skbuff.h:2907 [inline] RIP: 0010:skb_mac_offset include/linux/skbuff.h:2913 [inline] RIP: 0010:bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline] RIP: 0010:bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline] RIP: 0010:bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline] RIP: 0010:__bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline] RIP: 0010:bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470 Code: 8b 7c 24 30 e8 76 dd 1a 01 48 85 c0 74 0d 48 89 c3 e8 29 67 2e fe e9 15 ef ff ff e8 1f 67 2e fe e9 10 ef ff ff e8 15 67 2e fe <0f> 0b e9 45 f8 ff ff e8 09 67 2e fe e9 dc fa ff ff e8 ff 66 2e fe RSP: 0018:ffffc90002fff6e0 EFLAGS: 00010283 RAX: ffffffff835874db RBX: 000000000000ffff RCX: 0000000000040000 RDX: ffffc90004dcf000 RSI: 00000000000000b5 RDI: 00000000000000b6 RBP: ffffc90002fff8b8 R08: ffffffff83586d16 R09: ffffffff83586584 R10: 0000000000000007 R11: ffff8881599fc780 R12: ffff88811b6a7b7e R13: 1ffff110236d4f6f R14: ffff88811b6a7ac0 R15: 1ffff110236d4f76 FS: 00007f2e9eb47700(0000) GS:ffff8881f6b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2e421000 CR3: 000000010e6d4000 CR4: 00000000003526e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: [] netdev_start_xmit include/linux/netdevice.h:4925 [inline] [] __dev_direct_xmit+0x4ef/0x850 net/core/dev.c:4380 [] dev_direct_xmit include/linux/netdevice.h:3043 [inline] [] packet_direct_xmit+0x18b/0x300 net/packet/af_packet.c:284 [] packet_snd net/packet/af_packet.c:3112 [inline] [] packet_sendmsg+0x4a22/0x64d0 net/packet/af_packet.c:3143 [] sock_sendmsg_nosec net/socket.c:716 [inline] [] sock_sendmsg net/socket.c:736 [inline] [] __sys_sendto+0x472/0x5f0 net/socket.c:2139 [] __do_sys_sendto net/socket.c:2151 [inline] [] __se_sys_sendto net/socket.c:2147 [inline] [] __x64_sys_sendto+0xe5/0x100 net/socket.c:2147 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 7b8fc0103bb5 ("bonding: add a vlan+srcmac tx hashing option") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Jarod Wilson Cc: Moshe Tal Cc: Jussi Maki Cc: Jay Vosburgh Cc: Andy Gospodarek Cc: Vladimir Oltean Link: https://lore.kernel.org/r/20230622152304.2137482-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1b5ea7ffb7a3bdfffb4b7f40ce0d20a3372ee405 Author: Florian Fainelli Date: Thu Jun 22 03:31:07 2023 -0700 net: bcmgenet: Ensure MDIO unregistration has clocks enabled With support for Ethernet PHY LEDs having been added, while unregistering a MDIO bus and its child device liks PHYs there may be "late" accesses to the MDIO bus. One typical use case is setting the PHY LEDs brightness to OFF for instance. We need to ensure that the MDIO bus controller remains entirely functional since it runs off the main GENET adapter clock. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20230617155500.4005881-1-andrew@lunn.ch/ Fixes: 9a4e79697009 ("net: bcmgenet: utilize generic Broadcom UniMAC MDIO controller driver") Signed-off-by: Florian Fainelli Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230622103107.1760280-1-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski commit 54e47eade73046e860634736d2651ddc118ca694 Merge: ce44a03db73f7 7bce16630837c Author: Mark Brown Date: Sat Jun 24 01:57:59 2023 +0100 Add Renesas PMIC RAA215300 and built-in RTC Merge series from Biju Das : This patch series aims to add support for Renesas PMIC RAA215300 and built-in RTC found on this PMIC device. The details of PMIC can be found here[1]. Renesas PMIC RAA215300 exposes two separate i2c devices, one for the main device and another for rtc device. commit 4afc9a402aa3890885747b396c1adcd45f127665 Author: Yang Li Date: Thu Jun 8 16:23:12 2023 +0800 kernel/time/posix-stubs.c: remove duplicated include ./kernel/time/posix-stubs.c: linux/syscalls.h is included more than once. Link: https://lkml.kernel.org/r/20230608082312.123939-1-yang.lee@linux.alibaba.com Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=5463 Fixes: c1956519cd7e ("syscalls: add sys_ni_posix_timers prototype") Signed-off-by: Yang Li Cc: Arnd Bergmann Signed-off-by: Andrew Morton commit 7982f975600d59ae3a3d98831f703e55243aba7c Author: Colin Ian King Date: Thu Jun 22 11:27:36 2023 +0100 ocfs2: remove redundant assignment to variable bit_off Variable bit_off is being assigned a value that is never read, it is being re-assigned a new value in the following while loop. Remove the assignment. Cleans up clang scan build warning: fs/ocfs2/localalloc.c:976:18: warning: Although the value stored to 'bit_off' is used in the enclosing expression, the value is never actually read from 'bit_off' [deadcode.DeadStores] Link: https://lkml.kernel.org/r/20230622102736.2831126-1-colin.i.king@gmail.com Signed-off-by: Colin Ian King Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Signed-off-by: Andrew Morton commit a8992d8ad7775860594d3d981ef93fc423185fa4 Author: Lukas Bulwahn Date: Fri Jun 23 06:07:17 2023 +0200 watchdog/hardlockup: fix typo in config HARDLOCKUP_DETECTOR_PREFER_BUDDY Commit a5fcc2367e22 ("watchdog/hardlockup: make HAVE_NMI_WATCHDOG sparc64-specific") accidentially introduces a typo in one of the config dependencies of HARDLOCKUP_DETECTOR_PREFER_BUDDY. Fix this accidental typo. Link: https://lkml.kernel.org/r/20230623040717.8645-1-lukas.bulwahn@gmail.com Fixes: a5fcc2367e22 ("watchdog/hardlockup: make HAVE_NMI_WATCHDOG sparc64-specific") Signed-off-by: Lukas Bulwahn Reviewed-by: Petr Mladek Cc: Douglas Anderson Signed-off-by: Andrew Morton commit df8b78e1630fa6cff82fdc33ce04000e3ed065f7 Author: Douglas Anderson Date: Wed Jun 21 16:48:19 2023 -0700 powerpc: move arch_trigger_cpumask_backtrace from nmi.h to irq.h The powerpc architecture was the only one that defined arch_trigger_cpumask_backtrace() in asm/nmi.h instead of asm/irq.h. Move it to be consistent. This fixes compile time errors introduced by commit 7ca8fe94aa92 ("watchdog/hardlockup: define HARDLOCKUP_DETECTOR_ARCH"). That commit caused to stop being included if the hardlockup detector wasn't enabled. The specific errors were: error: implicit declaration of function `nmi_cpu_backtrace' error: implicit declaration of function `nmi_trigger_cpumask_backtrace' NOTE: when moving this into irq.h, we also change the guards from just checking if "CONFIG_NMI_IPI" is defined to also checking if "CONFIG_PPC_BOOK3S_64" is defined. This matches the code in arch/powerpc/kernel/stacktrace.c. Previously this worked because was included if "CONFIG_HAVE_HARDLOCKUP_DETECTOR_ARCH" was defined. For powerpc that's only selected if "CONFIG_PPC_BOOK3S_64" is defined. [dianders@chromium.org: change the guards to include CONFIG_PPC_BOOK3S_64] Link: https://lkml.kernel.org/r/20230622202816.v2.1.Ice67126857506712559078e7de26d32d26e64631@changeid Link: https://lkml.kernel.org/r/20230621164809.1.Ice67126857506712559078e7de26d32d26e64631@changeid Fixes: 7ca8fe94aa92 ("watchdog/hardlockup: define HARDLOCKUP_DETECTOR_ARCH") Signed-off-by: Douglas Anderson Reported-by: Michael Ellerman Closes: https://lore.kernel.org/r/871qi5otdh.fsf@mail.lhotse Reviewed-by: Petr Mladek Cc: Arnd Bergmann Cc: Christophe Leroy Cc: Douglas Anderson Cc: Laurent Dufour Cc: Nicholas Piggin Cc: Stephen Rothwell Cc: Tom Rix Signed-off-by: Andrew Morton commit 875e0c31f84cb264d4d7b1569a1966cedcc4d459 Author: Ben Dooks Date: Wed Jun 21 17:30:50 2023 +0100 devres: show which resource was invalid in __devm_ioremap_resource() The other error prints in this call show the resource which wsan't valid, so add this to the first print when it checks for basic validity of the resource. Link: https://lkml.kernel.org/r/20230621163050.477668-1-ben.dooks@codethink.co.uk Signed-off-by: Ben Dooks Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton commit acc72d59c7509540c27c49625cb4b5a8db1f1a84 Author: Sidhartha Kumar Date: Thu Jun 22 22:49:48 2023 -0700 mm/hugetlb: remove hugetlb_set_page_subpool() All users have been converted to hugetlb_set_folio_subpool() so we can safely remove this function. Link: https://lkml.kernel.org/r/20230623054948.280627-1-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Cc: Mike Kravetz Cc: Muchun Song Cc: Tarun Sahu Signed-off-by: Andrew Morton commit 341d51c8861fe05a8b3ea317f03f26aa0fb30710 Author: lipeifeng Date: Thu Jun 22 12:01:52 2023 +0800 mm: nommu: correct the range of mmap_sem_read_lock in task_mem() During the seq_printf,the mmap_sem_read_lock protection is not required. Link: https://lkml.kernel.org/r/20230622040152.1173-1-lipeifeng@oppo.com Signed-off-by: lipeifeng Cc: David Hildenbrand Cc: Liam R. Howlett Cc: Matthew Wilcox Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit fd4aed8d985a3236d0877ff6d0c80ad39d4ce81a Author: Mike Kravetz Date: Wed Jun 21 14:24:03 2023 -0700 hugetlb: revert use of page_cache_next_miss() Ackerley Tng reported an issue with hugetlbfs fallocate as noted in the Closes tag. The issue showed up after the conversion of hugetlb page cache lookup code to use page_cache_next_miss. User visible effects are: - hugetlbfs fallocate incorrectly returns -EEXIST if pages are presnet in the file. - hugetlb pages will not be included in core dumps if they need to be brought in via GUP. - userfaultfd UFFDIO_COPY will not notice pages already present in the cache. It may try to allocate a new page and potentially return ENOMEM as opposed to EEXIST. Revert the use page_cache_next_miss() in hugetlb code. IMPORTANT NOTE FOR STABLE BACKPORTS: This patch will apply cleanly to v6.3. However, due to the change of filemap_get_folio() return values, it will not function correctly. This patch must be modified for stable backports. [dan.carpenter@linaro.org: fix hugetlbfs_pagecache_present()] Link: https://lkml.kernel.org/r/efa86091-6a2c-4064-8f55-9b44e1313015@moroto.mountain Link: https://lkml.kernel.org/r/20230621212403.174710-2-mike.kravetz@oracle.com Fixes: d0ce0e47b323 ("mm/hugetlb: convert hugetlb fault paths to use alloc_hugetlb_folio()") Signed-off-by: Mike Kravetz Signed-off-by: Dan Carpenter Reported-by: Ackerley Tng Closes: https://lore.kernel.org/linux-mm/cover.1683069252.git.ackerleytng@google.com Reviewed-by: Sidhartha Kumar Cc: Erdem Aktas Cc: Greg Kroah-Hartman Cc: Matthew Wilcox Cc: Muchun Song Cc: Vishal Annapurve Signed-off-by: Andrew Morton commit 16f8eb3eea9eb2a1568279d64ca4dc977e7aa538 Author: Mike Kravetz Date: Wed Jun 21 14:24:02 2023 -0700 Revert "page cache: fix page_cache_next/prev_miss off by one" This reverts commit 9425c591e06a9ab27a145ba655fb50532cf0bcc9 The reverted commit fixed up routines primarily used by readahead code such that they could also be used by hugetlb. Unfortunately, this caused a performance regression as pointed out by the Closes: tag. The hugetlb code which uses page_cache_next_miss will be addressed in a subsequent patch. Link: https://lkml.kernel.org/r/20230621212403.174710-1-mike.kravetz@oracle.com Fixes: 9425c591e06a ("page cache: fix page_cache_next/prev_miss off by one") Signed-off-by: Mike Kravetz Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202306211346.1e9ff03e-oliver.sang@intel.com Reviewed-by: Sidhartha Kumar Cc: Ackerley Tng Cc: Erdem Aktas Cc: Greg Kroah-Hartman Cc: Matthew Wilcox Cc: Muchun Song Cc: Vishal Annapurve Signed-off-by: Andrew Morton commit 1bc545bff45ce9eefc176ccf663074462a209cb6 Author: Yosry Ahmed Date: Wed Jun 21 02:31:01 2023 +0000 mm/vmscan: fix root proactive reclaim unthrottling unbalanced node When memory.reclaim was introduced, it became the first case where cgroup_reclaim() is true for the root cgroup. Johannes concluded [1] that for most cases this is okay, except for one case. Historically, kswapd would throttle reclaim on a node if a lot of pages marked for reclaim are under writeback (aka the node is congested). This occurred by setting LRUVEC_CONGESTED bit in lruvec->flags. The bit would be cleared when the node is balanced. Similarly, cgroup reclaim would set the same bit when an lruvec is congested, and clear it on the way out of reclaim (to throttle local reclaimers). Before the introduction of memory.reclaim, the root memcg was the only target of kswapd reclaim, and non-root memcgs were the only targets of cgroup reclaim, so they would never interfere. Using the same bit for both was fine. After memory.reclaim, it is possible for cgroup reclaim on the root cgroup to clear the bit set by kswapd. This would result in reclaim on the node to be unthrottled before the node is balanced. Fix this by introducing separate bits for cgroup-level and node-level congestion. kswapd can unthrottle an lruvec that is marked as congested by cgroup reclaim (as the entire node should no longer be congested), but not vice versa (to prevent premature unthrottling before the entire node is balanced). [1]https://lore.kernel.org/lkml/20230405200150.GA35884@cmpxchg.org/ Link: https://lkml.kernel.org/r/20230621023101.432780-1-yosryahmed@google.com Signed-off-by: Yosry Ahmed Reported-by: Johannes Weiner Closes: https://lore.kernel.org/lkml/20230405200150.GA35884@cmpxchg.org/ Cc: Michal Hocko Cc: Roman Gushchin Cc: Shakeel Butt Cc: Muchun Song Cc: Yu Zhao Signed-off-by: Andrew Morton commit 7a704474b3022dabbb68f72bf18a3d89ec1c0a24 Author: Yosry Ahmed Date: Wed Jun 21 02:30:53 2023 +0000 mm: memcg: rename and document global_reclaim() Evidently, global_reclaim() can be a confusing name. Especially that it used to exist before with a subtly different definition (removed by commit b5ead35e7e1d ("mm: vmscan: naming fixes: global_reclaim() and sane_reclaim()"). It can be interpreted as non-cgroup reclaim, even though it returns true for cgroup reclaim on the root memcg (through memory.reclaim). Rename it to root_reclaim() in an attempt to make it less ambiguous, and add documentation to it as well as cgroup_reclaim. Link: https://lkml.kernel.org/r/20230621023053.432374-1-yosryahmed@google.com Signed-off-by: Yosry Ahmed Reported-by: Johannes Weiner Closes: https://lore.kernel.org/lkml/20230405200150.GA35884@cmpxchg.org/ Acked-by: Yu Zhao Cc: Michal Hocko Cc: Muchun Song Cc: Roman Gushchin Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 7302338a14f97eb44cd13f34aab0dc6596f1632c Author: Kefeng Wang Date: Mon Jun 19 19:07:18 2023 +0800 mm: kill [add|del]_page_to_lru_list() Now no one call [add|del]_page_to_lru_list(), let's drop unused page interfaces. Link:https://lkml.kernel.org/r/20230619110718.65679-2-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Acked-by: Yu Zhao Reviewed-by: Baolin Wang Cc: James Gowans Cc: Matthew Wilcox Signed-off-by: Andrew Morton commit 56ae0bb349b4eeb172674d4876f2b6290d505a25 Author: Kefeng Wang Date: Mon Jun 19 19:07:17 2023 +0800 mm: compaction: convert to use a folio in isolate_migratepages_block() Directly use a folio instead of page_folio() when page successfully isolated (hugepage and movable page) and after folio_get_nontail_page(), which removes several calls to compound_head(). Link: https://lkml.kernel.org/r/20230619110718.65679-1-wangkefeng.wang@huawei.com Signed-off-by: Kefeng Wang Cc: Baolin Wang Cc: James Gowans Cc: Matthew Wilcox Cc: Yu Zhao Signed-off-by: Andrew Morton commit 18a937076c6991a21b88d99af95b779b5027b29b Author: Yosry Ahmed Date: Wed Jun 21 09:30:09 2023 +0000 mm: zswap: fix double invalidate with exclusive loads If exclusive loads are enabled for zswap, we invalidate the entry before returning from zswap_frontswap_load(), after dropping the local reference. However, the tree lock is dropped during decompression after the local reference is acquired, so the entry could be invalidated before we drop the local ref. If this happens, the entry is freed once we drop the local ref, and zswap_invalidate_entry() tries to invalidate an already freed entry. Fix this by: (a) Making sure zswap_invalidate_entry() is always called with a local ref held, to avoid being called on a freed entry. (b) Making sure zswap_invalidate_entry() only drops the ref if the entry was actually on the rbtree. Otherwise, another invalidation could have already happened, and the initial ref is already dropped. With these changes, there is no need to check that there is no need to make sure the entry still exists in the tree in zswap_reclaim_entry() before invalidating it, as zswap_reclaim_entry() will make this check internally. Link: https://lkml.kernel.org/r/20230621093009.637544-1-yosryahmed@google.com Fixes: b9c91c43412f ("mm: zswap: support exclusive loads") Signed-off-by: Yosry Ahmed Reported-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Dan Streetman Cc: Domenico Cerasuolo Cc: Johannes Weiner Cc: Konrad Rzeszutek Wilk Cc: Nhat Pham Cc: Seth Jennings Cc: Vitaly Wool Cc: Yu Zhao Signed-off-by: Andrew Morton commit 994ec4e29b3de188d11fe60d17403285fcc8917a Author: Matthew Wilcox (Oracle) Date: Wed Jun 21 17:45:57 2023 +0100 mm: remove unnecessary pagevec includes These files no longer need pagevec.h, mostly due to function declarations being moved out of it. Link: https://lkml.kernel.org/r/20230621164557.3510324-14-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 1fec6890bf2247ecc93f5491c2d3f33c333d5c6e Author: Matthew Wilcox (Oracle) Date: Wed Jun 21 17:45:56 2023 +0100 mm: remove references to pagevec Most of these should just refer to the LRU cache rather than the data structure used to implement the LRU cache. Link: https://lkml.kernel.org/r/20230621164557.3510324-13-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 1a0fc811f5f5addf54499826bd1b6e34e917491c Author: Matthew Wilcox (Oracle) Date: Wed Jun 21 17:45:55 2023 +0100 mm: rename invalidate_mapping_pagevec to mapping_try_invalidate We don't use pagevecs for the LRU cache any more, and we don't know that the failed invalidations were due to the folio being in an LRU cache. So rename it to be more accurate. Link: https://lkml.kernel.org/r/20230621164557.3510324-12-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 1e0877d58b1e22517d8939b22b963c043e6c63fd Author: Matthew Wilcox (Oracle) Date: Wed Jun 21 17:45:54 2023 +0100 mm: remove struct pagevec All users are now converted to use the folio_batch so we can get rid of this data structure. Link: https://lkml.kernel.org/r/20230621164557.3510324-11-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 76fa88429075667fe76d4905f2f471e0ac3d543c Author: Matthew Wilcox (Oracle) Date: Wed Jun 21 17:45:53 2023 +0100 net: convert sunrpc from pagevec to folio_batch Remove the last usage of pagevecs. There is a slight change here; we now free the folio_batch as soon as it fills up instead of freeing the folio_batch when we try to add a page to a full batch. This should have no effect in practice. Link: https://lkml.kernel.org/r/20230621164557.3510324-10-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Chuck Lever Signed-off-by: Andrew Morton commit f8a101ff09a70ec708b66b3f5bd4e7405283d14a Author: Matthew Wilcox (Oracle) Date: Wed Jun 21 17:45:52 2023 +0100 i915: convert i915_gpu_error to use a folio_batch Remove one of the last remaining users of pagevec. Link: https://lkml.kernel.org/r/20230621164557.3510324-9-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit ce06442812fc584337c5b23a43bd2be7d037041d Author: Matthew Wilcox (Oracle) Date: Wed Jun 21 17:45:51 2023 +0100 pagevec: rename fbatch_count() This should always have been called folio_batch_count(). Link: https://lkml.kernel.org/r/20230621164557.3510324-8-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit e0b72c14d8dcc9477e580c261041dae86d4906fe Author: Matthew Wilcox (Oracle) Date: Wed Jun 21 17:45:50 2023 +0100 mm: remove check_move_unevictable_pages() All callers have now been converted to call check_move_unevictable_folios(). Link: https://lkml.kernel.org/r/20230621164557.3510324-7-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 3291e09a463870610b8227f32b16b19a587edf33 Author: Matthew Wilcox (Oracle) Date: Wed Jun 21 17:45:49 2023 +0100 drm: convert drm_gem_put_pages() to use a folio_batch Remove a few hidden compound_head() calls by converting the returned page to a folio once and using the folio APIs. Link: https://lkml.kernel.org/r/20230621164557.3510324-6-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 0b62af28f249b9c4036a05acfb053058dc02e2e2 Author: Matthew Wilcox (Oracle) Date: Wed Jun 21 17:45:48 2023 +0100 i915: convert shmem_sg_free_table() to use a folio_batch Remove a few hidden compound_head() calls by converting the returned page to a folio once and using the folio APIs. We also only increment the refcount on the folio once instead of once for each page. Ideally, we would have a for_each_sgt_folio macro, but until then this will do. Link: https://lkml.kernel.org/r/20230621164557.3510324-5-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit bdadc6d83156016d2b5eed582c1458c881c53a1e Author: Matthew Wilcox (Oracle) Date: Wed Jun 21 17:45:47 2023 +0100 scatterlist: add sg_set_folio() This wrapper for sg_set_page() lets drivers add folios to a scatterlist more easily. We could, perhaps, do better by using a different page in the folio if offset is larger than UINT_MAX, but let's hope we get a better data structure than this before we need to care about such large folios. Link: https://lkml.kernel.org/r/20230621164557.3510324-4-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 982a7194afc9a58ec55ed174c61869c2722bb918 Author: Matthew Wilcox (Oracle) Date: Wed Jun 21 17:45:46 2023 +0100 mm: add __folio_batch_release() This performs the same role as __pagevec_release(), ie skipping the check for batch length of 0. Link: https://lkml.kernel.org/r/20230621164557.3510324-3-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit f5f288a023193dddbc612d00abaa8f7353b44c5f Author: Matthew Wilcox (Oracle) Date: Wed Jun 21 17:45:45 2023 +0100 afs: convert pagevec to folio_batch in afs_extend_writeback() Patch series "Remove pagevecs". Removes a folio->page->folio conversion for each folio that's involved. More importantly, removes one of the last few uses of a pagevec. Link: https://lkml.kernel.org/r/20230621164557.3510324-1-willy@infradead.org Link: https://lkml.kernel.org/r/20230621164557.3510324-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 1bf61092bc90a9054d01cfdf35b42c1bf6fe47c7 Author: Baolin Wang Date: Wed Jun 21 16:14:28 2023 +0800 mm: page_alloc: use the correct type of list for free pages Commit bf75f200569d ("mm/page_alloc: add page->buddy_list and page->pcp_list") introduces page->buddy_list and page->pcp_list as a union with page->lru, but missed to change get_page_from_free_area() to use page->buddy_list to clarify the correct type of list for a free page. Link: https://lkml.kernel.org/r/7e7ab533247d40c0ea0373c18a6a48e5667f9e10.1687333557.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Acked-by: Mel Gorman Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton commit b5665cf936bf3955fec18c09a6aa53c8a57ea8b7 Author: Ivan Orlov Date: Tue Jun 20 20:33:15 2023 +0200 mm: backing-dev: make bdi_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the bdi_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at load time. Link: https://lkml.kernel.org/r/20230620183314.682822-2-gregkh@linuxfoundation.org Signed-off-by: Ivan Orlov Signed-off-by: Greg Kroah-Hartman Suggested-by: Greg Kroah-Hartman Cc: Jens Axboe Cc: Christoph Hellwig Signed-off-by: Andrew Morton commit 3fda49e89f1702df6bb6a2470076b1a7bf3a29de Author: Hugh Dickins Date: Mon Jun 19 23:50:00 2023 -0700 mm/swapfile: delete outdated pte_offset_map() comment Delete a triply out-of-date comment from add_swap_count_continuation(): 1. vmalloc_to_page() changed from pte_offset_map() to pte_offset_kernel() 2. pte_offset_map() changed from using kmap_atomic() to kmap_local_page() 3. kmap_atomic() changed from using fixed FIX_KMAP addresses in 2.6.37. Link: https://lkml.kernel.org/r/9022632b-ba9d-8cb0-c25-4be9786481b5@google.com Signed-off-by: Hugh Dickins Signed-off-by: Andrew Morton commit 61167ad5fecdeaa037f3df1ba354dddd5f66a1ed Author: Yajun Deng Date: Mon Jun 19 10:34:06 2023 +0800 mm: pass nid to reserve_bootmem_region() early_pfn_to_nid() is called frequently in init_reserved_page(), it returns the node id of the PFN. These PFN are probably from the same memory region, they have the same node id. It's not necessary to call early_pfn_to_nid() for each PFN. Pass nid to reserve_bootmem_region() and drop the call to early_pfn_to_nid() in init_reserved_page(). Also, set nid on all reserved pages before doing this, as some reserved memory regions may not be set nid. The most beneficial function is memmap_init_reserved_pages() if CONFIG_DEFERRED_STRUCT_PAGE_INIT is enabled. The following data was tested on an x86 machine with 190GB of RAM. before: memmap_init_reserved_pages() 67ms after: memmap_init_reserved_pages() 20ms Link: https://lkml.kernel.org/r/20230619023406.424298-1-yajun.deng@linux.dev Signed-off-by: Yajun Deng Reviewed-by: Mike Rapoport (IBM) Signed-off-by: Andrew Morton commit 9883c7f84053cec2826ca3c56254601b5ce9cdbe Author: Jason Gunthorpe Date: Mon Jun 19 15:27:25 2023 -0300 mm/gup: do not return 0 from pin_user_pages_fast() for bad args These routines are not intended to return zero, the callers cannot do anything sane with a 0 return. They should return an error which means future calls to GUP will not succeed, or they should return some non-zero number of pinned pages which means GUP should be called again. If start + nr_pages overflows it should return -EOVERFLOW to signal the arguments are invalid. Syzkaller keeps tripping on this when fuzzing GUP arguments. Link: https://lkml.kernel.org/r/0-v1-3d5ed1f20d50+104-gup_overflow_jgg@nvidia.com Signed-off-by: Jason Gunthorpe Reported-by: syzbot+353c7be4964c6253f24a@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/000000000000094fdd05faa4d3a4@google.com Reviewed-by: John Hubbard Reviewed-by: Lorenzo Stoakes Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton commit 0b52c420350e8f9873ba62768cd8246827184408 Author: Jan Glauber Date: Mon Jun 19 12:33:51 2023 +0200 mm: fix shmem THP counters on migration The per node numa_stat values for shmem don't change on page migration for THP: grep shmem /sys/fs/cgroup/machine.slice/.../memory.numa_stat: shmem N0=1092616192 N1=10485760 shmem_thp N0=1092616192 N1=10485760 migratepages 9181 0 1: shmem N0=0 N1=1103101952 shmem_thp N0=1092616192 N1=10485760 Fix that by updating shmem_thp counters likewise to shmem counters on page migration. [jglauber@digitalocean.com: use folio_test_pmd_mappable instead of folio_test_transhuge] Link: https://lkml.kernel.org/r/20230622094720.510540-1-jglauber@digitalocean.com Link: https://lkml.kernel.org/r/20230619103351.234837-1-jglauber@digitalocean.com Signed-off-by: Jan Glauber Reviewed-by: Baolin Wang Cc: "Huang, Ying" Signed-off-by: Andrew Morton commit 3360cd30a4c569eb601e737e2c10b7bd153210ca Author: Haifeng Xu Date: Mon Jun 19 12:47:35 2023 +0000 selftests: cgroup: fix unexpected failure on test_memcg_sock Before server got a client connection, there were some memory allocations in the test memcg, such as user stack. So do not count those allocations which are not related to socket when checking socket memory accounting. Link: https://lkml.kernel.org/r/20230619124735.2124-1-haifeng.xu@shopee.com Signed-off-by: Haifeng Xu Cc: Johannes Weiner Cc: Michal Hocko Cc: Michal Koutný Cc: Roman Gushchin Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 91f0dccef141483f8399299c39ce9114d19bb147 Author: Haifeng Xu Date: Mon Jun 19 13:04:42 2023 +0000 mm/memcontrol: do not tweak node in mem_cgroup_init() mem_cgroup_init() request for allocations from each possible node, and it's used to be a problem because NODE_DATA is not allocated for offline node. Things have already changed since commit 09f49dca570a9 ("mm: handle uninitialized numa nodes gracefully"), so it's unnecessary to check for !node_online nodes here. How to test? qemu-system-x86_64 \ -kernel vmlinux \ -initrd full.rootfs.cpio.gz \ -append "console=ttyS0,115200 root=/dev/ram0 nokaslr earlyprintk=serial oops=panic panic_on_warn" \ -drive format=qcow2,file=vm_disk.qcow2,media=disk,if=ide \ -enable-kvm \ -cpu host \ -m 8G,slots=2,maxmem=16G \ -smp cores=4,threads=1,sockets=2 \ -object memory-backend-ram,id=mem0,size=4G \ -object memory-backend-ram,id=mem1,size=4G \ -numa node,memdev=mem0,cpus=0-3,nodeid=0 \ -numa node,memdev=mem1,cpus=4-7,nodeid=1 \ -numa node,nodeid=2 \ -net nic,model=virtio,macaddr=52:54:00:12:34:58 \ -net user \ -nographic \ -rtc base=localtime \ -gdb tcp::6000 Guest state when booting: [ 0.048881] NUMA: Node 0 [mem 0x00000000-0x0009ffff] + [mem 0x00100000-0xbfffffff] -> [mem 0x00000000-0xbfffffff] [ 0.050489] NUMA: Node 0 [mem 0x00000000-0xbfffffff] + [mem 0x100000000-0x13fffffff] -> [mem 0x00000000-0x13fffffff] [ 0.052173] NODE_DATA(0) allocated [mem 0x13fffc000-0x13fffffff] [ 0.053164] NODE_DATA(1) allocated [mem 0x23fffa000-0x23fffdfff] [ 0.054187] Zone ranges: [ 0.054587] DMA [mem 0x0000000000001000-0x0000000000ffffff] [ 0.055551] DMA32 [mem 0x0000000001000000-0x00000000ffffffff] [ 0.056515] Normal [mem 0x0000000100000000-0x000000023fffffff] [ 0.057484] Movable zone start for each node [ 0.058149] Early memory node ranges [ 0.058705] node 0: [mem 0x0000000000001000-0x000000000009efff] [ 0.059679] node 0: [mem 0x0000000000100000-0x00000000bffdffff] [ 0.060659] node 0: [mem 0x0000000100000000-0x000000013fffffff] [ 0.061649] node 1: [mem 0x0000000140000000-0x000000023fffffff] [ 0.062638] Initmem setup node 0 [mem 0x0000000000001000-0x000000013fffffff] [ 0.063745] Initmem setup node 1 [mem 0x0000000140000000-0x000000023fffffff] [ 0.064855] DMA zone: 158 reserved pages exceeds freesize 0 [ 0.065746] Initializing node 2 as memoryless [ 0.066437] Initmem setup node 2 as memoryless [ 0.067132] DMA zone: 158 reserved pages exceeds freesize 0 [ 0.068037] On node 0, zone DMA: 1 pages in unavailable ranges [ 0.068265] On node 0, zone DMA: 97 pages in unavailable ranges [ 0.124755] On node 0, zone Normal: 32 pages in unavailable ranges cat /sys/devices/system/node/online 0-1 cat /sys/devices/system/node/possible 0-2 Link: https://lkml.kernel.org/r/20230619130442.2487-1-haifeng.xu@shopee.com Signed-off-by: Haifeng Xu Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Roman Gushchin Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 726ccdba1521007fab4b2b7565d255fa0f2b770c Author: Tetsuo Handa Date: Sun May 28 00:25:31 2023 +0900 kasan,kmsan: remove __GFP_KSWAPD_RECLAIM usage from kasan/kmsan syzbot is reporting lockdep warning in __stack_depot_save(), for the caller of __stack_depot_save() (i.e. __kasan_record_aux_stack() in this report) is responsible for masking __GFP_KSWAPD_RECLAIM flag in order not to wake kswapd which in turn wakes kcompactd. Since kasan/kmsan functions might be called with arbitrary locks held, mask __GFP_KSWAPD_RECLAIM flag from all GFP_NOWAIT/GFP_ATOMIC allocations in kasan/kmsan. Note that kmsan_save_stack_with_flags() is changed to mask both __GFP_DIRECT_RECLAIM flag and __GFP_KSWAPD_RECLAIM flag, for wakeup_kswapd() from wake_all_kswapds() from __alloc_pages_slowpath() calls wakeup_kcompactd() if __GFP_KSWAPD_RECLAIM flag is set and __GFP_DIRECT_RECLAIM flag is not set. Link: https://lkml.kernel.org/r/656cb4f5-998b-c8d7-3c61-c2d37aa90f9a@I-love.SAKURA.ne.jp Signed-off-by: Tetsuo Handa Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=ece2915262061d6e0ac1 Reviewed-by: "Huang, Ying" Reviewed-by: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitry Vyukov Cc: Marco Elver Cc: Mel Gorman Cc: Vincenzo Frascino Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 9721fd82351d47a37ba982272e128101f24efd7c Author: Baolin Wang Date: Wed Jun 14 16:40:20 2023 +0800 mm: compaction: skip memory hole rapidly when isolating migratable pages On some machines, the normal zone can have a large memory hole like below memory layout, and we can see the range from 0x100000000 to 0x1800000000 is a hole. So when isolating some migratable pages, the scanner can meet the hole and it will take more time to skip the large hole. From my measurement, I can see the isolation scanner will take 80us ~ 100us to skip the large hole [0x100000000 - 0x1800000000]. So adding a new helper to fast search next online memory section to skip the large hole can help to find next suitable pageblock efficiently. With this patch, I can see the large hole scanning only takes < 1us. [ 0.000000] Zone ranges: [ 0.000000] DMA [mem 0x0000000040000000-0x00000000ffffffff] [ 0.000000] DMA32 empty [ 0.000000] Normal [mem 0x0000000100000000-0x0000001fa7ffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000040000000-0x0000000fffffffff] [ 0.000000] node 0: [mem 0x0000001800000000-0x0000001fa3c7ffff] [ 0.000000] node 0: [mem 0x0000001fa3c80000-0x0000001fa3ffffff] [ 0.000000] node 0: [mem 0x0000001fa4000000-0x0000001fa402ffff] [ 0.000000] node 0: [mem 0x0000001fa4030000-0x0000001fa40effff] [ 0.000000] node 0: [mem 0x0000001fa40f0000-0x0000001fa73cffff] [ 0.000000] node 0: [mem 0x0000001fa73d0000-0x0000001fa745ffff] [ 0.000000] node 0: [mem 0x0000001fa7460000-0x0000001fa746ffff] [ 0.000000] node 0: [mem 0x0000001fa7470000-0x0000001fa758ffff] [ 0.000000] node 0: [mem 0x0000001fa7590000-0x0000001fa7ffffff] [baolin.wang@linux.alibaba.com: limit next_ptn to not exceed cc->free_pfn] Link: https://lkml.kernel.org/r/a1d859c28af0c7e85e91795e7473f553eb180a9d.1686813379.git.baolin.wang@linux.alibaba.com Link: https://lkml.kernel.org/r/75b4c8ca36bf44ad8c42bf0685ac19d272e426ec.1686705221.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Acked-by: "Huang, Ying" Cc: Mel Gorman Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 8c293a6353d663879ec0e5db1db052319ca2100f Author: Marco Elver Date: Tue Jun 20 19:17:35 2023 +0200 kasan, doc: note kasan.fault=panic_on_write behaviour for async modes Note the behaviour of kasan.fault=panic_on_write for async modes, since all asynchronous faults will result in panic (even if they are reads). Link: https://lkml.kernel.org/r/ZJHfL6vavKUZ3Yd8@elver.google.com Fixes: 452c03fdbed0 ("kasan: add support for kasan.fault=panic_on_write") Signed-off-by: Marco Elver Reviewed-by: Andrey Konovalov Cc: Aleksandr Nogikh Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Catalin Marinas Cc: Dmitry Vyukov Cc: Jonathan Corbet Cc: Taras Madan Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit 63773d2b593d86440c3b96fd300ed80d00cd06ef Merge: cf01724e2d73a 814bc1de03ea4 Author: Andrew Morton Date: Fri Jun 23 16:58:19 2023 -0700 Merge mm-hotfixes-stable into mm-stable to pick up depended-upon changes. commit 814bc1de03ea4361101408e63a68e4b82aef22cb Author: Yu Zhao Date: Mon Jun 19 13:38:21 2023 -0600 mm/mglru: make memcg_lru->lock irq safe lru_gen_rotate_memcg() can happen in softirq if memory.soft_limit_in_bytes is set. This requires memcg_lru->lock to be irq safe. Lockdep warns on this. This problem only affects memcg v1. Link: https://lkml.kernel.org/r/20230619193821.2710944-1-yuzhao@google.com Fixes: e4dde56cd208 ("mm: multi-gen LRU: per-node lru_gen_folio lists") Signed-off-by: Yu Zhao Reported-by: syzbot+87c490fd2be656269b6a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=87c490fd2be656269b6a Reviewed-by: Yosry Ahmed Cc: Signed-off-by: Andrew Morton commit a7ab84a5915fc67697131b8e5eba96c278bbe785 Author: Krzysztof Kozlowski Date: Fri Jun 9 16:07:09 2023 +0200 dt-bindings: pwm: drop unneeded quotes Cleanup bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20230609140709.64655-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit f6814f6f3fb2802d8808749b9abead2756f57402 Author: Krzysztof Kozlowski Date: Wed Jun 21 08:44:03 2023 +0200 dt-bindings: crypto: drop unneeded quotes Cleanup bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Linus Walleij Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230621064403.9221-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 2c5555983bd27d24162534b682b10654639a5576 Author: Jan Kara Date: Thu Jun 22 18:46:55 2023 +0200 bcache: Fix bcache device claiming Commit 2736e8eeb0cc ("block: use the holder as indication for exclusive opens") introduced a change that blkdev_put() has to get exclusive holder of the bdev as an argument. However it overlooked that register_bdev() and register_cache() overwrite the bdev->bd_holder field in the block device to point to the real owning object which was not available at the time we called blkdev_get_by_path(). Messing with bdev internals like this is a layering violation and it also causes blkdev_put() to issue warning about mismatching holders. Fix bcache to reopen the block device with appropriate holder once it is available which also restores the behavior that multiple bcache caches cannot claim the same device which was broken by commit 29499ab060fe ("bcache: don't pass a stack address to blkdev_get_by_path"). Fixes: 2736e8eeb0cc ("block: use the holder as indication for exclusive opens") Signed-off-by: Jan Kara Reviewed-by: Kent Overstreet Acked-by: Coly Li Link: https://lore.kernel.org/r/20230622164658.12861-2-jack@suse.cz Signed-off-by: Jens Axboe commit abcc0cbd49283fccd20420e86416b2475b00819c Author: Jan Kara Date: Thu Jun 22 18:46:54 2023 +0200 bcache: Alloc holder object before async registration Allocate holder object (cache or cached_dev) before offloading the rest of the startup to async work. This will allow us to open the block block device with proper holder. Signed-off-by: Jan Kara Acked-by: Coly Li Reviewed-by: Kent Overstreet Link: https://lore.kernel.org/r/20230622164658.12861-1-jack@suse.cz Signed-off-by: Jens Axboe commit 95bf6df03d412f678a7b558da186c2ef797ac40c Merge: 0e796e3eafc5b 46e66dab8565f Author: Vishal Verma Date: Fri Jun 23 15:20:00 2023 -0600 Merge branch 'for-6.5/dax-cleanups' into nvdimm-for-next The reference counting of dax_region objects is needlessly complicated, has lead to confusion [1], and has hidden a bug [2]. While testing the cleanup for those issues, a CONFIG_DEBUG_KOBJECT_RELEASE test run uncovered a use-after-free in dax_mapping_release(). Clean all of that up. Thanks to Yongqiang, Paul, and Ira for their analysis. Additionally, clean up a redundant variable in fsdax, and fix memory hotplug registration in the kmem driver. [1]: http://lore.kernel.org/r/20221203095858.612027-1-liuyongqiang13@huawei.com [2]: http://lore.kernel.org/r/3cf0890b-4eb0-e70e-cd9c-2ecc3d496263@hpe.com commit a3eb95484f276488e3d59cffa8eec29f79be416e Author: Varshini Rajendran Date: Sat Jun 24 02:00:43 2023 +0530 spi: dt-bindings: atmel,at91rm9200-spi: add sam9x7 compatible Add sam9x7 compatible to DT bindings documentation. Signed-off-by: Varshini Rajendran Link: https://lore.kernel.org/r/Message-Id: <20230623203056.689705-33-varshini.rajendran@microchip.com> Signed-off-by: Mark Brown commit 2d0cad0473bd1ffbc5842be0b9f2546265acb011 Author: Mark Brown Date: Fri Jun 23 22:04:39 2023 +0100 ASoC: core: Always store of_node when getting DAI link component The generic snd_soc_dai_get_dlc() contains a default translation function for DAI names which has factored out common code in a number of card drivers, resolving the dai_name and of_node either using a driver provided translation function or with a generic implementation. Unfortunately the of_node can't be set by the translation function since it currently doesn't have an interface to do that but snd_soc_dai_get_dlc() only initialises the of_node in the case where there is no translation function. This breaks the Meson support after conversion to use the generic helpers since the DPCM cards for it check which component of the SoC is connected to each link by checking the compatible for the component and the Meson components provide a custom operation so don't use the generic code. Fix this and potentially other cards by unconditionally storing the node in the dai_link_component, there shouldn't be a binding specific of_node selected since that's how we determine the translation function. Fixes: 2e1dbea1f8a3 ("ASoC: meson: use snd_soc_{of_}get_dlc()") Fixes: 3c8b5861850c ("ASoC: soc-core.c: add index on snd_soc_of_get_dai_name()") Link: https://lore.kernel.org/r/Message-Id: <20230623-asoc-fix-meson-probe-v1-1-82b2c2ec5ca4@kernel.org> Signed-off-by: Mark Brown commit 0e796e3eafc5ba450a1f479f22aef4c8a4c7d686 Author: Ben Dooks Date: Fri Jun 16 17:09:25 2023 +0100 nvdimm: make security_show static The security_show function is not used outside of drivers/nvdimm/dimm_devs.c and the attribute it is for is also already static. Silence the sparse warning for this not being declared by making it static. Fixes: drivers/nvdimm/dimm_devs.c:352:9: warning: symbol 'security_show' was not declared. Should it be static? Signed-off-by: Ben Dooks Link: https://lore.kernel.org/r/20230616160925.17687-1-ben.dooks@codethink.co.uk Reviewed-by: Dave Jiang Signed-off-by: Vishal Verma commit 191a9f3a611175b3e8e8c9e700fb8bce12ad7aa3 Author: Ben Dooks Date: Fri Jun 16 17:06:28 2023 +0100 nvdimm: make nd_class variable static The nd_class is not used outside of drivers/nvdimm/bus.c and thus sparse is generating the following warning. Remove this by making it static: drivers/nvdimm/bus.c:28:14: warning: symbol 'nd_class' was not declared. Should it be static? Signed-off-by: Ben Dooks Link: https://lore.kernel.org/r/20230616160628.11801-1-ben.dooks@codethink.co.uk Reviewed-by: Ira Weiny Signed-off-by: Vishal Verma commit 8fb3e25c3dd1a2755c848ce7488c2f06a9fb9f97 Author: Lyude Paul Date: Tue Jun 13 17:05:28 2023 -0400 drm/nouveau/kms/nv50-: Fix drm_dp_remove_payload() invocation We changed the semantics for this in: commit e761cc20946a ("drm/display/dp_mst: Handle old/new payload states in drm_dp_remove_payload()") But I totally forgot to update this properly in nouveau. So, let's do that. Signed-off-by: Lyude Paul Reviewed-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20230613210529.552098-1-lyude@redhat.com commit 061cbfab09fb35898f2907d42f936cf9ae271d93 Author: Frank Li Date: Mon May 15 11:10:49 2023 -0400 PCI: layerscape: Add the endpoint linkup notifier support Layerscape has PME interrupt, which can be used as linkup notifier. Set CFG_READY bit of PEX_PF0_CONFIG to enable accesses from root complex when linkup detected. Link: https://lore.kernel.org/r/20230515151049.2797105-1-Frank.Li@nxp.com Signed-off-by: Xiaowei Bao Signed-off-by: Frank Li Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Acked-by: Manivannan Sadhasivam commit 4ab91207fe37cb0b17d73aa7b042218a83908971 Author: Frank Li Date: Wed Dec 14 12:22:54 2022 -0500 PCI: endpoint: pci-epf-vntb: Fix typo in comments Replace "Span" with "Spad". Link: https://lore.kernel.org/r/20221214172254.668282-1-Frank.Li@nxp.com Signed-off-by: Frank Li Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 39cce0875121ce31b90467811de807c46aed9f0f Author: Manivannan Sadhasivam Date: Fri Jun 2 17:17:56 2023 +0530 MAINTAINERS: Add PCI MHI endpoint function driver under MHI bus Add PCI endpoint driver for MHI bus under the MHI bus entry in MAINTAINERS file. Link: https://lore.kernel.org/r/20230602114756.36586-10-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Damien Le Moal commit 1bf5f25324f7f6a52c3eb566ec5f78f6a901db96 Author: Manivannan Sadhasivam Date: Fri Jun 2 17:17:55 2023 +0530 PCI: endpoint: Add PCI Endpoint function driver for MHI bus Add PCI Endpoint driver for the Qualcomm MHI (Modem Host Interface) bus. The driver implements the MHI function over PCI in the endpoint device such as SDX55 modem. The MHI endpoint function driver acts as a controller driver for the MHI Endpoint stack and carries out all PCI related functionality. Link: https://lore.kernel.org/r/20230602114756.36586-9-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Kishon Vijay Abraham I Reviewed-by: Damien Le Moal commit 8f05cd35c73b97b9df759dd70e3ad26bc7482a7d Author: Manivannan Sadhasivam Date: Fri Jun 2 17:17:54 2023 +0530 PCI: qcom-ep: Add support for BME notification Add support to pass BME (Bus Master Enable) notification to Endpoint function driver so that the BME event can be processed by the function. Link: https://lore.kernel.org/r/20230602114756.36586-8-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Kishon Vijay Abraham I Reviewed-by: Damien Le Moal commit c47c74b7217a3a142d6c7f0371d8e0240acb21a0 Author: Manivannan Sadhasivam Date: Fri Jun 2 17:17:53 2023 +0530 PCI: qcom-ep: Add support for Link down notification Add support to pass Link down notification to Endpoint function driver so that the LINK_DOWN event can be processed by the function. Link: https://lore.kernel.org/r/20230602114756.36586-7-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Kishon Vijay Abraham I Reviewed-by: Damien Le Moal commit 6360efb96b19d89990b2a5bf3a73c689a429f5da Author: Manivannan Sadhasivam Date: Fri Jun 2 17:17:52 2023 +0530 PCI: endpoint: Add BME notifier support Add support to notify the EPF device about the Bus Master Enable (BME) event received by the EPC device from the Root complex. Link: https://lore.kernel.org/r/20230602114756.36586-6-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Kishon Vijay Abraham I Reviewed-by: Damien Le Moal commit a1f6c3d7d3a2fdcb7bf77da17a17944c81ca13de Author: Manivannan Sadhasivam Date: Fri Jun 2 17:17:51 2023 +0530 PCI: endpoint: Add linkdown notifier support Add support to notify the EPF device about the linkdown event from the EPC device. Link: https://lore.kernel.org/r/20230602114756.36586-5-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Kishon Vijay Abraham I Reviewed-by: Damien Le Moal commit a504c965588b781f864364e897917a2c7b48ea5b Author: Manivannan Sadhasivam Date: Fri Jun 2 17:17:50 2023 +0530 PCI: endpoint: Return error if EPC is started/stopped multiple times When the EPC is started or stopped multiple times from configfs, just return -EALREADY. There is no need to call the EPC start/stop functions in those cases. Link: https://lore.kernel.org/r/20230602114756.36586-4-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Kishon Vijay Abraham I Reviewed-by: Damien Le Moal commit 081c715dfd50542e89df5ee12a8e32e7ed936cd1 Author: Manivannan Sadhasivam Date: Fri Jun 2 17:17:49 2023 +0530 PCI: endpoint: Pass EPF device ID to the probe function Currently, the EPF probe function doesn't get the device ID argument needed to correctly identify the device table ID of the EPF device. When multiple entries are added to the "struct pci_epf_device_id" table, the probe function needs to identify the correct one. This is achieved by modifying the pci_epf_match_id() function to return the match ID pointer and passing it to the driver's probe function. pci_epf_device_match() function can return bool based on the return value of pci_epf_match_id(). Link: https://lore.kernel.org/r/20230602114756.36586-3-manivannan.sadhasivam@linaro.org Signed-off-by: Manivannan Sadhasivam Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Kishon Vijay Abraham I Reviewed-by: Damien Le Moal commit ff2f19d6f1fcb6128950263c3ea46ff1aefec54f Author: Manivannan Sadhasivam Date: Fri Jun 2 17:17:48 2023 +0530 PCI: endpoint: Add missing documentation about the MSI/MSI-X range Both pci_epc_raise_irq() and pci_epc_map_msi_irq() APIs expect the MSI/MSI-X vectors to start from 1 but it is not documented. Add the range info to the kdoc of the APIs to make it clear. Link: https://lore.kernel.org/r/20230602114756.36586-2-manivannan.sadhasivam@linaro.org Fixes: 5e8cb4033807 ("PCI: endpoint: Add EP core layer to enable EP controller and EP functions") Fixes: 87d5972e476f ("PCI: endpoint: Add pci_epc_ops to map MSI IRQ") Signed-off-by: Manivannan Sadhasivam Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Damien Le Moal commit b6a6e0331fad61e38316a00e14ef6381d9f03161 Author: Damien Le Moal Date: Mon May 15 16:43:47 2023 +0900 PCI: endpoint: Improve pci_epf_type_add_cfs() pci_epf_type_add_cfs() should not be called with an unbound EPF device, that is, an epf device with epf->driver not set. For such case, replace the NULL return in pci_epf_type_add_cfs() with a clear ERR_PTR(-ENODEV) pointer error return. Link: https://lore.kernel.org/r/20230515074348.595704-2-dlemoal@kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivami commit 880d51c729a3fa944794feb19f605eefe55916fc Author: Yoshihiro Shimoda Date: Wed Apr 12 15:34:47 2023 +0900 PCI: endpoint: functions/pci-epf-test: Fix dma_chan direction In pci_epf_test_init_dma_chan() epf_test->dma_chan_rx is assigned from dma_request_channel() with DMA_DEV_TO_MEM as filter.dma_mask. However, in pci_epf_test_data_transfer() if the dir is DMA_DEV_TO_MEM, epf->dma_chan_rx should be used but instead we are using epf_test->dma_chan_tx. Fix it. Link: https://lore.kernel.org/r/20230412063447.2841177-1-yoshihiro.shimoda.uh@renesas.com Fixes: 8353813c88ef ("PCI: endpoint: Enable DMA tests for endpoints with DMA capabilities") Tested-by: Kunihiko Hayashi Signed-off-by: Yoshihiro Shimoda Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Frank Li commit 4c50f933f50e018653a11bd77eb872d46d67c193 Author: Damien Le Moal Date: Sat Apr 15 11:35:42 2023 +0900 misc: pci_endpoint_test: Simplify pci_endpoint_test_msi_irq() Simplify the code of pci_endpoint_test_msi_irq() by correctly using booleans: remove the msix comparison to false as that variable is already a boolean, and directly return the result of the comparison of the raised interrupt number. Link: https://lore.kernel.org/r/20230415023542.77601-18-dlemoal@kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 168e6f62e4298815125591ff9c85d374b2a93c6c Author: Damien Le Moal Date: Sat Apr 15 11:35:41 2023 +0900 misc: pci_endpoint_test: Do not write status in IRQ handler pci_endpoint_test_irqhandler() always rewrites the status register when an IRQ is raised, either as-is if STATUS_IRQ_RAISED is not set, or with STATUS_IRQ_RAISED cleared if that flag is set. The first case creates a race window with the endpoint side, meaning that the host side test driver may end up reading what it just wrote, thus losing the real status as set by the endpoint side before raising the next interrupt. This can prevent detecting that the STATUS_IRQ_RAISED flag was set by the endpoint. Remove this race window by not clearing the STATUS_IRQ_RAISED status flag and not rewriting that register for every IRQ received. Link: https://lore.kernel.org/r/20230415023542.77601-17-dlemoal@kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit fb620ae73b70c2f57b9d3e911fc24c024ba2324f Author: Damien Le Moal Date: Sat Apr 15 11:35:40 2023 +0900 misc: pci_endpoint_test: Re-init completion for every test The irq_raised completion used to detect the end of a test case is initialized when the test device is probed, but never reinitialized again before a test case. As a result, the irq_raised completion synchronization is effective only for the first ioctl test case executed. Any subsequent call to wait_for_completion() by another ioctl() call will immediately return, potentially too early, leading to false positive failures. Fix this by reinitializing the irq_raised completion before starting a new ioctl() test command. Link: https://lore.kernel.org/r/20230415023542.77601-16-dlemoal@kernel.org Fixes: 2c156ac71c6b ("misc: Add host side PCI driver for PCI test function device") Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org commit f61b7634a3249d12b9daa36ffbdb9965b6f24c6c Author: Damien Le Moal Date: Sat Apr 15 11:35:39 2023 +0900 misc: pci_endpoint_test: Free IRQs before removing the device In pci_endpoint_test_remove(), freeing the IRQs after removing the device creates a small race window for IRQs to be received with the test device memory already released, causing the IRQ handler to access invalid memory, resulting in an oops. Free the device IRQs before removing the device to avoid this issue. Link: https://lore.kernel.org/r/20230415023542.77601-15-dlemoal@kernel.org Fixes: e03327122e2c ("pci_endpoint_test: Add 2 ioctl commands") Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org commit 1754dfd2e7931f60d199a9cb044991ab80cdfe0b Author: Damien Le Moal Date: Sat Apr 15 11:35:38 2023 +0900 PCI: epf-test: Simplify transfers result print In pci_epf_test_print_rate(), instead of open coding a reduction loop to allow for a division by a 32-bits ns value, simply use div64_u64() to calculate the transfer rate. To match the printed unit of KB/s, this calculation divides the rate by 1000 instead of 1024 (that would be KiB/s unit). Change the format of the results printed by pci_epf_test_print_rate() to be more compact without the double new line. Also use dev_info() instead of pr_info(). Link: https://lore.kernel.org/r/20230415023542.77601-14-dlemoal@kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 2566cbea69ab8dad4996ab4b4840fd952e62e5b4 Author: Damien Le Moal Date: Sat Apr 15 11:35:37 2023 +0900 PCI: epf-test: Simplify DMA support checks There is no need to have each read, write and copy test functions check for the FLAG_USE_DMA flag against the DMA support status indicated by epf_test->dma_supported. Move this test to the command handler function pci_epf_test_cmd_handler() to check once for all cases. Link: https://lore.kernel.org/r/20230415023542.77601-13-dlemoal@kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 2eec4bec3574ce1a8b0fcf568cebc82c1ad7ec80 Author: Damien Le Moal Date: Sat Apr 15 11:35:36 2023 +0900 PCI: epf-test: Cleanup request result handling Each of the test functions pci_epf_test_write(), pci_epf_test_read() and pci_epf_test_copy() return an int result which is used by pci_epf_test_cmd_handler() to set a success or error bit in the request status. In the spirit of keeping the processing of each test case self-contained within its own test function, move the request status field update from pci_epf_test_cmd_handler() to each of these test functions and change these functions declaration to returning void. Link: https://lore.kernel.org/r/20230415023542.77601-12-dlemoal@kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 96d513f5ed4cafafa31ed99f74ad527f6b0ff47b Author: Damien Le Moal Date: Sat Apr 15 11:35:35 2023 +0900 PCI: epf-test: Cleanup pci_epf_test_cmd_handler() Command codes are never combined together as flags into a single value. Thus we can replace the series of "if" tests in pci_epf_test_cmd_handler() with a cleaner switch-case statement. This also allows checking that we got a valid command and print an error message if we did not. Link: https://lore.kernel.org/r/20230415023542.77601-11-dlemoal@kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit fc97f5f7c23735da0c7314533203306d96a038fb Author: Damien Le Moal Date: Sat Apr 15 11:35:34 2023 +0900 PCI: epf-test: Improve handling of command and status registers The pci-epf-test driver uses the test register BAR memory directly to get and execute a test registers set by the RC side and defined using a struct pci_epf_test_reg. This direct use relies on using the register BAR address as a pointer to a struct pci_epf_test_reg to execute the test case and to send back the test result through the status field of struct pci_epf_test_reg. In practice, the status field is always updated before an interrupt is raised in pci_epf_test_raise_irq(), to ensure that the RC side sees the updated status when receiving an interrupt. However, such assignment direct access does not ensure that changes to the status register make it to memory, and so visible to the host, before an interrupt is raised, thus potentially resulting in the RC host not seeing the correct status result for a test. Avoid this potential problem by using READ_ONCE()/WRITE_ONCE() when accessing the command and status fields of a pci_epf_test_reg structure. This ensure that a test start (pci_epf_test_cmd_handler() function) and completion (with the function pci_epf_test_raise_irq()) achieve a correct synchronization with the MMIO register accesses on the RC host. Link: https://lore.kernel.org/r/20230415023542.77601-10-dlemoal@kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 48d19fc6e4a74e8f7d395f0186cd9e6f93c6ee26 Author: Damien Le Moal Date: Sat Apr 15 11:35:33 2023 +0900 PCI: epf-test: Simplify IRQ test commands execution For the commands COMMAND_RAISE_LEGACY_IRQ, COMMAND_RAISE_MSI_IRQ and COMMAND_RAISE_MSIX_IRQ, the function pci_epf_test_cmd_handler() sets the STATUS_IRQ_RAISED status flag and calls the epc function pci_epc_raise_irq() directly. However, this is also exactly what the pci_epf_test_raise_irq() function does. Avoid duplicating these operations by directly using pci_epf_test_raise_irq() for the IRQ test commands. It is OK to do so as the host side endpoint test driver always set the correct IRQ type for the IRQ test commands. At the same time, move the IRQ number check done for the COMMAND_RAISE_MSI_IRQ and COMMAND_RAISE_MSIX_IRQ commands to pci_epf_test_raise_irq(), to also check the IRQ number requested by the host for other test commands. This significantly simplifies pci_epf_test_cmd_handler(). Link: https://lore.kernel.org/r/20230415023542.77601-9-dlemoal@kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 5444737e16402db4a62fdf521a02c68fa84153a6 Author: Damien Le Moal Date: Sat Apr 15 11:35:32 2023 +0900 PCI: epf-test: Simplify pci_epf_test_raise_irq() Change the interface of the function pci_epf_test_raise_irq() to directly pass a pointer to the struct pci_epf_test_reg defining the test being executed. This avoids the need for grabbing this pointer using the register BAR address and simplifies the call sites as the IRQ type and IRQ numbers do not have to be passed as arguments. Link: https://lore.kernel.org/r/20230415023542.77601-8-dlemoal@kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 62d48ec7ef87d65723e3efcbfa6178cf2f7d8156 Author: Damien Le Moal Date: Sat Apr 15 11:35:31 2023 +0900 PCI: epf-test: Simplify read/write/copy test functions The function pci_epf_test_cmd_handler() uses the register BAR address as a pointer to a struct pci_epf_test_reg to determine the command sent by the host and to execute the test function accordingly. There is no need for doing this assignment again in each of the read, write and copy test functions. We can simply pass the reg pointer as an argument to the functions pci_epf_test_write(), pci_epf_test_read() and pci_epf_test_copy(). Link: https://lore.kernel.org/r/20230415023542.77601-7-dlemoal@kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 349d5c840a5d2608bc910261a176a6bd355fcc73 Author: Damien Le Moal Date: Sat Apr 15 11:35:30 2023 +0900 PCI: epf-test: Use dmaengine_submit() to initiate DMA transfer Instead of an open coded call to the tx_submit() operation of struct dma_async_tx_descriptor, use the helper function dmaengine_submit(). No functional change is introduced with this. Link: https://lore.kernel.org/r/20230415023542.77601-6-dlemoal@kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 933f31a2fe1f20e5b1ee065579f652cd1b317183 Author: Damien Le Moal Date: Sat Apr 15 11:35:29 2023 +0900 PCI: epf-test: Fix DMA transfer completion detection pci_epf_test_data_transfer() and pci_epf_test_dma_callback() are not handling DMA transfer completion correctly, leading to completion notifications to the RC side that are too early. This problem can be detected when the RC side is running an IOMMU with messages such as: pci-endpoint-test 0000:0b:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x001c address=0xfff00000 flags=0x0000] When running the pcitest.sh tests: the address used for a previous test transfer generates the above error while the next test transfer is running. Fix this by testing the DMA transfer status in pci_epf_test_dma_callback() and notifying the completion only when the transfer status is DMA_COMPLETE or DMA_ERROR. Furthermore, in pci_epf_test_data_transfer(), be paranoid and check again the transfer status and always call dmaengine_terminate_sync() before returning. Link: https://lore.kernel.org/r/20230415023542.77601-5-dlemoal@kernel.org Fixes: 8353813c88ef ("PCI: endpoint: Enable DMA tests for endpoints with DMA capabilities") Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org commit 4aca56f8eae8aa44867ddd6aa107e06f7613226f Author: Damien Le Moal Date: Sat Apr 15 11:35:28 2023 +0900 PCI: epf-test: Fix DMA transfer completion initialization Reinitialize the transfer_complete DMA transfer completion before calling tx_submit(), to avoid seeing the DMA transfer complete before the completion is initialized, thus potentially losing the completion notification. Link: https://lore.kernel.org/r/20230415023542.77601-4-dlemoal@kernel.org Fixes: 8353813c88ef ("PCI: endpoint: Enable DMA tests for endpoints with DMA capabilities") Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam Cc: stable@vger.kernel.org commit f6ec33979e9ae7fcc2b5582bd3bfdfaa1fc98a78 Author: Damien Le Moal Date: Sat Apr 15 11:35:27 2023 +0900 PCI: endpoint: Move pci_epf_type_add_cfs() code pci_epf_type_add_cfs() is called only from pci_ep_cfs_add_type_group() in drivers/pci/endpoint/pci-ep-cfs.c, so there is no need to export this function. Move its code from pci-epf-core.c to pci-ep-cfs.c as a static function. Link: https://lore.kernel.org/r/20230415023542.77601-3-dlemoal@kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 70b3740f2c1941e2006d61539131b70d20cba9a6 Author: Damien Le Moal Date: Sat Apr 15 11:35:26 2023 +0900 PCI: endpoint: Automatically create a function specific attributes group A PCI endpoint function driver can define function specific attributes under its function configfs directory using the add_cfs() endpoint driver operation. This is done by tying up the mkdir operation for the function configfs directory to a call to the add_cfs() operation. However, there are no checks preventing the user from repeatedly creating function specific attribute directories with different names, resulting in the same endpoint specific attributes group being added multiple times, which also result in an invalid reference counting for the attribute groups. E.g., using the pci-epf-ntb function driver as an example, the user creates the function as follows: $ modprobe pci-epf-ntb $ cd /sys/kernel/config/pci_ep/functions/pci_epf_ntb $ mkdir func0 $ tree func0 func0/ |-- baseclass_code |-- cache_line_size |-- ... `-- vendorid $ mkdir func0/attrs $ tree func0 func0/ |-- attrs | |-- db_count | |-- mw1 | |-- mw2 | |-- mw3 | |-- mw4 | |-- num_mws | `-- spad_count |-- baseclass_code |-- cache_line_size |-- ... `-- vendorid At this point, the function can be started by linking the EP controller. However, if the user mistakenly creates again a directory: $ mkdir func0/attrs2 $ tree func0 func0/ |-- attrs | |-- db_count | |-- mw1 | |-- mw2 | |-- mw3 | |-- mw4 | |-- num_mws | `-- spad_count |-- attrs2 | |-- db_count | |-- mw1 | |-- mw2 | |-- mw3 | |-- mw4 | |-- num_mws | `-- spad_count |-- baseclass_code |-- cache_line_size |-- ... `-- vendorid The endpoint function specific attributes are duplicated and cause a crash when the endpoint function device is torn down: refcount_t: addition on 0; use-after-free. WARNING: CPU: 2 PID: 834 at lib/refcount.c:25 refcount_warn_saturate+0xc8/0x144 CPU: 2 PID: 834 Comm: rmdir Not tainted 6.3.0-rc1 #1 Hardware name: Pine64 RockPro64 v2.1 (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) ... Call trace: refcount_warn_saturate+0xc8/0x144 config_item_get+0x7c/0x80 configfs_rmdir+0x17c/0x30c vfs_rmdir+0x8c/0x204 do_rmdir+0x158/0x184 __arm64_sys_unlinkat+0x64/0x80 invoke_syscall+0x48/0x114 ... Fix this by modifying pci_epf_cfs_work() to execute the new function pci_ep_cfs_add_type_group() which itself calls pci_epf_type_add_cfs() to obtain the function specific attribute group and the group name (directory name) from the endpoint function driver. If the function driver defines an attribute group, pci_ep_cfs_add_type_group() then proceeds to register this group using configfs_register_group(), thus automatically exposing the function type specific configfs attributes to the user. E.g.: $ modprobe pci-epf-ntb $ cd /sys/kernel/config/pci_ep/functions/pci_epf_ntb $ mkdir func0 $ tree func0 func0/ |-- baseclass_code |-- cache_line_size |-- ... |-- pci_epf_ntb.0 | |-- db_count | |-- mw1 | |-- mw2 | |-- mw3 | |-- mw4 | |-- num_mws | `-- spad_count |-- primary |-- ... `-- vendorid With this change, there is no need for the user to create or delete directories in the endpoint function attributes directory. The pci_epf_type_group_ops group operations are thus removed. Also update the documentation for the pci-epf-ntb and pci-epf-vntb function drivers to reflect this change, removing the explanations showing the need to manually create the sub-directory for the function specific attributes. Link: https://lore.kernel.org/r/20230415023542.77601-2-dlemoal@kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 37587673cda963ec950e4983db5023802f9b5ff2 Author: Shunsuke Mie Date: Thu Feb 2 19:38:32 2023 +0900 PCI: endpoint: Fix a Kconfig prompt of vNTB driver vNTB driver and NTB driver have same Kconfig prompt. Changed to make it distinguishable. Link: https://lore.kernel.org/r/20230202103832.2038286-1-mie@igel.co.jp Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP") Signed-off-by: Shunsuke Mie Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Manivannan Sadhasivam commit 1af3d0a8e8b8db855ee3c98d210f8ee01b2bb80f Author: Evan Quan Date: Thu Jun 15 11:03:49 2023 +0800 drm/amd/pm: update the LC_L1_INACTIVITY setting to address possible noise issue It is proved that insufficient LC_L1_INACTIVITY setting can cause audio noise on some platform. With the LC_L1_INACTIVITY increased to 4ms, the issue can be resolved. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 111c1813a1ab70d5422594aec0fd5a5ba914c25e Author: Aric Cyr Date: Sun Jun 11 20:14:20 2023 -0400 drm/amd/display: 3.2.240 This version brings along the following: - DCN314 fixes - DCN32x fixes - New fast update sequence enablement - DC mode clock switching enablement for DCN32x - DP link loss fix - New debugfs entry to set MST link settings Acked-by: Hamza Mahfooz Signed-off-by: Aric Cyr Signed-off-by: Alex Deucher commit 12a6e62bfdcad8be49644b6dcf70c15e0e6bab6b Author: Alvin Lee Date: Fri Jun 9 20:32:57 2023 -0400 drm/amd/display: Enable dc mode clock switching for DCN32x - DC mode clock switch interface was previously only executed for DCN303. Enable it for DCN32x so that the interface is called correctly - Assign function pointers for DCN32x that are used in the dc mode interface - Update the dc mode interface to work generically for each ASIC - In update_clocks, make sure to consider softmax if we're in DC mode Reviewed-by: Jun Lei Acked-by: Hamza Mahfooz Signed-off-by: Alvin Lee Signed-off-by: Alex Deucher commit ed83fe2abcace898fdec5c2ba0455703178ac9a3 Author: Ilya Bakoulin Date: Wed Jun 7 16:49:45 2023 -0400 drm/amd/display: Fix 128b132b link loss handling [Why] We don't check 128b132b-specific bits in LANE_ALIGN_STATUS_UPDATED DPCD registers when parsing link loss status, which can cause us to miss a link loss notification from some sinks. [How] Add a 128b132b-specific status bit check. Cc: stable@vger.kernel.org # 6.3+ Reviewed-by: Wenjing Liu Acked-by: Hamza Mahfooz Signed-off-by: Ilya Bakoulin Signed-off-by: Alex Deucher commit effee878a8661d7f4f497304ecf256e4b1790d1e Author: Dmytro Laktyushkin Date: Thu Jun 8 10:44:42 2023 -0400 drm/amd/display: fix odm k2 div calculation Correct setting is div by 2 for odm. Seamless odm transitions are enabled with enable_dp_dig_pixel_rate_div_policy debug flag. Fixes: a2c7356f526d ("drm/amd/display: fix pixel rate update sequence") Reviewed-by: Nicholas Kazlauskas Acked-by: Hamza Mahfooz Signed-off-by: Dmytro Laktyushkin Signed-off-by: Alex Deucher commit 0250a7145e9c44c9f60d14aed7b66ed3a9de07f9 Author: Fangzhi Zuo Date: Tue Jun 6 09:57:30 2023 -0400 drm/amd/display: Add MST Preferred Link Setting Entry When using debugfs to change MST link settings, we need to wait until the next stream update to apply the preferred link setting. So, trigger a hotplug event right after the preferred link setting is applied. Reviewed-by: Wayne Lin Acked-by: Hamza Mahfooz Signed-off-by: Fangzhi Zuo Signed-off-by: Alex Deucher commit 26518b39181876064850209ecdab48c0ee5924b1 Author: Leo Chen Date: Thu Jun 8 16:37:38 2023 -0400 drm/amd/display: disable seamless boot if force_odm_combine is enabled [Why & How] Having seamless boot on while forcing debug option ODM combine 2 to 1 will cause some corruptions because of some missing programmings. Cc: stable@vger.kernel.org # 6.1+ Reviewed-by: Nicholas Kazlauskas Acked-by: Hamza Mahfooz Signed-off-by: Leo Chen Signed-off-by: Alex Deucher commit 2bf0ce3bec8b22e4bac828aeaeade15884fa0f5c Author: Austin Zheng Date: Wed Jun 7 12:20:38 2023 -0400 drm/amd/display: Disable DC Mode Capping On DCN321 Why: Limiting clocks to DC mode max results in some display modes to no longer be supported How: Disable the path that limits the clock values Fixes: 3b718dcaf163 ("drm/amd/display: Filter out AC mode frequencies on DC mode systems") Reviewed-by: Martin Leung Acked-by: Hamza Mahfooz Signed-off-by: Austin Zheng Signed-off-by: Alex Deucher commit 724617b94bd657d71f980c5bfe2d429fc0acc27b Author: Alvin Lee Date: Tue Jun 6 17:51:32 2023 -0400 drm/amd/display: enable the new fast update path for supported ASICs The new fast update sequence is now supported on some ASICs. So, enable it by default for all applicable ASICs. Reviewed-by: Samson Tam Acked-by: Hamza Mahfooz Signed-off-by: Alvin Lee Signed-off-by: Alex Deucher commit 873bbf2da278f253df9fa78acb8df83fb05c7c52 Author: Alvin Lee Date: Wed Jun 7 17:17:59 2023 -0400 drm/amd/display: Clear update flags at end of flip Clear update flags so the next flip does not have any redundant programming (if a subsequent flip does not have a stream or plane update, the update flags are not cleared). Fixes: 0baae6246307 ("drm/amd/display: Refactor fast update to use new HWSS build sequence") Reviewed-by: Jun Lei Acked-by: Hamza Mahfooz Signed-off-by: Alvin Lee Signed-off-by: Alex Deucher commit c8f293541810e2542c5cbf082b7f7c2c2eaa47a8 Author: Alvin Lee Date: Wed Jun 7 16:30:28 2023 -0400 drm/amd/display: Fix pipe check condition for manual trigger Condition for programming manually trigger used the wrong pipe (always used top pipe instead of the one we are iterating through). Fixes: 0baae6246307 ("drm/amd/display: Refactor fast update to use new HWSS build sequence") Reviewed-by: Samson Tam Acked-by: Hamza Mahfooz Signed-off-by: Alvin Lee Signed-off-by: Alex Deucher commit 4a87495a82add04d57bef1d58dd0b55f10684ee0 Author: Sridevi Arvindekar Date: Tue May 30 17:41:12 2023 -0400 drm/amd/display: add missing ABM registers [Why] We are currently missing some ABM registers. [How] Add the missing registers to dce_abm.h. Reviewed-by: Jun Lei Reviewed-by: Chris Park Acked-by: Hamza Mahfooz Signed-off-by: Sridevi Arvindekar Signed-off-by: Alex Deucher commit c5f78ea8d768ce6f4471b0921728c2bd2dd95d93 Author: Austin Zheng Date: Mon Jun 5 18:17:23 2023 -0400 drm/amd/display: Add Clock Table Entry With Max DC Values Why: Certain display configs resulted in underflow How: Add an entry containing all max DC clock timings Reviewed-by: Alvin Lee Acked-by: Hamza Mahfooz Signed-off-by: Austin Zheng Signed-off-by: Alex Deucher commit 0f48a4b83610cb0e4e0bc487800ab69f51b4aca6 Author: Sung-huai Wang Date: Tue Jun 6 14:28:38 2023 +0800 drm/amd/display: add a NULL pointer check [Why & How] We have to check if stream is properly initialized before calling find_matching_pll(), otherwise we might end up trying to deferecence a NULL pointer. Cc: stable@vger.kernel.org # 6.1+ Reviewed-by: Nicholas Kazlauskas Acked-by: Hamza Mahfooz Signed-off-by: Sung-huai Wang Signed-off-by: Alex Deucher commit a99a4ff6ef205d125002fc7e0857074e4e6597b6 Author: Daniel Miess Date: Wed May 31 11:47:35 2023 -0400 Partially revert "drm/amd/display: Fix possible underflow for displays with large vblank" This partially reverts commit de231189e7bf ("drm/amd/display: Fix possible underflow for displays with large vblank"). [Why] The increased value of VBlankNomDefaultUS causes underflow at the desktop of an IP KVM setup [How] Change the value from 800 back to 668 Reviewed-by: Nicholas Kazlauskas Reviewed-by: Jun Lei Acked-by: Hamza Mahfooz Signed-off-by: Daniel Miess Signed-off-by: Alex Deucher commit bf0097c5c9aec528da75e2b5fcede472165322bb Author: Daniel Miess Date: Wed Jun 7 16:24:08 2023 +0800 Revert "drm/amd/display: Move DCN314 DOMAIN power control to DMCUB" This reverts commit e383b12709e32d6494c948422070c2464b637e44. Controling hubp power gating using the DMCUB isn't stable so we are reverting this change to move control back into the driver. Cc: stable@vger.kernel.org # 6.3+ Reviewed-by: Nicholas Kazlauskas Acked-by: Hamza Mahfooz Signed-off-by: Daniel Miess Signed-off-by: Alex Deucher commit 85e41f1ed5d94a26fe4e57003c399936d291ed70 Author: Daniel Miess Date: Wed Jun 7 11:11:44 2023 -0400 drm/amd/display: disable RCO for DCN314 [Why] RCO is causing error messages on some DCN314 systems [How] Force disable RCO for DCN314 Fixes: 17fbdbda9cc8 ("drm/amd/display: Enable dcn314 DPP RCO") Reviewed-by: Nicholas Kazlauskas Acked-by: Hamza Mahfooz Signed-off-by: Daniel Miess Signed-off-by: Alex Deucher commit 65dae8ff4c7d5dde1016d1736c6740a0f80e68e3 Author: Daniel Miess Date: Wed Jun 14 13:09:14 2023 -0400 drm/amd/display: disable power gating for DCN314 [Why] Power gating is causing error messages on some DCN314 systems [How] Force disable power gating for DCN314 Fixes: 4cc1cebe08bf ("drm/amd/display: Re-enable DPP/HUBP Power Gating") Reviewed-by: Nicholas Kazlauskas Acked-by: Hamza Mahfooz Signed-off-by: Daniel Miess Signed-off-by: Alex Deucher commit acbe761046628cbd5da03a4af84e8831c2afb8f2 Author: Zhigang Luo Date: Thu May 18 16:01:31 2023 -0400 drm/amdgpu: Skip TMR for MP0_HWIP 13.0.6 For SRIOV VF, no TMR needed. Reviewed-by: Alex Deucher Signed-off-by: Zhigang Luo Signed-off-by: Alex Deucher commit 44762718b391b5ad7bd226a7a3badfb93248ad3b Author: Nathan Chancellor Date: Thu Jun 15 10:06:09 2023 -0700 drm/amdgpu: Move clocks closer to its only usage in amdgpu_parse_cg_state() After commit 8020f0f9316b ("drm/amd/amdgpu: enable W=1 for amdgpu"), there is an instance of -Wunused-const-variable when CONFIG_DEBUG_FS is disabled: drivers/gpu/drm/amd/amdgpu/../pm/amdgpu_pm.c:38:34: error: unused variable 'clocks' [-Werror,-Wunused-const-variable] 38 | static const struct cg_flag_name clocks[] = { | ^ 1 error generated. clocks is only used when CONFIG_DEBUG_FS is set, so move the definition into the CONFIG_DEBUG_FS block right above its only usage to clear up the warning. Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher commit fd21987274463a439c074b8f3c93d3b132e4c031 Author: Evan Quan Date: Thu Jun 15 10:56:55 2023 +0800 drm/amd/pm: revise the ASPM settings for thunderbolt attached scenario Also, correct the comment for NAVI10_PCIE__LC_L1_INACTIVITY_TBT_DEFAULT as 0x0000000E stands for 400ms instead of 4ms. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit ea2c3c08554601b051d91403a241266e1cf490a5 Author: Samuel Pitoiset Date: Fri Jun 16 15:14:07 2023 +0200 drm/amdgpu: fix clearing mappings for BOs that are always valid in VM Per VM BOs must be marked as moved or otherwise their ranges are not updated on use which might be necessary when the replace operation splits mappings. This fixes random GPU hangs when replacing sparse mappings from the userspace, while OP_MAP/OP_UNMAP works fine because always valid BOs are correctly handled there. Cc: stable@vger.kernel.org Signed-off-by: Samuel Pitoiset Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 03d400e7605e3d36abd3f949b25ba806cccff0cb Author: Alex Sierra Date: Thu Jun 15 10:37:21 2023 -0500 drm/amdkfd: set coherent host access capability flag This flag determines whether the host possesses coherent access to the memory of the device. Signed-off-by: Alex Sierra Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 184d83848242b2465b466a0a8e6eb58f1df10407 Author: Lijo Lazar Date: Thu Jun 15 14:13:23 2023 +0530 drm/amdgpu: Add vbios attribute only if supported Not all devices carry VBIOS version information. Add the device attribute only if supported. Signed-off-by: Lijo Lazar Reviewed-by: Le Ma Signed-off-by: Alex Deucher commit c09b3bf7363db982b17950b8e4f27b0564817301 Author: Alex Deucher Date: Wed Jun 7 12:43:30 2023 -0400 drm/amdgpu/atomfirmware: fix LPDDR5 width reporting LPDDR5 channels are 32 bit rather than 64, report the width properly in the log. v2: Only LPDDR5 are 32 bits per channel. DDR5 is 64 bits per channel Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2468 Acked-by: Hawking Zhang Signed-off-by: Alex Deucher commit 4e3f85d1c071ed174aa5a7477d499d576412df3b Author: Nathan Chancellor Date: Thu Jun 15 10:06:08 2023 -0700 drm/amdgpu: Remove CONFIG_DEBUG_FS guard around body of amdgpu_rap_debugfs_init() After commit 8020f0f9316b ("drm/amd/amdgpu: enable W=1 for amdgpu"), there is an instance of -Wunused-const-variable when CONFIG_DEBUG_FS is disabled: drivers/gpu/drm/amd/amdgpu/amdgpu_rap.c:110:37: error: unused variable 'amdgpu_rap_debugfs_ops' [-Werror,-Wunused-const-variable] 110 | static const struct file_operations amdgpu_rap_debugfs_ops = { | ^ 1 error generated. There is no reason for the body of this function to be guarded when CONFIG_DEBUG_FS is disabled, as debugfs_create_file() is a stub that just returns an error pointer in that situation. Remove the preprocessor guards so that the variable never appears unused, while not changing anything at run time. Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher commit 3ec61983aae0acbffbd5c22d83b2019f5c0eb516 Author: Mingtong Bao Date: Wed Jun 14 10:19:08 2023 +0800 drm/amd/pm: remove unneeded variable fix the following coccicheck warning: drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c:1657:14-18: Unneeded variable: "size". Signed-off-by: Mingtong Bao Signed-off-by: Alex Deucher commit 025654ae429112aabf6875870c06d6a7ee475104 Author: Lijo Lazar Date: Wed Jun 14 09:46:49 2023 +0530 drm/amdgpu: Move calculation of xcp per memory node Its value is required for finding the memory id of xcp. Fixes: d26ea1b346e7 ("drm/amdgpu: Add xcp manager num_xcp_per_mem_partition") Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit ef3c36a6e025e9b16ca3321479ba016841fa17a0 Author: Jiadong Zhu Date: Thu Jun 15 19:10:57 2023 +0800 drm/amdgpu: Skip mark offset for high priority rings Only low priority rings are using chunks to save the offset. Bypass the mark offset callings from high priority rings. Signed-off-by: Jiadong Zhu Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 1ff310b97f82437237a1d779195b0d90b90da070 Author: Wang Ming Date: Wed Jun 14 11:49:23 2023 +0800 amd/display/dc: remove repeating expression Identify issues that arise by using the tests/doubletest.cocci semantic patch. Need to remove duplicate expression in if statement. Signed-off-by: Wang Ming Reviewed-by: Ammar Faizi Signed-off-by: Alex Deucher commit 29e4c95faee52a9b7a4f1293cb92cd17a0b5fd91 Author: Jiri Pirko Date: Thu Jun 1 09:17:17 2023 +0200 net/mlx5: Remove pointless vport lookup from mlx5_esw_check_port_type() As xa_get_mark() returns false in case the entry is not present, no need to redundantly check if vport is present. Remove the lookup. Signed-off-by: Jiri Pirko Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit 899862b653d74ed5fc3a61cd5e14a88b824a71d7 Author: Jiri Pirko Date: Wed May 31 15:11:07 2023 +0200 net/mlx5: Remove redundant check from mlx5_esw_query_vport_vhca_id() Since mlx5_esw_query_vport_vhca_id() could be called either from mlx5_esw_vport_enable() or mlx5_esw_vport_disable() where the the check is done, this is always false here. Remove the redundant check. Signed-off-by: Jiri Pirko Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit 0d0946d6488e785c30a0c4fce4cf21dc7da6dc1f Author: Jiri Pirko Date: Thu Jun 1 13:15:12 2023 +0200 net/mlx5: Remove redundant is_mdev_switchdev_mode() check from is_ib_rep_supported() is_mdev_switchdev_mode() check is done in is_eth_rep_supported(). Function is_ib_rep_supported() calls is_eth_rep_supported(). Remove the redundant check from it. Signed-off-by: Jiri Pirko Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit 61955da523d93b4d89f45f84dc6ce9d44ced7bae Author: Jiri Pirko Date: Thu Jun 1 13:12:37 2023 +0200 net/mlx5: Remove redundant MLX5_ESWITCH_MANAGER() check from is_ib_rep_supported() MLX5_ESWITCH_MANAGER() check is done in is_eth_rep_supported(). Function is_ib_rep_supported() calls is_eth_rep_supported(). Remove the redundant check from it. Signed-off-by: Jiri Pirko Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit 15ddd72ee323cf4b7012dc8e002ebb812f92e11f Author: Roi Dayan Date: Mon May 29 09:32:57 2023 +0300 net/mlx5e: E-Switch, Fix shared fdb error flow On error flow resources being freed in esw_master_egress_destroy_resources() but pointers not being set to null if error flow is from creating a bounce rule. Then in esw_acl_egress_ofld_cleanup() we try to access already freed pointers. Fix it by resetting the pointers to null. Also if error is from creating a second or later bounce rule then the flow group and table being used and cannot and should not be freed. Add a check to destroy the flow group and table if there are no bounce rules. mlx5_core.sf mlx5_core.sf.2: mlx5_destroy_flow_group:2306:(pid 2235): Flow group 4 wasn't destroyed, refcount > 1 mlx5_core.sf mlx5_core.sf.2: mlx5_destroy_flow_table:2295:(pid 2235): Flow table 3 wasn't destroyed, refcount > 1 Fixes: 5e0202eb49ed ("net/mlx5: E-switch, Handle multiple master egress rules") Signed-off-by: Roi Dayan Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit ae4de894931d37ff12405db29ca3a2395d3a0449 Author: Roi Dayan Date: Mon May 29 09:24:54 2023 +0300 net/mlx5e: Remove redundant comment The function comment says what it is and the comment is redundant. Signed-off-by: Roi Dayan Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit 4575ab3b7de04813400acf989ca7f26dd7e29c59 Author: Roi Dayan Date: Sun May 28 17:10:43 2023 +0300 net/mlx5e: E-Switch, Pass other_vport flag if vport is not 0 When creating flow table for shared fdb resources, there is only need to pass other_vport flag if vport is not 0 or if the port is ECPF in BlueField. Signed-off-by: Roi Dayan Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit 70c36438393546be0bbfd001d043a08e8ff611e9 Author: Roi Dayan Date: Sun May 28 12:11:47 2023 +0300 net/mlx5e: E-Switch, Use xarray for devcom paired device index To allow devcom events on E-Switch that is not a vport group manager, use vhca id as an index instead of device index which might be shared between several E-Switches. for example SF and its PF. Signed-off-by: Roi Dayan Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit 1552e9b51810761881f7438d26c9b2dad171e423 Author: Roi Dayan Date: Sun May 28 12:10:26 2023 +0300 net/mlx5e: E-Switch, Add peer fdb miss rules for vport manager or ecpf Add peer fdb rules for E-Switch that are vport managers or ecpf device. It is not needed for other devices. Signed-off-by: Roi Dayan Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit 1da9f36252d4852205a1990f003549d753320e8c Author: Roi Dayan Date: Sun May 28 10:58:03 2023 +0300 net/mlx5e: Use vhca_id for device index in vport rx rules Device index is like PF index and limited to max physical ports. For example, SFs created under PF the device index is the PF device index. Use vhca_id which gets the FW index per vport, for vport rx rules and vport pair events. Signed-off-by: Roi Dayan Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit 8ec91f5d077c09e72e4e11d701a83eb1f1504ea3 Author: Roi Dayan Date: Tue May 23 12:02:06 2023 +0300 net/mlx5: Lag, Remove duplicate code checking lag is supported Remove duplicate function for checking if device has lag support. Signed-off-by: Roi Dayan Reviewed-by: Shay Drory Signed-off-by: Saeed Mahameed commit 690ad62fc6e445cc371e625fe2016e62c3793a0f Author: Dan Carpenter Date: Tue Jun 20 16:43:07 2023 +0300 net/mlx5: Fix error code in mlx5_is_reset_now_capable() The mlx5_is_reset_now_capable() function returns bool, not negative error codes. So if fast teardown is not supported it should return false instead of -EOPNOTSUPP. Fixes: 92501fa6e421 ("net/mlx5: Ack on sync_reset_request only if PF can do reset_now") Signed-off-by: Dan Carpenter Reviewed-by: Kalesh AP Signed-off-by: Saeed Mahameed commit 9ee473c259de393718ae1c6fdd51271d5d087c4b Author: Lama Kayal Date: Mon Jun 12 16:34:43 2023 +0300 net/mlx5: Fix reserved at offset in hca_cap register A member of struct mlx5_ifc_cmd_hca_cap_bits has been mistakenly assigned the wrong reserved_at offset value. Correct it to align to the right value, thus avoid future miscalculation. Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Reviewed-by: Rahul Rameshbabu Signed-off-by: Saeed Mahameed commit 25c24801d7da8f9cb088bc0ad5947d2e84035411 Author: Shay Drory Date: Mon Jun 19 07:42:07 2023 +0300 net/mlx5: Fix SFs kernel documentation error Indent SFs probe code example in order to fix the below error: Documentation/networking/device_drivers/ethernet/mellanox/mlx5/switchdev.rst:57: ERROR: Unexpected indentation. Documentation/networking/device_drivers/ethernet/mellanox/mlx5/switchdev.rst:61: ERROR: Unexpected indentation. Fixes: e71383fb9cd1 ("net/mlx5: Light probe local SFs") Signed-off-by: Shay Drory Reviewed-by: Rahul Rameshbabu Signed-off-by: Saeed Mahameed Reviewed-by: Moshe Shemesh Reviewed-by: Automatic Verification Reviewed-by: Gal Pressman commit da744fd1362cd8ccf71043c62825cb88cb946886 Author: Shay Drory Date: Wed Jun 14 16:26:07 2023 +0300 net/mlx5: Fix UAF in mlx5_eswitch_cleanup() mlx5_eswitch_cleanup() is using esw right after freeing it for releasing devlink_param. Fix it by releasing the devlink_param before freeing the esw, and adjust the create function accordingly. Fixes: 3f90840305e2 ("net/mlx5: Move esw multiport devlink param to eswitch code") Reported-by: Dan Carpenter Signed-off-by: Shay Drory Reviewed-by: Automatic Verification Reviewed-by: Gal Pressman Reviewed-by: Moshe Shemesh Signed-off-by: Saeed Mahameed commit c36591f6828b00f01e0b54ccacd603e55cdc45d0 Merge: fcaa174a9c995 a8d5fdd4d2702 Author: Jens Axboe Date: Fri Jun 23 11:59:05 2023 -0600 Merge tag 'md-next-20230623' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md into for-6.5/block-late Pull MD fixes from Song. * tag 'md-next-20230623' of https://git.kernel.org/pub/scm/linux/kernel/git/song/md: raid10: avoid spin_lock from fastpath from raid10_unplug() md: fix 'delete_mutex' deadlock md: use mddev->external to select holder in export_rdev() md/raid1-10: fix casting from randomized structure in raid1_submit_write() md/raid10: fix the condition to call bio_end_io_acct() commit abc17128c81ae8d6a091f24348c63cbe8fe59724 Merge: f42039d10b0f1 5f0419a0083b3 Author: Catalin Marinas Date: Fri Jun 23 18:34:16 2023 +0100 Merge branch 'for-next/feat_s1pie' into for-next/core * for-next/feat_s1pie: : Support for the Armv8.9 Permission Indirection Extensions (stage 1 only) KVM: selftests: get-reg-list: add Permission Indirection registers KVM: selftests: get-reg-list: support ID register features arm64: Document boot requirements for PIE arm64: transfer permission indirection settings to EL2 arm64: enable Permission Indirection Extension (PIE) arm64: add encodings of PIRx_ELx registers arm64: disable EL2 traps for PIE arm64: reorganise PAGE_/PROT_ macros arm64: add PTE_WRITE to PROT_SECT_NORMAL arm64: add PTE_UXN/PTE_WRITE to SWAPPER_*_FLAGS KVM: arm64: expose ID_AA64MMFR3_EL1 to guests KVM: arm64: Save/restore PIE registers KVM: arm64: Save/restore TCR2_EL1 arm64: cpufeature: add Permission Indirection Extension cpucap arm64: cpufeature: add TCR2 cpucap arm64: cpufeature: add system register ID_AA64MMFR3 arm64/sysreg: add PIR*_ELx registers arm64/sysreg: update HCRX_EL2 register arm64/sysreg: add system registers TCR2_ELx arm64/sysreg: Add ID register ID_AA64MMFR3 commit f42039d10b0f1d0075568df1d64df31f5cc90e92 Merge: dea0f4146f66a 211ceca377f40 c152aed4dcc21 1f9d4ba6839cc 833b0f07b915f 39138093f139c d8a324f102cc8 3e35d303ab7d2 f0d4627f64592 7dae5f086fceb fcea0ccf4fd7f 389ce21b622b0 3927eaff464f1 a0238ada560fc f7a5d72edc522 Author: Catalin Marinas Date: Fri Jun 23 18:32:20 2023 +0100 Merge branches 'for-next/kpti', 'for-next/missing-proto-warn', 'for-next/iss2-decode', 'for-next/kselftest', 'for-next/misc', 'for-next/feat_mops', 'for-next/module-alloc', 'for-next/sysreg', 'for-next/cpucap', 'for-next/acpi', 'for-next/kdump', 'for-next/acpi-doc', 'for-next/doc' and 'for-next/tpidr2-fix', remote-tracking branch 'arm64/for-next/perf' into for-next/core * arm64/for-next/perf: docs: perf: Fix warning from 'make htmldocs' in hisi-pmu.rst docs: perf: Add new description for HiSilicon UC PMU drivers/perf: hisi: Add support for HiSilicon UC PMU driver drivers/perf: hisi: Add support for HiSilicon H60PA and PAv3 PMU driver perf: arm_cspmu: Add missing MODULE_DEVICE_TABLE perf/arm-cmn: Add sysfs identifier perf/arm-cmn: Revamp model detection perf/arm_dmc620: Add cpumask dt-bindings: perf: fsl-imx-ddr: Add i.MX93 compatible drivers/perf: imx_ddr: Add support for NXP i.MX9 SoC DDRC PMU driver perf/arm_cspmu: Decouple APMT dependency perf/arm_cspmu: Clean up ACPI dependency ACPI/APMT: Don't register invalid resource perf/arm_cspmu: Fix event attribute type perf: arm_cspmu: Set irq affinitiy only if overflow interrupt is used drivers/perf: hisi: Don't migrate perf to the CPU going to teardown drivers/perf: apple_m1: Force 63bit counters for M2 CPUs perf/arm-cmn: Fix DTC reset perf: qcom_l2_pmu: Make l2_cache_pmu_probe_cluster() more robust perf/arm-cci: Slightly optimize cci_pmu_sync_counters() * for-next/kpti: : Simplify KPTI trampoline exit code arm64: entry: Simplify tramp_alias macro and tramp_exit routine arm64: entry: Preserve/restore X29 even for compat tasks * for-next/missing-proto-warn: : Address -Wmissing-prototype warnings arm64: add alt_cb_patch_nops prototype arm64: move early_brk64 prototype to header arm64: signal: include asm/exception.h arm64: kaslr: add kaslr_early_init() declaration arm64: flush: include linux/libnvdimm.h arm64: module-plts: inline linux/moduleloader.h arm64: hide unused is_valid_bugaddr() arm64: efi: add efi_handle_corrupted_x18 prototype arm64: cpuidle: fix #ifdef for acpi functions arm64: kvm: add prototypes for functions called in asm arm64: spectre: provide prototypes for internal functions arm64: move cpu_suspend_set_dbg_restorer() prototype to header arm64: avoid prototype warnings for syscalls arm64: add scs_patch_vmlinux prototype arm64: xor-neon: mark xor_arm64_neon_*() static * for-next/iss2-decode: : Add decode of ISS2 to data abort reports arm64/esr: Add decode of ISS2 to data abort reporting arm64/esr: Use GENMASK() for the ISS mask * for-next/kselftest: : Various arm64 kselftest improvements kselftest/arm64: Log signal code and address for unexpected signals kselftest/arm64: Add a smoke test for ptracing hardware break/watch points * for-next/misc: : Miscellaneous patches arm64: alternatives: make clean_dcache_range_nopatch() noinstr-safe arm64: hibernate: remove WARN_ON in save_processor_state arm64/fpsimd: Exit streaming mode when flushing tasks arm64: mm: fix VA-range sanity check arm64/mm: remove now-superfluous ISBs from TTBR writes arm64: consolidate rox page protection logic arm64: set __exception_irq_entry with __irq_entry as a default arm64: syscall: unmask DAIF for tracing status arm64: lockdep: enable checks for held locks when returning to userspace arm64/cpucaps: increase string width to properly format cpucaps.h arm64/cpufeature: Use helper for ECV CNTPOFF cpufeature * for-next/feat_mops: : Support for ARMv8.8 memcpy instructions in userspace kselftest/arm64: add MOPS to hwcap test arm64: mops: allow disabling MOPS from the kernel command line arm64: mops: detect and enable FEAT_MOPS arm64: mops: handle single stepping after MOPS exception arm64: mops: handle MOPS exceptions KVM: arm64: hide MOPS from guests arm64: mops: don't disable host MOPS instructions from EL2 arm64: mops: document boot requirements for MOPS KVM: arm64: switch HCRX_EL2 between host and guest arm64: cpufeature: detect FEAT_HCX KVM: arm64: initialize HCRX_EL2 * for-next/module-alloc: : Make the arm64 module allocation code more robust (clean-up, VA range expansion) arm64: module: rework module VA range selection arm64: module: mandate MODULE_PLTS arm64: module: move module randomization to module.c arm64: kaslr: split kaslr/module initialization arm64: kasan: remove !KASAN_VMALLOC remnants arm64: module: remove old !KASAN_VMALLOC logic * for-next/sysreg: (21 commits) : More sysreg conversions to automatic generation arm64/sysreg: Convert TRBIDR_EL1 register to automatic generation arm64/sysreg: Convert TRBTRG_EL1 register to automatic generation arm64/sysreg: Convert TRBMAR_EL1 register to automatic generation arm64/sysreg: Convert TRBSR_EL1 register to automatic generation arm64/sysreg: Convert TRBBASER_EL1 register to automatic generation arm64/sysreg: Convert TRBPTR_EL1 register to automatic generation arm64/sysreg: Convert TRBLIMITR_EL1 register to automatic generation arm64/sysreg: Rename TRBIDR_EL1 fields per auto-gen tools format arm64/sysreg: Rename TRBTRG_EL1 fields per auto-gen tools format arm64/sysreg: Rename TRBMAR_EL1 fields per auto-gen tools format arm64/sysreg: Rename TRBSR_EL1 fields per auto-gen tools format arm64/sysreg: Rename TRBBASER_EL1 fields per auto-gen tools format arm64/sysreg: Rename TRBPTR_EL1 fields per auto-gen tools format arm64/sysreg: Rename TRBLIMITR_EL1 fields per auto-gen tools format arm64/sysreg: Convert OSECCR_EL1 to automatic generation arm64/sysreg: Convert OSDTRTX_EL1 to automatic generation arm64/sysreg: Convert OSDTRRX_EL1 to automatic generation arm64/sysreg: Convert OSLAR_EL1 to automatic generation arm64/sysreg: Standardise naming of bitfield constants in OSL[AS]R_EL1 arm64/sysreg: Convert MDSCR_EL1 to automatic register generation ... * for-next/cpucap: : arm64 cpucap clean-up arm64: cpufeature: fold cpus_set_cap() into update_cpu_capabilities() arm64: cpufeature: use cpucap naming arm64: alternatives: use cpucap naming arm64: standardise cpucap bitmap names * for-next/acpi: : Various arm64-related ACPI patches ACPI: bus: Consolidate all arm specific initialisation into acpi_arm_init() * for-next/kdump: : Simplify the crashkernel reservation behaviour of crashkernel=X,high on arm64 arm64: add kdump.rst into index.rst Documentation: add kdump.rst to present crashkernel reservation on arm64 arm64: kdump: simplify the reservation behaviour of crashkernel=,high * for-next/acpi-doc: : Update ACPI documentation for Arm systems Documentation/arm64: Update ACPI tables from BBR Documentation/arm64: Update references in arm-acpi Documentation/arm64: Update ARM and arch reference * for-next/doc: : arm64 documentation updates Documentation/arm64: Add ptdump documentation * for-next/tpidr2-fix: : Fix the TPIDR2_EL0 register restoring on sigreturn kselftest/arm64: Add a test case for TPIDR2 restore arm64/signal: Restore TPIDR2 register rather than memory state commit f7a5d72edc522b9210521d9b3969eac221eb6ecb Author: Mark Brown Date: Thu Jun 22 14:39:46 2023 +0100 kselftest/arm64: Add a test case for TPIDR2 restore Due to the fact that TPIDR2 is intended to be managed by libc we don't currently test modifying it via the signal context since that might disrupt libc's usage of it and cause instability. We can however test the opposite case with less risk, modifying TPIDR2 in a signal handler and making sure that the original value is restored after returning from the signal handler. Add a test which does this. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230621-arm64-fix-tpidr2-signal-restore-v2-2-c8e8fcc10302@kernel.org Signed-off-by: Catalin Marinas commit 616cb2f4b141852cac3dfffe8354c8bf19e9999d Author: Mark Brown Date: Thu Jun 22 14:39:45 2023 +0100 arm64/signal: Restore TPIDR2 register rather than memory state Currently when restoring the TPIDR2 signal context we set the new value from the signal frame in the thread data structure but not the register, following the pattern for the rest of the data we are restoring. This does not work in the case of TPIDR2, the register always has the value for the current task. This means that either we return to userspace and ignore the new value or we context switch and save the register value on top of the newly restored value. Load the value from the signal context into the register instead. Fixes: 39e54499280f ("arm64/signal: Include TPIDR2 in the signal context") Signed-off-by: Mark Brown Cc: # 6.3.x Link: https://lore.kernel.org/r/20230621-arm64-fix-tpidr2-signal-restore-v2-1-c8e8fcc10302@kernel.org Signed-off-by: Catalin Marinas commit 112a7f9c8edbf76f7cb83856a6cb6b60a210b659 Author: Mario Limonciello Date: Tue Jun 20 09:04:51 2023 -0500 PCI/ACPI: Call _REG when transitioning D-states ACPI r6.5, sec 6.5.4, describes how AML is unable to access an OperationRegion unless _REG has been called to connect a handler: The OS runs _REG control methods to inform AML code of a change in the availability of an operation region. When an operation region handler is unavailable, AML cannot access data fields in that region. (Operation region writes will be ignored and reads will return indeterminate data.) The PCI core does not call _REG at any time, leading to the undefined behavior mentioned in the spec. The spec explains that _REG should be executed to indicate whether a given region can be accessed: Once _REG has been executed for a particular operation region, indicating that the operation region handler is ready, a control method can access fields in the operation region. Conversely, control methods must not access fields in operation regions when _REG method execution has not indicated that the operation region handler is ready. An example included in the spec demonstrates calling _REG when devices are turned off: "when the host controller or bridge controller is turned off or disabled, PCI Config Space Operation Regions for child devices are no longer available. As such, ETH0’s _REG method will be run when it is turned off and will again be run when PCI1 is turned off." It is reported that ASMedia PCIe GPIO controllers fail functional tests after the system has returning from suspend (S3 or s2idle). This is because the BIOS checks whether the OSPM has called the _REG method to determine whether it can interact with the OperationRegion assigned to the device as part of the other AML called for the device. To fix this issue, call acpi_evaluate_reg() when devices are transitioning to D3cold or D0. [bhelgaas: split pci_power_t checking to preliminary patch] Link: https://uefi.org/specs/ACPI/6.5/06_Device_Configuration.html#reg-region Link: https://lore.kernel.org/r/20230620140451.21007-1-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Bjorn Helgaas Reviewed-by: Rafael J. Wysocki commit 5557b62634abbd55bab7b154ce4bca348ad7f96f Author: Bjorn Helgaas Date: Wed Jun 21 16:36:12 2023 -0500 PCI/ACPI: Validate acpi_pci_set_power_state() parameter Previously acpi_pci_set_power_state() assumed the requested power state was valid (PCI_D0 ... PCI_D3cold). If a caller supplied something else, we could index outside the state_conv[] array and pass junk to acpi_device_set_power(). Validate the pci_power_t parameter and return -EINVAL if it's invalid. Link: https://lore.kernel.org/r/20230621222857.GA122930@bhelgaas Signed-off-by: Bjorn Helgaas Reviewed-by: Mario Limonciello commit 9e30fd26f43b89cb6b4e850a86caa2e50dedb454 Author: Ondrej Zary Date: Wed Jun 14 09:42:53 2023 +0200 PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold The quirk for Elo i2 introduced in commit 92597f97a40b ("PCI/PM: Avoid putting Elo i2 PCIe Ports in D3cold") is also needed by EloPOS E2/S2/H2 which uses the same Continental Z2 board. Change the quirk to match the board instead of system. Link: https://bugzilla.kernel.org/show_bug.cgi?id=215715 Link: https://lore.kernel.org/r/20230614074253.22318-1-linux@zary.sk Signed-off-by: Ondrej Zary Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org commit 488833ccdcac118da16701f4ee0673b20ba47fe3 Merge: 91afbaafd6b1f 1ffe6ddc5c64f Author: Palmer Dabbelt Date: Thu Jun 22 14:23:56 2023 -0700 Merge patch series "dt-bindings: riscv: cpus: switch to unevaluatedProperties: false" Conor Dooley says: From: Conor Dooley Do the various bits needed to drop the additionalProperties: true that we currently have in riscv/cpu.yaml, to permit actually enforcing what people put in cpus nodes. * b4-shazam-merge: dt-bindings: riscv: cpus: switch to unevaluatedProperties: false dt-bindings: riscv: cpus: add a ref the common cpu schema Link: https://lore.kernel.org/r/20230615-creamer-emu-ade0fa0bdb68@spud Signed-off-by: Palmer Dabbelt commit 91afbaafd6b1f1846520efd2b158066a25a1a316 Author: Song Shuai Date: Fri Jun 9 15:50:48 2023 +0800 riscv: hibernate: remove WARN_ON in save_processor_state During hibernation or restoration, freeze_secondary_cpus checks num_online_cpus via BUG_ON, and the subsequent save_processor_state also does the checking with WARN_ON. In the case of CONFIG_PM_SLEEP_SMP=n, freeze_secondary_cpus is not defined, but the sole possible condition to disable CONFIG_PM_SLEEP_SMP is !SMP where num_online_cpus is always 1. We also don't have to check it in save_processor_state. So remove the unnecessary checking in save_processor_state. Fixes: c0317210012e ("RISC-V: Add arch functions to support hibernation/suspend-to-disk") Signed-off-by: Song Shuai Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230609075049.2651723-4-songshuaishuai@tinylab.org Signed-off-by: Palmer Dabbelt commit b5e13f3ace78a8159dbad92bb005090a431e36d7 Merge: 42b89447b6586 a7555f6b62e7f Author: Palmer Dabbelt Date: Thu Jun 22 10:38:39 2023 -0700 Merge patch series "riscv: Add independent irq/softirq stacks support" guoren@kernel.org says: From: Guo Ren This patch series adds independent irq/softirq stacks to decrease the press of the thread stack. Also, add a thread STACK_SIZE config for users to adjust the proper size during compile time. * b4-shazam-merge: riscv: stack: Add config of thread stack size riscv: stack: Support HAVE_SOFTIRQ_ON_OWN_STACK riscv: stack: Support HAVE_IRQ_EXIT_ON_IRQ_STACK Link: https://lore.kernel.org/r/20230614013018.2168426-1-guoren@kernel.org Signed-off-by: Palmer Dabbelt commit 42b89447b65863904eaf802ee05b55a238eac538 Merge: ee95b88d71b9c 07edc32779e3d Author: Palmer Dabbelt Date: Wed Jun 21 07:49:09 2023 -0700 Merge patch series "ISA string parser cleanups" Conor Dooley says: From: Conor Dooley Here are some bits that were discussed with Drew on the "should we allow caps" threads that I have now created patches for: - splitting of riscv_of_processor_hartid() into two distinct functions, one for use purely during early boot, prior to the establishment of the possible-cpus mask & another to fit the other current use-cases - that then allows us to then completely skip some validation of the hartid in the parser - the biggest diff in the series is a rework of the comments in the parser, as I have mostly found the existing (sparse) ones to not be all that helpful whenever I have to go back and look at it - from writing the comments, I found a conditional doing a bit of a dance that I found counter-intuitive, so I've had a go at making that match what I would expect a little better - `i` implies 4 other extensions, so add them as extensions and set them for the craic. Sure why not like... * b4-shazam-merge: RISC-V: always report presence of extensions formerly part of the base ISA dt-bindings: riscv: explicitly mention assumption of Zicntr & Zihpm support RISC-V: remove decrement/increment dance in ISA string parser RISC-V: rework comments in ISA string parser RISC-V: validate riscv,isa at boot, not during ISA string parsing RISC-V: split early & late of_node to hartid mapping RISC-V: simplify register width check in ISA string parsing Link: https://lore.kernel.org/r/20230607-audacity-overhaul-82bb867a825f@spud Signed-off-by: Palmer Dabbelt commit cf431a5998326a0468532a188a188ac2c8e9c55d Merge: efd2ed9351efe ad5c18c75d2a1 Author: Miquel Raynal Date: Fri Jun 23 19:02:09 2023 +0200 Merge branch 'nand/next' into mtd/next commit a8d5fdd4d2702d0c7ec125bd3bbce3fc589afa67 Author: Yu Kuai Date: Wed Jun 21 18:57:28 2023 +0800 raid10: avoid spin_lock from fastpath from raid10_unplug() Commit 0c0be98bbe67 ("md/raid10: prevent unnecessary calls to wake_up() in fast path") missed one place, for example, with: fio -direct=1 -rw=write/randwrite -iodepth=1 ... Plug and unplug are called for each io, then wake_up() from raid10_unplug() will cause lock contention as well. Avoid this contention by using wake_up_barrier() instead of wake_up(), where spin_lock is not held if waitqueue is empty. Fio test script: [global] name=random reads and writes ioengine=libaio direct=1 readwrite=randrw rwmixread=70 iodepth=64 buffered=0 filename=/dev/md0 size=1G runtime=30 time_based randrepeat=0 norandommap refill_buffers ramp_time=10 bs=4k numjobs=400 group_reporting=1 [job1] Test result with ramdisk raid10(By Ali): Before this patch With this patch READ IOPS=2033k IOPS=3642k WRITE IOPS=871k IOPS=1561K By the way, in this scenario, blk_plug_cb() will be allocated and freed for each io, this seems need to be optimized as well. Reported-and-tested-by: Ali Gholami Rudi Closes: https://lore.kernel.org/all/20231606122233@laper.mirepesht/ Signed-off-by: Yu Kuai Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20230621105728.1268542-1-yukuai1@huaweicloud.com commit 4934b6401a812f9fe368e7d2d091cd1d120ea262 Author: Yu Kuai Date: Wed Jun 21 22:29:33 2023 +0800 md: fix 'delete_mutex' deadlock Commit 3ce94ce5d05a ("md: fix duplicate filename for rdev") introduce a new lock 'delete_mutex', and trigger a new deadlock: t1: remove rdev t2: sysfs writer rdev_attr_store rdev_attr_store mddev_lock state_store md_kick_rdev_from_array lock delete_mutex list_add mddev->deleting unlock delete_mutex mddev_unlock mddev_lock ... lock delete_mutex kobject_del // wait for sysfs writers to be done mddev_unlock lock delete_mutex // wait for delete_mutex, deadlock 'delete_mutex' is used to protect the list 'mddev->deleting', turns out that this list can be protected by 'reconfig_mutex' directly, and this lock can be removed. Fix this problem by removing the lock, and use 'reconfig_mutex' to protect the list. mddev_unlock() will move this list to a local list to be handled after 'reconfig_mutex' is dropped. Fixes: 3ce94ce5d05a ("md: fix duplicate filename for rdev") Signed-off-by: Yu Kuai Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20230621142933.1395629-1-yukuai1@huaweicloud.com commit a1d7671910965ca9f8f0377e7e3bfd1179fba4d8 Author: Song Liu Date: Fri Jun 16 22:24:04 2023 -0700 md: use mddev->external to select holder in export_rdev() mdadm test "10ddf-create-fail-rebuild" triggers warnings like the following [ 215.526357] ------------[ cut here ]------------ [ 215.527243] WARNING: CPU: 18 PID: 1264 at block/bdev.c:617 blkdev_put+0x269/0x350 [ 215.528334] Modules linked in: [ 215.528806] CPU: 18 PID: 1264 Comm: mdmon Not tainted 6.4.0-rc2+ #768 [ 215.529863] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS [ 215.531464] RIP: 0010:blkdev_put+0x269/0x350 [ 215.532167] Code: ff ff 49 8d 7d 10 e8 56 bf b8 ff 4d 8b 65 10 49 8d bc 24 58 05 00 00 e8 05 be b8 ff 41 83 ac 24 58 05 00 00 01 e9 44 ff ff ff <0f> 0b e9 52 fe ff ff 0f 0b e9 6b fe ff ff1 [ 215.534780] RSP: 0018:ffffc900040bfbf0 EFLAGS: 00010283 [ 215.535635] RAX: ffff888174001000 RBX: ffff88810b1c3b00 RCX: ffffffff819a4061 [ 215.536645] RDX: dffffc0000000000 RSI: dffffc0000000000 RDI: ffff88810b1c3ba0 [ 215.537657] RBP: ffff88810dbde800 R08: fffffbfff0fca983 R09: fffffbfff0fca983 [ 215.538674] R10: ffffc900040bfbf0 R11: fffffbfff0fca982 R12: ffff88810b1c3b38 [ 215.539687] R13: ffff88810b1c3b10 R14: ffff88810dbdecb8 R15: ffff88810b1c3b00 [ 215.540833] FS: 00007f2aabdff700(0000) GS:ffff888dfb400000(0000) knlGS:0000000000000000 [ 215.541961] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 215.542775] CR2: 00007fa19a85d934 CR3: 000000010c076006 CR4: 0000000000370ee0 [ 215.543814] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 215.544840] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 215.545885] Call Trace: [ 215.546257] [ 215.546608] export_rdev.isra.63+0x71/0xe0 [ 215.547338] mddev_unlock+0x1b1/0x2d0 [ 215.547898] array_state_store+0x28d/0x450 [ 215.548519] md_attr_store+0xd7/0x150 [ 215.549059] ? __pfx_sysfs_kf_write+0x10/0x10 [ 215.549702] kernfs_fop_write_iter+0x1b9/0x260 [ 215.550351] vfs_write+0x491/0x760 [ 215.550863] ? __pfx_vfs_write+0x10/0x10 [ 215.551445] ? __fget_files+0x156/0x230 [ 215.552053] ksys_write+0xc0/0x160 [ 215.552570] ? __pfx_ksys_write+0x10/0x10 [ 215.553141] ? ktime_get_coarse_real_ts64+0xec/0x100 [ 215.553878] do_syscall_64+0x3a/0x90 [ 215.554403] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 215.555125] RIP: 0033:0x7f2aade11847 [ 215.555696] Code: c3 66 90 41 54 49 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 1b fd ff ff 4c 89 e2 48 89 ee 89 df 41 89 c0 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 448 [ 215.558398] RSP: 002b:00007f2aabdfeba0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 215.559516] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 00007f2aade11847 [ 215.560515] RDX: 0000000000000005 RSI: 0000000000438b8b RDI: 0000000000000010 [ 215.561512] RBP: 0000000000438b8b R08: 0000000000000000 R09: 00007f2aaecf0060 [ 215.562511] R10: 000000000e3ba40b R11: 0000000000000293 R12: 0000000000000005 [ 215.563647] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000c70750 [ 215.564693] [ 215.565029] irq event stamp: 15979 [ 215.565584] hardirqs last enabled at (15991): [] __up_console_sem+0x52/0x60 [ 215.566806] hardirqs last disabled at (16000): [] __up_console_sem+0x37/0x60 [ 215.568022] softirqs last enabled at (15716): [] __do_softirq+0x3eb/0x531 [ 215.569239] softirqs last disabled at (15711): [] irq_exit_rcu+0x115/0x160 [ 215.570434] ---[ end trace 0000000000000000 ]--- This means export_rdev() calls blkdev_put with a different holder than the one used by blkdev_get_by_dev(). This is because mddev->major_version == -2 is not a good check for external metadata. Fix this by using mddev->external instead. Also, do not clear mddev->external in md_clean(), as the flag might be used later in export_rdev(). Fixes: 2736e8eeb0cc ("block: use the holder as indication for exclusive opens") Cc: Christoph Hellwig Cc: Jens Axboe Signed-off-by: Song Liu Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230617052405.305871-1-song@kernel.org commit aa88054b70905069d1cf706aa5e9a3418d1d341d Author: Baruch Siach Date: Fri Jun 23 08:56:44 2023 +0300 binfmt_elf: fix comment typo s/reset/regset/ Signed-off-by: Baruch Siach Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/0b2967c4a4141875c493e835d5a6f8f2d19ae2d6.1687499804.git.baruch@tkos.co.il commit 0b3d412798a4763aaf39213a279e453e1fddc81d Author: Baruch Siach Date: Fri Jun 23 08:50:11 2023 +0300 elf: correct note name comment NT_PRFPREG note is named "CORE". Correct the comment accordingly. Fixes: 00e19ceec80b ("ELF: Add ELF program property parsing support") Signed-off-by: Baruch Siach Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/455b22b986de4d3bc6d9bfd522378e442943de5f.1687499411.git.baruch@tkos.co.il commit b5a99602b74bbfa655be509c615181dd95b0719e Author: Yu Kuai Date: Fri Jun 16 09:21:36 2023 +0800 md/raid1-10: fix casting from randomized structure in raid1_submit_write() Following build error triggered while build with clang version 17.0.0 with W=1(this can't be reporduced with gcc 13.1.0): drivers/md/raid1-10.c:117:25: error: casting from randomized structure pointer type 'struct block_device *' to 'struct md_rdev *' 117 | struct md_rdev *rdev = (struct md_rdev *)bio->bi_bdev; | ^ Fix this by casting 'bio->bi_bdev' to 'void *', as it used to be. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306142042.fmjfmTF8-lkp@intel.com/ Fixes: 8295efbe68c0 ("md/raid1-10: factor out a helper to submit normal write") Signed-off-by: Yu Kuai Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20230616012136.3047071-1-yukuai1@huaweicloud.com commit 125bfc7cd750e68c99f1d446e2c22abea08c237f Author: Li Nan Date: Fri Jun 9 17:43:20 2023 +0800 md/raid10: fix the condition to call bio_end_io_acct() /sys/block/[device]/queue/iostats is used to control whether to count io stat. Write 0 to it will clear queue_flags QUEUE_FLAG_IO_STAT which means iostats is disabled. If we disable iostats and later endable it, the io issued during this period will be counted incorrectly, inflight will be decreased to -1. //T1 set iostats echo 0 > /sys/block/md0/queue/iostats clear QUEUE_FLAG_IO_STAT //T2 issue io if (QUEUE_FLAG_IO_STAT) -> false bio_start_io_acct inflight++ echo 1 > /sys/block/md0/queue/iostats set QUEUE_FLAG_IO_STAT //T3 io end if (QUEUE_FLAG_IO_STAT) -> true bio_end_io_acct inflight-- -> -1 Also, if iostats is enabled while issuing io but disabled while io end, inflight will never be decreased. Fix it by checking start_time when io end. If start_time is not 0, call bio_end_io_acct(). Fixes: 528bc2cf2fcc ("md/raid10: enable io accounting") Signed-off-by: Li Nan Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20230609094320.2397604-1-linan666@huaweicloud.com commit 7bce16630837c705f72e8fd53a11ae8c236236f4 Author: Biju Das Date: Fri Jun 23 15:09:40 2023 +0100 regulator: Add Renesas PMIC RAA215300 driver The RAA215300 is a 9-channel PMIC that consists of * Internally compensated regulators * built-in Real Time Clock (RTC) * 32kHz crystal oscillator * coin cell battery charger The RTC on RAA215300 is similar to the IP found in the ISL1208. The existing driver for the ISL1208 works for this PMIC too, however the RAA215300 exposes two devices via I2C, one for the RTC IP, and one for everything else. The RTC IP has to be enabled by the other I2C device, therefore this driver is necessary to get the RTC to work. The external oscillator bit is inverted on PMIC version 0x11. Add PMIC RAA215300 driver for enabling RTC block and instantiating RTC device based on PMIC version. Signed-off-by: Biju Das Link: https://lore.kernel.org/r/Message-Id: <20230623140948.384762-3-biju.das.jz@bp.renesas.com> Signed-off-by: Mark Brown commit fff8f6b0723159f09eb2c067e626fb96402c0e53 Author: Biju Das Date: Fri Jun 23 15:09:39 2023 +0100 regulator: dt-bindings: Add Renesas RAA215300 PMIC bindings Document Renesas RAA215300 PMIC bindings. The RAA215300 is a high Performance 9-Channel PMIC supporting DDR Memory, with Built-In Charger and RTC. It supports DDR3, DDR3L, DDR4, and LPDDR4 memory power requirements. The internally compensated regulators, built-in Real-Time Clock (RTC), 32kHz crystal oscillator, and coin cell battery charger provide a highly integrated, small footprint power solution ideal for System-On-Module (SOM) applications. A spread spectrum feature provides an ease-of-use solution for noise-sensitive audio or RF applications. Signed-off-by: Biju Das Reviewed-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/Message-Id: <20230623140948.384762-2-biju.das.jz@bp.renesas.com> Signed-off-by: Mark Brown commit ed959833db7bdb4e57fa8f4076babf3810296f5b Author: Dan Carpenter Date: Fri Jun 23 15:09:48 2023 +0300 ASoC: tas2781: Fix error code in tas2781_load_calibration() Return -EINVAL instead of success on this error path. Fixes: 915f5eadebd2 ("ASoC: tas2781: firmware lib") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/Message-Id: <729bb6b3-bc1d-4b3d-8b65-077a492c753c@moroto.mountain> Signed-off-by: Mark Brown commit 0c3855ba8dad41c4113e73f77eb926e44577e4af Author: Christian König Date: Fri Jun 23 09:08:00 2023 +0200 drm/ttm: fix warning that we shouldn't mix && and || Trivial warning fix. Signed-off-by: Christian König Fixes: 4481913607e5 ("drm/ttm: fix bulk_move corruption when adding a entry") Reviewed-by: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20230623070935.65102-1-christian.koenig@amd.com commit b54c4b02abd1578132712eae5b294a9c77e7422b Author: Wilken Gottwalt Date: Fri Jun 23 13:36:28 2023 +0000 hwmon: (corsair-psu) various cleanups Fix some typos, adjust documentation and comments to current state of knowledge and update coding style to be more uniform. Signed-off-by: Wilken Gottwalt Link: https://lore.kernel.org/r/ZJWf3H972hGgLK-8@monster.localdomain Signed-off-by: Guenter Roeck commit fc30ace06f250f79381a8e3f6ed92dd68e25a9f5 Author: Donglin Peng Date: Fri Jun 23 15:17:28 2023 +0800 tracing: Fix warnings when building htmldocs for function graph retval When building htmldocs, the following warnings appear: Documentation/trace/ftrace.rst:2797: WARNING: Literal block expected; none found. Documentation/trace/ftrace.rst:2816: WARNING: Literal block expected; none found. So fix it. Link: https://lore.kernel.org/all/20230623143517.19ffc6c0@canb.auug.org.au/ Link: https://lkml.kernel.org/r/20230623071728.25688-1-pengdonglin@sangfor.com.cn Fixes: 21c094d3f8a6 ("tracing: Add documentation for funcgraph-retval and funcgraph-retval-hex") Signed-off-by: Donglin Peng Acked-by: Masami Hiramatsu (Google) Reported-by: Stephen Rothwell Signed-off-by: Steven Rostedt (Google) commit 81ca2dbefaabe1a2ca1c7cfc84dfd45c072c82a6 Author: Demi Marie Obenour Date: Sat Jun 3 10:52:44 2023 -0400 dm ioctl: Refuse to create device named "." or ".." Using either of these is going to greatly confuse userspace, as they are not valid symlink names and so creating the usual /dev/mapper/NAME symlink will not be possible. As creating a device with either of these names is almost certainly a userspace bug, just error out. Signed-off-by: Demi Marie Obenour Signed-off-by: Mike Snitzer commit a85f1a9de91a59cd9b12d60f631cbda9c56a1c3c Author: Demi Marie Obenour Date: Sat Jun 3 10:52:43 2023 -0400 dm ioctl: Refuse to create device named "control" Typical userspace setups create a symlink under /dev/mapper with the name of the device, but /dev/mapper/control is reserved for DM's control device. Therefore, trying to create such a device is almost certain to be a userspace bug. Signed-off-by: Demi Marie Obenour Signed-off-by: Mike Snitzer commit 249bed821b4db6d95a99160f7d6d236ea5fe6362 Author: Demi Marie Obenour Date: Sat Jun 3 10:52:42 2023 -0400 dm ioctl: Avoid double-fetch of version The version is fetched once in check_version(), which then does some validation and then overwrites the version in userspace with the API version supported by the kernel. copy_params() then fetches the version from userspace *again*, and this time no validation is done. The result is that the kernel's version number is completely controllable by userspace, provided that userspace can win a race condition. Fix this flaw by not copying the version back to the kernel the second time. This is not exploitable as the version is not further used in the kernel. However, it could become a problem if future patches start relying on the version field. Cc: stable@vger.kernel.org Signed-off-by: Demi Marie Obenour Signed-off-by: Mike Snitzer commit 10655c7a48570315343fdd9cc6acb261d57c2c7a Author: Demi Marie Obenour Date: Sat Jun 3 10:52:41 2023 -0400 dm ioctl: structs and parameter strings must not overlap The NUL terminator for each target parameter string must precede the following 'struct dm_target_spec'. Otherwise, dm_split_args() might corrupt this struct. Furthermore, the first 'struct dm_target_spec' must come after the 'struct dm_ioctl', as if it overlaps too much dm_split_args() could corrupt the 'struct dm_ioctl'. Signed-off-by: Demi Marie Obenour Reviewed-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit 13f4a697f8b4feb705569f9336127e9e2f9ac596 Author: Demi Marie Obenour Date: Sat Jun 3 10:52:40 2023 -0400 dm ioctl: Avoid pointer arithmetic overflow Especially on 32-bit systems, it is possible for the pointer arithmetic to overflow and cause a userspace pointer to be dereferenced in the kernel. Signed-off-by: Demi Marie Obenour Reviewed-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit b60528d9e68113e2c297c3a45102332cb1d3e608 Author: Demi Marie Obenour Date: Sat Jun 3 10:52:39 2023 -0400 dm ioctl: Check dm_target_spec is sufficiently aligned Otherwise subsequent code, if given malformed input, could dereference a misaligned 'struct dm_target_spec *'. Signed-off-by: Demi Marie Obenour Signed-off-by: Stephen Rothwell # use %zu Reviewed-by: Mikulas Patocka Signed-off-by: Mike Snitzer commit fcaa174a9c995cf0af3967e55644a1543ea07e36 Author: Yu Kuai Date: Thu Jun 22 00:01:11 2023 +0800 scsi/sg: don't grab scsi host module reference In order to prevent request_queue to be freed before cleaning up blktrace debugfs entries, commit db59133e9279 ("scsi: sg: fix blktrace debugfs entries leakage") use scsi_device_get(), however, scsi_device_get() will also grab scsi module reference and scsi module can't be removed. It's reported that blktests can't unload scsi_debug after block/001: blktests (master) # ./check block block/001 (stress device hotplugging) [failed] +++ /root/blktests/results/nodev/block/001.out.bad 2023-06-19 Running block/001 Stressing sd +modprobe: FATAL: Module scsi_debug is in use. Fix this problem by grabbing request_queue reference directly, so that scsi host module can still be unloaded while request_queue will be pinged by sg device. Reported-by: Chaitanya Kulkarni Link: https://lore.kernel.org/all/1760da91-876d-fc9c-ab51-999a6f66ad50@nvidia.com/ Fixes: db59133e9279 ("scsi: sg: fix blktrace debugfs entries leakage") Signed-off-by: Yu Kuai Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230621160111.1433521-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit c98c81a4ac37b651be7eb9d16f562fc4acc5f867 Author: Pavel Begunkov Date: Fri Jun 23 12:23:31 2023 +0100 io_uring: merge conditional unlock flush helpers There is no reason not to use __io_cq_unlock_post_flush for intermediate aux CQE flushing, all ->task_complete should apply there, i.e. if set it should be the submitter task. Combine them, get rid of of __io_cq_unlock_post() and rename the left function. This place was also taking a couple percents of CPU according to profiles for max throughput net benchmarks due to multishot recv flooding it with completions. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/bbed60734cbec2e833d9c7bdcf9741aada5d8aab.1687518903.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 0fdb9a196c6728b51e0e7a4f6fa292d9fd5793de Author: Pavel Begunkov Date: Fri Jun 23 12:23:30 2023 +0100 io_uring: make io_cq_unlock_post static io_cq_unlock_post() is exclusively used in io_uring/io_uring.c, mark it static and don't expose to other files. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/3dc8127dda4514e1dd24bb32035faac887c5fa37.1687518903.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit ff12617728fa5c7fb5325e164503ca4e936b80bd Author: Pavel Begunkov Date: Fri Jun 23 12:23:29 2023 +0100 io_uring: inline __io_cq_unlock __io_cq_unlock is not very helpful, and users should be calling flush variants anyway. Open code the function. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/d875c4cfb69f38ccecb58a57111446c77a614caa.1687518903.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 55b6a69fed5df6f88ef0b2ace562b422162beb61 Author: Pavel Begunkov Date: Fri Jun 23 12:23:28 2023 +0100 io_uring: fix acquire/release annotations We do conditional locking, so __io_cq_lock() and friends not always actually grab/release the lock, so kill misleading annotations. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/2a098f9144c24cab622f8bf90b39f44da5d0401e.1687518903.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit f432b76bcc93f36edb3d371f7b8d7881261dd6e7 Author: Pavel Begunkov Date: Fri Jun 23 12:23:27 2023 +0100 io_uring: kill io_cq_unlock() We're abusing ->completion_lock helpers. io_cq_unlock() neither locking conditionally nor doing CQE flushing, which means that callers must have some side reason of taking the lock and should do it directly. Open code io_cq_unlock() into io_cqring_overflow_kill() and clean it up. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/7dabb36856db2b562e78780480396c52c29b2bf4.1687518903.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 91c7884ac9a92ffbf78af7fc89603daf24f448a9 Author: Pavel Begunkov Date: Fri Jun 23 12:23:26 2023 +0100 io_uring: remove IOU_F_TWQ_FORCE_NORMAL Extract a function for non-local task_work_add, and use it directly from io_move_task_work_from_local(). Now we don't use IOU_F_TWQ_FORCE_NORMAL and it can be killed. As a small positive side effect we don't grab task->io_uring in io_req_normal_work_add anymore, which is not needed for io_req_local_work_add(). Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/2e55571e8ff2927ae3cc12da606d204e2485525b.1687518903.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 2fdd6fb5ff958a0f6b403e3f3ffd645b60b2a2b2 Author: Pavel Begunkov Date: Fri Jun 23 12:23:25 2023 +0100 io_uring: don't batch task put on reqs free We're trying to batch io_put_task() in io_free_batch_list(), but considering that the hot path is a simple inc, it's most cerainly and probably faster to just do io_put_task() instead of task tracking. We don't care about io_put_task_remote() as it's only for IOPOLL where polling/waiting is done by not the submitter task. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/4a7ef7dce845fe2bd35507bf389d6bd2d5c1edf0.1687518903.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 5a754dea27fb91a418f7429e24479e4184dee2e3 Author: Pavel Begunkov Date: Fri Jun 23 12:23:24 2023 +0100 io_uring: move io_clean_op() Move io_clean_op() up in the source file and remove the forward declaration, as the function doesn't have tricky dependencies anymore. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/1b7163b2ba7c3a8322d972c79c1b0a9301b3057e.1687518903.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 3b7a612fd0dbd321e15a308b8ac1f8bbf81432bd Author: Pavel Begunkov Date: Fri Jun 23 12:23:23 2023 +0100 io_uring: inline io_dismantle_req() io_dismantle_req() is only used in __io_req_complete_post(), open code it there. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/ba8f20cb2c914eefa2e7d120a104a198552050db.1687518903.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 6ec9afc7f4cba58ab740c59d4c964d9422e2ea82 Author: Pavel Begunkov Date: Fri Jun 23 12:23:22 2023 +0100 io_uring: remove io_free_req_tw Request completion is a very hot path in general, but there are 3 places that can be doing it: io_free_batch_list(), io_req_complete_post() and io_free_req_tw(). io_free_req_tw() is used rather marginally and we don't care about it. Killing it can help to clean up and optimise the left two, do that by replacing it with io_req_task_complete(). There are two things to consider: 1) io_free_req() is called when all refs are put, so we need to reinit references. The easiest way to do that is to clear REQ_F_REFCOUNT. 2) We also don't need a cqe from it, so silence it with REQ_F_CQE_SKIP. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/434a2be8f33d474ad888ce1c17fe5ea7bbcb2a55.1687518903.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 247f97a5f19b642eba5f5c1cf95fc3169326b3fb Author: Pavel Begunkov Date: Fri Jun 23 12:23:21 2023 +0100 io_uring: open code io_put_req_find_next There is only one user of io_put_req_find_next() and it doesn't make much sense to have it. Open code the function. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/38b5c5e48e4adc8e6a0cd16fdd5c1531d7ff81a9.1687518903.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit a42fb5a75ccc37dfd69aa9bde5ba2866e802ff3c Author: Jan Kara Date: Thu Jun 22 18:51:07 2023 +0200 ext4: Fix warning in blkdev_put() ext4_blkdev_remove() passes a wrong holder pointer to blkdev_put() which triggers a warning there. Fix it. Fixes: 2736e8eeb0cc ("block: use the holder as indication for exclusive opens") Signed-off-by: Jan Kara Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230622165107.13687-1-jack@suse.cz Signed-off-by: Jens Axboe commit 95e2b352c03b0a86c5717ba1d24ea20969abcacc Author: Immad Mir Date: Fri Jun 23 19:17:08 2023 +0530 FS: JFS: Check for read-only mounted filesystem in txBegin This patch adds a check for read-only mounted filesystem in txBegin before starting a transaction potentially saving from NULL pointer deref. Signed-off-by: Immad Mir Signed-off-by: Dave Kleikamp commit 47cfdc338d674d38f4b2f22b7612cc6a2763ba27 Author: Immad Mir Date: Fri Jun 23 19:14:01 2023 +0530 FS: JFS: Fix null-ptr-deref Read in txBegin Syzkaller reported an issue where txBegin may be called on a superblock in a read-only mounted filesystem which leads to NULL pointer deref. This could be solved by checking if the filesystem is read-only before calling txBegin, and returning with appropiate error code. Reported-By: syzbot+f1faa20eec55e0c8644c@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=be7e52c50c5182cc09a09ea6fc456446b2039de3 Signed-off-by: Immad Mir Signed-off-by: Dave Kleikamp commit 92554cdd428fce212d2a71a06939e7cab90f7c77 Author: Stefan Wahren Date: Sat Jun 17 15:36:17 2023 +0200 dt-bindings: pwm: convert pwm-bcm2835 bindings to YAML Convert the DT binding document for pwm-bcm2835 from .txt to YAML. Signed-off-by: Stefan Wahren Reviewed-by: Rob Herring Reviewed-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 254d3a727421ccc935f085eaa9bae51cb6c9df25 Author: Biju Das Date: Fri Jun 2 11:11:21 2023 +0100 pwm: Add Renesas RZ/G2L MTU3a PWM driver The RZ/G2L Multi-Function Timer Pulse Unit 3 (a.k.a MTU3a) uses one counter and two match components to configure duty_cycle and period to generate PWM output waveform. Add basic support for RZ/G2L MTU3a PWM driver by creating separate PWM channels for each IOs. Signed-off-by: Biju Das Reviewed-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit bc13d60e4e1e945b34769a4a4c2b172e8552abe5 Author: Shuijing Li Date: Wed May 31 11:10:01 2023 +0800 pwm: mtk_disp: Fix the disable flow of disp_pwm There is a flow error in the original mtk_disp_pwm_apply() function. If this function is called when the clock is disabled, there will be a chance to operate the disp_pwm register, resulting in disp_pwm exception. Fix this accordingly. Fixes: 888a623db5d0 ("pwm: mtk-disp: Implement atomic API .apply()") Signed-off-by: Shuijing Li Reviewed-by: Matthias Brugger Tested-by: Fei Shao Acked-by: Uwe Kleine-König Reviewed-by: Alexandre Mergnat Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Thierry Reding commit 05b743db9d8cc4e51b3eb77889d24ab9aa2bf169 Author: Krzysztof Kozlowski Date: Tue May 30 16:48:46 2023 +0200 dt-bindings: pwm: restrict node name suffixes Make the pattern matching node names a bit stricter to improve DTS consistency. The pattern is restricted to: 1. Only one unit address or one -N suffix, 2. -N suffixes to decimal numbers. Suggested-by: Rob Herring Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Reviewed-by: Uwe Kleine-König Reviewed-by: Tony Lindgren Signed-off-by: Thierry Reding commit 8bfc651a28ceaab5334d7284a31fce7cb1615348 Author: Uwe Kleine-König Date: Thu May 25 23:13:05 2023 +0200 pwm: pca9685: Switch i2c driver back to use .probe() After commit b8a1a4cd5a98 ("i2c: Provide a temporary .probe_new() call-back type"), all drivers being converted to .probe_new() and then 03c835f498b5 ("i2c: Switch .probe() to not take an id parameter") convert back to (the new) .probe() to be able to eventually drop .probe_new() from struct i2c_driver. Signed-off-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit cdcffafc4d845cc0c6392cba168c7a942734cce7 Author: Dan Carpenter Date: Mon May 22 14:07:42 2023 +0300 pwm: ab8500: Fix error code in probe() This code accidentally return positive EINVAL instead of negative -EINVAL. Fixes: eb41f334589d ("pwm: ab8500: Fix register offset calculation to not depend on probe order") Signed-off-by: Dan Carpenter Reviewed-by: Uwe Kleine-König Reviewed-by: Linus Walleij Signed-off-by: Thierry Reding commit de0bb6a8883342c19a5d20f28d5430169f87373e Author: Conor Dooley Date: Thu May 18 13:29:21 2023 +0100 MAINTAINERS: add pwm to PolarFire SoC entry Add the newly introduced pwm driver to the existing PolarFire SoC entry. Signed-off-by: Conor Dooley Acked-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 2bf7ecf7b4fffd87d8eb5c072395239d6ff54728 Author: Conor Dooley Date: Thu May 18 13:29:20 2023 +0100 pwm: add microchip soft ip corePWM driver Add a driver that supports the Microchip FPGA "soft" PWM IP core. Signed-off-by: Conor Dooley Reviewed-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 38ba83598633373f47951384cfc389181c8d1bed Author: Marek Vasut Date: Fri May 12 18:47:36 2023 +0200 pwm: sysfs: Do not apply state to already disabled PWMs If the PWM is exported but not enabled, do not call pwm_class_apply_state(). First of all, in this case, period may still be unconfigured and this would make pwm_class_apply_state() return -EINVAL, and then suspend would fail. Second, it makes little sense to apply state onto PWM that is not enabled before suspend. Failing case: " $ echo 1 > /sys/class/pwm/pwmchip4/export $ echo mem > /sys/power/state ... pwm pwmchip4: PM: dpm_run_callback(): pwm_class_suspend+0x1/0xa8 returns -22 pwm pwmchip4: PM: failed to suspend: error -22 PM: Some devices failed to suspend, or early wake event detected " Working case: " $ echo 1 > /sys/class/pwm/pwmchip4/export $ echo 100 > /sys/class/pwm/pwmchip4/pwm1/period $ echo 10 > /sys/class/pwm/pwmchip4/pwm1/duty_cycle $ echo mem > /sys/power/state ... " Do not call pwm_class_apply_state() in case the PWM is disabled to fix this issue. Fixes: 7fd4edc57bbae ("pwm: sysfs: Add suspend/resume support") Signed-off-by: Marek Vasut Fixes: ef2bf4997f7d ("pwm: Improve args checking in pwm_apply_state()") Reviewed-by: Brian Norris Reviewed-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit 661dfb7f46298e53f6c3deaa772fa527aae86193 Author: Fancy Fang Date: Fri May 5 14:58:39 2023 +0800 pwm: imx-tpm: force 'real_period' to be zero in suspend During suspend, all the tpm registers will lose values. So the 'real_period' value of struct 'imx_tpm_pwm_chip' should be forced to be zero to force the period update code can be executed after system resume back. Signed-off-by: Fancy Fang Signed-off-by: Clark Wang Acked-by: Uwe Kleine-König Fixes: 738a1cfec2ed ("pwm: Add i.MX TPM PWM driver support") Signed-off-by: Thierry Reding commit 329db102a26da0ba876974dbe04308d08acfad94 Author: Heiner Kallweit Date: Wed May 24 21:52:21 2023 +0200 pwm: meson: make full use of common clock framework Newer versions of the PWM block use a core clock with external mux, divider, and gate. These components either don't exist any longer in the PWM block, or they are bypassed. To minimize needed changes for supporting the new version, the internal divider and gate should be handled by CCF too. I didn't see a good way to split the patch, therefore it's somewhat bigger. What it does: - The internal mux is handled by CCF already. Register also internal divider and gate with CCF, so that we have one representation of the input clock: [mux] parent of [divider] parent of [gate] - Now that CCF selects an appropriate mux parent, we don't need the DT-provided default parent any longer. Accordingly we can also omit setting the mux parent directly in the driver. - Instead of manually handling the pre-div divider value, let CCF set the input clock. Targeted input clock frequency is 0xffff * 1/period for best precision. - For the "inverted pwm disabled" scenario target an input clock frequency of ULONG_MAX. This ensures that the remaining low pulses have minimum length. I don't have hw with the old PWM block, therefore I couldn't test this patch. With the not yet included extension for the new PWM block (channel->clk coming directly from get_clk(external_clk)) I didn't notice any problem. My system uses PWM for the CPU voltage regulator and for the SDIO 32kHz clock. Note: The clock gate in the old PWM block is permanently disabled. This seems to indicate that it's not used by the new PWM block. Signed-off-by: Heiner Kallweit Signed-off-by: Thierry Reding commit 3bddf73285d578a1798189e0eed2e7f82ebf0e11 Author: Heiner Kallweit Date: Wed May 24 21:51:31 2023 +0200 pwm: meson: don't use hdmi/video clock as mux parent The meson_vclk code from the display driver may change the rate of the video clock. Therefore better don't use it as pwm mux parent. After removing this clock from the parent list pwm_gxbb_data and pwm_g12a_ee_data are the same as pwm_meson8b_data. So we can remove them. Reported-by: Martin Blumenstingl Reviewed-by: Martin Blumenstingl Signed-off-by: Heiner Kallweit Signed-off-by: Thierry Reding commit ed73300326ec67d2a0c35fb7f911314cc6d7d918 Author: Heiner Kallweit Date: Wed May 24 21:50:47 2023 +0200 pwm: meson: switch to using struct clk_parent_data for mux parents We'll use struct clk_parent_data for mux/div/gate initialization in the follow-up patches. As a first step switch the mux from using parent_names to clk_parent_data. Suggested-by: Martin Blumenstingl Reviewed-by: Martin Blumenstingl Tested-by: Martin Blumenstingl Signed-off-by: Heiner Kallweit Signed-off-by: Thierry Reding commit bafa23b6c07caac63a9637e83a605c26771b43ee Author: Heiner Kallweit Date: Wed May 24 21:49:56 2023 +0200 pwm: meson: remove not needed check in meson_pwm_calc period >= duty implies that cnt >= duty_cnt. We verified before that cnt <= 0xffff, therefore we can omit the check here. Suggested-by: Uwe Kleine-König Signed-off-by: Heiner Kallweit Signed-off-by: Thierry Reding commit 87a2cbf02d7701255f9fcca7e5bd864a7bb397cf Author: Heiner Kallweit Date: Wed May 24 21:48:36 2023 +0200 pwm: meson: fix handling of period/duty if greater than UINT_MAX state->period/duty are of type u64, and if their value is greater than UINT_MAX, then the cast to uint will cause problems. Fix this by changing the type of the respective local variables to u64. Fixes: b79c3670e120 ("pwm: meson: Don't duplicate the polarity internally") Cc: stable@vger.kernel.org Suggested-by: Uwe Kleine-König Reviewed-by: Martin Blumenstingl Signed-off-by: Heiner Kallweit Signed-off-by: Thierry Reding commit 6b9352f3f8a1a35faf0efc1ad1807ee303467796 Author: Heiner Kallweit Date: Wed May 24 21:47:43 2023 +0200 pwm: meson: modify and simplify calculation in meson_pwm_get_state I don't see a reason why we should treat the case lo < hi differently and return 0 as period and duty_cycle. The current logic was added with c375bcbaabdb ("pwm: meson: Read the full hardware state in meson_pwm_get_state()"), Martin as original author doesn't remember why it was implemented this way back then. So let's handle it as normal use case and also remove the optimization for lo == 0. I think the improved readability is worth it. Fixes: c375bcbaabdb ("pwm: meson: Read the full hardware state in meson_pwm_get_state()") Reviewed-by: Uwe Kleine-König Reviewed-by: Dmitry Rokosov Acked-by: Martin Blumenstingl Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit Signed-off-by: Thierry Reding commit 5442c33f218b1aabbe699db978e407317a231d10 Author: Wolfram Sang Date: Tue May 2 18:53:29 2023 +0200 dt-bindings: pwm: Add R-Car V3U device tree bindings Tested-by: Kieran Bingham Signed-off-by: Wolfram Sang Acked-by: Rob Herring Acked-by: Uwe Kleine-König Reviewed-by: Kieran Bingham Reviewed-by: Geert Uytterhoeven Signed-off-by: Thierry Reding commit c799ad062a75858e10a7626e20233e6e94dbf554 Author: Alexander Stein Date: Mon Apr 24 10:21:07 2023 +0200 dt-bindings: pwm: imx: add i.MX8QXP compatible i.MX8QXP compatible is missing in the list, add it. Signed-off-by: Alexander Stein Acked-by: Uwe Kleine-König Acked-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit 967da67a745fb73fd0fc7aa61fd197b76fceb273 Author: Daniel Golle Date: Fri Apr 21 00:23:21 2023 +0100 pwm: mediatek: Add support for MT7981 The PWM unit on MT7981 uses different register offsets than previous MediaTek PWM units. Add support for these new offsets and add support for PWM on MT7981 which has 3 PWM channels, one of them is typically used for a temperature controlled fan. While at it, also reorder pwm_mediatek_of_data entries to restore alphabetic order. Signed-off-by: Daniel Golle Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Matthias Brugger Signed-off-by: Thierry Reding commit 88c66e018aa8b5a15d7fdba9908c01260c657bff Author: Daniel Golle Date: Fri Apr 21 00:22:49 2023 +0100 dt-bindings: pwm: mediatek: Add mediatek,mt7981 compatible Add compatible string for the PWM unit found of the MediaTek MT7981 SoC. This is in preparation to adding support in the pwm-mediatek.c driver. Signed-off-by: Daniel Golle Reviewed-by: AngeloGioacchino Del Regno Acked-by: Krzysztof Kozlowski Signed-off-by: Thierry Reding commit 55e644b840baf7a884a27be81b7582794f54a808 Author: Uwe Kleine-König Date: Tue Apr 18 22:21:02 2023 +0200 pwm: sifive: Simplify using devm_clk_get_prepared() Instead of preparing the clk after it was requested and unpreparing in .probe()'s error path and .remove(), use devm_clk_get_prepared() which copes for unpreparing automatically. Signed-off-by: Uwe Kleine-König Reviewed-by: Emil Renner Berthing Signed-off-by: Thierry Reding commit 2b8e30b1bd500df67554f1c183caf333de82f8d2 Author: Christophe JAILLET Date: Sun Apr 16 11:02:13 2023 +0200 pwm: clk: Use the devm_clk_get_prepared() helper function Use the devm_clk_get_prepared() helper function instead of hand-writing it. It saves some line of codes. Signed-off-by: Christophe JAILLET Acked-by: Uwe Kleine-König Signed-off-by: Thierry Reding commit dc917ea7a2c95545dd41572a5685a95566ff9985 Author: Ladislav Michl Date: Mon Jun 19 22:14:03 2023 +0200 MIPS: OCTEON: octeon-usb: cleanup divider calculation Simple self-contained function is easier to review. Signed-off-by: Ladislav Michl Signed-off-by: Thomas Bogendoerfer commit 2257c6c90e9223e00d0e37ec721c86f45d8ba1d9 Author: Ladislav Michl Date: Mon Jun 19 22:13:38 2023 +0200 MIPS: OCTEON: octeon-usb: introduce dwc3_octeon_{read,write}q Move all register access code into separate functions and provide their no-op version for non Octeon platforms. Later it might be possible to replace them with standard Linux functions, however datasheets are not publicly available and I have only one Octeon board to test, so lets stay on safe side for now. Signed-off-by: Ladislav Michl Signed-off-by: Thomas Bogendoerfer commit 793bef570951431cdf257b637fcb21356d7faec9 Author: Ladislav Michl Date: Mon Jun 19 22:13:14 2023 +0200 MIPS: OCTEON: octeon-usb: move gpio config to separate function Power gpio configuration is using Octeon specific code, so move it to separate function, that can later be guarded with ifdefs. Signed-off-by: Ladislav Michl Signed-off-by: Thomas Bogendoerfer commit 940692c6ccf51277d6cbdb069c38141e4ed9eb31 Author: Ladislav Michl Date: Mon Jun 19 22:12:34 2023 +0200 MIPS: OCTEON: octeon-usb: use bitfields for shim register Use Linux standard bitfield access macros to manipulate shim register. Signed-off-by: Ladislav Michl Signed-off-by: Thomas Bogendoerfer commit 74ac367c9c851a1a896291ef5cf292541cdf17c0 Author: Ladislav Michl Date: Mon Jun 19 22:12:10 2023 +0200 MIPS: OCTEON: octeon-usb: use bitfields for host config register Use Linux standard bitfield access macros to manipulate host config register. Signed-off-by: Ladislav Michl Signed-off-by: Thomas Bogendoerfer commit ce942c0f69c2e492f3d2be27b1a42cdbf59f6b1c Author: Ladislav Michl Date: Mon Jun 19 22:11:43 2023 +0200 MIPS: OCTEON: octeon-usb: use bitfields for control register Code needs to compile for all platforms in order to move it to drivers/usb/dwc3. Use Linux standard bitfield access macros to manipulate control register. Signed-off-by: Ladislav Michl Signed-off-by: Thomas Bogendoerfer commit c7b6a1eb2f85a8d10f3bb93a57e7b91a3dc58693 Author: Ladislav Michl Date: Mon Jun 19 22:11:19 2023 +0200 MIPS: OCTEON: octeon-usb: add all register offsets Glue code uses a mix of offset and absolute address register definition. Define all of them as offsets and use them consistently. Signed-off-by: Ladislav Michl Signed-off-by: Thomas Bogendoerfer commit 670f77f76f650b1b341d31d009cc2fb03a4d1fcf Author: Shiji Yang Date: Fri Jun 23 08:17:48 2023 +0800 mips: ralink: match all supported system controller compatible strings Recently, A new clock and reset controller driver has been introduced to the ralink mips target[1]. It provides proper system control and adds more SoC specific compatible strings. In order to better initialize CPUs, this patch removes the outdated "ralink,mt7620a-sysc" and add all dt-binding documented compatible strings to the system controller match table. [1] https://lore.kernel.org/all/20230619040941.1340372-1-sergio.paracuellos@gmail.com/ Signed-off-by: Shiji Yang Reviewed-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 7b191b9b55df2a844bd32d1d380f47a7df1c2896 Author: Gustavo A. R. Silva Date: Thu Jun 22 17:43:57 2023 -0600 MIPS: dec: prom: Address -Warray-bounds warning Zero-length arrays are deprecated, and we are replacing them with flexible array members instead. So, replace zero-length array with flexible-array member in struct memmap. Address the following warning found after building (with GCC-13) mips64 with decstation_64_defconfig: In function 'rex_setup_memory_region', inlined from 'prom_meminit' at arch/mips/dec/prom/memory.c:91:3: arch/mips/dec/prom/memory.c:72:31: error: array subscript i is outside array bounds of 'unsigned char[0]' [-Werror=array-bounds=] 72 | if (bm->bitmap[i] == 0xff) | ~~~~~~~~~~^~~ In file included from arch/mips/dec/prom/memory.c:16: ./arch/mips/include/asm/dec/prom.h: In function 'prom_meminit': ./arch/mips/include/asm/dec/prom.h:73:23: note: while referencing 'bitmap' 73 | unsigned char bitmap[0]; This helps with the ongoing efforts to globally enable -Warray-bounds. This results in no differences in binary output. Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/KSPP/linux/issues/323 Signed-off-by: Gustavo A. R. Silva Signed-off-by: Thomas Bogendoerfer commit 944520f85d5b1fb2f9ea243be41f9c9af3d4cef3 Author: Paul Cercueil Date: Thu Jun 22 19:59:34 2023 +0200 MIPS: DTS: CI20: Raise VDDCORE voltage to 1.125 volts Commit 08384e80a70f ("MIPS: DTS: CI20: Fix ACT8600 regulator node names") caused the VDDCORE power supply (regulated by the ACT8600's DCDC1 output) to drop from a voltage of 1.2V configured by the bootloader, to the 1.1V set in the Device Tree. According to the documentation, the VDDCORE supply should be between 0.99V and 1.21V; both values are therefore within the supported range. However, VDDCORE being 1.1V results in the CI20 being very unstable, with corrupted memory, failures to boot, or reboots at random. The reason might be succint drops of the voltage below the minimum required. Raising the minimum voltage to 1.125 volts seems to be enough to address this issue, while still keeping a relatively low core voltage which helps for power consumption and thermals. Fixes: 08384e80a70f ("MIPS: DTS: CI20: Fix ACT8600 regulator node names") Signed-off-by: Paul Cercueil Signed-off-by: Thomas Bogendoerfer commit 6e68dae946e3a0333fbde5487ce163142ca10ae0 Author: Nathan Chancellor Date: Thu Jun 22 15:56:19 2023 +0000 clk: ralink: mtmips: Fix uninitialized use of ret in mtmips_register_{fixed,factor}_clocks() Clang warns: drivers/clk/ralink/clk-mtmips.c:309:9: error: variable 'ret' is uninitialized when used here [-Werror,-Wuninitialized] 309 | return ret; | ^~~ drivers/clk/ralink/clk-mtmips.c:285:9: note: initialize the variable 'ret' to silence this warning 285 | int ret, i; | ^ | = 0 drivers/clk/ralink/clk-mtmips.c:359:9: error: variable 'ret' is uninitialized when used here [-Werror,-Wuninitialized] 359 | return ret; | ^~~ drivers/clk/ralink/clk-mtmips.c:335:9: note: initialize the variable 'ret' to silence this warning 335 | int ret, i; | ^ | = 0 2 errors generated. Set ret to the return value of clk_hw_register_fixed_rate() using the PTR_ERR() macro, which ensures ret is not used uninitialized, clearing up the warning. Fixes: 6f3b15586eef ("clk: ralink: add clock and reset driver for MTMIPS SoCs") Closes: https://github.com/ClangBuiltLinux/linux/issues/1879 Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Acked-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 6fb605c41d731d511b33045d0cd713d706970b6d Merge: 8a86133e06e6a a3c10035d12f5 Author: Wolfram Sang Date: Fri Jun 23 12:59:46 2023 +0200 Merge tag 'at24-updates-for-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into i2c/for-mergewindow at24 updates for v6.5 - use dev_err_probe() where applicable commit faaa5fd30344f9a7b3816ae7a6b58ccd5a34998f Author: Rob Herring Date: Wed Jun 21 17:10:12 2023 -0600 dt-bindings: net: altr,tse: Fix error in "compatible" conditional schema The conditional if/then schema has an error as the "enum" values have "const" in them. Drop the "const". Signed-off-by: Rob Herring Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230621231012.3816139-1-robh@kernel.org Signed-off-by: Paolo Abeni commit 8a86133e06e6a4f8797a8cc611a99785c05d8183 Author: Andi Shyti Date: Mon Jun 12 00:57:02 2023 +0200 i2c: uniphier: Use devm_clk_get_enabled() Replace the pair of functions, devm_clk_get() and clk_prepare_enable(), with a single function devm_clk_get_enabled(). Signed-off-by: Andi Shyti Signed-off-by: Wolfram Sang commit ff896ef401866c0eb0d07c0c279b5382e2d9e3cf Author: Andi Shyti Date: Mon Jun 12 00:57:01 2023 +0200 i2c: uniphier-f: Use devm_clk_get_enabled() Replace the pair of functions, devm_clk_get() and clk_prepare_enable(), with a single function devm_clk_get_enabled(). Signed-off-by: Andi Shyti Signed-off-by: Wolfram Sang commit 7e8e6677a8f70deb14482b70bef59dbf094d4321 Author: Andi Shyti Date: Mon Jun 12 00:56:56 2023 +0200 i2c: owl: Use devm_clk_get_enabled() Replace the pair of functions, devm_clk_get() and clk_prepare_enable(), with a single function devm_clk_get_enabled(). Signed-off-by: Andi Shyti Signed-off-by: Wolfram Sang commit 9d8b7b6102d9cefb9e95c7ba764121182f696943 Author: Andi Shyti Date: Mon Jun 12 00:56:54 2023 +0200 i2c: lpc2k: Use devm_clk_get_enabled() Replace the pair of functions, devm_clk_get() and clk_prepare_enable(), with a single function devm_clk_get_enabled(). Signed-off-by: Andi Shyti Signed-off-by: Wolfram Sang commit 0ff9f5e57c5bb45b6b807a4d466228de39d8cd2f Author: Bartosz Golaszewski Date: Fri Jun 9 16:36:09 2023 +0200 of: unittest: drop assertions for GPIO hog messages These have now been demoted to debug and are normally hidden. Drop the assertions entirely. Suggested-by: Rob Herring Signed-off-by: Bartosz Golaszewski Acked-by: Andy Shevchenko Acked-by: Rob Herring commit 2153244b641031654d2dd534dfa3f9b4a820c572 Author: Andi Shyti Date: Mon Jun 12 00:56:52 2023 +0200 i2c: hix5hd2: Use devm_clk_get_enabled() Replace the pair of functions, devm_clk_get() and clk_prepare_enable(), with a single function devm_clk_get_enabled(). Signed-off-by: Andi Shyti Signed-off-by: Wolfram Sang commit 154756319cc6f8b8b86241da02da6a8fcc6abd1f Author: Arun Gopal Kondaveeti Date: Sat Jun 24 03:11:40 2023 +0530 ASoC: amd: update pm_runtime enable sequence pm_runtime_allow() is not needed for ACP child platform devices. Replace pm_runtime_allow() with pm_runtime_mark_last_busy() & pm_runtime_set_active() in pm_runtime enable sequence for ACP child platform drivers. Signed-off-by: Arun Gopal Link: https://lore.kernel.org/r/Message-Id: <20230623214150.4058721-1-arungopal.kondaveeti@amd.com> Signed-off-by: Mark Brown commit 83c624d8842d7f6c0780bc7658cb8fa67c0501f1 Author: Fabrizio Castro Date: Thu Jun 22 12:33:39 2023 +0100 spi: Add support for Renesas CSI The RZ/V2M SoC comes with the Clocked Serial Interface (CSI) IP, which is a master/slave SPI controller. This commit adds a driver to support CSI master mode. Signed-off-by: Fabrizio Castro Link: https://lore.kernel.org/r/Message-Id: <20230622113341.657842-4-fabrizio.castro.jz@renesas.com> Signed-off-by: Mark Brown commit 14dde0746e67588524d8dd464ac5e4afd3478bb3 Author: Fabrizio Castro Date: Thu Jun 22 12:33:37 2023 +0100 spi: dt-bindings: Add bindings for RZ/V2M CSI Add dt-bindings for the CSI IP found inside the RZ/V2M SoC. Signed-off-by: Fabrizio Castro Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/Message-Id: <20230622113341.657842-2-fabrizio.castro.jz@renesas.com> Signed-off-by: Mark Brown commit 75ff8a340a81252b71611ca3a60c03cf86310955 Author: Andi Shyti Date: Mon Jun 12 00:57:00 2023 +0200 i2c: sun6i-p2wi: Use devm_clk_get_enabled() Replace the pair of functions, devm_clk_get() and clk_prepare_enable(), with a single function devm_clk_get_enabled(). Signed-off-by: Andi Shyti Reviewed-by: Jernej Skrabec Signed-off-by: Wolfram Sang commit 877e91191ccf0782ae18c5dfa7522fb1e5bfba8c Author: Nathan Chancellor Date: Thu Jun 22 16:12:41 2023 +0000 leds: leds-mt6323: Adjust return/parameter types in wled get/set callbacks Clang's kernel Control Flow Integrity (kCFI) is a compiler-based security mitigation that ensures the target of an indirect function call matches the expected type of the call and trapping if they do not match exactly. The warning -Wincompatible-function-pointer-types-strict aims to catch these issues at compile time, which reveals: drivers/leds/leds-mt6323.c:598:49: error: incompatible function pointer types assigning to 'int (*)(struct led_classdev *, enum led_brightness)' from 'int (struct led_classdev *, unsigned int)' [-Werror,-Wincompatible-function-pointer-types-strict] 598 | leds->led[reg]->cdev.brightness_set_blocking = | ^ 599 | mt6323_wled_set_brightness; | ~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/leds/leds-mt6323.c:600:40: error: incompatible function pointer types assigning to 'enum led_brightness (*)(struct led_classdev *)' from 'unsigned int (struct led_classdev *)' [-Werror,-Wincompatible-function-pointer-types-strict] 600 | leds->led[reg]->cdev.brightness_get = | ^ 601 | mt6323_get_wled_brightness; | ~~~~~~~~~~~~~~~~~~~~~~~~~~ 2 errors generated. While 'unsigned int' is ABI compatible with 'enum led_brightness' (hence no warning from -Wincompatible-function-pointer-types) and the callers of these callbacks use/pass the values as 'unsigned int', the mismatch between the prototype and the called function will trip kCFI at runtime. Change the types in the implementations to match the prototypes, clearing up the warning and avoiding kCFI failures. Fixes: 9bb0a9e0626c ("leds: leds-mt6323: Add support for WLEDs and MT6332") Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230622-mt6323-wled-wincompatible-function-pointer-types-strict-v1-1-6ad256f220e8@kernel.org Signed-off-by: Lee Jones commit 9aaccc6565fcbfe1fc062878009f5e8efa979d11 Author: Andi Shyti Date: Mon Jun 12 00:56:57 2023 +0200 i2c: pasemi-platform: Use devm_clk_get_enabled() Replace the pair of functions, devm_clk_get() and clk_prepare_enable(), with a single function devm_clk_get_enabled(). Signed-off-by: Andi Shyti Reviewed-by: Alyssa Rosenzweig Signed-off-by: Wolfram Sang commit 2158566b4413c8d6fd9b498b4f3daa27d73e22db Author: Andi Shyti Date: Mon Jun 12 00:56:55 2023 +0200 i2c: mt7621: Use devm_clk_get_enabled() Replace the pair of functions, devm_clk_get() and clk_prepare_enable(), with a single function devm_clk_get_enabled(). Signed-off-by: Andi Shyti Reviewed-by: Matthias Brugger Reviewed-by: Stefan Roese Signed-off-by: Wolfram Sang commit 6656ba754d0630ae0af770f71b4fb012ff9a075a Merge: ebe14dad2d033 1471d85ffba7d Author: Paolo Abeni Date: Fri Jun 23 11:55:56 2023 +0200 Merge branch 's390-net-updates-2023-06-10' Alexandra Winter says: ==================== s390/net: updates 2023-06-10 Please apply the following patch series for s390's ctcm and lcs drivers to netdev's net-next tree. Just maintenance patches, no functional changes. ==================== Link: https://lore.kernel.org/r/20230621134921.904217-1-wintera@linux.ibm.com Signed-off-by: Paolo Abeni commit 1471d85ffba7d17456670afa1b75e50234caa2c6 Author: Thorsten Winkler Date: Wed Jun 21 15:49:21 2023 +0200 s390/ctcm: Convert sprintf/snprintf to scnprintf This LWN article explains the why scnprintf is preferred over snprintf in general https://lwn.net/Articles/69419/ Ie. snprintf() returns what *would* be the resulting length, while scnprintf() returns the actual length. Note that ctcm_print_statistics() writes the data into the kernel log and is therefore not suitable for sysfs_emit(). Observable behavior is not changed, as there may be dependencies. Reviewed-by: Alexandra Winter Signed-off-by: Thorsten Winkler Signed-off-by: Alexandra Winter Signed-off-by: Paolo Abeni commit d585e4b7480615031f798ef25e4012bfe53ff135 Author: Thorsten Winkler Date: Wed Jun 21 15:49:20 2023 +0200 s390/ctcm: Convert sysfs sprintf to sysfs_emit Following the advice of the Documentation/filesystems/sysfs.rst. All sysfs related show()-functions should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Reviewed-by: Alexandra Winter Reviewed-by: Simon Horman Signed-off-by: Thorsten Winkler Signed-off-by: Alexandra Winter Signed-off-by: Paolo Abeni commit 1a079f3e95295c3534c89f008e5e961a386e25e9 Author: Thorsten Winkler Date: Wed Jun 21 15:49:19 2023 +0200 s390/lcs: Convert sprintf to scnprintf This LWN article explains the why scnprintf is preferred over snprintf in general https://lwn.net/Articles/69419/ Ie. snprintf() returns what *would* be the resulting length, while scnprintf() returns the actual length. Reported-by: Jules Irenge Reviewed-by: Alexandra Winter Signed-off-by: Thorsten Winkler Signed-off-by: Alexandra Winter Signed-off-by: Paolo Abeni commit d3f0c7fa09932d34bbf5548a156316927a099f25 Author: Thorsten Winkler Date: Wed Jun 21 15:49:18 2023 +0200 s390/lcs: Convert sysfs sprintf to sysfs_emit Following the advice of the Documentation/filesystems/sysfs.rst. All sysfs related show()-functions should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. While at it, follow Linux kernel coding style and unify indentation Reported-by: Jules Irenge Reported-by: Joe Perches Reviewed-by: Alexandra Winter Reviewed-by: Simon Horman Signed-off-by: Thorsten Winkler Signed-off-by: Alexandra Winter Signed-off-by: Paolo Abeni commit 8390dc7477e49e4acc9e553f385f4ff59d186efe Author: Andi Shyti Date: Mon Jun 12 00:56:49 2023 +0200 i2c: xiic: Use devm_clk_get_enabled() Replace the pair of functions, devm_clk_get() and clk_prepare_enable(), with a single function devm_clk_get_enabled(). Signed-off-by: Andi Shyti Acked-by: Michal Simek Signed-off-by: Wolfram Sang commit ebe14dad2d033ec91c2c4b13e7fe7f1e54a65489 Merge: e6988447c15d6 ed1c6f35b73ec Author: Paolo Abeni Date: Fri Jun 23 10:59:21 2023 +0200 Merge branch 'net-hns3-there-are-some-cleanup-for-the-hns3-ethernet-driver' Hao Lan says: ==================== net: hns3: There are some cleanup for the HNS3 ethernet driver There are some cleanup for the HNS3 ethernet driver. ==================== Link: https://lore.kernel.org/r/20230621123309.34381-1-lanhao@huawei.com Signed-off-by: Paolo Abeni commit ed1c6f35b73ec9249c07ebbd300423155c7baac3 Author: Peiyang Wang Date: Wed Jun 21 20:33:09 2023 +0800 net: hns3: clear hns unused parameter alarm Several functions in the hns3 driver have unused parameters. The compiler will warn about them when building with -Wunused-parameter option of hns3. Signed-off-by: Peiyang Wang Signed-off-by: Hao Lan Signed-off-by: Paolo Abeni commit 1cf3d5567f273a8746d1bade00633a93204f80f0 Author: Hao Chen Date: Wed Jun 21 20:33:08 2023 +0800 net: hns3: fix strncpy() not using dest-buf length as length issue Now, strncpy() in hns3_dbg_fill_content() use src-length as copy-length, it may result in dest-buf overflow. This patch is to fix intel compile warning for csky-linux-gcc (GCC) 12.1.0 compiler. The warning reports as below: hclge_debugfs.c:92:25: warning: 'strncpy' specified bound depends on the length of the source argument [-Wstringop-truncation] strncpy(pos, items[i].name, strlen(items[i].name)); hclge_debugfs.c:90:25: warning: 'strncpy' output truncated before terminating nul copying as many bytes from a string as its length [-Wstringop-truncation] strncpy(pos, result[i], strlen(result[i])); strncpy() use src-length as copy-length, it may result in dest-buf overflow. So,this patch add some values check to avoid this issue. Signed-off-by: Hao Chen Reported-by: kernel test robot Closes: https://lore.kernel.org/lkml/202207170606.7WtHs9yS-lkp@intel.com/T/ Signed-off-by: Hao Lan Signed-off-by: Paolo Abeni commit 9b476494da1aad70f4f083e853eb817bcb292d08 Author: Jian Shen Date: Wed Jun 21 20:33:07 2023 +0800 net: hns3: refine the tcam key convert handle The result of expression '(k ^ ~v) & k' is exactly the same with 'k & v', so simplify it. (k ^ ~v) & k == k & v The truth table (in non table form): k == 0, v == 0: (k ^ ~v) & k == (0 ^ ~0) & 0 == (0 ^ 1) & 0 == 1 & 0 == 0 k & v == 0 & 0 == 0 k == 0, v == 1: (k ^ ~v) & k == (0 ^ ~1) & 0 == (0 ^ 0) & 0 == 1 & 0 == 0 k & v == 0 & 1 == 0 k == 1, v == 0: (k ^ ~v) & k == (1 ^ ~0) & 1 == (1 ^ 1) & 1 == 0 & 1 == 0 k & v == 1 & 0 == 0 k == 1, v == 1: (k ^ ~v) & k == (1 ^ ~1) & 1 == (1 ^ 0) & 1 == 1 & 1 == 1 k & v == 1 & 1 == 1 Signed-off-by: Jian Shen Signed-off-by: Hao Lan Signed-off-by: Paolo Abeni commit 53431798f4bb60d214ae1ec4a79eefdd414f577b Author: Masami Hiramatsu (Google) Date: Mon Jun 12 20:58:57 2023 +0900 tracing/probes: Fix tracepoint event with $arg* to fetch correct argument To hide the first dummy 'data' argument on the tracepoint probe events, the BTF argument array was modified (skip the first argument for tracepoint), but the '$arg*' meta argument parser missed that. Fix to increment the argument index if it is tracepoint probe. And decrement the index when searching the type of the argument. Link: https://lore.kernel.org/all/168657113778.3038017.12245893750241701312.stgit@mhiramat.roam.corp.google.com/ Reviewed-by: Steven Rostedt (Google) Signed-off-by: Masami Hiramatsu (Google) commit a2bd0c08a459b4cb8da57cc9c754de5e45d7a61e Author: Masami Hiramatsu (Google) Date: Sun Jun 4 11:29:11 2023 +0900 Documentation: Fix typo of reference file name Fix a typo of Documentation/trace/fprobe.rst. Link: https://lore.kernel.org/all/168584575125.2056209.5771945721143181243.stgit@mhiramat.roam.corp.google.com/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306040144.aD72UzkF-lkp@intel.com/ Reviewed-by: Steven Rostedt (Google) Signed-off-by: Masami Hiramatsu (Google) commit ed5f297802fca41d88fbfa6f9c13b218e7c6f5cb Author: Masami Hiramatsu (Google) Date: Sun Jun 4 11:29:00 2023 +0900 tracing/probes: Fix to return NULL and keep using current argc Fix to return NULL and keep using current argc when there is $argN and the BTF is not available. Link: https://lore.kernel.org/all/168584574094.2056209.2694238431743782342.stgit@mhiramat.roam.corp.google.com/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306030940.Cej2JoUx-lkp@intel.com/ Reviewed-by: Steven Rostedt (Google) Signed-off-by: Masami Hiramatsu (Google) commit 5985329c7073924afc19132456d212e1e8b57b1f Author: Akanksha J N Date: Tue Jun 6 21:39:57 2023 +0900 selftests/ftrace: Add new test case which checks for optimized probes Add new test case kprobe_opt_types.tc which enables and checks if each probe has been optimized in order to test potential issues with optimized probes. The '|| continue' is added with the echo statement to ignore errors that are caused by trying to add kprobes to non probeable lines and continue with the test. Link: Link: https://lore.kernel.org/linux-trace-kernel/20230428163842.95118-3-akanksha@linux.ibm.com Signed-off-by: Akanksha J N Acked-by: Masami Hiramatsu (Google) Acked-by: Shuah Khan Acked-by: Steven Rostedt (Google) Signed-off-by: Masami Hiramatsu (Google) commit 3b7a628decfb3b385ca5169d7c415752bf40e536 Author: Ivan Orlov Date: Tue Jun 20 16:41:38 2023 +0200 comedi: make all 'class' structures const Now that the driver core allows for struct class to be in read-only memory, making all 'class' structures to be declared at build time placing them into read-only memory, instead of having to be dynamically allocated at load time. Cc: Ian Abbott Cc: H Hartley Sweeten Cc: Benjamin Tissoires Cc: Ivan Orlov Cc: Xuezhi Zhang Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230620144137.581406-2-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 9ee202e69e29470e3a0a2406493538378d4e9a85 Author: Ivan Orlov Date: Tue Jun 20 16:38:00 2023 +0200 char: xillybus: make xillybus_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the xillybus_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at load time. Cc: Eli Billauer Cc: Arnd Bergmann Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Acked-by: Eli Billauer Link: https://lore.kernel.org/r/20230620143751.578239-18-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 936cb492a13e767c63b75ab84fd321682a18f9a5 Author: Ivan Orlov Date: Tue Jun 20 16:37:59 2023 +0200 xilinx_hwicap: make icap_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the icap_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at load time. Cc: Arnd Bergmann Cc: Michal Simek Cc: Benjamin Tissoires Cc: Ivan Orlov Cc: linux-arm-kernel@lists.infradead.org Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230620143751.578239-17-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 11680fdf29cec560987fc8f6d290a5bfdb73e4e4 Author: Ivan Orlov Date: Tue Jun 20 16:37:58 2023 +0200 virtio_console: make port class a static const structure Now that the driver core allows for struct class to be in read-only memory, remove the class field of the ports_driver_data structure and create the port_class static class structure declared at build time which places it into read-only memory, instead of having it to be dynamically allocated at load time. Cc: Amit Shah Cc: Arnd Bergmann Cc: virtualization@lists.linux-foundation.org Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230620143751.578239-16-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 98ab58a7a0b08be3f5ebdcb44fdf49127f749970 Author: Ivan Orlov Date: Tue Jun 20 16:37:57 2023 +0200 ppdev: make ppdev_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the ppdev_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at load time. Cc: Sudip Mukherjee Cc: Arnd Bergmann Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230620143751.578239-15-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit eafd52e6971ab63dd9294df1e363951148f292cf Author: Ivan Orlov Date: Tue Jun 20 16:37:56 2023 +0200 char: misc: make misc_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the misc_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at load time. Cc: Arnd Bergmann Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230620143751.578239-14-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 7671284b6c77df93b7dad8be40fe354dd4243a5d Author: Ivan Orlov Date: Tue Jun 20 16:37:55 2023 +0200 /dev/mem: make mem_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the mem_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at load time. Cc: Arnd Bergmann Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230620143751.578239-13-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 03bcd4d8e9e6da7521b1bdff4116bfed9050cfa9 Author: Ivan Orlov Date: Tue Jun 20 16:37:54 2023 +0200 char: lp: make lp_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the lp_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at load time. Cc: Arnd Bergmann Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230620143751.578239-12-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit bd31ef88361a1ca8435bf81551b2bba2d1e07457 Author: Ivan Orlov Date: Tue Jun 20 16:37:53 2023 +0200 dsp56k: make dsp56k_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the dsp56k_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at boot time. Cc: Arnd Bergmann Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230620143751.578239-11-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit e55ce9fd3d8fbf4e94fd5d0c72eb5b7d01fc4574 Author: Ivan Orlov Date: Tue Jun 20 16:37:52 2023 +0200 bsr: make bsr_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the bsr_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at boot time. Cc: Arnd Bergmann Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230620143751.578239-10-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 02fa4bcf4d15d7c93e6bb09d000d291dc2eb410e Author: Ivan Orlov Date: Tue Jun 20 20:34:47 2023 +0200 oradax: make 'cl' a static const structure Now that the driver core allows for struct class to be in read-only memory, move the 'cl' structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at load time. Cc: "David S. Miller" Cc: Andrew Morton Cc: Jonathan Corbet Cc: Benjamin Tissoires Cc: "Mike Rapoport (IBM)" Cc: Suren Baghdasaryan Cc: Ivan Orlov Cc: sparclinux@vger.kernel.org Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Acked-by: Sam Ravnborg Link: https://lore.kernel.org/r/20230620183446.684061-2-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit dcb31e8df8cf6e80ccfaad9d9c1fa286d38a87e9 Author: Andrew Davis Date: Mon May 15 12:50:41 2023 -0500 i2c: davinci: Use platform table macro over module_alias Generates the same platform module alias. More standard usage. Signed-off-by: Andrew Davis Reviewed-by: Bartosz Golaszewski [wsa: rebased to i2c/for-mergewindow] Signed-off-by: Wolfram Sang commit 9e1a1ee93f6b08aad5ee645073f7c7b115f71e15 Author: Wang Zhang Date: Fri May 26 15:05:33 2023 +0800 i2c: ocores: use devm_ managed clks Smatch complains that: drivers/i2c/busses/i2c-ocores.c:704 ocores_i2c_probe() warn: missing unwind goto? If any wrong occurs in ocores_i2c_of_probe, the i2c->clk needs to be released. But the function returns directly without freeing the clock. Fix this by updating the code to use devm_clk_get_optional_enabled() instead. Use dev_err_probe() where appropriate as well since we are changing those statements. Fixes: f5f35a92e44a ("i2c: ocores: Add irq support for sparc") Signed-off-by: Wang Zhang Reviewed-by: Andi Shyti Reviewed-by: Andrew Lunn Signed-off-by: Wolfram Sang commit 4a22870cede374d80c5d2f9c5b79253a5a667832 Author: Tree Davies Date: Wed Jun 21 16:09:35 2023 -0700 staging: rtl8192e: Remove whitespace and blank lines This patch cleans up extraneous whitespace for the struct rt_hi_throughput definition. Signed-off-by: Tree Davies Message-ID: Signed-off-by: Greg Kroah-Hartman commit b335f258e8ddafec0e8ae2201ca78d29ed8f85eb Author: Martin Kaiser Date: Fri Jun 16 16:59:21 2023 +0100 hwrng: imx-rngc - switch to DEFINE_SIMPLE_DEV_PM_OPS SIMPLE_DEV_PM_OPS is deprecated, replace it with DEFINE_SIMPLE_DEV_PM_OPS and use pm_sleep_ptr for setting the driver's pm routines. We can now remove the __maybe_unused qualifier in the suspend and resume functions. Signed-off-by: Martin Kaiser Signed-off-by: Herbert Xu commit 501e197a02d4aef157f53ba3a0b9049c3e52fedc Author: Martin Kaiser Date: Fri Jun 16 09:58:13 2023 +0100 hwrng: st - keep clock enabled while hwrng is registered The st-rng driver uses devres to register itself with the hwrng core, the driver will be unregistered from hwrng when its device goes out of scope. This happens after the driver's remove function is called. However, st-rng's clock is disabled in the remove function. There's a short timeframe where st-rng is still registered with the hwrng core although its clock is disabled. I suppose the clock must be active to access the hardware and serve requests from the hwrng core. Switch to devm_clk_get_enabled and let devres disable the clock and unregister the hwrng. This avoids the race condition. Fixes: 3e75241be808 ("hwrng: drivers - Use device-managed registration API") Signed-off-by: Martin Kaiser Signed-off-by: Herbert Xu commit afa9d00ee0fda2387ad598d0b106e96a7ed360ae Author: Martin Kaiser Date: Fri Jun 16 09:58:12 2023 +0100 hwrng: st - support compile-testing Allow compile-testing the st-rng driver if we're not running on an ST chipset. Signed-off-by: Martin Kaiser Signed-off-by: Herbert Xu commit d744ae7477190967a3ddc289e2cd4ae59e8b1237 Author: Martin Kaiser Date: Thu Jun 15 15:49:59 2023 +0100 hwrng: imx-rngc - fix the timeout for init and self check Fix the timeout that is used for the initialisation and for the self test. wait_for_completion_timeout expects a timeout in jiffies, but RNGC_TIMEOUT is in milliseconds. Call msecs_to_jiffies to do the conversion. Cc: stable@vger.kernel.org Fixes: 1d5449445bd0 ("hwrng: mx-rngc - add a driver for Freescale RNGC") Signed-off-by: Martin Kaiser Signed-off-by: Herbert Xu commit 63ba4d67594ad05b2c899b5a3a8cc7581052dd13 Author: Herbert Xu Date: Thu Jun 15 18:28:55 2023 +0800 KEYS: asymmetric: Use new crypto interface without scatterlists Use the new akcipher and sig interfaces which no longer have scatterlists in them. Signed-off-by: Herbert Xu commit e5221fa6a355112ddcc29dc82a94f7c3a1aacc0b Author: Herbert Xu Date: Thu Jun 15 18:28:53 2023 +0800 KEYS: asymmetric: Move sm2 code into x509_public_key The sm2 certificate requires a modified digest. Move the code for the hashing from the signature verification path into the code where we generate the digest. Signed-off-by: Herbert Xu commit b6d0695bb3c24ebe8dbaaaf61de791d5821a00ac Author: Herbert Xu Date: Thu Jun 15 18:28:50 2023 +0800 KEYS: Add forward declaration in asymmetric-parser.h Add forward declaration for struct key_preparsed_payload so that this header file is self-contained. Signed-off-by: Herbert Xu commit 6cb8815f41a966b217c0d9826c592254d72dcc31 Author: Herbert Xu Date: Thu Jun 15 18:28:48 2023 +0800 crypto: sig - Add interface for sign/verify Split out the sign/verify functionality from the existing akcipher interface. Most algorithms in akcipher either support encryption and decryption, or signing and verify. Only one supports both. As a signature algorithm may not support encryption at all, these two should be spearated. For now sig is simply a wrapper around akcipher as all algorithms remain unchanged. This is a first step and allows users to start allocating sig instead of akcipher. Signed-off-by: Herbert Xu commit addde1f2c966833f210e9318b17050293086b8c6 Author: Herbert Xu Date: Thu Jun 15 18:28:46 2023 +0800 crypto: akcipher - Add sync interface without SG lists The only user of akcipher does not use SG lists. Therefore forcing users to use SG lists only results unnecessary overhead. Add a new interface that supports arbitrary kernel pointers. For the time being the copy will be performed unconditionally. But this will go away once the underlying interface is updated. Note also that only encryption and decryption is addressed by this patch as sign/verify will go into a new interface (sig). Signed-off-by: Herbert Xu commit 9979c6e55d2b54ed6e0ce69b6f7faa7889549402 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Wed Jun 14 18:46:43 2023 +0100 crypto: cipher - On clone do crypto_mod_get() The refcounter of underlying algorithm should be incremented, otherwise it'll be destroyed with the cloned cipher, wrecking the original cipher. Signed-off-by: Dmitry Safonov Signed-off-by: Herbert Xu commit fa3b3565f3ac5a468e3efebca00e10db5db3d6bb Author: Herbert Xu Date: Thu Jun 15 17:00:51 2023 +0800 crypto: api - Add __crypto_alloc_tfmgfp Use it straight away in crypto_clone_cipher(), as that is not meant to sleep. Fixes: 51d8d6d0f4be ("crypto: cipher - Add crypto_clone_cipher") Signed-off-by: Dmitry Safonov Signed-off-by: Herbert Xu commit fa919f9e8857bfe230891a8b7ea6d7f69396cdc5 Author: Dmitry Safonov <0x7f454c46@gmail.com> Date: Wed Jun 14 18:46:41 2023 +0100 crypto: api - Remove crypto_init_ops() Purge crypto_type::init() as well. The last user seems to be gone with commit d63007eb954e ("crypto: ablkcipher - remove deprecated and unused ablkcipher support"). Signed-off-by: Dmitry Safonov Reviewed-by: Eric Biggers Signed-off-by: Herbert Xu commit 6637e11e4ad22ff03183da0dbd36d65c98b81cf7 Author: Mahmoud Adam Date: Tue Jun 13 16:17:31 2023 +0000 crypto: rsa - allow only odd e and restrict value in FIPS mode check if rsa public exponent is odd and check its value is between 2^16 < e < 2^256. FIPS 186-5 DSS (page 35)[1] specify that: 1. The public exponent e shall be selected with the following constraints: (a) The public verification exponent e shall be selected prior to generating the primes, p and q, and the private signature exponent d. (b) The exponent e shall be an odd positive integer such that: 2^16 < e < 2^256. [1] https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-5.pdf Signed-off-by: Mahmoud Adam Reviewed-by: Stephan Mueller Signed-off-by: Herbert Xu commit ba51738fa78972fb446b49b6b9ddda4058a272e0 Author: Herbert Xu Date: Tue Jun 13 17:13:35 2023 +0800 crypto: geniv - Split geniv out of AEAD Kconfig option Give geniv its own Kconfig option so that its dependencies are distinct from that of the AEAD API code. This also allows it to be disabled if no IV generators (seqiv/echainiv) are enabled. Remove the obsolete select on RNG2 by SKCIPHER2 as skcipher IV generators disappeared long ago. Signed-off-by: Herbert Xu commit fb28fabfad332a731423ffdd2be122b73ea90f1e Author: Herbert Xu Date: Tue Jun 13 16:49:24 2023 +0800 crypto: algboss - Add missing dependency on RNG2 The testmgr code uses crypto_rng without depending on it. Add an explicit dependency to Kconfig. Also sort the MANAGER2 dependencies alphabetically. Signed-off-by: Herbert Xu commit 445a4aaf5842073e4130b1d6dbe3785284d9615f Author: Jia Jie Ho Date: Mon Jun 12 16:52:30 2023 +0800 crypto: starfive - Add RSA algo support Adding RSA enc/dec and sign/verify feature for StarFive cryptographic module. The module only supports mod sizes up to 2048, therefore calculations more than that will use fallback algo. Co-developed-by: Huan Feng Signed-off-by: Huan Feng Signed-off-by: Jia Jie Ho Signed-off-by: Herbert Xu commit df12284ad3dc1db11bdc784265a4947d3db29c06 Author: Jia Jie Ho Date: Mon Jun 12 16:52:29 2023 +0800 crypto: starfive - Update hash module irq handling Hash driver needs to check the value of irq mask register before writing as it will mask irq of other modules. Co-developed-by: Huan Feng Signed-off-by: Huan Feng Signed-off-by: Jia Jie Ho Signed-off-by: Herbert Xu commit 1abc89661ad3cd18d8c6af5c2584bcc63df43bf2 Author: Meenakshi Aggarwal Date: Mon Jun 12 10:30:42 2023 +0200 crypto: caam - optimize RNG sample size TRNG "sample size" (the total number of entropy samples that will be taken during entropy generation) default / POR value is very conservatively set to 2500. Let's set it to 512, the same as the caam driver in U-boot (drivers/crypto/fsl_caam.c) does. This solves the issue of RNG performance dropping after a suspend/resume cycle on parts where caam loses power, since the initial U-boot setttings are lost and kernel does not restore them when resuming. Note: when changing the sample size, the self-test parameters need to be updated accordingly. Signed-off-by: Horia Geantă Signed-off-by: Meenakshi Aggarwal Reviewed-by: Gaurav Jain Signed-off-by: Herbert Xu commit 2be0d806e25e7b068113187f9245575914daf0dc Author: Victoria Milhoan (b42089) Date: Mon Jun 12 10:28:42 2023 +0200 crypto: caam - add a test for the RNG CAAM includes a Random Number Generator. This change adds a kernel configuration option to test the RNG's capabilities via the hw_random framework. Signed-off-by: Victoria Milhoan Signed-off-by: Dan Douglass Signed-off-by: Vipul Kumar Signed-off-by: Horia Geantă Signed-off-by: Meenakshi Aggarwal Reviewed-by: Gaurav Jain Signed-off-by: Herbert Xu commit ef492d080302913e85122a2d92efa2ca174930f8 Author: Victoria Milhoan Date: Mon Jun 12 10:26:15 2023 +0200 crypto: caam - adjust RNG timing to support more devices Adjust RNG timing parameters to support more i.MX6 devices. Signed-off-by: Victoria Milhoan Signed-off-by: Dan Douglass Signed-off-by: Vipul Kumar Signed-off-by: Horia Geantă Reviewed-by: Gaurav Jain Signed-off-by: Herbert Xu commit 4a1b5ba16e27cdfa71310393673d5799d8c02af1 Merge: 724418b84e624 33cd7630782df Author: Takashi Iwai Date: Fri Jun 23 09:56:19 2023 +0200 Merge branch 'topic/midi20' into for-next Pull one more API update for UMP core. Signed-off-by: Takashi Iwai commit 33cd7630782df2230529c3e8f1a6d0ae9cd6ab49 Author: Takashi Iwai Date: Fri Jun 23 09:55:30 2023 +0200 ALSA: ump: Export MIDI1 / UMP conversion helpers Yet more preliminary work for the upcoming USB gadget support. Now export the helpers to convert between legacy MIDI1 and UMP data for handling the MIDI 1.0 USB interface. The header file is moved to include/sound. The API functions are slightly changed, so that they can be used without the direct access to snd_ump object. The allocation is done in ump.c itself as it's a simple kcalloc(). Link: https://lore.kernel.org/r/20230623075530.10976-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 18af4b5c97915a6daef9de28a30ae1d3786bc2ac Author: Wesley Cheng Date: Wed May 31 15:27:19 2023 -0700 usb: host: xhci-plat: Set XHCI_STATE_REMOVING before resuming XHCI HC There are situations during the xhci_resume() sequence, which allows for re-initializing of the XHCI HC. However, in case the HCD is being removed, these operations may not be needed. Set the removal state before issuing the runtime PM get on the XHCI device, so that the XHCI resume routine will know when to bypass the re-init logic. Signed-off-by: Wesley Cheng Message-ID: <20230531222719.14143-3-quic_wcheng@quicinc.com> Signed-off-by: Greg Kroah-Hartman commit fb2ce17874cf3c3c183e5fd75144ffbe2313bf31 Author: Wesley Cheng Date: Wed May 31 15:27:18 2023 -0700 usb: host: xhci: Do not re-initialize the XHCI HC if being removed During XHCI resume, if there was a host controller error detected the routine will attempt to re-initialize the XHCI HC, so that it can return back to an operational state. If the XHCI host controller is being removed, this sequence would be already handled within the XHCI halt path, leading to a duplicate set of reg ops/calls. In addition, since the XHCI bus is being removed, the overhead added in restarting the HCD is unnecessary. Check for the XHC state before setting the reinit_xhc parameter, which is responsible for triggering the restart. Signed-off-by: Wesley Cheng Message-ID: <20230531222719.14143-2-quic_wcheng@quicinc.com> Signed-off-by: Greg Kroah-Hartman commit 256a02e2caa3c606b84a40e8035e240beb93e67b Author: Neil Armstrong Date: Thu Jun 22 18:16:26 2023 +0200 usb: typec: nb7vpq904m: fix CONFIG_DRM dependency With the following config set: CONFIG_DRM=m CONFIG_DRM_PANEL=y CONFIG_DRM_BRIDGE=y CONFIG_DRM_PANEL_BRIDGE=y CONFIG_TYPEC_MUX_NB7VPQ904M=y vmlinux fails on the following symbols: ld.lld: error: undefined symbol: devm_drm_bridge_add ld.lld: error: undefined symbol: devm_drm_of_get_bridge Add dependendy on DRM || DRM=no since CONFIG_DRM dependency is optional and guarded by: IS_ENABLED(CONFIG_OF) && IS_ENABLED(CONFIG_DRM_PANEL_BRIDGE) in the drive. Also add "select DRM_PANEL_BRIDGE if DRM" to clarify DRM_PANEL_BRIDGE is required if CONFIG_DRM is enabled. Fixes: 88d8f3ac9c67 ("usb: typec: add support for the nb7vpq904m Type-C Linear Redriver") Reported-by: Arnd Bergmann Suggested-by: Arnd Bergmann Signed-off-by: Neil Armstrong Message-ID: <20230622-topic-sm8x50-upstream-redriver-config-fix-v1-1-005ab6f4d1f5@linaro.org> Signed-off-by: Greg Kroah-Hartman commit 61d52f64ac58f917e47175cbc5bb54ee9a672209 Author: Azeem Shaikh Date: Thu Jun 15 18:05:04 2023 +0000 usbip: usbip_host: Replace strlcpy with strscpy strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). Direct replacement is safe here since return value of -errno is used to check for truncation instead of sizeof(dest). [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh Reviewed-by: Kees Cook Acked-by: Shuah Khan Message-ID: <20230615180504.401169-1-azeemshaikh38@gmail.com> Signed-off-by: Greg Kroah-Hartman commit c0aabed9cabe057309779a9e26fe86a113d24dad Author: Krishna Kurapati Date: Sun Jun 18 17:39:49 2023 +0530 usb: dwc3: gadget: Propagate core init errors to UDC during pullup In scenarios where pullup relies on resume (get sync) to initialize the controller and set the run stop bit, then core_init is followed by gadget_resume which will eventually set run stop bit. But in cases where the core_init fails, the return value is not sent back to udc appropriately. So according to UDC the controller has started but in reality we never set the run stop bit. On systems like Android, there are uevents sent to HAL depending on whether the configfs_bind / configfs_disconnect were invoked. In the above mentioned scnenario, if the core init fails, the run stop won't be set and the cable plug-out won't result in generation of any disconnect event and userspace would never get any uevent regarding cable plug out and we never call pullup(0) again. Furthermore none of the next Plug-In/Plug-Out's would be known to configfs. Return back the appropriate result to UDC to let the userspace/ configfs know that the pullup failed so they can take appropriate action. Fixes: 77adb8bdf422 ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded") Cc: stable Signed-off-by: Krishna Kurapati Acked-by: Thinh Nguyen Message-ID: <20230618120949.14868-1-quic_kriskura@quicinc.com> Signed-off-by: Greg Kroah-Hartman commit 0e5342f634b26eed0a0fb21daa53a45449396c3f Merge: e6ecc0414c871 ffa5f7a3bf28c Author: Greg Kroah-Hartman Date: Fri Jun 23 09:43:31 2023 +0200 Merge tag 'usb-serial-6.5-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB-serial updates for 6.5-rc1 Here are the USB-serial updates for 6.5-rc1, including: - improved error handling for break signalling - report to user space when a device does not support break signalling Included are also some new modem device ids. All have been in linux-next with no reported issues. * tag 'usb-serial-6.5-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add LARA-R6 01B PIDs USB: serial: report unsupported break signalling USB: serial: cp210x: disable break signalling on CP2105 SCI USB: serial: return errors from break handling commit 8b5bf64c89c7100c921bd807ba39b2eb003061ab Author: Feng Mingxi Date: Tue Apr 25 06:56:11 2023 +0000 clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe Smatch reports: drivers/clocksource/timer-cadence-ttc.c:529 ttc_timer_probe() warn: 'timer_baseaddr' from of_iomap() not released on lines: 498,508,516. timer_baseaddr may have the problem of not being released after use, I replaced it with the devm_of_iomap() function and added the clk_put() function to cleanup the "clk_ce" and "clk_cs". Fixes: e932900a3279 ("arm: zynq: Use standard timer binding") Fixes: 70504f311d4b ("clocksource/drivers/cadence_ttc: Convert init function to return error") Signed-off-by: Feng Mingxi Reviewed-by: Dongliang Mu Acked-by: Michal Simek Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230425065611.702917-1-m202271825@hust.edu.cn commit 6d0d4df8e7e1fe22d961d667c2bfa40c3d5022e8 Author: Sergio Paracuellos Date: Tue Jun 20 12:02:31 2023 +0200 dt-bindings: timers: Add Ralink SoCs timer Add YAML documentation for the timer which is present on Ralink SoCs. Signed-off-by: Sergio Paracuellos Reviewed-by: Rob Herring Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230620100231.1412582-1-sergio.paracuellos@gmail.com commit e5313f1c540434b18ea57927633b1584c534b14a Author: Michael Kelley Date: Mon Jun 19 12:02:40 2023 -0700 clocksource/drivers/hyper-v: Rework clocksource and sched clock setup Current code assigns either the Hyper-V TSC page or MSR-based ref counter as the sched clock. This may be sub-optimal in two cases. First, if there is hardware support to ensure consistent TSC frequency across live migrations and Hyper-V is using that support, the raw TSC is a faster source of time than the Hyper-V TSC page. Second, the MSR-based ref counter is relatively slow because reads require a trap to the hypervisor. As such, it should never be used as the sched clock. The native sched clock based on the raw TSC or jiffies is much better. Rework the sched clock setup so it is set to the TSC page only if Hyper-V indicates that the TSC may have inconsistent frequency across live migrations. Also, remove the code that sets the sched clock to the MSR-based ref counter. In the cases where it is not set, the sched clock will then be the native sched clock. As part of the rework, always enable both the TSC page clocksource and the MSR-based ref counter clocksource. Set the ratings so the TSC page clocksource is preferred. While the MSR-based ref counter clocksource is unlikely to ever be the default, having it available for manual selection is convenient for development purposes. Signed-off-by: Michael Kelley Reviewed-by: Dexuan Cui Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/1687201360-16003-1-git-send-email-mikelley@microsoft.com commit 038d454ad996a5e275d46188d65d890d2a243f36 Author: Stanislav Jakubek Date: Sun Jun 18 16:46:35 2023 +0200 dt-bindings: timer: brcm,kona-timer: convert to YAML Convert Broadcom Kona family timer bindings to DT schema. Changes during conversion: - drop deprecated compatible (it's been deprecated for ~10 years) Signed-off-by: Stanislav Jakubek Reviewed-by: Krzysztof Kozlowski Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230618144635.GA22166@standask-GA-A55M-S2HP commit 281bf6b94aec092096d788b56c106a8c9c2a432a Author: Uwe Kleine-König Date: Tue Mar 28 12:05:31 2023 +0200 clocksource/drivers/imx-gpt: Fold into its only user Only the imx-gpt timer driver makes use of enum imx_gpt_type that is otherwise unused. Move its definition into the timer-imx-gpt driver. Signed-off-by: Uwe Kleine-König Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230328100531.879485-3-u.kleine-koenig@pengutronix.de commit 011da162da2f915989a571b557867f7eea699000 Author: Uwe Kleine-König Date: Tue Mar 28 12:05:30 2023 +0200 clk: imx: Drop inclusion of unused header The clk drivers use none of the symbols defined in . Signed-off-by: Uwe Kleine-König Signed-off-by: Daniel Lezcano Link: https://lore.kernel.org/r/20230328100531.879485-2-u.kleine-koenig@pengutronix.de commit 46e66dab8565f742374e9cc4ff7d35f344d774e2 Author: Tarun Sahu Date: Wed Jun 21 21:20:25 2023 +0530 dax/kmem: Pass valid argument to memory_group_register_static memory_group_register_static takes maximum number of pages as the argument while dev_dax_kmem_probe passes total_len (in bytes) as the argument. IIUC, I don't see any crash/panic impact as such. As, memory_group_register_static just set the max_pages limit which is used in auto_movable_zone_for_pfn to determine the zone. which might cause these condition to behave differently, This will be true always so jump will happen to kernel_zone ... if (!auto_movable_can_online_movable(NUMA_NO_NODE, group, nr_pages)) goto kernel_zone; ... kernel_zone: return default_kernel_zone_for_pfn(nid, pfn, nr_pages); Here, In below, zone_intersects compare range will be larger as nr_pages will be higher (derived from total_len passed in dev_dax_kmem_probe). ... static struct zone *default_kernel_zone_for_pfn(int nid, unsigned long start_pfn, unsigned long nr_pages) { struct pglist_data *pgdat = NODE_DATA(nid); int zid; for (zid = 0; zid < ZONE_NORMAL; zid++) { struct zone *zone = &pgdat->node_zones[zid]; if (zone_intersects(zone, start_pfn, nr_pages)) return zone; } return &pgdat->node_zones[ZONE_NORMAL]; } Incorrect zone will be returned here, which in later time might cause bigger problem. Fixes: eedf634aac3b ("dax/kmem: use a single static memory group for a single probed unit") Signed-off-by: Tarun Sahu Link: https://lore.kernel.org/r/20230621155025.370672-1-tsahu@linux.ibm.com Reviewed-by: Vishal Verma Signed-off-by: Vishal Verma commit dd0c64258a9d9e74b4896f05c7e77fa3365b5f12 Author: Colin Ian King Date: Wed Jun 21 14:02:56 2023 +0100 fsdax: remove redundant variable 'error' The variable 'error' is being assigned a value that is never read, the assignment and the variable and redundant and can be removed. Cleans up clang scan build warning: fs/dax.c:1880:10: warning: Although the value stored to 'error' is used in the enclosing expression, the value is never actually read from 'error' [deadcode.DeadStores] Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20230621130256.2676126-1-colin.i.king@gmail.com Reviewed-by: Jan Kara Signed-off-by: Vishal Verma commit 2532f41607c4308733239dd43278f8a5540f3ec7 Author: Dan Williams Date: Fri Jun 2 23:14:11 2023 -0700 dax: Cleanup extra dax_region references Now that free_dev_dax_id() internally manages the references it needs the extra references taken by the dax_region drivers are not needed. Reported-by: Ira Weiny Signed-off-by: Dan Williams Link: https://lore.kernel.org/r/168577285161.1672036.8111253437794419696.stgit@dwillia2-xfh.jf.intel.com Reviewed-by: Dave Jiang Reviewed-by: Fan Ni Reviewed-by: Ira Weiny Signed-off-by: Vishal Verma commit 70aab281e18c68a1284bc387de127c2fc0bed3f8 Author: Dan Williams Date: Fri Jun 2 23:14:05 2023 -0700 dax: Introduce alloc_dev_dax_id() The reference counting of dax_region objects is needlessly complicated, has lead to confusion [1], and has hidden a bug [2]. Towards cleaning up that mess introduce alloc_dev_dax_id() to minimize the holding of a dax_region reference to only what dev_dax_release() needs, the dax_region->ida. Part of the reason for the mess was the design to dereference a dax_region in all cases in free_dev_dax_id() even if the id was statically assigned by the upper level dax_region driver. Remove the need to call "is_static(dax_region)" by tracking whether the id is dynamic directly in the dev_dax instance itself. With that flag the dax_region pinning and release per dev_dax instance can move to alloc_dev_dax_id() and free_dev_dax_id() respectively. A follow-on cleanup address the unnecessary references in the dax_region setup and drivers. Fixes: 0f3da14a4f05 ("device-dax: introduce 'seed' devices") Link: http://lore.kernel.org/r/20221203095858.612027-1-liuyongqiang13@huawei.com [1] Link: http://lore.kernel.org/r/3cf0890b-4eb0-e70e-cd9c-2ecc3d496263@hpe.com [2] Reported-by: Yongqiang Liu Reported-by: Paul Cassella Reported-by: Ira Weiny Signed-off-by: Dan Williams Link: https://lore.kernel.org/r/168577284563.1672036.13493034988900989554.stgit@dwillia2-xfh.jf.intel.com Reviewed-by: Ira Weiny Signed-off-by: Vishal Verma commit 82b4ceeccb89cfd0b03706f1b15e31a7db6a027d Author: Dan Williams Date: Fri Jun 2 23:13:59 2023 -0700 dax: Use device_unregister() in unregister_dax_mapping() Replace an open-coded device_unregister() sequence with the helper. Signed-off-by: Dan Williams Link: https://lore.kernel.org/r/168577283989.1672036.7777592498865470652.stgit@dwillia2-xfh.jf.intel.com Reviewed-by: Dave Jiang Reviewed-by: Fan Ni Reviewed-by: Ira Weiny Signed-off-by: Vishal Verma commit 6d24b170a9db0456f577b1ab01226a2254c016a8 Author: Dan Williams Date: Fri Jun 2 23:13:54 2023 -0700 dax: Fix dax_mapping_release() use after free A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region provider (like modprobe -r dax_hmem) yields: kobject: 'mapping0' (ffff93eb460e8800): kobject_release, parent 0000000000000000 (delayed 2000) [..] DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 23 PID: 282 at kernel/locking/lockdep.c:232 __lock_acquire+0x9fc/0x2260 [..] RIP: 0010:__lock_acquire+0x9fc/0x2260 [..] Call Trace: [..] lock_acquire+0xd4/0x2c0 ? ida_free+0x62/0x130 _raw_spin_lock_irqsave+0x47/0x70 ? ida_free+0x62/0x130 ida_free+0x62/0x130 dax_mapping_release+0x1f/0x30 device_release+0x36/0x90 kobject_delayed_cleanup+0x46/0x150 Due to attempting ida_free() on an ida object that has already been freed. Devices typically only hold a reference on their parent while registered. If a child needs a parent object to complete its release it needs to hold a reference that it drops from its release callback. Arrange for a dax_mapping to pin its parent dev_dax instance until dax_mapping_release(). Fixes: 0b07ce872a9e ("device-dax: introduce 'mapping' devices") Signed-off-by: Dan Williams Link: https://lore.kernel.org/r/168577283412.1672036.16111545266174261446.stgit@dwillia2-xfh.jf.intel.com Reviewed-by: Dave Jiang Reviewed-by: Fan Ni Reviewed-by: Ira Weiny Signed-off-by: Vishal Verma commit d06593aa00b2bb1cc1ac9d88157bb8db0ac17872 Author: Ian Rogers Date: Thu Jun 22 21:38:43 2023 -0700 perf pmu: Remove a hard coded cpu PMU assumption The property of "cpu" when it has no cpu map is true on S390 with the PMU cpum_cf. Rather than maintain a list of such PMUs, reuse the is_core test result from the caller. Signed-off-by: Ian Rogers Tested-by: Thomas Richter Cc: Ravi Bangoria Cc: James Clark Cc: Mark Rutland Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Alexander Shishkin Cc: Kan Liang Cc: Ingo Molnar Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Link: https://lore.kernel.org/r/20230623043843.4080180-2-irogers@google.com Signed-off-by: Namhyung Kim commit d685819b40affd39d2fbc937e93b2eee7fc63dd5 Author: Ian Rogers Date: Thu Jun 22 21:38:42 2023 -0700 perf pmus: Add notion of default PMU for JSON events JSON events created in pmu-events.c by jevents.py may not specify a PMU they are associated with, in which case it is implied that it is the first core PMU. Care is needed to select this for regular 'cpu', s390 'cpum_cf' and ARMs many names as at the point the name is first needed the core PMUs list hasn't been initialized. Add a helper in perf_pmus to create this value, in the worst case by scanning sysfs. v2. Add missing close if fdopendir fails. Signed-off-by: Ian Rogers Tested-by: Thomas Richter Cc: Ravi Bangoria Cc: James Clark Cc: Mark Rutland Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Thomas Richter Cc: Alexander Shishkin Cc: Kan Liang Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230623043843.4080180-1-irogers@google.com Signed-off-by: Namhyung Kim commit 33941dbd14da4eac40a26ac5fd5f84e1842ffc3a Author: Ian Rogers Date: Thu Jun 22 21:31:07 2023 -0700 perf unwind: Fix map reference counts The result of thread__find_map is the map in the passed in addr_location. Calling addr_location__exit puts that map and so copies need to do a map__get. Add in the corresponding map__puts. v2. Add missing map__put when dso is missing. Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Mark Rutland Cc: Ivan Babrou Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Alexander Shishkin Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230623043107.4077510-1-irogers@google.com Signed-off-by: Namhyung Kim commit e4ef3ef1bc0a3d2535427da78b8095ef657eb474 Author: Namhyung Kim Date: Thu Jun 22 16:53:57 2023 -0700 perf test: Set PERF_EXEC_PATH for script execution The task-analyzer.py script (actually every other scripts too) requires PERF_EXEC_PATH env to find dependent libraries and scripts. For scripts test to run correctly, it needs to set PERF_EXEC_PATH to the perf tool source directory. Instead of blindly update the env, let's check the directory structure to make sure it points to the correct location. Fixes: e8478b84d6ba ("perf test: add new task-analyzer tests") Cc: Petar Gligoric Cc: Hagen Paul Pfeifer Cc: Aditya Gupta Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Ingo Molnar Acked-by: Ian Rogers Signed-off-by: Namhyung Kim commit 2d7f5540b8696b855adf4121ce4a9bf77938848f Author: Namhyung Kim Date: Thu Jun 22 16:53:56 2023 -0700 perf script: Initialize buffer for regs_map() The buffer is used to save register mapping in a sample. Normally perf samples don't have any register so the string should be empty. But it missed to initialize the buffer when the size is 0. And it's passed to PyUnicode_FromString() with a garbage data. So it returns NULL due to invalid input (instead of an empty unicode string object) which causes a segfault like below: Thread 2.1 "perf" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7ffff7c83780 (LWP 193775)] 0x00007ffff6dbca2e in PyDict_SetItem () from /lib/x86_64-linux-gnu/libpython3.11.so.1.0 (gdb) bt #0 0x00007ffff6dbca2e in PyDict_SetItem () from /lib/x86_64-linux-gnu/libpython3.11.so.1.0 #1 0x00007ffff6dbf848 in PyDict_SetItemString () from /lib/x86_64-linux-gnu/libpython3.11.so.1.0 #2 0x000055555575824d in pydict_set_item_string_decref (val=0x0, key=0x5555557f96e3 "iregs", dict=0x7ffff5f7f780) at util/scripting-engines/trace-event-python.c:145 #3 set_regs_in_dict (evsel=0x555555efc370, sample=0x7fffffffb870, dict=0x7ffff5f7f780) at util/scripting-engines/trace-event-python.c:776 #4 get_perf_sample_dict (sample=sample@entry=0x7fffffffb870, evsel=evsel@entry=0x555555efc370, al=al@entry=0x7fffffffb2e0, addr_al=addr_al@entry=0x0, callchain=callchain@entry=0x7ffff63ef440) at util/scripting-engines/trace-event-python.c:923 #5 0x0000555555758ec1 in python_process_tracepoint (sample=0x7fffffffb870, evsel=0x555555efc370, al=0x7fffffffb2e0, addr_al=0x0) at util/scripting-engines/trace-event-python.c:1044 #6 0x00005555555c5db8 in process_sample_event (tool=, event=, sample=, evsel=0x555555efc370, machine=0x555555ef4d68) at builtin-script.c:2421 #7 0x00005555556b7793 in perf_session__deliver_event (session=0x555555ef4b60, event=0x7ffff62ff7d0, tool=0x7fffffffc150, file_offset=30672, file_path=0x555555efb8a0 "perf.data") at util/session.c:1639 #8 0x00005555556bc864 in do_flush (show_progress=true, oe=0x555555efb700) at util/ordered-events.c:245 #9 __ordered_events__flush (oe=oe@entry=0x555555efb700, how=how@entry=OE_FLUSH__FINAL, timestamp=timestamp@entry=0) at util/ordered-events.c:324 #10 0x00005555556bd06e in ordered_events__flush (oe=oe@entry=0x555555efb700, how=how@entry=OE_FLUSH__FINAL) at util/ordered-events.c:342 #11 0x00005555556b9d63 in __perf_session__process_events (session=0x555555ef4b60) at util/session.c:2465 #12 perf_session__process_events (session=0x555555ef4b60) at util/session.c:2627 #13 0x00005555555cb1d0 in __cmd_script (script=0x7fffffffc150) at builtin-script.c:2839 #14 cmd_script (argc=, argv=) at builtin-script.c:4365 #15 0x0000555555650811 in run_builtin (p=p@entry=0x555555ed8948 , argc=argc@entry=4, argv=argv@entry=0x7fffffffe240) at perf.c:323 #16 0x0000555555597eb3 in handle_internal_command (argv=0x7fffffffe240, argc=4) at perf.c:377 #17 run_argv (argv=, argcp=) at perf.c:421 #18 main (argc=4, argv=0x7fffffffe240) at perf.c:537 Fixes: 51cfe7a3e87e ("perf python: Avoid 2 leak sanitizer issues") Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Ingo Molnar Acked-by: Ian Rogers Signed-off-by: Namhyung Kim commit 33fe7c08446af6dda0ff08ff4fa9c921e574477f Author: James Clark Date: Thu Jun 22 11:18:09 2023 +0100 perf tests: Fix test_arm_callgraph_fp variable expansion $TEST_PROGRAM is a command with spaces so it's supposed to be word split. The referenced fix to fix the shellcheck warnings incorrectly quoted this string so unquote it to fix the test. At the same time silence the shellcheck warning for that line and fix two more shellcheck errors at the end of the script. Fixes: 1bb17b4c6c91 ("perf tests arm_callgraph_fp: Address shellcheck warnings about signal names and adding double quotes for expression") Signed-off-by: James Clark Acked-by: Namhyung Kim Cc: Mark Rutland Cc: Ian Rogers Cc: spoorts2@in.ibm.com Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Kajol Jain Cc: Alexander Shishkin Cc: Athira Rajeev Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230622101809.2431897-1-james.clark@arm.com Signed-off-by: Namhyung Kim commit e6988447c15d622d11c68250a33f47b3cacb66eb Merge: 08eeccb2491a3 31b5a547622b3 Author: Jakub Kicinski Date: Thu Jun 22 20:09:13 2023 -0700 Merge tag 'wireless-next-2023-06-22' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Notable changes this time around: MAINTAINERS - add missing driver git trees ath11k - factory test mode support iwlwifi - config rework to drop test devices and split the different families - major update for new firmware and MLO stack - initial multi-link reconfiguration suppor - multi-BSSID and MLO improvements other - fix the last few W=1 warnings from GCC 13 - merged wireless tree to avoid conflicts * tag 'wireless-next-2023-06-22' of git://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (245 commits) wifi: ieee80211: fix erroneous NSTR bitmap size checks wifi: rtlwifi: cleanup USB interface wifi: rtlwifi: simplify LED management wifi: ath10k: improve structure padding wifi: ath9k: convert msecs to jiffies where needed wifi: iwlwifi: mvm: Add support for IGTK in D3 resume flow wifi: iwlwifi: mvm: update two most recent GTKs on D3 resume flow wifi: iwlwifi: mvm: Refactor security key update after D3 wifi: mac80211: mark keys as uploaded when added by the driver wifi: iwlwifi: remove support of A0 version of FM RF wifi: iwlwifi: cfg: clean up Bz module firmware lines wifi: iwlwifi: pcie: add device id 51F1 for killer 1675 wifi: iwlwifi: bump FW API to 83 for AX/BZ/SC devices wifi: iwlwifi: cfg: remove trailing dash from FW_PRE constants wifi: iwlwifi: also unify Ma device configurations wifi: iwlwifi: also unify Sc device configurations wifi: iwlwifi: unify Bz/Gl device configurations wifi: iwlwifi: pcie: also drop jacket from info macro wifi: iwlwifi: remove support for *nJ devices wifi: iwlwifi: don't load old firmware for 22000 ... ==================== Link: https://lore.kernel.org/r/20230622185602.147650-2-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 08eeccb2491a3198f4adcba63adeace6e2499ea3 Merge: 0ec92a8f56ff0 790ef3901f18b Author: Jakub Kicinski Date: Thu Jun 22 20:05:25 2023 -0700 Merge tag 'linux-can-next-for-6.5-20230622' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2023-06-22 The first patch is by Carsten Schmidt, targets the kvaser_usb driver and adds len8_dlc support. Marcel Hellwig's patch for the xilinx_can driver adds support for CAN transceivers via the PHY framework. Frank Jungclaus contributes 6+2 patches for the esd_usb driver in preparation for the upcoming CAN-USB/3 support. The 2 patches by Miquel Raynal for the sja1000 driver work around overruns stalls on the Renesas SoCs. The next 3 patches are by me and fix the coding style in the rx-offload helper and in the m_can and ti_hecc driver. Vincent Mailhol contributes 3 patches to fix and update the calculation of the length of CAN frames on the wire. Oliver Hartkopp's patch moves the CAN_RAW_FILTER_MAX definition into the correct header. The remaining 14 patches are by Jimmy Assarsson, target the kvaser_pciefd driver and bring various updates and improvements. * tag 'linux-can-next-for-6.5-20230622' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: (33 commits) can: kvaser_pciefd: Use TX FIFO size read from CAN controller can: kvaser_pciefd: Refactor code can: kvaser_pciefd: Add len8_dlc support can: kvaser_pciefd: Use FIELD_{GET,PREP} and GENMASK where appropriate can: kvaser_pciefd: Sort register definitions can: kvaser_pciefd: Change return type for kvaser_pciefd_{receive,transmit,set_tx}_irq() can: kvaser_pciefd: Rename device ID defines can: kvaser_pciefd: Sort includes in alphabetic order can: kvaser_pciefd: Remove SPI flash parameter read functionality can: uapi: move CAN_RAW_FILTER_MAX definition to raw.h can: kvaser_pciefd: Define unsigned constants with type suffix 'U' can: kvaser_pciefd: Set hardware timestamp on transmitted packets can: kvaser_pciefd: Add function to set skb hwtstamps can: kvaser_pciefd: Remove handler for unused KVASER_PCIEFD_PACK_TYPE_EFRAME_ACK can: kvaser_pciefd: Remove useless write to interrupt register can: length: refactor frame lengths definition to add size in bits can: length: fix bitstuffing count can: length: fix description of the RRS field can: m_can: fix coding style can: ti_hecc: fix coding style ... ==================== Link: https://lore.kernel.org/r/20230622082658.571150-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 6f68fc395f49fb43f6ae801c340953ee4f793e98 Merge: fc0649395dca8 e38910c0072b5 Author: Jakub Kicinski Date: Thu Jun 22 20:02:11 2023 -0700 Merge tag 'linux-can-fixes-for-6.4-20230622' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2023-06-22 Oliver Hartkopp's patch fixes the return value in the error path of isotp_sendmsg() in the CAN ISOTP protocol. * tag 'linux-can-fixes-for-6.4-20230622' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: isotp: isotp_sendmsg(): fix return error fix on TX path ==================== Link: https://lore.kernel.org/r/20230622090122.574506-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 0ec92a8f56ff07237dbe8af7c7a72aba7f957baf Author: Piotr Gardocki Date: Wed Jun 21 15:21:06 2023 +0200 net: fix net device address assign type Commit ad72c4a06acc introduced optimization to return from function quickly if the MAC address is not changing at all. It was reported that such change causes dev->addr_assign_type to not change to NET_ADDR_SET from _PERM or _RANDOM. Restore the old behavior and skip only call to ndo_set_mac_address. Fixes: ad72c4a06acc ("net: add check for current MAC address in dev_set_mac_address") Reported-by: Gal Pressman Signed-off-by: Piotr Gardocki Reviewed-by: Simon Horman Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/20230621132106.991342-1-piotrx.gardocki@intel.com Signed-off-by: Jakub Kicinski commit 9a14f2e3dab106df7f27d1730cc540247317d4b9 Author: Edward Cree Date: Wed Jun 21 13:15:04 2023 +0100 sfc: keep alive neighbour entries while a TC encap action is using them When processing counter updates, if any action set using the newly incremented counter includes an encap action, prod the corresponding neighbouring entry to indicate to the neighbour cache that the entry is still in use and passing traffic. Signed-off-by: Edward Cree Link: https://lore.kernel.org/r/20230621121504.17004-1-edward.cree@amd.com Signed-off-by: Jakub Kicinski commit 2555f35a4f428a9bfdf09aa0459dbfdf59a24a9a Author: Christian Marangi Date: Wed Jun 21 11:54:09 2023 +0200 net: dsa: qca8k: add support for additional modes for netdev trigger The QCA8K switch supports additional modes that can be handled in hardware for the LED netdev trigger. Add these additional modes to further support the Switch LEDs and offload more blink modes. Add additional modes: - link_10 - link_100 - link_1000 - half_duplex - full_duplex Signed-off-by: Christian Marangi Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20230621095409.25859-1-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 2ffb8d02a9b60d9190a871cb8466cd0721bc0a49 Author: Christian Marangi Date: Wed Jun 21 11:26:53 2023 +0200 docs: ABI: sysfs-class-led-trigger-netdev: add new modes and entry Document newly introduced modes and entry for the LED netdev trigger. Add documentation for new modes: - link_10 - link_100 - link_1000 - half_duplex - full_duplex Add documentation for new entry: - hw_control Also add additional info for the interval entry and the tx/rx modes with the special case of hw_control ON. Signed-off-by: Christian Marangi Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230621092653.23172-1-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit 004d25060c78fc31f66da0fa439c544dda1ac9d5 Author: Ying Hsu Date: Tue Jun 20 10:47:32 2023 -0700 igb: Fix igb_down hung on surprise removal In a setup where a Thunderbolt hub connects to Ethernet and a display through USB Type-C, users may experience a hung task timeout when they remove the cable between the PC and the Thunderbolt hub. This is because the igb_down function is called multiple times when the Thunderbolt hub is unplugged. For example, the igb_io_error_detected triggers the first call, and the igb_remove triggers the second call. The second call to igb_down will block at napi_synchronize. Here's the call trace: __schedule+0x3b0/0xddb ? __mod_timer+0x164/0x5d3 schedule+0x44/0xa8 schedule_timeout+0xb2/0x2a4 ? run_local_timers+0x4e/0x4e msleep+0x31/0x38 igb_down+0x12c/0x22a [igb 6615058754948bfde0bf01429257eb59f13030d4] __igb_close+0x6f/0x9c [igb 6615058754948bfde0bf01429257eb59f13030d4] igb_close+0x23/0x2b [igb 6615058754948bfde0bf01429257eb59f13030d4] __dev_close_many+0x95/0xec dev_close_many+0x6e/0x103 unregister_netdevice_many+0x105/0x5b1 unregister_netdevice_queue+0xc2/0x10d unregister_netdev+0x1c/0x23 igb_remove+0xa7/0x11c [igb 6615058754948bfde0bf01429257eb59f13030d4] pci_device_remove+0x3f/0x9c device_release_driver_internal+0xfe/0x1b4 pci_stop_bus_device+0x5b/0x7f pci_stop_bus_device+0x30/0x7f pci_stop_bus_device+0x30/0x7f pci_stop_and_remove_bus_device+0x12/0x19 pciehp_unconfigure_device+0x76/0xe9 pciehp_disable_slot+0x6e/0x131 pciehp_handle_presence_or_link_change+0x7a/0x3f7 pciehp_ist+0xbe/0x194 irq_thread_fn+0x22/0x4d ? irq_thread+0x1fd/0x1fd irq_thread+0x17b/0x1fd ? irq_forced_thread_fn+0x5f/0x5f kthread+0x142/0x153 ? __irq_get_irqchip_state+0x46/0x46 ? kthread_associate_blkcg+0x71/0x71 ret_from_fork+0x1f/0x30 In this case, igb_io_error_detected detaches the network interface and requests a PCIE slot reset, however, the PCIE reset callback is not being invoked and thus the Ethernet connection breaks down. As the PCIE error in this case is a non-fatal one, requesting a slot reset can be avoided. This patch fixes the task hung issue and preserves Ethernet connection by ignoring non-fatal PCIE errors. Signed-off-by: Ying Hsu Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230620174732.4145155-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit b2fef875aa6f78dfa89a943282d6dbeaf0dd2095 Merge: 0c3d6fd4b89c1 5c844d57aa789 Author: Jakub Kicinski Date: Thu Jun 22 19:48:40 2023 -0700 Merge branch 'net-dsa-microchip-fix-writes-to-phy-registers-0x10' Rasmus Villemoes says: ==================== net: dsa: microchip: fix writes to phy registers >= 0x10 Patch 1 is just a simplification, technically unrelated to the other two patches. But it would be a bit inconsistent to have the new ksz_prmw32() introduced in patch 2 use ksz_rmw32() while leaving ksz_prmw8() as-is. The actual fix is of course patch 3. I can definitely see some weird behaviour on our ksz9567 when writing to phy registers 0x1e and 0x1f (with phytool from userspace), though it does not seem that the effect is always to write zeroes to the buddy register as the errata sheet says would be the case. In our case, the switch is connected via i2c; I hope somebody with other switches and/or the SPI variants can test this. ==================== Link: https://lore.kernel.org/r/20230620113855.733526-1-linux@rasmusvillemoes.dk Signed-off-by: Jakub Kicinski commit 5c844d57aa7894154e49cf2fc648bfe2f1aefc1c Author: Rasmus Villemoes Date: Tue Jun 20 13:38:54 2023 +0200 net: dsa: microchip: fix writes to phy registers >= 0x10 According to the errata sheets for ksz9477 and ksz9567, writes to the PHY registers 0x10-0x1f (i.e. those located at addresses 0xN120 to 0xN13f) must be done as a 32 bit write to the 4-byte aligned address containing the register, hence requires a RMW in order not to change the adjacent PHY register. Signed-off-by: Rasmus Villemoes Reviewed-by: Simon Horman Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230620113855.733526-4-linux@rasmusvillemoes.dk Signed-off-by: Jakub Kicinski commit ece28ecbec9f63e3f722d7c9a99fb965cbeafc1b Author: Rasmus Villemoes Date: Tue Jun 20 13:38:53 2023 +0200 net: dsa: microchip: add ksz_prmw32() helper This will be used in a subsequent patch fixing an errata for writes to certain PHY registers. Signed-off-by: Rasmus Villemoes Reviewed-by: Simon Horman Acked-by: Arun Ramadoss Link: https://lore.kernel.org/r/20230620113855.733526-3-linux@rasmusvillemoes.dk Signed-off-by: Jakub Kicinski commit 3b42fbd5951171bce5ecd22ad72d6a16fefaa704 Author: Rasmus Villemoes Date: Tue Jun 20 13:38:52 2023 +0200 net: dsa: microchip: simplify ksz_prmw8() Implement ksz_prmw8() in terms of ksz_rmw8(), just as all the other ksz_pX are implemented in terms of ksz_X. No functional change. Signed-off-by: Rasmus Villemoes Reviewed-by: Simon Horman Acked-by: Arun Ramadoss Link: https://lore.kernel.org/r/20230620113855.733526-2-linux@rasmusvillemoes.dk Signed-off-by: Jakub Kicinski commit 0c3d6fd4b89c1a6393283249cdd0bd484ad8f2e5 Author: Jakub Kicinski Date: Wed Jun 21 16:17:19 2023 -0700 tools: ynl: improve the direct-include header guard logic Przemek suggests that I shouldn't accuse GCC of witchcraft, there is a simpler explanation for why we need manual define. scripts/headers_install.sh modifies the guard, removing _UAPI. That's why including a kernel header from the tree and from /usr leads to duplicate definitions. This also solves the mystery of why I needed to include the header conditionally. I had the wrong guards for most cases but ethtool. Suggested-by: Przemek Kitszel Reviewed-by: Przemek Kitszel Link: https://lore.kernel.org/r/20230621231719.2728928-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2a441a3dbe84be61be502142a2fb8ea633fcc528 Author: Zhengchao Shao Date: Tue Jun 20 14:25:19 2023 +0800 net: txgbe: remove unused buffer in txgbe_calc_eeprom_checksum Half a year passed since commit 049fe5365324c ("net: txgbe: Add operations to interact with firmware") was submitted, the buffer in txgbe_calc_eeprom_checksum was not used. So remove it and the related branch codes. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306200242.FXsHokaJ-lkp@intel.com/ Reviewed-by: Jiawen Wu Signed-off-by: Zhengchao Shao Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230620062519.1575298-1-shaozhengchao@huawei.com Signed-off-by: Jakub Kicinski commit fc0649395dca81f2b3b02d9b248acb38cbcee55c Author: Oleksij Rempel Date: Wed Jun 21 06:38:48 2023 +0200 net: phy: dp83td510: fix kernel stall during netboot in DP83TD510E PHY driver Fix an issue where the kernel would stall during netboot, showing the "sched: RT throttling activated" message. This stall was triggered by the behavior of the mii_interrupt bit (Bit 7 - DP83TD510E_STS_MII_INT) in the DP83TD510E's PHY_STS Register (Address = 0x10). The DP83TD510E datasheet (2020) states that the bit clears on write, however, in practice, the bit clears on read. This discrepancy had significant implications on the driver's interrupt handling. The PHY_STS Register was used by handle_interrupt() to check for pending interrupts and by read_status() to get the current link status. The call to read_status() was unintentionally clearing the mii_interrupt status bit without deasserting the IRQ pin, causing handle_interrupt() to miss other pending interrupts. This issue was most apparent during netboot. The fix refrains from using the PHY_STS Register for interrupt handling. Instead, we now solely rely on the INTERRUPT_REG_1 Register (Address = 0x12) and INTERRUPT_REG_2 Register (Address = 0x13) for this purpose. These registers directly influence the IRQ pin state and are latched high until read. Note: The INTERRUPT_REG_2 Register (Address = 0x13) exists and can also be used for interrupt handling, specifically for "Aneg page received interrupt" and "Polarity change interrupt". However, these features are currently not supported by this driver. Fixes: 165cd04fe253 ("net: phy: dp83td510: Add support for the DP83TD510 Ethernet PHY") Cc: Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230621043848.3806124-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 018c00dd4e88d78b0e97d4bcc413dd727497128f Merge: 84ef94d9421d3 f40df95d375dc Author: Jakub Kicinski Date: Thu Jun 22 19:41:13 2023 -0700 Merge branch 'add-and-use-helper-for-pcs-negotiation-modes' Russell King says: ==================== Add and use helper for PCS negotiation modes Earlier this month, I proposed a helper for deciding whether a PCS should use inband negotiation modes or not. There was some discussion around this topic, and I believe there was no disagreement about providing the helper. The initial discussion can be found at: https://lore.kernel.org/r/ZGIkGmyL8yL1q1zp@shell.armlinux.org.uk Subsequently, I posted a RFC series back in May: https://lore.kernel.org/r/ZGzhvePzPjJ0v2En@shell.armlinux.org.uk that added a helper, phylink_pcs_neg_mode() which PCS drivers could use to parse the state, and updated a bunch of drivers to use it. I got a couple of bits of feedback to it, including some ACKs. However, I've decided to take this slightly further and change the "mode" parameter to both the pcs_config() and pcs_link_up() methods when a PCS driver opts in to this (by setting "neg_mode" in the phylink_pcs structure.) If this is not set, we default to the old behaviour. That said, this series converts all the PCS implementations I can find currently in net-next. Doing this has the added benefit that the negotiation mode parameter is also available to the pcs_link_up() function, which can now know whether inband negotiation was in fact enabled or not at pcs_config() time. It has been posted as RFC at: https://lore.kernel.org/r/ZIh/CLQ3z89g0Ua0@shell.armlinux.org.uk and received one reply, thanks Elad, which is a similar amount of interest to previous postings. Let's post it as non-RFC and see whether we get more reaction. ==================== Link: https://lore.kernel.org/r/ZIxQIBfO9dH5xFlg@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f40df95d375dc9c96da541a2c4ac0ce1e630309d Author: Russell King (Oracle) Date: Fri Jun 16 13:07:34 2023 +0100 net: macb: update PCS driver to use neg_mode Update macb's embedded PCS drivers to use neg_mode, even though it makes no use of it or the "mode" argument. This makes the driver consistent with converted drivers. Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1qA8Eo-00EaGX-KJ@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6c1e4eca0b4e4ec6a67a10e69cc0d936d0d9c19c Author: Russell King (Oracle) Date: Fri Jun 16 13:07:29 2023 +0100 net: dsa: mt7530: update PCS driver to use neg_mode Update mt7530's embedded PCS driver to use neg_mode, even though it makes no use of it or the "mode" argument. This makes the driver consistent with converted drivers. Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1qA8Ej-00EaGR-Fk@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 772c476dd1d43546ac8123c9a7060557d06dfe7c Author: Russell King (Oracle) Date: Fri Jun 16 13:07:24 2023 +0100 net: dsa: b53: update PCS driver to use neg_mode Update B53's embedded PCS driver to use neg_mode, even though it makes no use of it or the "mode" argument. This makes the driver consistent with converted drivers. Signed-off-by: Russell King (Oracle) Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/E1qA8Ee-00EaGL-Az@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 6e5bb3da9842950a161625b4ab2743d1d5c64715 Author: Russell King (Oracle) Date: Fri Jun 16 13:07:19 2023 +0100 net: sparx5: update PCS driver to use neg_mode Update Sparx5's embedded PCS driver to use neg_mode rather than the mode argument. As there is no pcs_link_up() method, this only affects the pcs_config() method. Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1qA8EZ-00EaGF-6F@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit bfa0a3ac05b69842aaee7c60a8ceffd734f2e2b9 Author: Russell King (Oracle) Date: Fri Jun 16 13:07:14 2023 +0100 net: qca8k: update PCS driver to use neg_mode Update qca8k's embedded PCS driver to use neg_mode rather than the mode argument. As there is no pcs_link_up() method, this only affects the pcs_config() method. Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1qA8EU-00EaG9-1l@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d5a05299306227d73b0febba9cecedf88931c507 Author: Russell King (Oracle) Date: Fri Jun 16 13:07:08 2023 +0100 net: prestera: update PCS driver to use neg_mode Update prestera's embedded PCS driver to use neg_mode rather than the mode argument. As there is no pcs_link_up() method, this only affects the pcs_config() method. Acked-by: Elad Nachman Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1qA8EO-00EaG3-TR@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d5b16264fffe1e6a9ccad7b1cf311ea2fd5e2e79 Author: Russell King (Oracle) Date: Fri Jun 16 13:07:03 2023 +0100 net: mvpp2: update PCS driver to use neg_mode Update mvpp2's embedded PCS drivers to use neg_mode rather than the mode argument, remembering to update the ACPI path as well. As there are no pcs_link_up() methods, this only affects the two pcs_config() methods. Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1qA8EJ-00EaFx-P6@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 140d1002e2a30db0df58d18c07df3f72dc0659fa Author: Russell King (Oracle) Date: Fri Jun 16 13:06:58 2023 +0100 net: mvneta: update PCS driver to use neg_mode Update mvneta's embedded PCS driver to use neg_mode rather than the mode argument. As there is no pcs_link_up() method, this only affects the pcs_config() method. Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1qA8EE-00EaFr-Kx@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a0e93cfdac4c91b73f79a4bfbfcf74b0911c1ad3 Author: Russell King (Oracle) Date: Fri Jun 16 13:06:53 2023 +0100 net: lan966x: update PCS driver to use neg_mode Update lan966x's embedded PCS driver to use neg_mode rather than the mode argument. As there is no pcs_link_up() method, this only affects the pcs_config() method. Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1qA8E9-00EaFl-GN@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c689a6528c22b20565bd14d5a7fb8e827d6faa7c Author: Russell King (Oracle) Date: Fri Jun 16 13:06:48 2023 +0100 net: pcs: lynx: update PCS driver to use neg_mode Update the Lynx PCS driver to use neg_mode rather than the mode argument. This ensures that the link_up() method will always program the speed and duplex when negotiation is disabled. Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1qA8E4-00EaFf-Bf@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3b2de56a146f34e3f70a84cc3a1897064e445d16 Author: Russell King (Oracle) Date: Fri Jun 16 13:06:43 2023 +0100 net: pcs: lynxi: update PCS driver to use neg_mode Update the Lynxi PCS driver to use neg_mode rather than the mode argument. This ensures that the link_up() method will always program the speed and duplex when negotiation is disabled. Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1qA8Dz-00EaFY-5A@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a3a47cfb88fcdf862594eae417611ef533ed8bae Author: Russell King (Oracle) Date: Fri Jun 16 13:06:37 2023 +0100 net: pcs: xpcs: update PCS driver to use neg_mode Update xpcs to use neg_mode to configure whether inband negotiation should be used. We need to update sja1105 as well as that directly calls into the XPCS driver's config function. Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1qA8Dt-00EaFS-W9@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit febf2aaf05641f3258cc30e072aff65cffc7c82c Author: Russell King (Oracle) Date: Fri Jun 16 13:06:32 2023 +0100 net: phylink: pass neg_mode into phylink_mii_c22_pcs_config() Convert fman_dtsec, xilinx_axienet and pcs-lynx to pass the neg_mode into phylink_mii_c22_pcs_config(). Where appropriate, drivers are updated to have neg_mode passed into their pcs_config() and pcs_link_up() functions. For other drivers, we just hoist the call to phylink_pcs_neg_mode() to their pcs_config() method out of phylink_mii_c22_pcs_config(). Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1qA8Do-00EaFM-Ra@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit cdb08aa0473730315dbc088d5394e59622314034 Author: Russell King (Oracle) Date: Fri Jun 16 13:06:27 2023 +0100 net: phylink: convert phylink_mii_c22_pcs_config() to neg_mode Use phylink_pcs_neg_mode() for phylink_mii_c22_pcs_config(). This results in no functional change. Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1qA8Dj-00EaFG-Mt@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit f99d471afa03f770149f1cc60a288b9a08285903 Author: Russell King (Oracle) Date: Fri Jun 16 13:06:22 2023 +0100 net: phylink: add PCS negotiation mode PCS have to work out whether they should enable PCS negotiation by looking at the "mode" and "interface" arguments, and the Autoneg bit in the advertising mask. This leads to some complex logic, so lets pull that out into phylink and instead pass a "neg_mode" argument to the PCS configuration and link up methods, instead of the "mode" argument. In order to transition drivers, add a "neg_mode" flag to the phylink PCS structure to PCS can indicate whether they want to be passed the neg_mode or the old mode argument. Signed-off-by: Russell King (Oracle) Link: https://lore.kernel.org/r/E1qA8De-00EaFA-Ht@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 84ef94d9421d39b9148f2f4fd4cca2888deb6103 Merge: a7384f3918756 a0e128ef88e4a Author: Jakub Kicinski Date: Thu Jun 22 19:38:46 2023 -0700 Merge branch 'fix-comment-typos-about-transmit' Yueh-Shun Li says: ==================== Fix comment typos about "transmit" Fix typos about "transmit" missing the first "s" found by searching with keyword "tram" in the first 7 patches. ==================== Link: https://lore.kernel.org/r/20230622012627.15050-1-shamrocklee@posteo.net Signed-off-by: Jakub Kicinski commit a0e128ef88e4a033a52963ec4ad94d96a17f8179 Author: Yueh-Shun Li Date: Thu Jun 22 01:26:33 2023 +0000 net/tls: fix comment typo Spell "retransmit" properly. Found by searching for keyword "tranm". Signed-off-by: Yueh-Shun Li Link: https://lore.kernel.org/r/20230622012627.15050-7-shamrocklee@posteo.net Signed-off-by: Jakub Kicinski commit 304b1875ba02022f2504952a32e5e90482bbdb39 Author: Yueh-Shun Li Date: Thu Jun 22 01:26:31 2023 +0000 tcp: fix comment typo Spell "transmissions" properly. Found by searching for keyword "tranm". Signed-off-by: Yueh-Shun Li Link: https://lore.kernel.org/r/20230622012627.15050-6-shamrocklee@posteo.net Signed-off-by: Jakub Kicinski commit b028813ac97370e61351b1190c1860a1bd24fe56 Author: Yueh-Shun Li Date: Thu Jun 22 01:26:25 2023 +0000 i40e, xsk: fix comment typo Spell "transmission" properly. Found by searching for keyword "tranm". Signed-off-by: Yueh-Shun Li Link: https://lore.kernel.org/r/20230622012627.15050-3-shamrocklee@posteo.net Signed-off-by: Jakub Kicinski commit aa5406950726e336c5c9585b09799a734b6e77bf Author: Eric Dumazet Date: Wed Jun 21 17:47:20 2023 +0000 netlink: do not hard code device address lenth in fdb dumps syzbot reports that some netdev devices do not have a six bytes address [1] Replace ETH_ALEN by dev->addr_len. [1] (Case of a device where dev->addr_len = 4) BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copyout+0xb8/0x100 lib/iov_iter.c:169 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copyout+0xb8/0x100 lib/iov_iter.c:169 _copy_to_iter+0x6d8/0x1d00 lib/iov_iter.c:536 copy_to_iter include/linux/uio.h:206 [inline] simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:513 __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:419 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:527 skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline] netlink_recvmsg+0x4ae/0x15a0 net/netlink/af_netlink.c:1970 sock_recvmsg_nosec net/socket.c:1019 [inline] sock_recvmsg net/socket.c:1040 [inline] ____sys_recvmsg+0x283/0x7f0 net/socket.c:2722 ___sys_recvmsg+0x223/0x840 net/socket.c:2764 do_recvmmsg+0x4f9/0xfd0 net/socket.c:2858 __sys_recvmmsg net/socket.c:2937 [inline] __do_sys_recvmmsg net/socket.c:2960 [inline] __se_sys_recvmmsg net/socket.c:2953 [inline] __x64_sys_recvmmsg+0x397/0x490 net/socket.c:2953 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was stored to memory at: __nla_put lib/nlattr.c:1009 [inline] nla_put+0x1c6/0x230 lib/nlattr.c:1067 nlmsg_populate_fdb_fill+0x2b8/0x600 net/core/rtnetlink.c:4071 nlmsg_populate_fdb net/core/rtnetlink.c:4418 [inline] ndo_dflt_fdb_dump+0x616/0x840 net/core/rtnetlink.c:4456 rtnl_fdb_dump+0x14ff/0x1fc0 net/core/rtnetlink.c:4629 netlink_dump+0x9d1/0x1310 net/netlink/af_netlink.c:2268 netlink_recvmsg+0xc5c/0x15a0 net/netlink/af_netlink.c:1995 sock_recvmsg_nosec+0x7a/0x120 net/socket.c:1019 ____sys_recvmsg+0x664/0x7f0 net/socket.c:2720 ___sys_recvmsg+0x223/0x840 net/socket.c:2764 do_recvmmsg+0x4f9/0xfd0 net/socket.c:2858 __sys_recvmmsg net/socket.c:2937 [inline] __do_sys_recvmmsg net/socket.c:2960 [inline] __se_sys_recvmmsg net/socket.c:2953 [inline] __x64_sys_recvmmsg+0x397/0x490 net/socket.c:2953 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook+0x12d/0xb60 mm/slab.h:716 slab_alloc_node mm/slub.c:3451 [inline] __kmem_cache_alloc_node+0x4ff/0x8b0 mm/slub.c:3490 kmalloc_trace+0x51/0x200 mm/slab_common.c:1057 kmalloc include/linux/slab.h:559 [inline] __hw_addr_create net/core/dev_addr_lists.c:60 [inline] __hw_addr_add_ex+0x2e5/0x9e0 net/core/dev_addr_lists.c:118 __dev_mc_add net/core/dev_addr_lists.c:867 [inline] dev_mc_add+0x9a/0x130 net/core/dev_addr_lists.c:885 igmp6_group_added+0x267/0xbc0 net/ipv6/mcast.c:680 ipv6_mc_up+0x296/0x3b0 net/ipv6/mcast.c:2754 ipv6_mc_remap+0x1e/0x30 net/ipv6/mcast.c:2708 addrconf_type_change net/ipv6/addrconf.c:3731 [inline] addrconf_notify+0x4d3/0x1d90 net/ipv6/addrconf.c:3699 notifier_call_chain kernel/notifier.c:93 [inline] raw_notifier_call_chain+0xe4/0x430 kernel/notifier.c:461 call_netdevice_notifiers_info net/core/dev.c:1935 [inline] call_netdevice_notifiers_extack net/core/dev.c:1973 [inline] call_netdevice_notifiers+0x1ee/0x2d0 net/core/dev.c:1987 bond_enslave+0xccd/0x53f0 drivers/net/bonding/bond_main.c:1906 do_set_master net/core/rtnetlink.c:2626 [inline] rtnl_newlink_create net/core/rtnetlink.c:3460 [inline] __rtnl_newlink net/core/rtnetlink.c:3660 [inline] rtnl_newlink+0x378c/0x40e0 net/core/rtnetlink.c:3673 rtnetlink_rcv_msg+0x16a6/0x1840 net/core/rtnetlink.c:6395 netlink_rcv_skb+0x371/0x650 net/netlink/af_netlink.c:2546 rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6413 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0xf28/0x1230 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x122f/0x13d0 net/netlink/af_netlink.c:1913 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0x999/0xd50 net/socket.c:2503 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2557 __sys_sendmsg net/socket.c:2586 [inline] __do_sys_sendmsg net/socket.c:2595 [inline] __se_sys_sendmsg net/socket.c:2593 [inline] __x64_sys_sendmsg+0x304/0x490 net/socket.c:2593 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Bytes 2856-2857 of 3500 are uninitialized Memory access of size 3500 starts at ffff888018d99104 Data copied to user address 0000000020000480 Fixes: d83b06036048 ("net: add fdb generic dump routine") Reported-by: syzbot Signed-off-by: Eric Dumazet Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/20230621174720.1845040-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8d61f926d42045961e6b65191c09e3678d86a9cf Author: Eric Dumazet Date: Wed Jun 21 15:43:37 2023 +0000 netlink: fix potential deadlock in netlink_set_err() syzbot reported a possible deadlock in netlink_set_err() [1] A similar issue was fixed in commit 1d482e666b8e ("netlink: disable IRQs for netlink_lock_table()") in netlink_lock_table() This patch adds IRQ safety to netlink_set_err() and __netlink_diag_dump() which were not covered by cited commit. [1] WARNING: possible irq lock inversion dependency detected 6.4.0-rc6-syzkaller-00240-g4e9f0ec38852 #0 Not tainted syz-executor.2/23011 just changed the state of lock: ffffffff8e1a7a58 (nl_table_lock){.+.?}-{2:2}, at: netlink_set_err+0x2e/0x3a0 net/netlink/af_netlink.c:1612 but this lock was taken by another, SOFTIRQ-safe lock in the past: (&local->queue_stop_reason_lock){..-.}-{2:2} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(nl_table_lock); local_irq_disable(); lock(&local->queue_stop_reason_lock); lock(nl_table_lock); lock(&local->queue_stop_reason_lock); *** DEADLOCK *** Fixes: 1d482e666b8e ("netlink: disable IRQs for netlink_lock_table()") Reported-by: syzbot+a7d200a347f912723e5c@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=a7d200a347f912723e5c Link: https://lore.kernel.org/netdev/000000000000e38d1605fea5747e@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Johannes Berg Link: https://lore.kernel.org/r/20230621154337.1668594-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit c4fc88ad2a765224a648db8ab35f125e120fe41b Author: Bartosz Golaszewski Date: Wed Jun 21 15:55:37 2023 +0200 net: stmmac: fix double serdes powerdown Commit 49725ffc15fc ("net: stmmac: power up/down serdes in stmmac_open/release") correctly added a call to the serdes_powerdown() callback to stmmac_release() but did not remove the one from stmmac_remove() which leads to a doubled call to serdes_powerdown(). This can lead to all kinds of problems: in the case of the qcom ethqos driver, it caused an unbalanced regulator disable splat. Fixes: 49725ffc15fc ("net: stmmac: power up/down serdes in stmmac_open/release") Signed-off-by: Bartosz Golaszewski Reviewed-by: Jiri Pirko Acked-by: Junxiao Chang Reviewed-by: Andrew Halaney Tested-by: Andrew Halaney Link: https://lore.kernel.org/r/20230621135537.376649-1-brgl@bgdev.pl Signed-off-by: Jakub Kicinski commit b9ec61be2d91cc09b5e7302e65442e6d71f0ed93 Author: Sathesh Edara Date: Wed Jun 21 03:16:49 2023 -0700 MAINTAINERS: update email addresses of octeon_ep driver maintainers Update email addresses of Marvell octeon_ep driver maintainers. Also remove a former maintainer. As a maintainer below are the responsibilities: - Pushing the bug fixes and new features to upstream. - Responsible for reviewing the external changes submitted for the octeon_ep driver. - Reply to maintainers questions in a timely manner. Signed-off-by: Sathesh Edara Signed-off-by: Jakub Kicinski commit 533bbc7ce562e476ac381e8ddcb27c46279a44f9 Author: Krzysztof Kozlowski Date: Wed Jun 21 08:09:49 2023 +0200 Bluetooth: MAINTAINERS: add Devicetree bindings to Bluetooth drivers The Devicetree bindings should be picked up by subsystem maintainers, but respective pattern for Bluetooth drivers was missing. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit a7384f3918756c193e3fcd7e3111fc4bd3686013 Merge: 98e95872f2b81 8a28a0b6f1a1d Author: Jakub Kicinski Date: Thu Jun 22 18:40:38 2023 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR. Conflicts: tools/testing/selftests/net/fcnal-test.sh d7a2fc1437f7 ("selftests: net: fcnal-test: check if FIPS mode is enabled") dd017c72dde6 ("selftests: fcnal: Test SO_DONTROUTE on TCP sockets.") https://lore.kernel.org/all/5007b52c-dd16-dbf6-8d64-b9701bfa498b@tessares.net/ https://lore.kernel.org/all/20230619105427.4a0df9b3@canb.auug.org.au/ No adjacent changes. Signed-off-by: Jakub Kicinski commit fd3ac6e8049799ca7dbd2738de8e149536e92a5e Author: Sebastian Reichel Date: Mon Jun 12 19:13:35 2023 +0200 dt-bindings: phy: rockchip: rk3588 has two reset lines The RK3588 has two reset lines for the combphy. One for the APB interface and one for the actual PHY. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel Signed-off-by: Damien Le Moal commit 85b0e13b19c23f0ee71b2bacb43ccd6b0e6e31dd Author: Sebastian Reichel Date: Mon Jun 12 19:13:34 2023 +0200 dt-bindings: ata: dwc-ahci: add Rockchip RK3588 This adds Rockchip RK3588 AHCI binding. In order to narrow down the allowed clocks without bloating the generic binding, the description of Rockchip's AHCI controllers has been moved to its own file. Signed-off-by: Sebastian Reichel Reviewed-by: Serge Semin Reviewed-by: Krzysztof Kozlowski Signed-off-by: Damien Le Moal commit 2b3665b2971d2c67dd7a7a9171b06cb48fa393db Author: Sebastian Reichel Date: Mon Jun 12 19:13:33 2023 +0200 dt-bindings: ata: dwc-ahci: add PHY clocks Add PHY transmit and receive clocks as described by the DW SATA AHCI HW manual. Suggested-by: Serge Semin Reviewed-by: Serge Semin Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel Signed-off-by: Damien Le Moal commit b3f993c7e7a29d1e119c3d8ec6cdeeaae25afba7 Author: Damien Le Moal Date: Thu Jun 15 09:51:46 2023 +0900 ata: ahci_octeon: Remove unnecessary include asm/octeon/octeon.h already includes asm/bitfield.h, so there is no need to include this latter file in ahci_octeon.c as the code does not directly use the __BITFIELD_FIELD macro defined in it. Signed-off-by: Damien Le Moal commit a77541cab0be8c8a68f70cdeb68359fbe15e4612 Merge: 01fa9edd8bcf1 6eef895581c9b Author: Mark Brown Date: Fri Jun 23 01:31:11 2023 +0100 spi: Helper for deriving timeout values Merge series from Miquel Raynal : I recently came across an issue with the Atmel spi controller driver which would stop my transfers after a too small timeout when performing big transfers (reading a 4MiB flash in one transfer). My initial idea was to derive a the maximum amount of time a transfer would take depending on its size and use that as value to avoid erroring-out when not relevant. Mark wanted to go further by creating a core helper doing that, based on the heuristics from the sun6i driver. Here is a small series of 3 patches doing exactly that. commit 2971c058746319e9853919553259cef7fe280c94 Author: Russell Harmon Date: Sun Jun 4 22:08:53 2023 -0700 Documentation: dm-integrity: Document an example of how the tunables relate. Signed-off-by: Russell Harmon Signed-off-by: Mike Snitzer commit 52145f284c66b9de5be7b054444dd0da066079d6 Author: Russell Harmon Date: Sun Jun 4 22:08:52 2023 -0700 Documentation: dm-integrity: Document default values. Signed-off-by: Russell Harmon Signed-off-by: Mike Snitzer commit 3b671459e687e6b7d3f87d39a0b242bbebf871be Author: Russell Harmon Date: Sun Jun 4 22:08:51 2023 -0700 Documentation: dm-integrity: Document the meaning of "buffer". "Buffers" are buffers of the metadata/checksum area of dm-integrity. They are always at most as large as a single metadata area on-disk, but may be smaller. Signed-off-by: Russell Harmon Reviewed-by: Bagas Sanjaya Signed-off-by: Mike Snitzer commit c3ba5aa6f789097364398ad38fe541841bade17d Author: Russell Harmon Date: Sun Jun 4 22:08:50 2023 -0700 Documentation: dm-integrity: Fix minor grammatical error. "where dm-integrity uses bitmap" becomes "where dm-integrity uses a bitmap" Signed-off-by: Russell Harmon Reviewed-by: Bagas Sanjaya Signed-off-by: Mike Snitzer commit 25c9a4ab4d73d251886e6b317181cfc433e011f9 Author: Andy Shevchenko Date: Tue Jun 13 00:47:51 2023 +0300 dm integrity: Use %*ph for printing hexdump of a small buffer The kernel already has a helper to print a hexdump of a small buffer via pointer extension. Use that instead of open coded variant. In long term it helps to kill pr_cont() or at least narrow down its use. Note, the format is slightly changed, i.e. the trailing space is always printed. Also the IV dump is limited by 64 bytes which seems fine. Signed-off-by: Andy Shevchenko Signed-off-by: Mike Snitzer commit 765be32b97fe69f67164cc7772a74c6a10562e0b Author: Tiezhu Yang Date: Tue May 23 17:57:53 2023 +0800 perf symbol: Add LoongArch case in get_plt_sizes() We can see the following definitions in bfd/elfnn-loongarch.c: #define PLT_HEADER_INSNS 8 #define PLT_HEADER_SIZE (PLT_HEADER_INSNS * 4) #define PLT_ENTRY_INSNS 4 #define PLT_ENTRY_SIZE (PLT_ENTRY_INSNS * 4) so plt header size is 32 and plt entry size is 16 on LoongArch, let us add LoongArch case in get_plt_sizes(). Signed-off-by: Tiezhu Yang Acked-by: Huacai Chen Reviewed-by: Leo Yan Cc: Mark Rutland Cc: Ian Rogers Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Alexander Shishkin Cc: loongarch@lists.linux.dev Cc: loongson-kernel@lists.loongnix.cn Cc: Ingo Molnar Link: https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=bfd/elfnn-loongarch.c Link: https://lore.kernel.org/r/1684835873-15956-1-git-send-email-yangtiezhu@loongson.cn Signed-off-by: Namhyung Kim commit fcb66ee8d16aa0f88efcc9cb41083c0412e9db8a Author: Arnd Bergmann Date: Thu Jun 22 12:11:23 2023 +0200 ASoC: tas2781: fix Kconfig dependencies The new driver has two modules that both get enabled for build testing when all codecs are selected. The comlib part has an i2c dependency, so this remains disabled on builds without i2c, but then the other one fails to link: ERROR: modpost: "tasdevice_dev_bulk_write" [sound/soc/codecs/snd-soc-tas2781-fmwlib.ko] undefined! ERROR: modpost: "tasdevice_dev_update_bits" [sound/soc/codecs/snd-soc-tas2781-fmwlib.ko] undefined! ERROR: modpost: "tasdevice_dev_bulk_read" [sound/soc/codecs/snd-soc-tas2781-fmwlib.ko] undefined! ERROR: modpost: "tasdevice_dev_read" [sound/soc/codecs/snd-soc-tas2781-fmwlib.ko] undefined! ERROR: modpost: "tasdevice_dev_write" [sound/soc/codecs/snd-soc-tas2781-fmwlib.ko] undefined! There are many ways to address this, adding an explicit dependency seems to be the clearest method that keeps the structure of the driver otherwise unchanged. Fixes: ef3bcde75d06d ("ASoC: tas2781: Add tas2781 driver") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/Message-Id: <20230622101205.3180938-1-arnd@kernel.org> Signed-off-by: Mark Brown commit 3eb96217c16cb7be0fe6e1d416ff4fe47f686bea Author: Syed Saba Kareem Date: Thu Jun 22 20:53:41 2023 +0530 ASoC: amd: acp: remove acp poweroff function BIOS invokes ACP Power off sequence based on ACP device state. Remove redundant code from ACP PCI driver for ACP Power off sequence. Signed-off-by: Syed Saba Kareem Link: https://lore.kernel.org/r/Message-Id: <20230622152406.3709231-4-Syed.SabaKareem@amd.com> Signed-off-by: Mark Brown commit ad60672394bd1f95c58d3d9336902f47e05126fc Author: Syed Saba Kareem Date: Thu Jun 22 20:53:38 2023 +0530 ASoC: amd: acp: clear pdm dma interrupt mask Clear pdm dma interrupt mask in acp_dmic_shutdown(). 'Fixes: c32bd332ce5c9 ("ASoC: amd: acp: Add generic support for PDM controller on ACP")' Signed-off-by: Syed Saba Kareem Link: https://lore.kernel.org/r/Message-Id: <20230622152406.3709231-1-Syed.SabaKareem@amd.com> Signed-off-by: Mark Brown commit fb180283c00b435019bd9500ae027872da9faa3b Author: Maxim Kochetkov Date: Thu Jun 22 17:20:36 2023 +0300 ASoC: codecs: max98090: Allow dsp_a mode TDM mode for max98090 is dsp_a compatible with such limitations: 1) Up to four timeslots supported. 2) Only 16 bits timeslots supported. 3) Only 2 active timeslots (L/R) supported. We want to setup TDM mode only when dsp_a mode is selected. So move M98090_REG_TDM_FORMAT/M98090_REG_TDM_CONTROL registers setup from max98090_set_tdm_slot() to the max98090_dai_set_fmt(). Also extend max98090_set_tdm_slot() with all TDM limitations check. Signed-off-by: Maxim Kochetkov Link: https://lore.kernel.org/r/Message-Id: <20230622142038.63388-1-fido_max@inbox.ru> Signed-off-by: Mark Brown commit d7c2d34d72bfeffca4983c4dcba55d1dd31012be Author: Namhyung Kim Date: Wed Jun 21 22:58:32 2023 -0700 perf test: Remove x permission from lib/stat_output.sh The commit fc51fc87b1b8 factored out the helper functions to a library but the new file had execute permission. Due to the way it detects the shell test scripts, it showed up in the perf test list unexpectedly. $ ./perf test list 2>&1 | grep 86 76: x86 bp modify 77: x86 Sample parsing 78: x86 hybrid 86: <---- (here) $ ./perf test -v 86 86: : --- start --- test child forked, pid 1932207 test child finished with 0 ---- end ---- : Ok As it's a collection of library functions, it should not run as is. Let's remove the execute permission. Fixes: fc51fc87b1b8 ("perf test: Move all the check functions of stat CSV output to lib") Acked-by: Ian Rogers Cc: Kan Liang Cc: Andi Kleen Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230622055832.83476-1-namhyung@kernel.org Signed-off-by: Namhyung Kim commit 63e2f55cabedf8a7ede928f7cf3ab028af44b9e9 Author: Sean Christopherson Date: Tue Apr 11 10:16:51 2023 -0700 Documentation/process: Add a maintainer handbook for KVM x86 Add a KVM x86 doc to the subsystem/maintainer handbook section to explain how KVM x86 (currently) operates as a sub-subsystem, and to soapbox on the rules and expectations for contributing to KVM x86. Reviewed-by: Like Xu Link: https://lore.kernel.org/r/20230411171651.1067966-3-seanjc@google.com Signed-off-by: Sean Christopherson commit b7dac767c9356fe94fe345f907adf573cf745d8d Author: Sean Christopherson Date: Tue Apr 11 10:16:50 2023 -0700 Documentation/process: Add a label for the tip tree handbook's coding style Add a label for the tip tree's "Coding style notes" so that a forthcoming KVM x86 handbook can reference/piggyback the tip tree's preferred coding style. Link: https://lore.kernel.org/r/20230411171651.1067966-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 1ffe6ddc5c64f88b1ec2e250327defb5446a7904 Author: Conor Dooley Date: Thu Jun 15 23:50:15 2023 +0100 dt-bindings: riscv: cpus: switch to unevaluatedProperties: false To permit validation of cpu nodes, swap "additionalProperties: true" out for "unevaluatedProperties: false". Signed-off-by: Conor Dooley Reviewed-by: Rob Herring Acked-by: Palmer Dabbelt Link: https://lore.kernel.org/r/20230615-viper-stoic-1ff8efd7d51d@spud Signed-off-by: Palmer Dabbelt commit 3c1b4758a9544cbaf38d052ad66a69618e920ceb Author: Conor Dooley Date: Thu Jun 15 23:50:14 2023 +0100 dt-bindings: riscv: cpus: add a ref the common cpu schema To permit validation of RISC-V cpu nodes, "additionalProperties: true" needs to be swapped for "unevaluatedProperties: false". To facilitate this in a way that passes dt_binding_check, a reference to the cpu schema is required. Disallow the generic cache-op-block-size property that that drags in, since the RISC-V CBO extensions do not require a common size, and have individual properties. Signed-off-by: Conor Dooley Reviewed-by: Rob Herring Acked-by: Palmer Dabbelt Link: https://lore.kernel.org/r/20230615-dubiously-parasail-79d34cefedce@spud Signed-off-by: Palmer Dabbelt commit 6eef895581c9b5fcd002ff77837e0c3a4b1eecf6 Author: Miquel Raynal Date: Thu Jun 22 11:06:34 2023 +0200 spi: sun6i: Use the new helper to derive the xfer timeout value A helper was recently added to the core to factorize common code between drivers, like the amount of time a driver should wait for a transfer to happen. It is of course possible to use a default value (like eg. 1s) but it is way stronger to adapt this amount of time to the transfer. Indeed, long transfers (eg. 4MiB) on a slow single-spi bus might take more than the usual second of timeout and prevent lengthy transfers. The core helper was heavily inspired by the logic applied in this driver, the only difference being the minimum amount of time which was enlarged from 0.1s to 0.5s. Use this helper instead of open-coding it. Signed-off-by: Miquel Raynal Acked-by: Jernej Škrabec Link: https://lore.kernel.org/r/Message-Id: <20230622090634.3411468-4-miquel.raynal@bootlin.com> Signed-off-by: Mark Brown commit e0205d6203c2ce598ae26d4b2707ca4224a9c90b Author: Miquel Raynal Date: Thu Jun 22 11:06:33 2023 +0200 spi: atmel: Prevent false timeouts on long transfers A slow SPI bus clocks at ~20MHz, which means it would transfer about 2500 bytes per second with a single data line. Big transfers, like when dealing with flashes can easily reach a few MiB. The current DMA timeout is set to 1 second, which means any working transfer of about 4MiB will always be cancelled. With the above derivations, on a slow bus, we can assume every byte will take at most 0.4ms. Said otherwise, we could add 4ms to the 1-second timeout delay every 10kiB. On a 4MiB transfer, it would bring the timeout delay up to 2.6s which still seems rather acceptable for a timeout. The consequence of this is that long transfers might be allowed, which hence requires the need to interrupt the transfer if wanted by the user. We can hence switch to the _interruptible variant of wait_for_completion. This leads to a little bit more handling to also handle the interrupted case but looks really acceptable overall. While at it, we drop the useless, noisy and redundant WARN_ON() call. Signed-off-by: Miquel Raynal Acked-by: Ryan Wanner Link: https://lore.kernel.org/r/Message-Id: <20230622090634.3411468-3-miquel.raynal@bootlin.com> Signed-off-by: Mark Brown commit ad5c18c75d2a1de9eeaed60e417d308217f35e73 Author: Vadym Kochan Date: Mon Jun 19 16:07:42 2023 +1200 dt-bindings: mtd: marvell-nand: Convert to YAML DT scheme Switch the DT binding to a YAML schema to enable the DT validation. There was also an incorrect reference to dma-names being "rxtx" where the driver and existing device trees actually use dma-names = "data" so this is corrected in the conversion. Signed-off-by: Vadym Kochan Signed-off-by: Chris Packham Reviewed-by: Rob Herring Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230619040742.1108172-2-chris.packham@alliedtelesis.co.nz commit bae825ccfd4b49695466c81eed5bb51c00eebd54 Author: Miquel Raynal Date: Mon Jun 19 11:29:16 2023 +0200 dt-bindings: mtd: ti,am654: Prevent unevaluated properties Reference mtd-physmap.yaml which contains all the relevant properties for this device. Add "unevaluatedProperties: false" to avoid any spurious addition of random properties. Cc: Vignesh Raghavendra Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-18-miquel.raynal@bootlin.com commit 2beb46f04bd7a857f4994dd1085a49254d6c6602 Author: Miquel Raynal Date: Mon Jun 19 11:29:15 2023 +0200 dt-bindings: mtd: mediatek: Prevent NAND chip unevaluated properties nand-on-flash-bbt is a generic property which may apply to any raw NAND chip, it does not need to be listed in each controller description. The raw NAND chip description file which contains the property is already referenced, so no need to mention the property here again. Cc: Matthias Brugger Cc: AngeloGioacchino Del Regno Cc: Xiangsheng Hou Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-17-miquel.raynal@bootlin.com commit 18d07864e54654b38ba7612c96c0282982a71a41 Author: Miquel Raynal Date: Mon Jun 19 11:29:14 2023 +0200 dt-bindings: mtd: mediatek: Reference raw-nand-chip.yaml The mediatek NAND controller should reference the new raw-nand-chip.yaml binding instead of the original nand-chip.yaml which does not contain *all* the properties that may be used to fully describe the NAND devices, certain properties being actually described under nand-controller.yaml. Cc: Matthias Brugger Cc: AngeloGioacchino Del Regno Cc: Xiangsheng Hou Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-16-miquel.raynal@bootlin.com commit be907ba6c5195579f8bdc506c5b34ea00a9fb358 Author: Miquel Raynal Date: Mon Jun 19 11:29:13 2023 +0200 dt-bindings: mtd: stm32: Prevent NAND chip unevaluated properties List all the possible properties in the NAND chip as per the example and set unevaluatedProperties to false in the NAND chip section. Cc: Maxime Coquelin Cc: Alexandre Torgue Cc: Christophe Kerello Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-15-miquel.raynal@bootlin.com commit d028c1cf2c56317cb7e34fd5e37c45db48fe498a Author: Miquel Raynal Date: Mon Jun 19 11:29:12 2023 +0200 dt-bindings: mtd: rockchip: Prevent NAND chip unevaluated properties List all the possible properties in the NAND chip as per the example and set unevaluatedProperties to false in the NAND chip section. Cc: Heiko Stuebner Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-14-miquel.raynal@bootlin.com commit 1dcd314282957c3ed8e5faba1641b6382fe13b90 Author: Miquel Raynal Date: Mon Jun 19 11:29:11 2023 +0200 dt-bindings: mtd: intel: Prevent NAND chip unevaluated properties nand-ecc-mode is a generic property which may apply to any raw NAND chip, it does not need to be listed in each controller description. Instead, let's reference the raw NAND chip description file which contains the property. The description contained "additionalProperties: false" which is wrong as other properties such as partitions might very well be added in the final .dts, and anyway needs to be converted into "unexpectedProperties: false" to fit the property change new requirements. Cc: Vadivel Murugan Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-13-miquel.raynal@bootlin.com commit 129a70a17cfc4140fd4f1dd6e1f5e767248c8c74 Author: Miquel Raynal Date: Mon Jun 19 11:29:10 2023 +0200 dt-bindings: mtd: denali: Prevent NAND chip unevaluated properties Ensure all raw NAND chip properties are valid by referencing the relevant schema and set unevaluatedProperties to false in the NAND chip section to avoid spurious additions of random properties. Doing this in one location also saves us from dupplicating the description of the NAND chip object. Cc: Masahiro Yamada Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-12-miquel.raynal@bootlin.com commit 74b7e3bd289b02b80abcfc71f03dfac1f4fc937e Author: Miquel Raynal Date: Mon Jun 19 11:29:09 2023 +0200 dt-bindings: mtd: brcmnand: Prevent NAND chip unevaluated properties Ensure all raw NAND chip properties are valid by referencing the relevant schema and set unevaluatedProperties to false in the NAND chip section to avoid spurious additions of random properties. Cc: Brian Norris Cc: Kamal Dasu Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-11-miquel.raynal@bootlin.com commit e37eaf5ebc5be693f76f9d53ea55828fe5af5ffb Author: Miquel Raynal Date: Mon Jun 19 11:29:08 2023 +0200 dt-bindings: mtd: meson: Prevent NAND chip unevaluated properties Ensure all raw NAND chip properties are valid by referencing the relevant schema and set unevaluatedProperties to false in the NAND chip section to avoid spurious additions of random properties. Cc: Liang Yang Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-10-miquel.raynal@bootlin.com commit d58d29623a8aa3f6b34f4c4fadf4c0de821fcbff Author: Miquel Raynal Date: Mon Jun 19 11:29:07 2023 +0200 dt-bindings: mtd: sunxi: Prevent NAND chip unevaluated properties nand-ecc-mode is a generic property which may apply to any raw NAND chip, it does not need to be listed in each controller description. Instead, let's reference the raw NAND chip description file which contains the property. The description contained "additionalProperties: false" which is wrong as other properties such as partitions might very well be added in the final .dts, and anyway needs to be converted into "unexpectedProperties: false" to fit the property change new requirements. Cc: Maxime Ripard Cc: Chen-Yu Tsai Cc: Jernej Skrabec Cc: Samuel Holland Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-9-miquel.raynal@bootlin.com commit 711be9c35a1a6c3d1303f9cbacb98580bcabbb71 Author: Miquel Raynal Date: Mon Jun 19 11:29:06 2023 +0200 dt-bindings: mtd: ingenic: Prevent NAND chip unevaluated properties List all the possible properties in the NAND chip as per the example and set unevaluatedProperties to false in the NAND chip section. Cc: Paul Cercueil Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-8-miquel.raynal@bootlin.com commit 7578bb1f9273aa47d540f71fef446118821784b1 Author: Miquel Raynal Date: Mon Jun 19 11:29:05 2023 +0200 dt-bindings: mtd: qcom: Prevent NAND chip unevaluated properties List all the possible properties in the NAND chip as per the example and set unevaluatedProperties to false in the NAND chip section. Cc: Manivannan Sadhasivam Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-7-miquel.raynal@bootlin.com commit 411a1215a07904cafbea683f4b2908f1310946a1 Author: Miquel Raynal Date: Mon Jun 19 11:29:04 2023 +0200 dt-bindings: mtd: qcom: Fix a property position qcom,boot-partitions is a NAND chip property, not a NAND controller property. Move the description of the property into the NAND chip section and just enable the property in the if/else block. Fixes: 5278cc93a97f ("dt-bindings: mtd: qcom_nandc: document qcom,boot-partitions binding") Cc: Manivannan Sadhasivam Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-6-miquel.raynal@bootlin.com commit efdd296323cdf6303a034ec85086c4b0b2234a71 Author: Miquel Raynal Date: Mon Jun 19 11:29:03 2023 +0200 dt-bindings: mtd: Describe nand-ecc-mode This property has been extensively used for almost two decades already, a lot of device trees use it, this is not the preferred way to configure the ECC engines but we cannot just ignore it. Describe the property, list the exact strings which have once been supported and mark it deprecated. Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-5-miquel.raynal@bootlin.com commit 17241a02a84ef748d4ab7386c5a25771b1fa7cc7 Author: Miquel Raynal Date: Mon Jun 19 11:29:02 2023 +0200 dt-bindings: mtd: Mark nand-ecc-placement deprecated The nand-ecc-placement property has been deprecated for a long time already, it does not really mean something useful for the ECC engines and is anyway in the vast majority of cases totally useless. Just mark it deprecated to avoid appealing people to use it. Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-4-miquel.raynal@bootlin.com commit 46721a1c9f829fe934eb1ec03e19b9e2896b995a Author: Miquel Raynal Date: Mon Jun 19 11:29:01 2023 +0200 dt-bindings: mtd: Create a file for raw NAND chip properties In an effort to constrain as much as we can the existing binding, we want to add "unevaluatedProperties: false" in all the NAND chip descriptions part of NAND controller bindings. But in order to do that properly, we also need to reference a file which contains all the "allowed" properties. Right now this file is nand-chip.yaml but in practice raw NAND controllers may use additional properties in their NAND chip children node. These properties are listed under nand-controller.yaml, which makes the "unevaluatedProperties" checks fail while the description are valid. We need to move these NAND chip related properties into another file, because we do not want to pollute nand-chip.yaml which is also referenced by eg. SPI-NAND devices. Let's create a raw-nand-chip.yaml file to reference all the properties a raw NAND chip description can contain. The chain of inheritance becomes: nand-controller.yaml <- raw-nand-chip.yaml raw-nand-chip.yaml <- nand-chip.yaml spi-nand.yaml <- nand-chip.yaml Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-3-miquel.raynal@bootlin.com commit da787688a5a08ece05a2f752d38b281fab8df846 Author: Miquel Raynal Date: Mon Jun 19 11:29:00 2023 +0200 dt-bindings: mtd: Accept nand related node names There is no addition there, but the mtd.yaml file is so generic, it can be referenced by a wide variety of devices, including nand ones which already define the node name to "nand@". Right now it does not lead to any failure but when we will constrain more the schema, this will become a problem because we want the mtd-wide properties like label or partitions to be available for the callers. Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/linux-mtd/20230619092916.3028470-2-miquel.raynal@bootlin.com commit efd2ed9351efefe40cbcca36a527adf38ffe1b4d Author: Bo Liu Date: Tue Jun 20 22:03:31 2023 -0400 mtd: sm_ftl: Fix typos in comments Fix typo in the description of the 'succesfull'. Signed-off-by: Bo Liu Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20230621020331.1508-1-wangdeming@inspur.com commit 2a3110e3f97ddc0f53bb766797b926a35edd07e6 Author: Andy Shevchenko Date: Wed Jun 21 19:26:26 2023 +0300 MAINTAINERS: Add bitfield.h to the BITMAP API record From time to time changes are tending to go to bitfield.h header while it may affect other bit operataions. Add bitfiled.h to the BITMAP API record. Signed-off-by: Andy Shevchenko Acked-by: Yury Norov Acked-by: Rasmus Villemoes Signed-off-by: Yury Norov commit f4bc6c12b0280077f799f2d50719ca52370ecb20 Author: Andy Shevchenko Date: Wed Jun 21 19:26:25 2023 +0300 MAINTAINERS: Add bits.h to the BITMAP API record >From time to time changes are tending to go to the bits.h headers while it may affect other bit operataions. Add the bits.h to the BITMAP API record. Signed-off-by: Andy Shevchenko Acked-by: Yury Norov Acked-by: Rasmus Villemoes Signed-off-by: Yury Norov commit 839cad5fa54bd6e4aad137f695ec6f90acb78728 Author: Randy Dunlap Date: Mon Jan 2 13:18:30 2023 -0800 cpumask: fix function description kernel-doc notation Use kernel-doc notation for the function description to prevent a warning: lib/cpumask.c:160: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Returns an arbitrary cpu within srcp1 & srcp2. Signed-off-by: Randy Dunlap Reviewed-by: Andy Shevchenko Signed-off-by: Yury Norov commit cdd2d06fbc0a58297f782c8eb7e2f3c0b1dc367e Author: Gavin Shan Date: Tue Jan 24 08:02:43 2023 +0800 nodemask: Drop duplicate check in for_each_node_mask() The return value type is changed from 'int' to 'unsigned int' since commit 0dfe54071d7c8 ("nodemask: Fix return values to be unsigned"). Besides, the conversion between 'int' and 'unsigned int' on the parameter @node is guaranteed to be safe due to the limited range of MAX_NUMNODES and CONFIG_NODES_SHIFT. By the way, '(node >= 0)' should have been '(node) >= 0' actually. It's unnecessary to check if their return values are greater or equal to 0 in for_each_node_mask(). Remove it. No functional change intended. Signed-off-by: Gavin Shan Reviewed-by: Andy Shevchenko Signed-off-by: Yury Norov commit c1d2ba10f594046831d14b03f194e8d05e78abad Author: Yury Norov Date: Mon Feb 27 11:24:36 2023 -0800 lib/bitmap: drop optimization of bitmap_{from,to}_arr64 bitmap_{from,to}_arr64() optimization is overly optimistic on 32-bit LE architectures when it's wired to bitmap_copy_clear_tail(). bitmap_copy_clear_tail() takes care of unused bits in the bitmap up to the next word boundary. But on 32-bit machines when copying bits from bitmap to array of 64-bit words, it's expected that the unused part of a recipient array must be cleared up to 64-bit boundary, so the last 4 bytes may stay untouched when nbits % 64 <= 32. While the copying part of the optimization works correct, that clear-tail trick makes corresponding tests reasonably fail: test_bitmap: bitmap_to_arr64(nbits == 1): tail is not safely cleared: 0xa5a5a5a500000001 (must be 0x0000000000000001) Fix it by removing bitmap_{from,to}_arr64() optimization for 32-bit LE arches. Reported-by: Guenter Roeck Link: https://lore.kernel.org/lkml/20230225184702.GA3587246@roeck-us.net/ Fixes: 0a97953fd221 ("lib: add bitmap_{from,to}_arr64") Signed-off-by: Yury Norov Tested-by: Guenter Roeck Reviewed-by: Andy Shevchenko Reviewed-by: Alexander Lobakin commit c4c14c290682e080da5cee81f4998062e1be274a Author: Yury Norov Date: Sat Feb 25 16:19:30 2023 -0800 lib/test_bitmap: increment failure counter properly The tests that don't use expect_eq() macro to determine that a test is failured must increment failed_tests explicitly. Reported-by: Guenter Roeck Link: https://lore.kernel.org/lkml/20230225184702.GA3587246@roeck-us.net/ Signed-off-by: Yury Norov Reviewed-by: Andy Shevchenko Reviewed-by: Alexander Lobakin commit 81621430c81bb7965c3d5807039bc2b5b3ec87ca Author: Tejun Heo Date: Thu Jun 22 08:51:14 2023 -1000 Revert "cgroup: Avoid -Wstringop-overflow warnings" This reverts commit 36de5f303ca1bd6fce74815ef17ef3d8ff8737b5. The commit caused boot failures on some configurations due to cgroup hierarchies not being created at all. Signed-off-by: Tejun Heo commit b7a0345723385c3cc0438cf4266ccc110dc7b583 Author: Maciej Fijalkowski Date: Tue Jun 13 13:35:52 2023 +0200 ice: use ice_down_up() where applicable ice_change_mtu() is currently using a separate ice_down() and ice_up() calls to reflect changed MTU. ice_down_up() serves this purpose, so do the refactoring here. Signed-off-by: Maciej Fijalkowski Reviewed-by: Przemek Kitszel Reviewed-by: Simon Horman Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 1dacc49782e67d4316b46329e416c24473c0369c Author: Christophe JAILLET Date: Sun Jun 11 22:44:13 2023 +0200 ice: Remove managed memory usage in ice_get_fw_log_cfg() There is no need to use managed memory allocation here. The memory is released at the end of the function. Use kzalloc()/kfree() to simplify the code. Signed-off-by: Christophe JAILLET Reviewed-by: Pavan Chebbi Reviewed-by: Jacob Keller Signed-off-by: Tony Nguyen commit 31b5a547622b3782388eb676081da1eefe5b98d2 Author: Johannes Berg Date: Thu Jun 22 19:44:22 2023 +0200 wifi: ieee80211: fix erroneous NSTR bitmap size checks The complete profile bit together with the NSTR link pair present bit indicate whether or not the NSTR bitmap is, the NSTR bitmap size just indicates how big it is. Fixes: 7b6f08771bf6 ("wifi: ieee80211: Support validating ML station profile length") Fixes: 5c1f97537bfb ("wifi: mac80211: store BSS param change count from assoc response") Reported-by: Dan Carpenter Signed-off-by: Johannes Berg commit fbc5669de62a452fb3a26a4560668637d5c9e7b5 Author: Anton Protopopov Date: Thu Jun 22 09:54:24 2023 +0000 bpf, docs: Document existing macros instead of deprecated The BTF_TYPE_SAFE_NESTED macro was replaced by the BTF_TYPE_SAFE_TRUSTED, BTF_TYPE_SAFE_RCU, and BTF_TYPE_SAFE_RCU_OR_NULL macros. Fix the docs correspondingly. Fixes: 6fcd486b3a0a ("bpf: Refactor RCU enforcement in the verifier.") Signed-off-by: Anton Protopopov Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20230622095424.1024244-1-aspsk@isovalent.com commit 2404dd01b53430e4ab78fc9ca069e9e93fd22059 Author: Anton Protopopov Date: Thu Jun 22 09:54:07 2023 +0000 bpf, docs: BPF Iterator Document Fix the description of the seq_info field of the bpf_iter_reg structure which was wrong due to an accidental copy/paste of the previous field's description. Fixes: 8972e18a439d ("bpf, docs: BPF Iterator Document") Signed-off-by: Anton Protopopov Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20230622095407.1024053-1-aspsk@isovalent.com commit 0d67bbc48c7397bc97fa91c9b9c66c6570451131 Author: Wilken Gottwalt Date: Thu Jun 22 17:09:28 2023 +0000 hwmon: (corsair-psu) add support for reading PWM values and mode Add support for reading PWM values and mode, and update documentation accordingly. Signed-off-by: Wilken Gottwalt Link: https://lore.kernel.org/r/ZJSASByXpzoZ0XyH@monster.localdomain Signed-off-by: Guenter Roeck commit dd5219ce4f295a129ee38baff308f9c1e4f0761b Author: Guenter Roeck Date: Wed Jun 14 09:36:05 2023 -0700 hwmon: (pmbus/adm1275) Disable ADC while updating PMON_CONFIG According to ADI, changing PMON_CONFIG while the ADC is running can have unexpected results. ADI recommends halting the ADC with PMON_CONTROL before setting PMON_CONFIG and then resume after. Follow ADI recommendation and disable ADC while PMON_CONFIG is updated. Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/20230614163605.3688964-3-linux@roeck-us.net Signed-off-by: Guenter Roeck commit 98ac8af4e7b2f260236cf468762450630e73eb67 Author: Guenter Roeck Date: Wed Jun 14 09:36:04 2023 -0700 hwmon: (pmbus/adm1275) Prepare for protected write to PMON_CONFIG According to ADI, changing PMON_CONFIG while ADC is running can have unexpected results. ADI recommends halting the ADC with PMON_CONTROL before setting PMON_CONFIG and then resume after. To prepare for this change, rename adm1275_read_pmon_config() and adm1275_write_pmon_config() to adm1275_read_samples() and adm1275_write_samples() to more accurately reflect the functionality of the code. Introduce new function adm1275_write_pmon_config() and use it for all code writing into the PMON_CONFIG register. Signed-off-by: Guenter Roeck Link: https://lore.kernel.org/r/20230614163605.3688964-2-linux@roeck-us.net Signed-off-by: Guenter Roeck commit a7555f6b62e7f5b3a3b783cc6d4c4dafcb8527c8 Author: Guo Ren Date: Tue Jun 13 21:30:18 2023 -0400 riscv: stack: Add config of thread stack size The commit 0cac21b02ba5 ("riscv: use 16KB kernel stack on 64-bit") increases the thread size mandatory, but some scenarios, such as D1 with a small memory footprint, would suffer from that. After independent irq stack support, let's give users a choice to determine their custom stack size. Link: https://lore.kernel.org/linux-riscv/5f6e6c39-b846-4392-b468-02202404de28@www.fastmail.com/ Suggested-by: Arnd Bergmann Tested-by: Jisheng Zhang Signed-off-by: Guo Ren Signed-off-by: Guo Ren Link: https://lore.kernel.org/r/20230614013018.2168426-4-guoren@kernel.org Signed-off-by: Palmer Dabbelt commit dd69d07a5a6c5a9ada85321ab0695e7978fc6f3e Author: Guo Ren Date: Tue Jun 13 21:30:17 2023 -0400 riscv: stack: Support HAVE_SOFTIRQ_ON_OWN_STACK Add the HAVE_SOFTIRQ_ON_OWN_STACK feature for the IRQ_STACKS config, and the irq and softirq use the same irq_stack of percpu. Tested-by: Jisheng Zhang Signed-off-by: Guo Ren Signed-off-by: Guo Ren Link: https://lore.kernel.org/r/20230614013018.2168426-3-guoren@kernel.org Signed-off-by: Palmer Dabbelt commit 163e76cc6ef43b7a5e9b6e245a6d6667c9d9b4a7 Author: Guo Ren Date: Tue Jun 13 21:30:16 2023 -0400 riscv: stack: Support HAVE_IRQ_EXIT_ON_IRQ_STACK Add independent irq stacks for percpu to prevent kernel stack overflows. It is also compatible with VMAP_STACK by arch_alloc_vmap_stack. Tested-by: Jisheng Zhang Signed-off-by: Guo Ren Signed-off-by: Guo Ren Cc: Clément Léger Link: https://lore.kernel.org/r/20230614013018.2168426-2-guoren@kernel.org Signed-off-by: Palmer Dabbelt commit 7947540d1d1e76297869921ed601e2f47fa6f27d Author: Gustavo A. R. Silva Date: Thu Jun 22 10:46:33 2023 -0600 fbdev: sh7760fb: Fix -Wimplicit-fallthrough warnings Fix the following fallthrough warnings seen after building sh architecture with sh7763rdp_defconfig configuration: drivers/video/fbdev/sh7760fb.c: In function 'sh7760fb_get_color_info': drivers/video/fbdev/sh7760fb.c:138:23: warning: this statement may fall through [-Wimplicit-fallthrough=] 138 | lgray = 1; | ~~~~~~^~~ drivers/video/fbdev/sh7760fb.c:139:9: note: here 139 | case LDDFR_4BPP: | ^~~~ drivers/video/fbdev/sh7760fb.c:143:23: warning: this statement may fall through [-Wimplicit-fallthrough=] 143 | lgray = 1; | ~~~~~~^~~ drivers/video/fbdev/sh7760fb.c:144:9: note: here 144 | case LDDFR_8BPP: | ^~~~ Signed-off-by: Gustavo A. R. Silva Signed-off-by: Helge Deller commit 47fa0fac9bb5e525c5fa67bf06f3f663cf999841 Author: Geert Uytterhoeven Date: Thu Jun 22 11:28:48 2023 +0200 fbdev: sh_mobile_lcdcfb: Fix ARGB32 overlay format typo When configurating a CHn Source Image Format Register (LDBBSIFR), one should use the corresponding LDBBSIFR_RPKF_* definition for overlay planes, not the DDFR_PKF_* definition for the primary plane. Fortunately both definitions resolve to the same value, so this bug did not cause any harm. Signed-off-by: Geert Uytterhoeven Reviewed-by: Laurent Pinchart Signed-off-by: Helge Deller commit ad667d626825383b626ad6ed38d6205618abb115 Author: Przemek Kitszel Date: Wed May 31 14:38:40 2023 +0200 ice: remove null checks before devm_kfree() calls We all know they are redundant. Reviewed-by: Michal Swiatkowski Reviewed-by: Michal Wilczynski Reviewed-by: Simon Horman Signed-off-by: Przemek Kitszel Tested-by: Arpana Arland (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit f98277479ad85ff1398e11c1e944ba97c3917393 Author: Przemek Kitszel Date: Wed May 31 14:36:42 2023 +0200 ice: clean up freeing SR-IOV VFs The check for existing VFs was redundant since very inception of SR-IOV sysfs interface in the kernel, see commit 1789382a72a5 ("PCI: SRIOV control and status via sysfs"). Reviewed-by: Michal Swiatkowski Reviewed-by: Simon Horman Signed-off-by: Przemek Kitszel Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 469748429ac81f0a6a344637fc9d3b1d16a9f3d8 Author: Maciej Fijalkowski Date: Thu Jun 15 13:33:26 2023 +0200 ice: allow hot-swapping XDP programs Currently ice driver's .ndo_bpf callback brings interface down and up independently of XDP resources' presence. This is only needed when either these resources have to be configured or removed. It means that if one is switching XDP programs on-the-fly with running traffic, packets will be dropped. To avoid this, compare early on ice_xdp_setup_prog() state of incoming bpf_prog pointer vs the bpf_prog pointer that is already assigned to VSI. Do the swap in case VSI has bpf_prog and incoming one are non-NULL. Lastly, while at it, put old bpf_prog *after* the update of Rx ring's bpf_prog pointer. In theory previous code could expose us to a state where Rx ring's bpf_prog would still be referring to old_prog that got released with earlier bpf_prog_put(). Signed-off-by: Maciej Fijalkowski Acked-by: Toke Høiland-Jørgensen Reviewed-by: Alexander Lobakin Tested-by: Chandan Kumar Rout (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen commit a734c43caa4d9a08da521be1a2135cadf1510e75 Author: Jacob Keller Date: Tue Jun 13 13:40:53 2023 -0700 ice: reduce initial wait for control queue messages The ice_sq_send_cmd() function is used to send messages to the control queues used to communicate with firmware, virtual functions, and even some hardware. When sending a control queue message, the driver is designed to synchronously wait for a response from the queue. Currently it waits between checks for 100 to 150 microseconds. Commit f86d6f9c49f6 ("ice: sleep, don't busy-wait, for ICE_CTL_Q_SQ_CMD_TIMEOUT") did recently change the behavior from an unnecessary delay into a sleep which is a significant improvement over the old behavior of polling using udelay. Because of the nature of PCIe transactions, the hardware won't be informed about a new message until the write to the tail register posts. This is only guaranteed to occur at the next register read. In ice_sq_send_cmd(), this happens at the ice_sq_done() call. Because of this, the driver essentially forces a minimum of one full wait time regardless of how fast the response is. For the hardware-based sideband queue, this is especially slow. It is expected that the hardware will respond within 2 or 3 microseconds, an order of magnitude faster than the 100-150 microsecond sleep. Allow such fast completions to occur without delay by introducing a small 5 microsecond delay first before entering the sleeping timeout loop. Ensure the tail write has been posted by using ice_flush(hw) first. While at it, lets also remove the ICE_CTL_Q_SQ_CMD_USEC macro as it obscures the sleep time in the inner loop. It was likely introduced to avoid "magic numbers", but in practice sleep and delay values are easier to read and understand when using actual numbers instead of a named constant. This change should allow the fast hardware based control queue messages to complete quickly without delay, while slower firmware queue response times will sleep while waiting for the response. Signed-off-by: Jacob Keller Reviewed-by: Michal Schmidt Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 192df2aa0113ddddee2a93e453ff46610807b425 Author: Oliver Upton Date: Thu Jun 22 16:09:22 2023 +0000 KVM: arm64: Fix misuse of KVM_ARM_VCPU_POWER_OFF bit index KVM_ARM_VCPU_POWER_OFF is as bit index, _not_ a literal bitmask. Nonetheless, commit e3c1c0cae31e ("KVM: arm64: Relax invariance of KVM_ARM_VCPU_POWER_OFF") started using it that way, meaning that powering off a vCPU with the KVM_ARM_VCPU_INIT ioctl is completely broken. Fix it by using a shifted bit for the bitwise operations instead. Reported-by: Dan Carpenter Fixes: e3c1c0cae31e ("KVM: arm64: Relax invariance of KVM_ARM_VCPU_POWER_OFF") Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20230622160922.1925530-1-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 01fa9edd8bcf1c4fe330ea000c3da9ecf76c76a0 Author: Valentin Caron Date: Wed Jun 21 13:55:23 2023 +0200 spi: dt-bindings: stm32: do not disable spi-slave property for stm32f4-f7 STM32F4-F7 are, from hardware point of view, capable to handle device mode. So this property should not be forced at false in dt-bindings. Signed-off-by: Valentin Caron Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/Message-Id: <20230621115523.923176-3-valentin.caron@foss.st.com> Signed-off-by: Mark Brown commit 82f76ac26c601c5b0c0db7f69500efc42f2ee7ed Author: Srinivas Kandagatla Date: Thu Mar 2 12:03:27 2023 +0000 ASoC: qcom: common: add default jack dapm pins If the soundcard does not specify the dapm pins, let the common code add these pins for jack. Signed-off-by: Srinivas Kandagatla Tested-by: Johan Hovold Link: https://lore.kernel.org/r/Message-Id: <20230302120327.10823-1-srinivas.kandagatla@linaro.org> Signed-off-by: Mark Brown commit 012fa2622e30675f61413485785e708ba02be78b Author: Arnd Bergmann Date: Thu Jun 22 12:12:22 2023 +0200 ASoC: loongson: fix address space confusion The i2s driver uses the mapped __iomem address of the FIFO as the DMA address for the device. This apparently works on loongarch because of the way it handles __iomem pointers as aliases of physical addresses, but this is not portable to other architectures and causes a compiler warning when dma addresses are not the same size as pointers: sound/soc/loongson/loongson_i2s_pci.c: In function 'loongson_i2s_pci_probe': sound/soc/loongson/loongson_i2s_pci.c:110:29: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast] 110 | tx_data->dev_addr = (dma_addr_t)i2s->reg_base + LS_I2S_TX_DATA; | ^ sound/soc/loongson/loongson_i2s_pci.c:113:29: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast] 113 | rx_data->dev_addr = (dma_addr_t)i2s->reg_base + LS_I2S_RX_DATA; | ^ Change the driver to instead use the physical address as stored in the PCI BAR resource directly. Since 'dev_addr' is a 32-bit address, I think this results in the same truncated address on loongarch but is otherwise closer to portable code and avoids the warning. Fixes: d84881e06836d ("ASoC: Add support for Loongson I2S controller") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/Message-Id: <20230622101235.3230941-1-arnd@kernel.org> Signed-off-by: Mark Brown commit b2c28785b125acb28a681462510297410cbbabd7 Author: Rob Herring Date: Wed Jun 21 17:10:44 2023 -0600 ASoC: dt-bindings: microchip,sama7g5-pdmc: Simplify "microchip,mic-pos" constraints "enum" values should be integers or strings, not arrays (though json-schema does allow arrays, we do not). In this case, all possible combinations are allowed anyways, so there's little point in expressing as an array. Signed-off-by: Rob Herring Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/Message-Id: <20230621231044.3816914-1-robh@kernel.org> Signed-off-by: Mark Brown commit f47d43283a4233528683deaaba95f0ee2cfe862d Author: Sameer Pujar Date: Thu Jun 22 17:04:14 2023 +0530 ASoC: tegra: Remove stale comments in AHUB Remove stale comments in AHUB driver which is related to DAPM widgets and routes. This is misleading otherwise. Signed-off-by: Sameer Pujar Link: https://lore.kernel.org/r/Message-Id: <1687433656-7892-7-git-send-email-spujar@nvidia.com> Signed-off-by: Mark Brown commit 2cc41db71a434844ca97b6e30c9a30a2464a996e Author: Sameer Pujar Date: Thu Jun 22 17:04:13 2023 +0530 ASoC: tegra: Use normal system sleep for ASRC Align with other AHUB module drivers and use normal system sleep for ASRC as well. Signed-off-by: Sameer Pujar Link: https://lore.kernel.org/r/Message-Id: <1687433656-7892-6-git-send-email-spujar@nvidia.com> Signed-off-by: Mark Brown commit a4aadf0f5905661cd25c366b96cc1c840f05b756 Author: Przemek Kitszel Date: Wed Jun 21 08:54:05 2023 -0700 iavf: make functions static where possible Make all possible functions static. Move iavf_force_wb() up to avoid forward declaration. Suggested-by: Maciej Fijalkowski Reviewed-by: Maciej Fijalkowski Signed-off-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit b855bcdeb89777ff255bedf8f1330aac9b26b405 Author: Przemek Kitszel Date: Thu Jun 15 07:03:08 2023 -0400 iavf: remove some unused functions and pointless wrappers Remove iavf_aq_get_rss_lut(), iavf_aq_get_rss_key(), iavf_vf_reset(). Remove some "OS specific memory free for shared code" wrappers ;) Signed-off-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit 61f723e6f3d20f3276c678cd346de5ea86b8e5d3 Author: Przemek Kitszel Date: Mon Jun 19 04:06:35 2023 -0400 iavf: fix err handling for MAC replace Defer removal of current primary MAC until a replacement is successfully added. Previous implementation would left filter list with no primary MAC. This was found while reading the code. The patch takes advantage of the fact that there can only be a single primary MAC filter at any time ([1] by Piotr) Piotr has also applied some review suggestions during our internal patch submittal process. [1] https://lore.kernel.org/netdev/20230614145302.902301-2-piotrx.gardocki@intel.com/ Reviewed-by: Michal Swiatkowski Tested-by: Rafal Romanowski Signed-off-by: Piotr Gardocki Signed-off-by: Przemek Kitszel Reviewed-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen commit 4e302336d5ca1767a06beee7596a72d3bdc8d983 Author: Yogesh Date: Thu Jun 22 00:07:03 2023 +0530 fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:1965:6 index -84 is out of range for type 's8[341]' (aka 'signed char[341]') CPU: 1 PID: 4995 Comm: syz-executor146 Not tainted 6.4.0-rc6-syzkaller-00037-gb6dad5178cea #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAllocDmapLev+0x3e5/0x430 fs/jfs/jfs_dmap.c:1965 dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1809 dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1350 dbAlloc+0x658/0xca0 fs/jfs/jfs_dmap.c:874 dtSplitUp fs/jfs/jfs_dtree.c:974 [inline] dtInsert+0xda7/0x6b00 fs/jfs/jfs_dtree.c:863 jfs_create+0x7b6/0xbb0 fs/jfs/namei.c:137 lookup_open fs/namei.c:3492 [inline] open_last_lookups fs/namei.c:3560 [inline] path_openat+0x13df/0x3170 fs/namei.c:3788 do_filp_open+0x234/0x490 fs/namei.c:3818 do_sys_openat2+0x13f/0x500 fs/open.c:1356 do_sys_open fs/open.c:1372 [inline] __do_sys_openat fs/open.c:1388 [inline] __se_sys_openat fs/open.c:1383 [inline] __x64_sys_openat+0x247/0x290 fs/open.c:1383 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f1f4e33f7e9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc21129578 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1f4e33f7e9 RDX: 000000000000275a RSI: 0000000020000040 RDI: 00000000ffffff9c RBP: 00007f1f4e2ff080 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1f4e2ff110 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 The bug occurs when the dbAllocDmapLev()function attempts to access dp->tree.stree[leafidx + LEAFIND] while the leafidx value is negative. To rectify this, the patch introduces a safeguard within the dbAllocDmapLev() function. A check has been added to verify if leafidx is negative. If it is, the function immediately returns an I/O error, preventing any further execution that could potentially cause harm. Tested via syzbot. Reported-by: syzbot+853a6f4dfa3cf37d3aea@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=ae2f5a27a07ae44b0f17 Signed-off-by: Yogesh Signed-off-by: Dave Kleikamp commit 23d28cc0444be3f694eb986cd653b6888b78431d Author: Hans de Goede Date: Tue Jun 20 20:45:04 2023 +0200 ACPI: video: Add backlight=native DMI quirk for Dell Studio 1569 The Dell Studio 1569 predates Windows 8, so it defaults to using acpi_video# for backlight control, but this is non functional on this model. Add a DMI quirk to use the native intel_backlight interface which does work properly. Reported-by: raycekarneal Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki commit 3f711c249032fee954e92e4d04c8cd2744994291 Merge: 57cf6633f3853 6a8b7e8010541 Author: Arnd Bergmann Date: Thu Jun 22 17:35:09 2023 +0200 Merge tag 'optee-use-kmemdup-for-6.5' of https://git.linaro.org/people/jens.wiklander/linux-tee into soc/drivers Use kmemdup() in OP-TEE driver * tag 'optee-use-kmemdup-for-6.5' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: optee: Use kmemdup() to replace kmalloc + memcpy Link: https://lore.kernel.org/r/20230615130049.GA979203@rayden Signed-off-by: Arnd Bergmann commit 57cf6633f3853591b92019533e19bca543ec619f Merge: 2d0d3a1004076 6a66fb9ffe7b4 Author: Arnd Bergmann Date: Thu Jun 22 17:34:02 2023 +0200 Merge tag 'memory-controller-drv-6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers Memory controller drivers for v6.5 1. Renesas RPC IF: correct the Strobe Timing Adjustment. 2. Broadcom DPFE: fix smatch warning for testing array offset after use. 3. Atmel SDRAMC: drop driver because it was just a wrapper over enabling clock which is not handled by its clock controller. 4. Minor bindings cleanup. * tag 'memory-controller-drv-6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl: dt-bindings: memory-controllers: drop unneeded quotes memory: atmel-sdramc: remove the driver memory: brcmstb_dpfe: fix testing array offset after use memory: renesas-rpc-if: Fix PHYCNT.STRTIM setting Link: https://lore.kernel.org/r/20230612175508.288775-1-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 2d0d3a1004076b97627f5910f6a4600c52434bd1 Merge: 618d12930905e aaffb4cacd4c5 Author: Arnd Bergmann Date: Thu Jun 22 17:33:11 2023 +0200 Merge tag 'scmi-updates-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers Arm SCMI updates for v6.5 Couple of main additions :- 1. Support for multiple SMC/HVC transports for SCMI: Some platforms need to support multiple SCMI instances within a platform(more commonly in a VM). The same SMC/HVC FID is used with all the instances. The platform or the hypervisor needs a way to distinguish among SMC/HVC calls made from different instances. This change adds support for passing shmem channel address as the parameters in the SMC/HVC call. The address is split into 4KB-page and offset for simiplicity. 2. Addition od SCMI v3.2 explicit powercap enable/disable support: SCMI v3.2 specification introduces support to disable powercapping as a whole on the desired zones. This change adds the needed support to the core SCMI powercap protocol, exposing enable/disable protocol operations and then wiring up the new operartions in the related powercap framework helpers. * tag 'scmi-updates-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: powercap: arm_scmi: Add support for disabling powercaps on a zone firmware: arm_scmi: Add Powercap protocol enable support firmware: arm_scmi: Refactor the internal powercap get/set helpers firmware: arm_scmi: Augment SMC/HVC to allow optional parameters dt-bindings: firmware: arm,scmi: support for parameter in smc/hvc call Link: https://lore.kernel.org/r/20230612121017.4108104-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 618d12930905eb237383dcbc3b7113688dc414c0 Merge: 3a00b1c40626c a10b3841f9017 Author: Arnd Bergmann Date: Thu Jun 22 17:32:19 2023 +0200 Merge tag 'v6.5-rockchip-drivers1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/drivers An addition to the rk3588 power-domains, some new syscon compatibles for rk3588-based "General-register-files" register areas and a move to C99 array inits for the dtpm driver to fix sparse warnings. * tag 'v6.5-rockchip-drivers1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: soc: rockchip: dtpm: use C99 array init syntax dt-bindings: soc: rockchip: add rk3588 pipe-phy syscon dt-bindings: soc: rockchip: add rk3588 usb2phy syscon soc: rockchip: power-domain: add rk3588 mem module support Link: https://lore.kernel.org/r/10286366.nUPlyArG6x@phil Signed-off-by: Arnd Bergmann commit c1d57ee6eb99699f5ccd92fc6e8c5a79103dcaae Author: Linus Walleij Date: Wed Jun 14 11:30:32 2023 +0200 ARM: omap2: Fix copy/paste bug I mistyped one of the SD/MMC GPIO lines on the Nokia n810 which was supposed to be "vio" as "vsd". Fix it up. Reported-by: Peter Vasil Signed-off-by: Linus Walleij Reviewed-by: Tony Lindgren Link: https://lore.kernel.org/r/20230614093032.403982-1-linus.walleij@linaro.org Signed-off-by: Arnd Bergmann commit 00896810337e73f40af31f9818bfaa3e46fef917 Merge: 11ca605653480 825edae7d1c39 Author: Arnd Bergmann Date: Thu Jun 22 17:28:18 2023 +0200 Merge tag 'arm-soc/for-6.5/maintainers' of https://github.com/Broadcom/stblinux into soc/arm This pull request contains MAINTAINERS file updates for 6.5, please pull the following: - Justin, Kamal and Florian update their email to use their corporate Broadcom email address * tag 'arm-soc/for-6.5/maintainers' of https://github.com/Broadcom/stblinux: MAINTAINERS: Replace my email address MAINTAINERS: Replace my email address MAINTAINERS: Replace my email address Signed-off-by: Arnd Bergmann commit c789ad7cbebcac5d5f417296c140a1252c689524 Author: Vinicius Costa Gomes Date: Wed Jun 7 14:32:32 2023 -0700 igc: Work around HW bug causing missing timestamps There's an hardware issue that can cause missing timestamps. The bug is that the interrupt is only cleared if the IGC_TXSTMPH_0 register is read. The bug can cause a race condition if a timestamp is captured at the wrong time, and we will miss that timestamp. To reduce the time window that the problem is able to happen, in case no timestamp was ready, we read the "previous" value of the timestamp registers, and we compare with the "current" one, if it didn't change we can be reasonably sure that no timestamp was captured. If they are different, we use the new value as the captured timestamp. The HW bug is not easy to reproduce, got to reproduce it when smashing the NIC with timestamping requests from multiple applications (e.g. multiple ntpperf instances + ptp4l), after 10s of minutes. This workaround has more impact when multiple timestamp registers are used, and the IGC_TXSTMPH_0 register always need to be read, so the interrupt is cleared. Fixes: 2c344ae24501 ("igc: Add support for TX timestamping") Signed-off-by: Vinicius Costa Gomes Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit afa141583d82725f682b2fa762cb36a07f58b3f3 Author: Vinicius Costa Gomes Date: Wed Jun 7 14:32:31 2023 -0700 igc: Retrieve TX timestamp during interrupt handling When the interrupt is handled, the TXTT_0 bit in the TSYNCTXCTL register should already be set and the timestamp value already loaded in the appropriate register. This simplifies the handling, and reduces the latency for retrieving the TX timestamp, which increase the amount of TX timestamps that can be handled in a given time period. As the "work" function doesn't run in a workqueue anymore, rename it to something more sensible, a event handler. Using ntpperf[1] we can see the following performance improvements: Before: $ sudo ./ntpperf -i enp3s0 -m 10:22:22:22:22:21 -d 192.168.1.3 -s 172.18.0.0/16 -I -H -o -37 | responses | TX timestamp offset (ns) rate clients | lost invalid basic xleave | min mean max stddev 1000 100 0.00% 0.00% 0.00% 100.00% -56 +9 +52 19 1500 150 0.00% 0.00% 0.00% 100.00% -40 +30 +75 22 2250 225 0.00% 0.00% 0.00% 100.00% -11 +29 +72 15 3375 337 0.00% 0.00% 0.00% 100.00% -18 +40 +88 22 5062 506 0.00% 0.00% 0.00% 100.00% -19 +23 +77 15 7593 759 0.00% 0.00% 0.00% 100.00% +7 +47 +5168 43 11389 1138 0.00% 0.00% 0.00% 100.00% -11 +41 +5240 39 17083 1708 0.00% 0.00% 0.00% 100.00% +19 +60 +5288 50 25624 2562 0.00% 0.00% 0.00% 100.00% +1 +56 +5368 58 38436 3843 0.00% 0.00% 0.00% 100.00% -84 +12 +8847 66 57654 5765 0.00% 0.00% 100.00% 0.00% 86481 8648 0.00% 0.00% 100.00% 0.00% 129721 12972 0.00% 0.00% 100.00% 0.00% 194581 16384 0.00% 0.00% 100.00% 0.00% 291871 16384 27.35% 0.00% 72.65% 0.00% 437806 16384 50.05% 0.00% 49.95% 0.00% After: $ sudo ./ntpperf -i enp3s0 -m 10:22:22:22:22:21 -d 192.168.1.3 -s 172.18.0.0/16 -I -H -o -37 | responses | TX timestamp offset (ns) rate clients | lost invalid basic xleave | min mean max stddev 1000 100 0.00% 0.00% 0.00% 100.00% -44 +0 +61 19 1500 150 0.00% 0.00% 0.00% 100.00% -6 +39 +81 16 2250 225 0.00% 0.00% 0.00% 100.00% -22 +25 +69 15 3375 337 0.00% 0.00% 0.00% 100.00% -28 +15 +56 14 5062 506 0.00% 0.00% 0.00% 100.00% +7 +78 +143 27 7593 759 0.00% 0.00% 0.00% 100.00% -54 +24 +144 47 11389 1138 0.00% 0.00% 0.00% 100.00% -90 -33 +28 21 17083 1708 0.00% 0.00% 0.00% 100.00% -50 -2 +35 14 25624 2562 0.00% 0.00% 0.00% 100.00% -62 +7 +66 23 38436 3843 0.00% 0.00% 0.00% 100.00% -33 +30 +5395 36 57654 5765 0.00% 0.00% 100.00% 0.00% 86481 8648 0.00% 0.00% 100.00% 0.00% 129721 12972 0.00% 0.00% 100.00% 0.00% 194581 16384 19.50% 0.00% 80.50% 0.00% 291871 16384 35.81% 0.00% 64.19% 0.00% 437806 16384 55.40% 0.00% 44.60% 0.00% [1] https://github.com/mlichvar/ntpperf Signed-off-by: Vinicius Costa Gomes Reviewed-by: Kurt Kanzenbach Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit ce58c7cc8b9910f2bc1d038d7ba60c3f011b2cb2 Author: Vinicius Costa Gomes Date: Wed Jun 7 14:32:30 2023 -0700 igc: Check if hardware TX timestamping is enabled earlier Before requesting a packet transmission to be hardware timestamped, check if the user has TX timestamping enabled. Fixes an issue that if a packet was internally forwarded to the NIC, and it had the SKBTX_HW_TSTAMP flag set, the driver would mark that timestamp as skipped. In reality, that timestamp was "not for us", as TX timestamp could never be enabled in the NIC. Checking if the TX timestamping is enabled earlier has a secondary effect that when TX timestamping is disabled, there's no need to check for timestamp timeouts. We should only take care to free any pending timestamp when TX timestamping is disabled, as that skb would never be released otherwise. Fixes: 2c344ae24501 ("igc: Add support for TX timestamping") Suggested-by: Vladimir Oltean Signed-off-by: Vinicius Costa Gomes Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit 9c50e2b150c8ee0eee5f8154e2ad168cdd748877 Author: Vinicius Costa Gomes Date: Wed Jun 7 14:32:29 2023 -0700 igc: Fix race condition in PTP tx code Currently, the igc driver supports timestamping only one tx packet at a time. During the transmission flow, the skb that requires hardware timestamping is saved in adapter->ptp_tx_skb. Once hardware has the timestamp, an interrupt is delivered, and adapter->ptp_tx_work is scheduled. In igc_ptp_tx_work(), we read the timestamp register, update adapter->ptp_tx_skb, and notify the network stack. While the thread executing the transmission flow (the user process running in kernel mode) and the thread executing ptp_tx_work don't access adapter->ptp_tx_skb concurrently, there are two other places where adapter->ptp_tx_skb is accessed: igc_ptp_tx_hang() and igc_ptp_suspend(). igc_ptp_tx_hang() is executed by the adapter->watchdog_task worker thread which runs periodically so it is possible we have two threads accessing ptp_tx_skb at the same time. Consider the following scenario: right after __IGC_PTP_TX_IN_PROGRESS is set in igc_xmit_frame_ring(), igc_ptp_tx_hang() is executed. Since adapter->ptp_tx_start hasn't been written yet, this is considered a timeout and adapter->ptp_tx_skb is cleaned up. This patch fixes the issue described above by adding the ptp_tx_lock to protect access to ptp_tx_skb and ptp_tx_start fields from igc_adapter. Since igc_xmit_frame_ring() called in atomic context by the networking stack, ptp_tx_lock is defined as a spinlock, and the irq safe variants of lock/unlock are used. With the introduction of the ptp_tx_lock, the __IGC_PTP_TX_IN_PROGRESS flag doesn't provide much of a use anymore so this patch gets rid of it. Fixes: 2c344ae24501 ("igc: Add support for TX timestamping") Signed-off-by: Andre Guedes Signed-off-by: Vinicius Costa Gomes Reviewed-by: Kurt Kanzenbach Tested-by: Naama Meir Signed-off-by: Tony Nguyen commit 4dd595c34c4bb22c16a76206a18c13e4e194335d Author: Sohil Mehta Date: Wed Jun 21 22:36:00 2023 +0000 syscalls: Remove file path comments from headers Source file locations for syscall definitions can change over a period of time. File paths in comments get stale and are hard to maintain long term. Also, their usefulness is questionable since it would be easier to locate a syscall definition using the SYSCALL_DEFINEx() macro. Remove all source file path comments from the syscall headers. Also, equalize the uneven line spacing (some of which is introduced due to the deletions). Signed-off-by: Sohil Mehta Signed-off-by: Arnd Bergmann commit 648fa60fa7de3ca6f6303e1721591ad73def9cf0 Author: Christoph Hellwig Date: Thu Jun 22 17:06:44 2023 +0200 block: don't return -EINVAL for not found names in devt_from_devname When we didn't find a device and didn't guess it might be a partition, it might still show up later, so don't disable rootwait for it by returning -EINVAL. Fixes: 079caa35f786 ("init: clear root_wait on all invalid root= strings") Reported-by: Guenter Roeck Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230622150644.600327-1-hch@lst.de Signed-off-by: Jens Axboe commit 0526b56cbc3c489642bd6a5fe4b718dea7ef0ee8 Author: Tiezhu Yang Date: Thu Jun 22 22:13:39 2023 +0800 tools arch: Remove uapi bitsperlong.h of hexagon and microblaze After the following two commits: commit 872e24d5c698 ("hexagon: remove asm/bitsperlong.h") commit 83f0124ad81e ("microblaze: remove asm-generic wrapper headers") the arch-specific headers of hexagon and microblaze have been removed, the tools arch uapi headers are useless too, remove them. Signed-off-by: Tiezhu Yang Signed-off-by: Arnd Bergmann commit 8386f58f8deda81110283798a387fb53ec21957c Author: Tiezhu Yang Date: Thu Jun 22 22:13:38 2023 +0800 asm-generic: Unify uapi bitsperlong.h for arm64, riscv and loongarch Now we specify the minimal version of GCC as 5.1 and Clang/LLVM as 11.0.0 in Documentation/process/changes.rst, __CHAR_BIT__ and __SIZEOF_LONG__ are usable, it is probably fine to unify the definition of __BITS_PER_LONG as (__CHAR_BIT__ * __SIZEOF_LONG__) in asm-generic uapi bitsperlong.h. In order to keep safe and avoid regression, only unify uapi bitsperlong.h for some archs such as arm64, riscv and loongarch which are using newer toolchains that have the definitions of __CHAR_BIT__ and __SIZEOF_LONG__. Suggested-by: Xi Ruoyao Link: https://lore.kernel.org/all/d3e255e4746de44c9903c4433616d44ffcf18d1b.camel@xry111.site/ Suggested-by: Arnd Bergmann Link: https://lore.kernel.org/linux-arch/a3a4f48a-07d4-4ed9-bc53-5d383428bdd2@app.fastmail.com/ Signed-off-by: Tiezhu Yang Signed-off-by: Arnd Bergmann commit f50a000b42195a0e0d22c34c16b7c488b22063a2 Author: Jacky Huang Date: Thu Jun 22 14:13:43 2023 +0000 clk: nuvoton: Use clk_parent_data instead of string for parent clock For the declaration of parent clocks, use struct clk_parent_data instead of a string. Due to the change in the passed arguments, replace the usage of devm_clk_hw_register_mux() with clk_hw_register_mux_parent_data() for all cases. Signed-off-by: Jacky Huang Signed-off-by: Arnd Bergmann commit ebd617b675438a75d773833f5d87b70fbdb88e96 Author: Jacky Huang Date: Thu Jun 22 14:13:42 2023 +0000 clk: nuvoton: Update all constant hex values to lowercase The constant hex values used to define register offsets were written in uppercase. This patch update all these constant hex values to be lowercase. Signed-off-by: Jacky Huang Signed-off-by: Arnd Bergmann commit a5e3f37217b7b028c87f7bb73b199e65d346e51a Author: Jacky Huang Date: Thu Jun 22 14:13:41 2023 +0000 clk: nuvoton: Add clk-ma35d1.h for driver extern functions Moved the declaration of extern functions ma35d1_reg_clk_pll() and ma35d1_reg_adc_clkdiv() from the .c files to the newly created header file clk-ma35d1.h. Signed-off-by: Jacky Huang Signed-off-by: Arnd Bergmann commit 4481913607e58196c48a4fef5e6f45350684ec3c Author: Yunxiang Li Date: Thu Jun 22 10:18:03 2023 -0400 drm/ttm: fix bulk_move corruption when adding a entry When the resource is the first in the bulk_move range, adding it again (thus moving it to the tail) will corrupt the list since the first pointer is not moved. This eventually lead to null pointer deref in ttm_lru_bulk_move_del() Fixes: fee2ede15542 ("drm/ttm: rework bulk move handling v5") Signed-off-by: Yunxiang Li Reviewed-by: Christian König CC: stable@vger.kernel.org Link: https://patchwork.freedesktop.org/patch/msgid/20230622141902.28718-3-Yunxiang.Li@amd.com Signed-off-by: Christian König commit b97aec082b51a0728adc9f69494826d32e0d1f8f Author: Donglin Peng Date: Sat Apr 8 05:42:19 2023 -0700 riscv: ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL The previous patch ("function_graph: Support recording and printing the return value of function") has laid the groundwork for the for the funcgraph-retval, and this modification makes it available on the RISC-V platform. We introduce a new structure called fgraph_ret_regs for the RISC-V platform to hold return registers and the frame pointer. We then fill its content in the return_to_handler and pass its address to the function ftrace_return_to_handler to record the return value. Link: https://lore.kernel.org/linux-trace-kernel/a8d71b12259f90e7e63d0ea654fcac95b0232bbc.1680954589.git.pengdonglin@sangfor.com.cn Signed-off-by: Donglin Peng Acked-by: Palmer Dabbelt Signed-off-by: Steven Rostedt (Google) commit 38638ffa6059049334b4d87bd4d85cf3418b5e27 Author: Azeem Shaikh Date: Tue Jun 13 00:41:25 2023 +0000 tracing/boot: Replace strlcpy with strscpy strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). Direct replacement is safe here since return value of -E2BIG is used to check for truncation instead of sizeof(dest). [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Link: https://lore.kernel.org/linux-trace-kernel/20230613004125.3539934-1-azeemshaikh38@gmail.com Cc: Masami Hiramatsu Signed-off-by: Azeem Shaikh Reviewed-by: Kees Cook Signed-off-by: Steven Rostedt (Google) commit e88ed227f639ebcb31ed4e5b88756b47d904584b Author: Daniel Bristot de Oliveira Date: Tue Jun 6 17:12:27 2023 +0200 tracing/timerlat: Add user-space interface Going a step further, we propose a way to use any user-space workload as the task waiting for the timerlat timer. This is done via a per-CPU file named osnoise/cpu$id/timerlat_fd file. The tracef_fd allows a task to open at a time. When a task reads the file, the timerlat timer is armed for future osnoise/timerlat_period_us time. When the timer fires, it prints the IRQ latency and wakes up the user-space thread waiting in the timerlat_fd. The thread then starts to run, executes the timerlat measurement, prints the thread scheduling latency and returns to user-space. When the thread rereads the timerlat_fd, the tracer will print the user-ret(urn) latency, which is an additional metric. This additional metric is also traced by the tracer and can be used, for example of measuring the context switch overhead from kernel-to-user and user-to-kernel, or the response time for an arbitrary execution in user-space. The tracer supports one thread per CPU, the thread must be pinned to the CPU, and it cannot migrate while holding the timerlat_fd. The reason is that the tracer is per CPU (nothing prohibits the tracer from allowing migrations in the future). The tracer monitors the migration of the thread and disables the tracer if detected. The timerlat_fd is only available for opening/reading when timerlat tracer is enabled, and NO_OSNOISE_WORKLOAD is set. The simplest way to activate this feature from user-space is: -------------------------------- %< ----------------------------------- int main(void) { char buffer[1024]; int timerlat_fd; int retval; long cpu = 0; /* place in CPU 0 */ cpu_set_t set; CPU_ZERO(&set); CPU_SET(cpu, &set); if (sched_setaffinity(gettid(), sizeof(set), &set) == -1) return 1; snprintf(buffer, sizeof(buffer), "/sys/kernel/tracing/osnoise/per_cpu/cpu%ld/timerlat_fd", cpu); timerlat_fd = open(buffer, O_RDONLY); if (timerlat_fd < 0) { printf("error opening %s: %s\n", buffer, strerror(errno)); exit(1); } for (;;) { retval = read(timerlat_fd, buffer, 1024); if (retval < 0) break; } close(timerlat_fd); exit(0); } -------------------------------- >% ----------------------------------- When disabling timerlat, if there is a workload holding the timerlat_fd, the SIGKILL will be sent to the thread. Link: https://lkml.kernel.org/r/69fe66a863d2792ff4c3a149bf9e32e26468bb3a.1686063934.git.bristot@kernel.org Cc: Juri Lelli Cc: William White Cc: Daniel Bristot de Oliveira Cc: Masami Hiramatsu Cc: Jonathan Corbet Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit cb7ca871c883eed5132e106cda44b2b060e6f52e Author: Daniel Bristot de Oliveira Date: Tue Jun 6 17:12:26 2023 +0200 tracing/osnoise: Skip running osnoise if all instances are off In the case of all tracing instances being off, sleep for the entire period. Q: Why not kill all threads so? A: It is valid and useful to start the threads with tracing off. For example, rtla disables tracing, starts the tracer, applies the scheduling setup to the threads, e.g., sched priority and cgroup, and then begin tracing with all set. Skipping the period helps to speed up rtla setup and save the trace after a stop tracing. Link: https://lkml.kernel.org/r/aa4dd9b7e76fcb63901fe5407e15ec002b318599.1686063934.git.bristot@kernel.org Cc: Juri Lelli Cc: William White Cc: Daniel Bristot de Oliveira Cc: Masami Hiramatsu Cc: Jonathan Corbet Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 4998e7fda149d2392ea6aa9879299d8a32019dbe Author: Daniel Bristot de Oliveira Date: Tue Jun 6 17:12:25 2023 +0200 tracing/osnoise: Switch from PF_NO_SETAFFINITY to migrate_disable Currently, osnoise/timerlat threads run with PF_NO_SETAFFINITY set. It works well, however, cgroups do not allow PF_NO_SETAFFINITY threads to be accepted, and this creates a limitation to osnoise/timerlat. To avoid this limitation, disable migration of the threads as soon as they start to run, and then clean the PF_NO_SETAFFINITY flag (still) used during thread creation. If for some reason a thread migration is requested, e.g., via sched_settafinity, the tracer thread will notice and exit. Link: https://lkml.kernel.org/r/8ba8bc9c15b3ea40cf73cf67a9bc061a264609f0.1686063934.git.bristot@kernel.org Cc: Juri Lelli Cc: William White Cc: Daniel Bristot de Oliveira Cc: Masami Hiramatsu Cc: Jonathan Corbet Signed-off-by: Daniel Bristot de Oliveira Signed-off-by: Steven Rostedt (Google) commit 83f74441bcb16c324b7bdba0ab4261a44cb1ac21 Author: Jiri Olsa Date: Sun Jun 11 15:00:29 2023 +0200 ftrace: Show all functions with addresses in available_filter_functions_addrs Adding new available_filter_functions_addrs file that shows all available functions (same as available_filter_functions) together with addresses, like: # cat available_filter_functions_addrs | head ffffffff81000770 __traceiter_initcall_level ffffffff810007c0 __traceiter_initcall_start ffffffff81000810 __traceiter_initcall_finish ffffffff81000860 trace_initcall_finish_cb ... Note displayed address is the patch-site address and can differ from /proc/kallsyms address. It's useful to have address avilable for traceable symbols, so we don't need to allways cross check kallsyms with available_filter_functions (or the other way around) and have all the data in single file. For backwards compatibility reasons we can't change the existing available_filter_functions file output, but we need to add new file. The problem is that we need to do 2 passes: - through available_filter_functions and find out if the function is traceable - through /proc/kallsyms to get the address for traceable function Having available_filter_functions symbols together with addresses allow us to skip the kallsyms step and we are ok with the address in available_filter_functions_addr not being the function entry, because kprobe_multi uses fprobe and that handles both entry and patch-site address properly. We have 2 interfaces how to create kprobe_multi link: a) passing symbols to kernel 1) user gathers symbols and need to ensure that they are trace-able -> pass through available_filter_functions file 2) kernel takes those symbols and translates them to addresses through kallsyms api 3) addresses are passed to fprobe/ftrace through: register_fprobe_ips -> ftrace_set_filter_ips b) passing addresses to kernel 1) user gathers symbols and needs to ensure that they are trace-able -> pass through available_filter_functions file 2) user takes those symbols and translates them to addresses through /proc/kallsyms 3) addresses are passed to the kernel and kernel calls: register_fprobe_ips -> ftrace_set_filter_ips The new available_filter_functions_addrs file helps us with option b), because we can make 'b 1' and 'b 2' in one step - while filtering traceable functions, we get the address directly. Link: https://lore.kernel.org/linux-trace-kernel/20230611130029.1202298-1-jolsa@kernel.org Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Andrii Nakryiko Tested-by: Jackie Liu # x86 Suggested-by: Steven Rostedt (Google) Suggested-by: Andrii Nakryiko Signed-off-by: Jiri Olsa Signed-off-by: Steven Rostedt (Google) commit 3a00b1c40626cec57fbe93669c4094b180aa97f8 Merge: 0feedcaa0a272 6b0139b372d40 Author: Arnd Bergmann Date: Thu Jun 22 16:37:07 2023 +0200 Merge tag 'amlogic-drivers-for-v6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/drivers Amlogic Drivers changes for v6.5: - tag some powers domains as always-on for secure-pwrc - fix MAINTAINERS entry for PHY drivers & bindings - Amlogic Meson GPIO interrupt controller binding to yaml conversion * tag 'amlogic-drivers-for-v6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: dt-bindings: interrupt-controller: Convert Amlogic Meson GPIO interrupt controller binding MAINTAINERS: add PHY-related files to Amlogic SoC file list drivers: meson: secure-pwrc: always enable DMA domain Link: https://lore.kernel.org/r/a10ea420-7599-3f41-dfd8-1742ef436ca0@linaro.org Signed-off-by: Arnd Bergmann commit d8e4ebf87018736c0c29e2eb4afe3915156483cd Author: Miquel Raynal Date: Thu Jun 22 11:06:32 2023 +0200 spi: Create a helper to derive adaptive timeouts Big transfers might take a bit of time, too constraining timeouts might lead to false positives. In order to simplify the drivers work and with the goal of factorizing code in mind, let's add a helper that can be used by any spi controller driver to derive a relevant per-transfer timeout value. The logic is simple: we know how much time it would take to transfer a byte, we can easily derive the total theoretical amount of time involved for each transfer. We multiply it by two to have a bit of margin and enforce a minimum of 500ms. Suggested-by: Mark Brown Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/Message-Id: <20230622090634.3411468-2-miquel.raynal@bootlin.com> Signed-off-by: Mark Brown commit 8270cb10c0681d52fce508f827dfa1688d3acc3a Author: Jordy Zomer Date: Sat Jun 17 12:38:28 2023 +0100 cdrom: Fix spectre-v1 gadget This patch fixes a spectre-v1 gadget in cdrom. The gadget could be triggered by speculatively bypassing the cdi->capacity check. Signed-off-by: Jordy Zomer Link: https://lore.kernel.org/all/20230612110040.849318-2-jordyzomer@google.com Reviewed-by: Phillip Potter Link: https://lore.kernel.org/all/ZI1+1OG9Ut1MqsUC@equinox Signed-off-by: Phillip Potter Link: https://lore.kernel.org/r/20230617113828.1230-2-phil@philpotter.co.uk Signed-off-by: Jens Axboe commit 8241fdd3cdfe88e31a3de09a72b5bff661e4534a Author: Gao Xiang Date: Thu Jun 15 14:44:21 2023 +0800 erofs: clean up zmap.c Several trivial cleanups which aren't quite necessary to split: - Rename lcluster load functions as well as justify full indexes since they are typically used for global deduplication for compressed data; - Avoid unnecessary lines, comments for simplicity. No logic changes. Reviewed-by: Guo Xuenan Reviewed-by: Yue Hu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20230615064421.103178-1-hsiangkao@linux.alibaba.com commit 1990595547976baa922285b999612cc3549874d6 Author: Yangtao Li Date: Thu Jun 15 11:45:38 2023 +0800 erofs: remove unnecessary goto It's redundant, let's remove it. Signed-off-by: Yangtao Li Reviewed-by: Gao Xiang Reviewed-by: Jingbo Xu Link: https://lore.kernel.org/r/20230615034539.14286-1-frank.li@vivo.com Signed-off-by: Gao Xiang commit 12d0a24afd9ea58e581ea64d64e066f2027b28d9 Author: Sandeep Dhavale Date: Wed Jun 21 15:08:47 2023 -0700 erofs: Fix detection of atomic context Current check for atomic context is not sufficient as z_erofs_decompressqueue_endio can be called under rcu lock from blk_mq_flush_plug_list(). See the stacktrace [1] In such case we should hand off the decompression work for async processing rather than trying to do sync decompression in current context. Patch fixes the detection by checking for rcu_read_lock_any_held() and while at it use more appropriate !in_task() check than in_atomic(). Background: Historically erofs would always schedule a kworker for decompression which would incur the scheduling cost regardless of the context. But z_erofs_decompressqueue_endio() may not always be in atomic context and we could actually benefit from doing the decompression in z_erofs_decompressqueue_endio() if we are in thread context, for example when running with dm-verity. This optimization was later added in patch [2] which has shown improvement in performance benchmarks. ============================================== [1] Problem stacktrace [name:core&]BUG: sleeping function called from invalid context at kernel/locking/mutex.c:291 [name:core&]in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1615, name: CpuMonitorServi [name:core&]preempt_count: 0, expected: 0 [name:core&]RCU nest depth: 1, expected: 0 CPU: 7 PID: 1615 Comm: CpuMonitorServi Tainted: G S W OE 6.1.25-android14-5-maybe-dirty-mainline #1 Hardware name: MT6897 (DT) Call trace: dump_backtrace+0x108/0x15c show_stack+0x20/0x30 dump_stack_lvl+0x6c/0x8c dump_stack+0x20/0x48 __might_resched+0x1fc/0x308 __might_sleep+0x50/0x88 mutex_lock+0x2c/0x110 z_erofs_decompress_queue+0x11c/0xc10 z_erofs_decompress_kickoff+0x110/0x1a4 z_erofs_decompressqueue_endio+0x154/0x180 bio_endio+0x1b0/0x1d8 __dm_io_complete+0x22c/0x280 clone_endio+0xe4/0x280 bio_endio+0x1b0/0x1d8 blk_update_request+0x138/0x3a4 blk_mq_plug_issue_direct+0xd4/0x19c blk_mq_flush_plug_list+0x2b0/0x354 __blk_flush_plug+0x110/0x160 blk_finish_plug+0x30/0x4c read_pages+0x2fc/0x370 page_cache_ra_unbounded+0xa4/0x23c page_cache_ra_order+0x290/0x320 do_sync_mmap_readahead+0x108/0x2c0 filemap_fault+0x19c/0x52c __do_fault+0xc4/0x114 handle_mm_fault+0x5b4/0x1168 do_page_fault+0x338/0x4b4 do_translation_fault+0x40/0x60 do_mem_abort+0x60/0xc8 el0_da+0x4c/0xe0 el0t_64_sync_handler+0xd4/0xfc el0t_64_sync+0x1a0/0x1a4 [2] Link: https://lore.kernel.org/all/20210317035448.13921-1-huangjianan@oppo.com/ Reported-by: Will Shiu Suggested-by: Gao Xiang Signed-off-by: Sandeep Dhavale Reviewed-by: Gao Xiang Reviewed-by: Alexandre Mergnat Link: https://lore.kernel.org/r/20230621220848.3379029-1-dhavale@google.com Signed-off-by: Gao Xiang commit ad3d770b83afffd10abf624ec80c408254343a20 Author: Niklas Schnelle Date: Fri Jun 2 16:09:27 2023 +0200 s390/defconfigs: set CONFIG_NET_TC_SKB_EXT=y As made explicit by commit 03a283cdc8c8 ("net/mlx5: Kconfig: Make tc offload depend on tc skb extension") tc skb extension is required for offloading tc as well as bridges on switchdev capable ConnectX devices. Signed-off-by: Niklas Schnelle Signed-off-by: Alexander Gordeev commit 98703e4e061fb8715c7613cd227e32cdfd136b23 Author: Adrián Larumbe Date: Thu Jun 1 13:31:53 2023 +0100 drm: bridge: dw_hdmi: fix connector access for scdc Commit 5d844091f237 ("drm/scdc-helper: Pimp SCDC debugs") changed the scdc interface to pick up an i2c adapter from a connector instead. However, in the case of dw-hdmi, the wrong connector was being used to pass i2c adapter information, since dw-hdmi's embedded connector structure is only populated when the bridge attachment callback explicitly asks for it. drm-meson is handling connector creation, so this won't happen, leading to a NULL pointer dereference. Fix it by having scdc functions access dw-hdmi's current connector pointer instead, which is assigned during the bridge enablement stage. Fixes: 5d844091f237 ("drm/scdc-helper: Pimp SCDC debugs") Signed-off-by: Adrián Larumbe Reported-by: Lukas F. Hartmann Acked-by: Neil Armstrong [narmstrong: moved Fixes tag before first S-o-b and added Reported-by tag] Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20230601123153.196867-1-adrian.larumbe@collabora.com commit 9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2 Author: Thomas Richter Date: Thu Jun 15 13:31:58 2023 +0200 s390/cpum_cf: rework PER_CPU_DEFINE of struct cpu_cf_events Struct cpu_cf_events is a large data structure and is statically defined for each possible CPU. Rework this and replace it by dynamically allocated data structures created when a perf_event_open() system call is invoked or an access via character device /dev/hwctr takes place. It is replaced by an array of pointers to all possible CPUs and reference counting. The array of pointers is allocated when the first event is created. For each online CPU an event is installed on, a struct cpu_cf_events is allocated and a pointer to struct cpu_cf_events is stored in the array: CPU 0 1 2 3 ... N +---+---+---+---+---+---+ cpu_cf_root::cpucf--> | * | | | |...| | +-|-+---+---+---+---+---+ | | \|/ +-------------+ |cpu_cf_events| | | +-------------+ With this approach the large data structure is only allocated when an event is actually installed and used. Also implement proper reference counting for allocation and removal. During interrupt processing make sure the pointer to cpu_cf_events is valid. The interrupt handler is shared and might be called when no event is active. This requires checking for a valid pointer to struct cpu_cf_events. When the pointer to the per-cpu cpu_cf_events is NULL, simply return. Signed-off-by: Thomas Richter Acked-by: Sumanth Korikkar Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 8ed7e33a685a679c04cfe5ffdbb3b4c396ac8076 Author: Masahiro Yamada Date: Mon Jun 12 00:51:00 2023 +0900 linux/export.h: rename 'sec' argument to 'license' Now, EXPORT_SYMBOL() is populated in two stages. In the first stage, all of EXPORT_SYMBOL/EXPORT_SYMBOL_GPL go into the same section, '.export_symbol'. 'sec' does not make sense any more. Rename it to 'license'. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit f234627898d7644998e28938390fa3d63efeefb7 Author: Masahiro Yamada Date: Mon Jun 12 00:50:59 2023 +0900 modpost: show offset from symbol for section mismatch warnings Currently, modpost only shows the symbol names and section names, so it repeats the same message if there are multiple relocations in the same symbol. It is common the relocation spans across multiple instructions. It is better to show the offset from the symbol. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit 78dac1a22944910ba5c1475c384309d30c99afaa Author: Masahiro Yamada Date: Mon Jun 12 00:50:58 2023 +0900 modpost: merge two similar section mismatch warnings In case of section mismatch, modpost shows slightly different messages. For extable section mismatch: "%s(%s+0x%lx): Section mismatch in reference to the %s:%s\n" For the other cases: "%s: section mismatch in reference: %s (section: %s) -> %s (section: %s)\n" They are similar. Merge them. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit 5e9e95cc9148b82074a5eae283e63bce3f1aacfe Author: Masahiro Yamada Date: Mon Jun 12 00:50:57 2023 +0900 kbuild: implement CONFIG_TRIM_UNUSED_KSYMS without recursion When CONFIG_TRIM_UNUSED_KSYMS is enabled, Kbuild recursively traverses the directory tree to determine which EXPORT_SYMBOL to trim. If an EXPORT_SYMBOL turns out to be unused by anyone, Kbuild begins the second traverse, where some source files are recompiled with their EXPORT_SYMBOL() tuned into a no-op. Linus stated negative opinions about this slowness in commits: - 5cf0fd591f2e ("Kbuild: disable TRIM_UNUSED_KSYMS option") - a555bdd0c58c ("Kbuild: enable TRIM_UNUSED_KSYMS again, with some guarding") We can do this better now. The final data structures of EXPORT_SYMBOL are generated by the modpost stage, so modpost can selectively emit KSYMTAB entries that are really used by modules. Commit f73edc8951b2 ("kbuild: unify two modpost invocations") is another ground-work to do this in a one-pass algorithm. With the list of modules, modpost sets sym->used if it is used by a module. modpost emits KSYMTAB only for symbols with sym->used==true. BTW, Nicolas explained why the trimming was implemented with recursion: https://lore.kernel.org/all/2o2rpn97-79nq-p7s2-nq5-8p83391473r@syhkavp.arg/ Actually, we never achieved that level of optimization where the chain reaction of trimming comes into play because: - CONFIG_LTO_CLANG cannot remove any unused symbols - CONFIG_LD_DEAD_CODE_DATA_ELIMINATION is enabled only for vmlinux, but not modules If deeper trimming is required, we need to revisit this, but I guess that is unlikely to happen. Signed-off-by: Masahiro Yamada commit 700c48b439921b67715e25380e0f67e6e490d7b8 Author: Masahiro Yamada Date: Mon Jun 12 00:50:56 2023 +0900 modpost: use null string instead of NULL pointer for default namespace The default namespace is the null string, "". When set, the null string "" is converted to NULL: s->namespace = namespace[0] ? NOFAIL(strdup(namespace)) : NULL; When printed, the NULL pointer is get back to the null string: sym->namespace ?: "" This saves 1 byte memory allocated for "", but loses the readability. In kernel-space, we strive to save memory, but modpost is a userspace tool used to build the kernel. On modern systems, such small piece of memory is not a big deal. Handle the namespace string as is. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit 6e7611c485315a0e4e36c763d0810677e1f26ecd Author: Masahiro Yamada Date: Mon Jun 12 00:50:55 2023 +0900 modpost: squash sym_update_namespace() into sym_add_exported() Pass a set of the name, license, and namespace to sym_add_exported(). sym_update_namespace() is unneeded. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit 6d62b1c46b1e6e1686a0cf6617c96c80d4ab5cd5 Author: Masahiro Yamada Date: Mon Jun 12 00:50:54 2023 +0900 modpost: check static EXPORT_SYMBOL* by modpost again Commit 31cb50b5590f ("kbuild: check static EXPORT_SYMBOL* by script instead of modpost") moved the static EXPORT_SYMBOL* check from the mostpost to a shell script because I thought it must be checked per compilation unit to avoid false negatives. I came up with an idea to do this in modpost, against combined ELF files. The relocation entries in ELF will find the correct exported symbol even if there exist symbols with the same name in different compilation units. Again, the same sample code. Makefile: obj-y += foo1.o foo2.o foo1.c: #include static void foo(void) {} EXPORT_SYMBOL(foo); foo2.c: void foo(void) {} Then, modpost can catch it correctly. MODPOST Module.symvers ERROR: modpost: vmlinux: local symbol 'foo' was exported Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit 7d59313f19df0b55db6b31c5e4d4e828aa77d584 Author: Masahiro Yamada Date: Mon Jun 12 00:50:53 2023 +0900 ia64,export.h: replace EXPORT_DATA_SYMBOL* with EXPORT_SYMBOL* With the previous refactoring, you can always use EXPORT_SYMBOL*. Replace two instances in ia64, then remove EXPORT_DATA_SYMBOL*. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit ddb5cdbafaaad6b99d7007ae1740403124502d03 Author: Masahiro Yamada Date: Mon Jun 12 00:50:52 2023 +0900 kbuild: generate KSYMTAB entries by modpost Commit 7b4537199a4a ("kbuild: link symbol CRCs at final link, removing CONFIG_MODULE_REL_CRCS") made modpost output CRCs in the same way whether the EXPORT_SYMBOL() is placed in *.c or *.S. For further cleanups, this commit applies a similar approach to the entire data structure of EXPORT_SYMBOL(). The EXPORT_SYMBOL() compilation is split into two stages. When a source file is compiled, EXPORT_SYMBOL() will be converted into a dummy symbol in the .export_symbol section. For example, EXPORT_SYMBOL(foo); EXPORT_SYMBOL_NS_GPL(bar, BAR_NAMESPACE); will be encoded into the following assembly code: .section ".export_symbol","a" __export_symbol_foo: .asciz "" /* license */ .asciz "" /* name space */ .balign 8 .quad foo /* symbol reference */ .previous .section ".export_symbol","a" __export_symbol_bar: .asciz "GPL" /* license */ .asciz "BAR_NAMESPACE" /* name space */ .balign 8 .quad bar /* symbol reference */ .previous They are mere markers to tell modpost the name, license, and namespace of the symbols. They will be dropped from the final vmlinux and modules because the *(.export_symbol) will go into /DISCARD/ in the linker script. Then, modpost extracts all the information about EXPORT_SYMBOL() from the .export_symbol section, and generates the final C code: KSYMTAB_FUNC(foo, "", ""); KSYMTAB_FUNC(bar, "_gpl", "BAR_NAMESPACE"); KSYMTAB_FUNC() (or KSYMTAB_DATA() if it is data) is expanded to struct kernel_symbol that will be linked to the vmlinux or a module. With this change, EXPORT_SYMBOL() works in the same way for *.c and *.S files, providing the following benefits. [1] Deprecate EXPORT_DATA_SYMBOL() In the old days, EXPORT_SYMBOL() was only available in C files. To export a symbol in *.S, EXPORT_SYMBOL() was placed in a separate *.c file. arch/arm/kernel/armksyms.c is one example written in the classic manner. Commit 22823ab419d8 ("EXPORT_SYMBOL() for asm") removed this limitation. Since then, EXPORT_SYMBOL() can be placed close to the symbol definition in *.S files. It was a nice improvement. However, as that commit mentioned, you need to use EXPORT_DATA_SYMBOL() for data objects on some architectures. In the new approach, modpost checks symbol's type (STT_FUNC or not), and outputs KSYMTAB_FUNC() or KSYMTAB_DATA() accordingly. There are only two users of EXPORT_DATA_SYMBOL: EXPORT_DATA_SYMBOL_GPL(empty_zero_page) (arch/ia64/kernel/head.S) EXPORT_DATA_SYMBOL(ia64_ivt) (arch/ia64/kernel/ivt.S) They are transformed as follows and output into .vmlinux.export.c KSYMTAB_DATA(empty_zero_page, "_gpl", ""); KSYMTAB_DATA(ia64_ivt, "", ""); The other EXPORT_SYMBOL users in ia64 assembly are output as KSYMTAB_FUNC(). EXPORT_DATA_SYMBOL() is now deprecated. [2] merge and There are two similar header implementations: include/linux/export.h for .c files include/asm-generic/export.h for .S files Ideally, the functionality should be consistent between them, but they tend to diverge. Commit 8651ec01daed ("module: add support for symbol namespaces.") did not support the namespace for *.S files. This commit shifts the essential implementation part to C, which supports EXPORT_SYMBOL_NS() for *.S files. and will remain as a wrapper of for a while. They will be removed after #include directives are all replaced with #include . [3] Implement CONFIG_TRIM_UNUSED_KSYMS in one-pass algorithm (by a later commit) When CONFIG_TRIM_UNUSED_KSYMS is enabled, Kbuild recursively traverses the directory tree to determine which EXPORT_SYMBOL to trim. If an EXPORT_SYMBOL turns out to be unused by anyone, Kbuild begins the second traverse, where some source files are recompiled with their EXPORT_SYMBOL() tuned into a no-op. We can do this better now; modpost can selectively emit KSYMTAB entries that are really used by modules. Signed-off-by: Masahiro Yamada Reviewed-by: Nick Desaulniers commit ffa5f7a3bf28c1306eef85d4056539c2d4b8eb09 Author: Davide Tronchin Date: Thu Jun 22 11:29:21 2023 +0200 USB: serial: option: add LARA-R6 01B PIDs The new LARA-R6 product variant identified by the "01B" string can be configured (by AT interface) in three different USB modes: * Default mode (Vendor ID: 0x1546 Product ID: 0x1311) with 4 serial interfaces * RmNet mode (Vendor ID: 0x1546 Product ID: 0x1312) with 4 serial interfaces and 1 RmNet virtual network interface * CDC-ECM mode (Vendor ID: 0x1546 Product ID: 0x1313) with 4 serial interface and 1 CDC-ECM virtual network interface The first 4 interfaces of all the 3 USB configurations (default, RmNet, CDC-ECM) are the same. In default mode LARA-R6 01B exposes the following interfaces: If 0: Diagnostic If 1: AT parser If 2: AT parser If 3: AT parser/alternative functions In RmNet mode LARA-R6 01B exposes the following interfaces: If 0: Diagnostic If 1: AT parser If 2: AT parser If 3: AT parser/alternative functions If 4: RMNET interface In CDC-ECM mode LARA-R6 01B exposes the following interfaces: If 0: Diagnostic If 1: AT parser If 2: AT parser If 3: AT parser/alternative functions If 4: CDC-ECM interface Signed-off-by: Davide Tronchin Link: https://lore.kernel.org/r/20230622092921.12651-1-davide.tronchin.94@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit e30cb0599799aac099209e3b045379613c80730e Author: Boris Brezillon Date: Mon Jun 19 09:19:21 2023 +0200 drm/sched: Make sure we wait for all dependencies in kill_jobs_cb() drm_sched_entity_kill_jobs_cb() logic is omitting the last fence popped from the dependency array that was waited upon before drm_sched_entity_kill() was called (drm_sched_entity::dependency field), so we're basically waiting for all dependencies except one. In theory, this wait shouldn't be needed because resources should have their users registered to the dma_resv object, thus guaranteeing that future jobs wanting to access these resources wait on all the previous users (depending on the access type, of course). But we want to keep these explicit waits in the kill entity path just in case. Let's make sure we keep all dependencies in the array in drm_sched_job_dependency(), so we can iterate over the array and wait in drm_sched_entity_kill_jobs_cb(). We also make sure we wait on drm_sched_fence::finished if we were originally asked to wait on drm_sched_fence::scheduled. In that case, we assume the intent was to delegate the wait to the firmware/GPU or rely on the pipelining done at the entity/scheduler level, but when killing jobs, we really want to wait for completion not just scheduling. v2: - Don't evict deps in drm_sched_job_dependency() v3: - Always wait for drm_sched_fence::finished fences in drm_sched_entity_kill_jobs_cb() when we see a sched_fence v4: - Fix commit message - Fix a use-after-free bug v5: - Flag deps on which we should only wait for the scheduled event at insertion time v6: - Back to v4 implementation - Add Christian's R-b Cc: Frank Binns Cc: Sarah Walker Cc: Donald Robson Cc: Luben Tuikov Cc: David Airlie Cc: Daniel Vetter Cc: Sumit Semwal Cc: "Christian König" Signed-off-by: Boris Brezillon Suggested-by: "Christian König" Reviewed-by: "Christian König" Acked-by: Luben Tuikov Link: https://patchwork.freedesktop.org/patch/msgid/20230619071921.3465992-1-boris.brezillon@collabora.com commit ee77f3d602b0116203151fee372817c194970213 Author: Yonghong Song Date: Wed Jun 21 23:19:21 2023 -0700 selftests/bpf: Fix compilation failure for prog vrf_socket_lookup When building the latest kernel/selftest with clang17 compiler: make LLVM=1 -j <== for kernel make -C tools/testing/selftests/bpf LLVM=1 -j <== for selftest I hit the following compilation error: [...] In file included from progs/vrf_socket_lookup.c:3: In file included from /usr/include/linux/ip.h:21: In file included from /usr/include/asm/byteorder.h:5: In file included from /usr/include/linux/byteorder/little_endian.h:13: /usr/include/linux/swab.h:136:8: error: unknown type name '__always_inline' 136 | static __always_inline unsigned long __swab(const unsigned long y) | ^ /usr/include/linux/swab.h:171:8: error: unknown type name '__always_inline' 171 | static __always_inline __u16 __swab16p(const __u16 *p) | ^ /usr/include/linux/swab.h:171:29: error: expected ';' after top level declarator 171 | static __always_inline __u16 __swab16p(const __u16 *p) | ^ [...] Basically, with header files in my local host which is based on 5.12 kernel, __always_inline is not defined and this caused compilation failure. Since __always_inline is defined in bpf_helpers.h, let us move bpf_helpers.h to an early position which fixed the problem. Signed-off-by: Yonghong Song Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20230622061921.816772-1-yhs@fb.com commit 06b5d4fea89cd699408af12c14b6915d77ceffb0 Author: Oleksij Rempel Date: Wed Jun 21 11:32:41 2023 +0200 dt-bindings: mmc: fsl-imx-esdhc: Add imx6ul support Add the 'fsl,imx6ul-usdhc' value to the compatible properties list in the fsl-imx-esdhc.yaml file. This is required to match the compatible strings present in the 'mmc@2190000' node of 'imx6ul-prti6g.dtb'. This commit addresses the following dtbs_check warning: imx6ul-prti6g.dtb:0:0: /soc/bus@2100000/mmc@2190000: failed to match any schema with compatible: ['fsl,imx6ul-usdhc', 'fsl,imx6sx-usdhc'] Signed-off-by: Oleksij Rempel Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20230621093245.78130-2-o.rempel@pengutronix.de Signed-off-by: Ulf Hansson commit b1a665932dc23cad0b8af2745cd9713f9e930d63 Author: Ulf Hansson Date: Tue Jun 20 11:11:13 2023 +0200 mmc: mmci: Add support for SW busy-end timeouts The ux500 variant doesn't have a HW based timeout to use for busy-end IRQs. To avoid hanging and waiting for the card to stop signaling busy, let's schedule a delayed work, according to the corresponding cmd->busy_timeout for the command. If the work gets to run, let's kick the IRQ handler to complete the currently running request/command. Reviewed-by: Linus Walleij Tested-by: Linus Walleij Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20230620091113.33393-1-ulf.hansson@linaro.org commit e38910c0072b541a91954682c8b074a93e57c09b Author: Oliver Hartkopp Date: Wed Jun 7 09:27:08 2023 +0200 can: isotp: isotp_sendmsg(): fix return error fix on TX path With commit d674a8f123b4 ("can: isotp: isotp_sendmsg(): fix return error on FC timeout on TX path") the missing correct return value in the case of a protocol error was introduced. But the way the error value has been read and sent to the user space does not follow the common scheme to clear the error after reading which is provided by the sock_error() function. This leads to an error report at the following write() attempt although everything should be working. Fixes: d674a8f123b4 ("can: isotp: isotp_sendmsg(): fix return error on FC timeout on TX path") Reported-by: Carsten Schmidt Signed-off-by: Oliver Hartkopp Link: https://lore.kernel.org/all/20230607072708.38809-1-socketcan@hartkopp.net Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde commit 46448b36ff8c807194d5884a6efce00891e4bd02 Author: Arnd Bergmann Date: Thu Jun 22 10:14:02 2023 +0200 ARM: mvebu: fix unit address on armada-390-db flash The unit address needs to be changed to match the reg property: arch/arm/boot/dts/marvell/armada-390-db.dts:84.10-106.4: Warning (spi_bus_reg): /soc/spi@10680/flash@1: SPI bus unit address format error, expected "0" Reported-by: Stephen Rothwell Reviewed-by: Krzysztof Kozlowski Signed-off-by: Arnd Bergmann commit ccaa4926c2264ca2a2fcad4b3511fe435d7d4d15 Author: Ben Dooks Date: Wed Jun 21 08:59:28 2023 +0100 hrtimer: Add missing sparse annotations to hrtimer locking Sparse warns about lock imbalance vs. the hrtimer_base lock due to missing sparse annotations: kernel/time/hrtimer.c:175:33: warning: context imbalance in 'lock_hrtimer_base' - wrong count at exit kernel/time/hrtimer.c:1301:28: warning: context imbalance in 'hrtimer_start_range_ns' - unexpected unlock kernel/time/hrtimer.c:1336:28: warning: context imbalance in 'hrtimer_try_to_cancel' - unexpected unlock kernel/time/hrtimer.c:1457:9: warning: context imbalance in '__hrtimer_get_remaining' - unexpected unlock Add the annotations to the relevant functions. Signed-off-by: Ben Dooks Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20230621075928.394481-1-ben.dooks@codethink.co.uk commit 2c56a751845ddfd3078ebe79981aaaa182629163 Author: Fabio Estevam Date: Tue Jun 20 08:22:02 2023 -0300 drm/panel: simple: Add connector_type for innolux_at043tn24 The innolux at043tn24 display is a parallel LCD. Pass the 'connector_type' information to avoid the following warning: panel-simple panel: Specify missing connector_type Signed-off-by: Fabio Estevam Fixes: 41bcceb4de9c ("drm/panel: simple: Add support for Innolux AT043TN24") Reviewed-by: Sam Ravnborg Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20230620112202.654981-1-festevam@gmail.com commit a454850a815e62fa5d7c1eded0e8d56742613b94 Author: Rob Herring Date: Wed Jun 21 17:09:58 2023 -0600 dt-bindings: phy: brcm,brcmstb-usb-phy: Fix error in "compatible" conditional schema The conditional if/then schema has an error as the "enum" values have "const" in them. Drop the "const". Signed-off-by: Rob Herring Fixes: 46b616c1574d ("dt-bindings: phy: brcm, brcmstb-usb-phy: add BCM4908 binding") Acked-by: Rafał Miłecki Message-ID: <20230621230958.3815818-1-robh@kernel.org> Signed-off-by: Vinod Koul commit 03bd158e1535e68bcd2b1e095b0ebcad7c84bd20 Author: Arnd Bergmann Date: Fri Jun 9 12:45:42 2023 +0200 remoteproc: stm32: use correct format strings on 64-bit With CONFIG_ARCH_STM32 making it into arch/arm64, a couple of format strings no longer work, since they rely on size_t being compatible with %x, or they print an 'int' using %z: drivers/remoteproc/stm32_rproc.c: In function 'stm32_rproc_mem_alloc': drivers/remoteproc/stm32_rproc.c:122:22: error: format '%x' expects argument of type 'unsigned int', but argument 5 has type 'size_t' {aka 'long unsigned int'} [-Werror=format=] drivers/remoteproc/stm32_rproc.c:122:40: note: format string is defined here 122 | dev_dbg(dev, "map memory: %pa+%x\n", &mem->dma, mem->len); | ~^ | | | unsigned int | %lx drivers/remoteproc/stm32_rproc.c:125:30: error: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'size_t' {aka 'long unsigned int'} [-Werror=format=] drivers/remoteproc/stm32_rproc.c:125:65: note: format string is defined here 125 | dev_err(dev, "Unable to map memory region: %pa+%x\n", | ~^ | | | unsigned int | %lx drivers/remoteproc/stm32_rproc.c: In function 'stm32_rproc_get_loaded_rsc_table': drivers/remoteproc/stm32_rproc.c:646:30: error: format '%zx' expects argument of type 'size_t', but argument 4 has type 'int' [-Werror=format=] drivers/remoteproc/stm32_rproc.c:646:66: note: format string is defined here 646 | dev_err(dev, "Unable to map memory region: %pa+%zx\n", | ~~^ | | | long unsigned int | %x Fix up all three instances to work across architectures, and enable compile testing for this driver to ensure it builds everywhere. Reviewed-by: Arnaud Pouliquen Acked-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Arnd Bergmann commit 790ef3901f18be794f5b246f990f305bbd08ffd7 Merge: 735d86a8aaf66 6fdcd64ec34dc Author: Marc Kleine-Budde Date: Thu Jun 22 09:53:03 2023 +0200 Merge patch series "can: kvaser_pciefd: Fixes and improvements" Jimmy Assarsson says: This patch series contains various non critical fixes and improvements for the kvaser_pciefd driver. Link: https://lore.kernel.org/all/20230529134248.752036-1-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 6fdcd64ec34dc896335718299c348de99b29a605 Author: Jimmy Assarsson Date: Mon May 29 15:42:48 2023 +0200 can: kvaser_pciefd: Use TX FIFO size read from CAN controller Use the TX FIFO size read from CAN controller register, instead of using hard coded value. Signed-off-by: Jimmy Assarsson Reviewed-by: Vincent Mailhol Link: https://lore.kernel.org/all/20230529134248.752036-15-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit f4845741e4220eecf96aa157cbb5ba34aaed995e Author: Jimmy Assarsson Date: Mon May 29 15:42:47 2023 +0200 can: kvaser_pciefd: Refactor code Refactor code; - Format code - Rename variables and macros - Remove intermediate variables - Add/remove blank lines - Reduce scope of variables - Add helper functions Signed-off-by: Jimmy Assarsson Reviewed-by: Vincent Mailhol Link: https://lore.kernel.org/all/20230529134248.752036-14-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit f07008a213640ba5389d924ad0e9e08ea3beed4a Author: Jimmy Assarsson Date: Mon May 29 15:42:46 2023 +0200 can: kvaser_pciefd: Add len8_dlc support Add support for the Classical CAN raw DLC functionality to send and receive DLC values from 9 .. 15. Signed-off-by: Jimmy Assarsson Reviewed-by: Vincent Mailhol Link: https://lore.kernel.org/all/20230529134248.752036-13-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 954fb21268dd59a911dd0b493249eabfa03d0567 Author: Jimmy Assarsson Date: Mon May 29 15:42:45 2023 +0200 can: kvaser_pciefd: Use FIELD_{GET,PREP} and GENMASK where appropriate Replace opencoded masking and shifting, with GENMASK, FIELD_GET and FIELD_PREP macros. Suggested-by: Vincent MAILHOL Signed-off-by: Jimmy Assarsson Reviewed-by: Vincent Mailhol Link: https://lore.kernel.org/all/20230529134248.752036-12-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 69335013c4511cf99d3e338d369ccb37d30d6fee Author: Jimmy Assarsson Date: Mon May 29 15:42:44 2023 +0200 can: kvaser_pciefd: Sort register definitions Sort the registers defines, in the same order as the register bits/fields are defined. Sort register bits/fields in MSB-to-LSB order. Update and add comments. Signed-off-by: Jimmy Assarsson Reviewed-by: Vincent Mailhol Link: https://lore.kernel.org/all/20230529134248.752036-11-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 24aecf55370103cc2d1e3cbb1b8fffcb00482b74 Author: Jimmy Assarsson Date: Mon May 29 15:42:43 2023 +0200 can: kvaser_pciefd: Change return type for kvaser_pciefd_{receive,transmit,set_tx}_irq() Change return type to void for kvaser_pciefd_transmit_irq(), kvaser_pciefd_receive_irq() and kvaser_pciefd_set_tx_irq(). These functions always return zero. Signed-off-by: Jimmy Assarsson Reviewed-by: Vincent Mailhol Link: https://lore.kernel.org/all/20230529134248.752036-10-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 488c07b441f95e0d0d8df0ede4c67319f0f35787 Author: Jimmy Assarsson Date: Mon May 29 15:42:42 2023 +0200 can: kvaser_pciefd: Rename device ID defines Rename device ID defines to better match the product name of the supported device. Use 16 bit hexadecimal values for device IDs. And format kvaser_pciefd_id_table using clang-format. Signed-off-by: Jimmy Assarsson Reviewed-by: Vincent Mailhol Link: https://lore.kernel.org/all/20230529134248.752036-9-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 1b83d0ba1c11d51342d390db19d8e53128a80b40 Author: Jimmy Assarsson Date: Mon May 29 15:42:41 2023 +0200 can: kvaser_pciefd: Sort includes in alphabetic order Sort the includes in alphabetic order. Signed-off-by: Jimmy Assarsson Reviewed-by: Vincent Mailhol Link: https://lore.kernel.org/all/20230529134248.752036-8-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit c496adafee686246fdc803183c2506043f99b3af Author: Jimmy Assarsson Date: Mon May 29 15:42:40 2023 +0200 can: kvaser_pciefd: Remove SPI flash parameter read functionality Remove SPI flash parameter read functionality, since it's only used for reading the interface CAN controller count. This information is already read from a register, making the information redundant. Signed-off-by: Jimmy Assarsson Reviewed-by: Vincent Mailhol Link: https://lore.kernel.org/all/20230529134248.752036-7-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 735d86a8aaf660e2a5fd5d711ee05fa817e8d567 Author: Oliver Hartkopp Date: Fri Jun 9 14:10:51 2023 +0200 can: uapi: move CAN_RAW_FILTER_MAX definition to raw.h CAN_RAW_FILTER_MAX is only relevant for CAN_RAW sockets and used in linux/can/raw.c or in userspace applications that include the raw.h file anyway. Signed-off-by: Oliver Hartkopp Link: https://lore.kernel.org/all/20230609121051.9631-1-socketcan@hartkopp.net Signed-off-by: Marc Kleine-Budde commit 2c470dbbd32ff7f864e77397269cbb7dc453cfa2 Author: Jimmy Assarsson Date: Mon May 29 15:42:39 2023 +0200 can: kvaser_pciefd: Define unsigned constants with type suffix 'U' Define unsigned constants with type suffix 'U' Signed-off-by: Jimmy Assarsson Reviewed-by: Vincent Mailhol Link: https://lore.kernel.org/all/20230529134248.752036-6-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit ec681b91befa982477e24a150dd6452427fe6473 Author: Jimmy Assarsson Date: Mon May 29 15:42:38 2023 +0200 can: kvaser_pciefd: Set hardware timestamp on transmitted packets Set hardware timestamp on transmitted packets. Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") Signed-off-by: Jimmy Assarsson Reviewed-by: Vincent Mailhol Link: https://lore.kernel.org/all/20230529134248.752036-5-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 2d55e9f9b4427e1ad59b974f2267767aac3788d3 Author: Jimmy Assarsson Date: Mon May 29 15:42:37 2023 +0200 can: kvaser_pciefd: Add function to set skb hwtstamps Add new function, kvaser_pciefd_set_skb_timestamp(), to set skb hwtstamps. Signed-off-by: Jimmy Assarsson Reviewed-by: Vincent Mailhol Link: https://lore.kernel.org/all/20230529134248.752036-4-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 76c66ddf7f899b6a9cbd9098990b90f77a8bea9c Author: Jimmy Assarsson Date: Mon May 29 15:42:36 2023 +0200 can: kvaser_pciefd: Remove handler for unused KVASER_PCIEFD_PACK_TYPE_EFRAME_ACK The Kvaser KCAN controller got a feature to send error frames on request. The packet KVASER_PCIEFD_PACK_TYPE_EFRAME_ACK signals that the requested error frame was transmitted. Since this feature is not supported by the driver, drop the handler and add KVASER_PCIEFD_PACK_TYPE_EFRAME_ACK to the list of unexpected packet types. Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") Signed-off-by: Jimmy Assarsson Reviewed-by: Vincent Mailhol Link: https://lore.kernel.org/all/20230529134248.752036-3-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 7c921556c04f1907e68e57610f315d8873320ad7 Author: Jimmy Assarsson Date: Mon May 29 15:42:35 2023 +0200 can: kvaser_pciefd: Remove useless write to interrupt register The PCI interrupt register, KVASER_PCIEFD_IRQ_REG, is level triggered. Writing to the register doesn't affect it. Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") Signed-off-by: Jimmy Assarsson Reviewed-by: Vincent Mailhol Link: https://lore.kernel.org/all/20230529134248.752036-2-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit dc7dabab8c819558998cf2874e1d99c2b3dead6d Merge: 9fde4c557f78e 80a2fbce456e3 Author: Marc Kleine-Budde Date: Thu Jun 22 09:44:22 2023 +0200 Merge patch series "can: length: fix definitions and add bit length calculation" Vincent Mailhol says: When created in [1], frames length definitions were added to implement byte queue limits (bql). Because bql expects lengths in bytes, bit length definitions were not considered back then. Recently, a need to refer to the exact frame length in bits, with CAN bit stuffing, appeared in [2]. This series introduces can_frame_bits(): a function-like macro that can calculate the exact size of a CAN(-FD) frame in bits with or without bitsuffing. [1] commit 85d99c3e2a13 ("can: length: can_skb_get_frame_len(): introduce function to get data length of frame in data link layer") Link: https://git.kernel.org/torvalds/c/85d99c3e2a13 [2] RE: [PATCH] can: mcp251xfd: Increase poll timeout Link: https://lore.kernel.org/linux-can/BL3PR11MB64846C83ACD04E9330B0FE66FB729@BL3PR11MB6484.namprd11.prod.outlook.com * Changelog * v4 -> v5: * In __can_cc_frame_bits() and __can_fd_frame_bits(), enclose data_len in brackets to prevent operator precedence issues. * Add a note in can_frame_bits() documentation to explain that data_len shall have no side effects. * While at it, make CAN(FD)_FRAME_LEN_MAX definition fit on a single line. * A few typo/grammar small fixes in the commit descriptions. Link: https://lore.kernel.org/linux-can/20230601165625.100040-1-mailhol.vincent@wanadoo.fr v3 -> v4: * No functional changes. * as reported by Simon Horman, fix typo in the documentation of can_bitstuffing_len(): "bitstream_len" -> "destuffed_len". * as reported by Thomas Kopp, fix several other typos: - "indicatior" -> "indicator" - "in on the wire" -> "on the wire" - "bitsuffing" -> "bitstuffing". * in CAN_FRAME_LEN_MAX comment: specify that only the dynamic bitstuffing gets ignored but that the intermission is included. * move the Suggested-by: Thomas Kopp tag from patch 2 to patch 3. * add Reviewed-by: Thomas Kopp tag on the full series. * add an additional line of comment for the @intermission argument of can_frame_bits(). Link: https://lore.kernel.org/linux-can/20230530144637.4746-1-mailhol.vincent@wanadoo.fr v2 -> v3: * turn can_frame_bits() and can_frame_bytes() into function-like macros. The fact that inline functions can not be used to initialize constant struct fields was bothering me. I did my best to make the macro look as less ugly as possible. * as reported by Simon Horman, add missing document for the is_fd argument of can_frame_bits(). Link: https://lore.kernel.org/linux-can/20230523065218.51227-1-mailhol.vincent@wanadoo.fr v1 -> v2: * as suggested by Thomas Kopp, add a new patch to the series to fix the stuff bit count and the fixed stuff bits definitions * and another patch to fix documentation of the Remote Request Substitution (RRS). * refactor the length definition. Instead of using individual macro, rely on an inline function. One reason is to minimize the number of definitions. Another reason is that because the dynamic bit stuff is calculated differently for CAN and CAN-FD, it is just not possible to multiply the existing CANFD_FRAME_OVERHEAD_SFF/EFF by the overhead ratio to get the bitsuffing: for CAN-FD, the CRC field is already stuffed by the fixed stuff bits and is out of scope of the dynamic bitstuffing. Link: https://lore.kernel.org/linux-can/20230507155506.3179711-1-mailhol.vincent@wanadoo.fr Link: https://lore.kernel.org/all/20230611025728.450837-1-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 80a2fbce456e3f73b4f49ce12fefa3215a3d0773 Author: Vincent Mailhol Date: Sun Jun 11 11:57:28 2023 +0900 can: length: refactor frame lengths definition to add size in bits Introduce a method to calculate the exact size in bits of a CAN(-FD) frame with or without dynamic bitstuffing. These are all the possible combinations taken into account: - Classical CAN or CAN-FD - Standard or Extended frame format - CAN-FD CRC17 or CRC21 - Include or not intermission Instead of doing several individual macro definitions, declare the can_frame_bits() function-like macro. To this extent, do a full refactoring of the length definitions. In addition add the can_frame_bytes(). This function-like macro replaces the existing macro: - CAN_FRAME_OVERHEAD_SFF: can_frame_bytes(false, false, 0) - CAN_FRAME_OVERHEAD_EFF: can_frame_bytes(false, true, 0) - CANFD_FRAME_OVERHEAD_SFF: can_frame_bytes(true, false, 0) - CANFD_FRAME_OVERHEAD_EFF: can_frame_bytes(true, true, 0) Function-like macros were chosen over inline functions because they can be used to initialize const struct fields. The different maximum frame lengths (maximum data length, including intermission) are as follow: Frame type bits bytes ------------------------------------------------------- Classic CAN SFF no bitstuffing 111 14 Classic CAN EFF no bitstuffing 131 17 Classic CAN SFF bitstuffing 135 17 Classic CAN EFF bitstuffing 160 20 CAN-FD SFF no bitstuffing 579 73 CAN-FD EFF no bitstuffing 598 75 CAN-FD SFF bitstuffing 712 89 CAN-FD EFF bitstuffing 736 92 The macro CAN_FRAME_LEN_MAX and CANFD_FRAME_LEN_MAX are kept as an alias to, respectively, can_frame_bytes(false, true, CAN_MAX_DLEN) and can_frame_bytes(true, true, CANFD_MAX_DLEN). In addition to the above: - Use ISO 11898-1:2015 definitions for the names of the CAN frame fields. - Include linux/bits.h for use of BITS_PER_BYTE. - Include linux/math.h for use of mult_frac() and DIV_ROUND_UP(). N.B: the use of DIV_ROUND_UP() is not new to this patch, but the include was previously omitted. - Add copyright 2023 for myself. Suggested-by: Thomas Kopp Signed-off-by: Vincent Mailhol Reviewed-by: Thomas Kopp Link: https://lore.kernel.org/all/20230611025728.450837-4-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 9fde4c557f78ee2f3626e92b4089ce9d54a2573a Author: Vincent Mailhol Date: Sun Jun 11 11:57:26 2023 +0900 can: length: fix bitstuffing count The Stuff Bit Count is always coded on 4 bits [1]. Update the Stuff Bit Count size accordingly. In addition, the CRC fields of CAN FD Frames contain stuff bits at fixed positions called fixed stuff bits [2]. The CRC field starts with a fixed stuff bit and then has another fixed stuff bit after each fourth bit [2], which allows us to derive this formula: FSB count = 1 + round_down(len(CRC field)/4) The length of the CRC field is [1]: len(CRC field) = len(Stuff Bit Count) + len(CRC) = 4 + len(CRC) with len(CRC) either 17 or 21 bits depending of the payload length. In conclusion, for CRC17: FSB count = 1 + round_down((4 + 17)/4) = 6 and for CRC 21: FSB count = 1 + round_down((4 + 21)/4) = 7 Add a Fixed Stuff bits (FSB) field with above values and update CANFD_FRAME_OVERHEAD_SFF and CANFD_FRAME_OVERHEAD_EFF accordingly. [1] ISO 11898-1:2015 section 10.4.2.6 "CRC field": The CRC field shall contain the CRC sequence followed by a recessive CRC delimiter. For FD Frames, the CRC field shall also contain the stuff count. Stuff count If FD Frames, the stuff count shall be at the beginning of the CRC field. It shall consist of the stuff bit count modulo 8 in a 3-bit gray code followed by a parity bit [...] [2] ISO 11898-1:2015 paragraph 10.5 "Frame coding": In the CRC field of FD Frames, the stuff bits shall be inserted at fixed positions; they are called fixed stuff bits. There shall be a fixed stuff bit before the first bit of the stuff count, even if the last bits of the preceding field are a sequence of five consecutive bits of identical value, there shall be only the fixed stuff bit, there shall not be two consecutive stuff bits. A further fixed stuff bit shall be inserted after each fourth bit of the CRC field [...] Fixes: 85d99c3e2a13 ("can: length: can_skb_get_frame_len(): introduce function to get data length of frame in data link layer") Suggested-by: Thomas Kopp Signed-off-by: Vincent Mailhol Reviewed-by: Thomas Kopp Link: https://lore.kernel.org/all/20230611025728.450837-2-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 10711b11102bfc351240982d46a51d4eecc28c10 Author: Vincent Mailhol Date: Sun Jun 11 11:57:27 2023 +0900 can: length: fix description of the RRS field The CAN-FD frames only have one reserved bit. The bit corresponding to Classical CAN frame's RTR bit is called the "Remote Request Substitution (RRS)" [1]. N.B. The RRS is not to be confused with the Substitute Remote Request (SRR). Fix the description in the CANFD_FRAME_OVERHEAD_SFF/EFF macros. The total remains unchanged, so this is just a documentation fix. In addition to the above add myself as copyright owner for 2020 (as coauthor of the initial version, c.f. Fixes tag). [1] ISO 11898-1:2015 paragraph 10.4.2.3 "Arbitration field": RSS bit [only in FD Frames] The RRS bit shall be transmitted in FD Frames at the position of the RTR bit in Classical Frames. The RRS bit shall be transmitted dominant, but receivers shall accept recessive and dominant RRS bits. Fixes: 85d99c3e2a13 ("can: length: can_skb_get_frame_len(): introduce function to get data length of frame in data link layer") Signed-off-by: Vincent Mailhol Reviewed-by: Thomas Kopp Link: https://lore.kernel.org/all/20230611025728.450837-3-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 9c8d17f931f18482657503291b2737a0f4a79c7e Merge: 3d68f116ccdfe 8a9d8a3c8a05f Author: Marc Kleine-Budde Date: Thu Jun 22 09:43:31 2023 +0200 Merge patch series "can: fix coding style" Marc Kleine-Budde says: here are 2 coding style fixes for rx-offload and the ti_hecc driver. Link: https://lore.kernel.org/all/20230620131130.240180-1-mkl@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 3d68f116ccdfe8cd3a4923b47ae55401fd85d74b Author: Marc Kleine-Budde Date: Tue May 23 08:11:16 2023 +0200 can: m_can: fix coding style This patch aligns code to match open parenthesis and removes a trailing whitespace. Fixes: eb38c2053b67 ("can: rx-offload: rename can_rx_offload_queue_sorted() -> can_rx_offload_queue_timestamp()") Fixes: f5071d9e729d ("can: m_can: m_can_handle_bus_errors(): add support for handling DLEC error on CAN-FD frames") Reported-by: Judith Mendez Link: https://lore.kernel.org/all/20230523062410.1984098-1-mkl@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 8a9d8a3c8a05fdb9d076905855bc0d5b5ee8c881 Author: Marc Kleine-Budde Date: Tue Jun 20 15:11:30 2023 +0200 can: ti_hecc: fix coding style This patch aligns code to match open parenthesis. Link: https://lore.kernel.org/all/20230620131130.240180-3-mkl@pengutronix.de Signed-off-by: Marc Kleine-Budde commit fe6027fe097a173d12067e781143bc1cd2fb1a57 Author: Marc Kleine-Budde Date: Tue Jun 20 15:11:29 2023 +0200 can: rx-offload: fix coding style This patch aligns code to match open parenthesis. Link: https://lore.kernel.org/all/20230620131130.240180-2-mkl@pengutronix.de Signed-off-by: Marc Kleine-Budde commit 047698023267d2655da3ac81f2fb448746b61951 Merge: cf8462a8008a0 717c6ec241b55 Author: Marc Kleine-Budde Date: Thu Jun 22 09:42:17 2023 +0200 Merge patch series "can: sja1000: Prepare the use of a threaded handler" Miquel Raynal provides a series for the sja1000 driver to work around overrun stalls with a soft reset on Renesas SoCs. Link: https://lore.kernel.org/all/20230616134553.2786391-1-miquel.raynal@bootlin.com Signed-off-by: Marc Kleine-Budde commit 717c6ec241b5524400acc0f6009b89e2c59527f9 Author: Miquel Raynal Date: Fri Jun 16 15:45:53 2023 +0200 can: sja1000: Prevent overrun stalls with a soft reset on Renesas SoCs In their RZN1 SoC, Renesas put a CAN controller supposed to act very similarly to the original Philips sja1000. In practice, while flooding the bus with another device, we discovered that the controller very often after an overrun situation would just refuse any new frame, drop them all and trigger over and over again the overrun interrupt, even though the buffer would have been totally emptied. The controller acts like if its internal buffer offsets (where it writes and where the host reads) where totally screwed-up. Renesas manual mentions a single action to perform in order to resynchronize the read and write offsets within the buffer: performing a soft reset. Performing a soft reset takes a bit of time and involves small delays, so better do that in a threaded handler rather than inside the hard IRQ handler. Add platform data to recognize the platforms which need this workaround, and when the faulty situation is diagnosed, stop what is being performed and request the threaded handler to be executed in order to perform the reset. Tested-by: Jérémie Dautheribes # 5.10 Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/all/20230616134553.2786391-2-miquel.raynal@bootlin.com Signed-off-by: Marc Kleine-Budde commit af7647a0b4b50c3f988a76b05dea5e6bf20c858a Author: Miquel Raynal Date: Fri Jun 16 15:45:52 2023 +0200 can: sja1000: Prepare the use of a threaded handler In order to support a flavor of the sja1000 which sometimes freezes, it will be needed upon certain interrupts to perform a soft reset. The soft reset operation takes a bit of time, so better not do it within the hard interrupt handler but rather in a threaded handler. Let's prepare the possibility for sja1000_err() to request "interrupting" the current flow and request the threaded handler to be run while keeping the interrupt line low. There is no functional change. Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/all/20230616134553.2786391-1-miquel.raynal@bootlin.com Signed-off-by: Marc Kleine-Budde commit cf8462a8008a0dec9580f939d1b3bd11ab5c3a53 Merge: b74c3abf99804 8a99f2ada0b80 Author: Marc Kleine-Budde Date: Thu Jun 22 09:41:23 2023 +0200 Merge patch series "can: esd_usb: More preparation before supporting esd CAN-USB/3 (addendum)" Frank Jungclaus says: While trying to again merge my code changes for CAN-USB/3, I came across some more places where it could make sense to change them analogous to the previous clean-up patch series [1]. [1] [PATCH v2 0/6] can: esd_usb: More preparation before supporting esd CAN-USB/3 Link: https://lore.kernel.org/all/20230519195600.420644-1-frank.jungclaus@esd.eu Link: https://lore.kernel.org/r/20230523173105.3175086-1-frank.jungclaus@esd.eu Signed-off-by: Marc Kleine-Budde commit 8a99f2ada0b808aaaa3e2f13c15e623c7fe329bd Author: Frank Jungclaus Date: Tue May 23 19:31:05 2023 +0200 can: esd_usb: Use consistent prefix ESD_USB_ for macros Rename the following macros: - ESD_RTR to ESD_USB_RTR - ESD_EV_CAN_ERROR_EXT to ESD_USB_EV_CAN_ERROR_EXT Additionally remove the double newline trailing to definition of ESD_USB_RTR. Signed-off-by: Frank Jungclaus Link: https://lore.kernel.org/r/20230523173105.3175086-3-frank.jungclaus@esd.eu Signed-off-by: Marc Kleine-Budde commit 33665fdbd7ff825f2c7369524f0d985707e9f029 Author: Frank Jungclaus Date: Tue May 23 19:31:04 2023 +0200 can: esd_usb: Make use of kernel macros BIT() and GENMASK() Make use of kernel macros BIT() and GENMASK(). Signed-off-by: Frank Jungclaus Link: https://lore.kernel.org/r/20230523173105.3175086-2-frank.jungclaus@esd.eu Signed-off-by: Marc Kleine-Budde commit b74c3abf99804620c44a7623fd4d89396c87a064 Merge: d7588f02e8d8a 1336ca2d46017 Author: Marc Kleine-Budde Date: Thu Jun 22 09:39:36 2023 +0200 Merge patch series "can: esd_usb: More preparation before supporting esd CAN-USB/3" Frank Jungclaus says: Apply another small batch of patches as preparation for adding support of the newly available esd CAN-USB/3 to esd_usb.c. v1 -> v2: * Make use of GENMASK() macro for ESD_USB_NO_BAUDRATE and ESD_USB_IDMASK * Also use the BIT() macro for ESD_USB2_3_SAMPLES * Removed comments with redundant hexadecimal values from BIT()-constants * Reworded (shortened) the commit messages * Changed the macro ESD_USB_3_SAMPLES to ESD_USB_TRIPLE_SAMPLES v1: * Link: https://lore.kernel.org/all/20230517192251.2405290-1-frank.jungclaus@esd.eu Link: https://lore.kernel.org/r/20230519195600.420644-1-frank.jungclaus@esd.eu Signed-off-by: Marc Kleine-Budde commit 1336ca2d46017d4249a9bd6a9a403d1e86109751 Author: Frank Jungclaus Date: Fri May 19 21:56:00 2023 +0200 can: esd_usb: Don't bother the user with nonessential log message Replace a netdev_info(), emitting an informational message about the BTR value to be send to the controller, with a debug message by means of netdev_dbg(). Link: https://lore.kernel.org/all/20230509-superglue-hazy-38108aa66bfa-mkl@pengutronix.de/ Suggested-by: Marc Kleine-Budde Suggested-by: Vincent MAILHOL Signed-off-by: Frank Jungclaus Link: https://lore.kernel.org/r/20230519195600.420644-7-frank.jungclaus@esd.eu Signed-off-by: Marc Kleine-Budde commit 299a557651d7847c2acb5c43674e2a1c85d38d16 Author: Frank Jungclaus Date: Fri May 19 21:55:59 2023 +0200 can: esd_usb: Replace hardcoded message length given to USB commands Replace all hardcoded values supplied to the len element of esd_usb_msg (and its siblings) by more readable expressions, based on sizeof(), offsetof(), etc. Also spend documentation / comments that the len element of esd_usb_msg is in multiples of 32bit words and not in bytes. Link: https://lore.kernel.org/all/CAMZ6RqLaDNy-fZ2G0+QMhUEckkXLL+ZyELVSDFmqpd++aBzZQg@mail.gmail.com/ Suggested-by: Vincent MAILHOL Signed-off-by: Frank Jungclaus Link: https://lore.kernel.org/r/20230519195600.420644-6-frank.jungclaus@esd.eu Signed-off-by: Marc Kleine-Budde commit 8ef426e1f605cea86f9375ca75b59b3e7afab5f7 Author: Frank Jungclaus Date: Fri May 19 21:55:58 2023 +0200 can: esd_usb: Prefix all structures with the device name Prefix all the structures with the device name. For commonly used structures make use of (the module name) esd_usb_. For esd CAN-USB/2 and CAN-USB/Micro specific structures use esd_usb_2_ and esd_usb_m. Link: https://lore.kernel.org/all/CAMZ6RqLaDNy-fZ2G0+QMhUEckkXLL+ZyELVSDFmqpd++aBzZQg@mail.gmail.com/ Suggested-by: Vincent MAILHOL Signed-off-by: Frank Jungclaus Link: https://lore.kernel.org/r/20230519195600.420644-5-frank.jungclaus@esd.eu Signed-off-by: Marc Kleine-Budde commit 7e6689b34a815bd379dfdbe9855d36f395ef056c Author: Damien Le Moal Date: Tue Apr 18 09:46:58 2023 +0200 PCI: rockchip: Set address alignment for endpoint mode The address translation unit of the rockchip EP controller does not use the lower 8 bits of a PCIe-space address to map local memory. Thus we must set the align feature field to 256 to let the user know about this constraint. Link: https://lore.kernel.org/r/20230418074700.1083505-12-rick.wertenbroek@gmail.com Fixes: cf590b078391 ("PCI: rockchip: Add EP driver for Rockchip PCIe controller") Signed-off-by: Damien Le Moal Signed-off-by: Rick Wertenbroek Signed-off-by: Lorenzo Pieralisi Cc: stable@vger.kernel.org commit a52587e0bee14cbeeadf48a24013828cb04b8df8 Author: Rick Wertenbroek Date: Tue Apr 18 09:46:57 2023 +0200 PCI: rockchip: Don't advertise MSI-X in PCIe capabilities The RK3399 PCIe endpoint controller cannot generate MSI-X IRQs. This is documented in the RK3399 technical reference manual (TRM) section 17.5.9 "Interrupt Support". MSI-X capability should therefore not be advertised. Remove the MSI-X capability by editing the capability linked-list. The previous entry is the MSI capability, therefore get the next entry from the MSI-X capability entry and set it as next entry for the MSI capability. This in effect removes MSI-X from the list. Linked list before : MSI cap -> MSI-X cap -> PCIe Device cap -> ... Linked list now : MSI cap -> PCIe Device cap -> ... Link: https://lore.kernel.org/r/20230418074700.1083505-11-rick.wertenbroek@gmail.com Fixes: cf590b078391 ("PCI: rockchip: Add EP driver for Rockchip PCIe controller") Tested-by: Damien Le Moal Signed-off-by: Rick Wertenbroek Signed-off-by: Lorenzo Pieralisi Reviewed-by: Damien Le Moal Cc: stable@vger.kernel.org commit 8962b2cb39119cbda4fc69a1f83957824f102f81 Author: Rick Wertenbroek Date: Tue Apr 18 09:46:56 2023 +0200 PCI: rockchip: Use u32 variable to access 32-bit registers Previously u16 variables were used to access 32-bit registers, this resulted in not all of the data being read from the registers. Also the left shift of more than 16-bits would result in moving data out of the variable. Use u32 variables to access 32-bit registers Link: https://lore.kernel.org/r/20230418074700.1083505-10-rick.wertenbroek@gmail.com Fixes: cf590b078391 ("PCI: rockchip: Add EP driver for Rockchip PCIe controller") Tested-by: Damien Le Moal Signed-off-by: Rick Wertenbroek Signed-off-by: Lorenzo Pieralisi Reviewed-by: Damien Le Moal Cc: stable@vger.kernel.org commit dc73ed0f1b8bddd7f2bf70d123e68ffc99ad71ce Author: Rick Wertenbroek Date: Tue Apr 18 09:46:55 2023 +0200 PCI: rockchip: Fix window mapping and address translation for endpoint The RK3399 PCI endpoint core has 33 windows for PCIe space, now in the driver up to 32 fixed size (1M) windows are used and pages are allocated and mapped accordingly. The driver first used a single window and allocated space inside which caused translation issues (between CPU space and PCI space) because a window can only have a single translation at a given time, which if multiple pages are allocated inside will cause conflicts. Now each window is a single region of 1M which will always guarantee that the translation is not in conflict. Set the translation register addresses for physical function. As documented in the technical reference manual (TRM) section 17.5.5 "PCIe Address Translation" and section 17.6.8 "Address Translation Registers Description" Link: https://lore.kernel.org/r/20230418074700.1083505-9-rick.wertenbroek@gmail.com Fixes: cf590b078391 ("PCI: rockchip: Add EP driver for Rockchip PCIe controller") Tested-by: Damien Le Moal Signed-off-by: Rick Wertenbroek Signed-off-by: Lorenzo Pieralisi Reviewed-by: Damien Le Moal Cc: stable@vger.kernel.org commit 166e89d99dd85a856343cca51eee781b793801f2 Author: Rick Wertenbroek Date: Tue Apr 18 09:46:54 2023 +0200 PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core Fix legacy IRQ generation for RK3399 PCIe endpoint core according to the technical reference manual (TRM). Assert and deassert legacy interrupt (INTx) through the legacy interrupt control register ("PCIE_CLIENT_LEGACY_INT_CTRL") instead of manually generating a PCIe message. The generation of the legacy interrupt was tested and validated with the PCIe endpoint test driver. Link: https://lore.kernel.org/r/20230418074700.1083505-8-rick.wertenbroek@gmail.com Fixes: cf590b078391 ("PCI: rockchip: Add EP driver for Rockchip PCIe controller") Tested-by: Damien Le Moal Signed-off-by: Rick Wertenbroek Signed-off-by: Lorenzo Pieralisi Reviewed-by: Damien Le Moal Cc: stable@vger.kernel.org commit 21a2960d5ea2e70c15256b73fce1a14999071090 Author: Rick Wertenbroek Date: Tue Apr 18 09:46:53 2023 +0200 dt-bindings: PCI: Update the RK3399 example to a valid one Update the example in the documentation to a valid example. Address for mem-base was invalid, it pointed to address 0x8000'0000 which is the upper region of the DDR which is not necessarily populated depending on the board. This address should point to the base of the memory window region of the controller which is 0xfa00'0000. Add missing pinctrl. Link: https://lore.kernel.org/r/20230418074700.1083505-7-rick.wertenbroek@gmail.com Signed-off-by: Rick Wertenbroek Signed-off-by: Lorenzo Pieralisi Acked-by: Krzysztof Kozlowski commit 9dd3c7c4c8c3f7f010d9cdb7c3f42506d93c9527 Author: Rick Wertenbroek Date: Tue Apr 18 09:46:51 2023 +0200 PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked The RK3399 PCIe controller should wait until the PHY PLLs are locked. Add poll and timeout to wait for PHY PLLs to be locked. If they cannot be locked generate error message and jump to error handler. Accessing registers in the PHY clock domain when PLLs are not locked causes hang The PHY PLLs status is checked through a side channel register. This is documented in the TRM section 17.5.8.1 "PCIe Initialization Sequence". Link: https://lore.kernel.org/r/20230418074700.1083505-5-rick.wertenbroek@gmail.com Fixes: cf590b078391 ("PCI: rockchip: Add EP driver for Rockchip PCIe controller") Tested-by: Damien Le Moal Signed-off-by: Rick Wertenbroek Signed-off-by: Lorenzo Pieralisi Reviewed-by: Damien Le Moal Cc: stable@vger.kernel.org commit f397fd4ac1fa3afcabd8cee030f953ccaed2a364 Author: Rick Wertenbroek Date: Tue Apr 18 09:46:50 2023 +0200 PCI: rockchip: Assert PCI Configuration Enable bit after probe Assert PCI Configuration Enable bit after probe. When this bit is left to 0 in the endpoint mode, the RK3399 PCIe endpoint core will generate configuration request retry status (CRS) messages back to the root complex. Assert this bit after probe to allow the RK3399 PCIe endpoint core to reply to configuration requests from the root complex. This is documented in section 17.5.8.1.2 of the RK3399 TRM. Link: https://lore.kernel.org/r/20230418074700.1083505-4-rick.wertenbroek@gmail.com Fixes: cf590b078391 ("PCI: rockchip: Add EP driver for Rockchip PCIe controller") Tested-by: Damien Le Moal Signed-off-by: Rick Wertenbroek Signed-off-by: Lorenzo Pieralisi Reviewed-by: Damien Le Moal Cc: stable@vger.kernel.org commit 1f1c42ece18de365c976a060f3c8eb481b038e3a Author: Rick Wertenbroek Date: Tue Apr 18 09:46:49 2023 +0200 PCI: rockchip: Write PCI Device ID to correct register Write PCI Device ID (DID) to the correct register. The Device ID was not updated through the correct register. Device ID was written to a read-only register and therefore did not work. The Device ID is now set through the correct register. This is documented in the RK3399 TRM section 17.6.6.1.1 Link: https://lore.kernel.org/r/20230418074700.1083505-3-rick.wertenbroek@gmail.com Fixes: cf590b078391 ("PCI: rockchip: Add EP driver for Rockchip PCIe controller") Tested-by: Damien Le Moal Signed-off-by: Rick Wertenbroek Signed-off-by: Lorenzo Pieralisi Reviewed-by: Damien Le Moal Cc: stable@vger.kernel.org commit 92a9c57c325dd51682d428ba960d961fec3c8a08 Author: Rick Wertenbroek Date: Tue Apr 18 09:46:48 2023 +0200 PCI: rockchip: Remove writes to unused registers Remove write accesses to registers that are marked "unused" (and therefore read-only) in the technical reference manual (TRM) (see RK3399 TRM 17.6.8.1) Link: https://lore.kernel.org/r/20230418074700.1083505-2-rick.wertenbroek@gmail.com Tested-by: Damien Le Moal Signed-off-by: Rick Wertenbroek Signed-off-by: Lorenzo Pieralisi Reviewed-by: Damien Le Moal commit 9dc3a695da58f69ce580797a2fccea8262faa9cd Author: Frank Jungclaus Date: Fri May 19 21:55:57 2023 +0200 can: esd_usb: Use consistent prefixes for macros Add the consistent prefix ESD_USB_ to all macros defined within esd_usb.c. For macros specific to esd CAN-USB/2 use ESD_USB_2_ as prefix. For macros specific to esd CAN-USB/Micro use ESD_USB_M_ as prefix. Change the macro ESD_USB_3_SAMPLES to ESD_USB_TRIPLE_SAMPLES to not mix up with the prefix ESD_USB_3_ which will be introduced for the CAN-USB/3 device. Link: https://lore.kernel.org/all/CAMZ6RqLaDNy-fZ2G0+QMhUEckkXLL+ZyELVSDFmqpd++aBzZQg@mail.gmail.com/ Suggested-by: Vincent MAILHOL Signed-off-by: Frank Jungclaus Link: https://lore.kernel.org/r/20230519195600.420644-4-frank.jungclaus@esd.eu Signed-off-by: Marc Kleine-Budde commit 5a4dd8796d772252d7f31b547673d03d3a40df75 Author: Frank Jungclaus Date: Fri May 19 21:55:56 2023 +0200 can: esd_usb: Replace initializer macros used for struct can_bittiming_const Replace the macros used to initialize the members of struct can_bittiming_const with direct values. Then also use those struct members to do the calculations in esd_usb2_set_bittiming(). Link: https://lore.kernel.org/all/CAMZ6RqLaDNy-fZ2G0+QMhUEckkXLL+ZyELVSDFmqpd++aBzZQg@mail.gmail.com/ Suggested-by: Vincent MAILHOL Signed-off-by: Frank Jungclaus Link: https://lore.kernel.org/r/20230519195600.420644-3-frank.jungclaus@esd.eu [mkl: esd_usb2_set_bittiming() use esd_usb2_bittiming_const instead of priv->can.bittiming_const] Signed-off-by: Marc Kleine-Budde commit e6ecc0414c87126836d04b46cce8942e778226bb Author: Andy Shevchenko Date: Wed Jun 21 19:31:22 2023 +0300 usb: ulpi: Make container_of() no-op in to_ulpi_dev() Move embedded struct device member to make container_of() noop Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230621163122.5693-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 98e95872f2b818c74872d073eaa4c937579d41fc Merge: 5dfbbaa208f54 528cb5f2a1e85 Author: Jakub Kicinski Date: Wed Jun 21 22:45:59 2023 -0700 Merge branch 'mptcp-expose-more-info-and-small-improvements' Matthieu Baerts says: ==================== mptcp: expose more info and small improvements Patch 1-3/9 track and expose some aggregated data counters at the MPTCP level: the number of retransmissions and the bytes that have been transferred. The first patch prepares the work by moving where snd_una is updated for fallback sockets while the last patch adds some tests to cover the new code. Patch 4-6/9 introduce a new getsockopt for SOL_MPTCP: MPTCP_FULL_INFO. This new socket option allows to combine info from MPTCP_INFO, MPTCP_TCPINFO and MPTCP_SUBFLOW_ADDRS socket options into one. It can be needed to have all info in one because the path-manager can close and re-create subflows between getsockopt() and fooling the accounting. The first patch introduces a unique subflow ID to easily detect when subflows are being re-created with the same 5-tuple while the last patch adds some tests to cover the new code. Please note that patch 5/9 ("mptcp: introduce MPTCP_FULL_INFO getsockopt") can reveal a bug that were there for a bit of time, see [1]. A fix has recently been fixed to netdev for the -net tree: "mptcp: ensure listener is unhashed before updating the sk status", see [2]. There is no conflicts between the two patches but it might be better to apply this series after the one for -net and after having merged "net" into "net-next". Patch 7/9 is similar to commit 47867f0a7e83 ("selftests: mptcp: join: skip check if MIB counter not supported") recently applied in the -net tree but here it adapts the new code that is only in net-next (and it fixes a merge conflict resolution which didn't have any impact). Patch 8 and 9/9 are two simple refactoring. One to consolidate the transition to TCP_CLOSE in mptcp_do_fastclose() and avoid duplicated code. The other one reduces the scope of an argument passed to mptcp_pm_alloc_anno_list() function. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/407 [1] Link: https://lore.kernel.org/netdev/20230620-upstream-net-20230620-misc-fixes-for-v6-4-v1-0-f36aa5eae8b9@tessares.net/ [2] ==================== Link: https://lore.kernel.org/r/20230620-upstream-net-next-20230620-mptcp-expose-more-info-and-misc-v1-0-62b9444bfd48@tessares.net Signed-off-by: Jakub Kicinski commit 528cb5f2a1e859522f36f091f29f5c81ec6d4a4c Author: Geliang Tang Date: Tue Jun 20 18:30:22 2023 +0200 mptcp: pass addr to mptcp_pm_alloc_anno_list Pass addr parameter to mptcp_pm_alloc_anno_list() instead of entry. We can reduce the scope, e.g. in mptcp_pm_alloc_anno_list(), we only access "entry->addr", we can then restrict to the pointer to "addr" then. Signed-off-by: Geliang Tang Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit bbd49d114d5790a2dc3f67926cec3fc48b2d5d81 Author: Paolo Abeni Date: Tue Jun 20 18:30:21 2023 +0200 mptcp: consolidate transition to TCP_CLOSE in mptcp_do_fastclose() The MPTCP code always set the msk state to TCP_CLOSE before calling performing the fast-close. Move such state transition in mptcp_do_fastclose() to avoid some code duplication. Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 00079f18c24f373797cc38273c1bc0b475469d2b Author: Matthieu Baerts Date: Tue Jun 20 18:30:20 2023 +0200 selftests: mptcp: join: skip check if MIB counter not supported (part 2) Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features. One of them is the MPTCP MIB counters introduced in commit fc518953bc9c ("mptcp: add and use MIB counter infrastructure") and more later. The MPTCP Join selftest heavily relies on these counters. If a counter is not supported by the kernel, it is not displayed when using 'nstat -z'. We can then detect that and skip the verification. A new helper (get_counter()) has been added recently in the -net tree to do the required checks and return an error if the counter is not available. This commit is similar to the one with the same title applied in the -net tree but it modifies code only present in net-next for the moment, see the Fixes commit below. While at it, we can also remove the use of ${extra_msg} variable which is never assigned in chk_rm_tx_nr() function and use 'echo' without '-n' parameter. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368 Fixes: 0639fa230a21 ("selftests: mptcp: add explicit check for new mibs") Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit aa723d5b3541bfcf9b7493fc1c47e6af6a11b765 Author: Paolo Abeni Date: Tue Jun 20 18:30:19 2023 +0200 selftests: mptcp: add MPTCP_FULL_INFO testcase Add a testcase explicitly triggering the newly introduce MPTCP_FULL_INFO getsockopt. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/388 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Co-developed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 492432074e4fce4f8880213bf009b47adbf94a3a Author: Paolo Abeni Date: Tue Jun 20 18:30:18 2023 +0200 mptcp: introduce MPTCP_FULL_INFO getsockopt Some user-space applications want to monitor the subflows utilization. Dumping the per subflow tcp_info is not enough, as the PM could close and re-create the subflows under-the-hood, fooling the accounting. Even checking the src/dst addresses used by each subflow could not be enough, because new subflows could re-use the same address/port of the just closed one. This patch introduces a new socket option, allow dumping all the relevant information all-at-once (everything, everywhere...), in a consistent manner. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/388 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 6f06b4d4d1cc676a3f9d947f931ec3866b6c4f6c Author: Paolo Abeni Date: Tue Jun 20 18:30:17 2023 +0200 mptcp: add subflow unique id The user-space need to properly account the data received/sent by individual subflows. When additional subflows are created and/or closed during the MPTCP socket lifetime, the information currently exposed via MPTCP_TCPINFO are not enough: subflows are identified only by the sequential position inside the info dumps, and that will change with the above mentioned events. To solve the above problem, this patch introduces a new subflow identifier that is unique inside the given MPTCP socket scope. The initial subflow get the id 1 and the other subflows get incremental values at join time. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/388 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 5dcff89e14555a4ee6cfa132b82f7d13dcb1e80a Author: Paolo Abeni Date: Tue Jun 20 18:30:16 2023 +0200 selftests: mptcp: explicitly tests aggregate counters Update the existing sockopt test-case to do some basic checks on the newly added counters. Link: https://github.com/multipath-tcp/mptcp_net-next/issues/385 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 38967f424b5be79c4c676712e5640d846efd07e3 Author: Paolo Abeni Date: Tue Jun 20 18:30:15 2023 +0200 mptcp: track some aggregate data counters Currently there are no data transfer counters accounting for all the subflows used by a given MPTCP socket. The user-space can compute such figures aggregating the subflow info, but that is inaccurate if any subflow is closed before the MPTCP socket itself. Add the new counters in the MPTCP socket itself and expose them via the existing diag and sockopt. While touching mptcp_diag_fill_info(), acquire the relevant locks before fetching the msk data, to ensure better data consistency Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/385 Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit c026d33b8f5081969503e322ea30d7c1a6b17dda Author: Paolo Abeni Date: Tue Jun 20 18:30:14 2023 +0200 mptcp: move snd_una update earlier for fallback socket That will avoid an unneeded conditional in both the fast-path and in the fallback case and will simplify a bit the next patch. Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts Signed-off-by: Matthieu Baerts Signed-off-by: Jakub Kicinski commit 5dfbbaa208f5429a02ccb410ae3515222bbe64ef Author: David Arinzon Date: Tue Jun 20 13:35:44 2023 +0000 net: ena: Fix rst format issues in readme This patch fixes a warning in the ena documentation file identified by the kernel automatic tools. The patch also adds a missing newline between sections. Signed-off-by: David Arinzon Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306171804.U7E92zoE-lkp@intel.com/ Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230620133544.32584-1-darinzon@amazon.com Signed-off-by: Jakub Kicinski commit 1203a63da0461d0081ea6e3d5e52893985bfed42 Author: Weilin Wang Date: Tue Jun 20 10:00:27 2023 -0700 perf test: Rerun failed metrics with longer workload Rerun failed metrics with longer workload to avoid false failure because sometimes metric value test fails when running in very short amount of time. Skip rerun if equal to or more than 20 metrics fail. Signed-off-by: Weilin Wang Tested-by: Namhyung Kim Cc: ravi.bangoria@amd.com Cc: Ian Rogers Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Caleb Biggers Cc: Perry Taylor Cc: Samantha Alt Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Kan Liang Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230620170027.1861012-4-weilin.wang@intel.com Signed-off-by: Namhyung Kim commit a0f1cc18f91faf75a321135ac08385a4f260a87d Author: Weilin Wang Date: Tue Jun 20 10:00:26 2023 -0700 perf test: Add skip list for metrics known would fail Add skip list for metrics known would fail because some of the metrics are very likely to fail due to multiplexing or other errors. So add all of the flaky tests into the skip list. Signed-off-by: Weilin Wang Tested-by: Namhyung Kim Cc: ravi.bangoria@amd.com Cc: Ian Rogers Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Caleb Biggers Cc: Perry Taylor Cc: Samantha Alt Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Kan Liang Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230620170027.1861012-3-weilin.wang@intel.com Signed-off-by: Namhyung Kim commit 3ad7092f5145aab4118f575b57f0ab1707b1cd36 Author: Weilin Wang Date: Tue Jun 20 10:00:25 2023 -0700 perf test: Add metric value validation test Add metric value validation test to check if metric values are with in correct value ranges. There are three types of tests included: 1) positive-value test checks if all the metrics collected are non-negative; 2) single-value test checks if the list of metrics have values in given value ranges; 3) relationship test checks if multiple metrics follow a given relationship, e.g. memory_bandwidth_read + memory_bandwidth_write = memory_bandwidth_total. Signed-off-by: Weilin Wang Tested-by: Namhyung Kim Cc: ravi.bangoria@amd.com Cc: Ian Rogers Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Caleb Biggers Cc: Perry Taylor Cc: Samantha Alt Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Kan Liang Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230620170027.1861012-2-weilin.wang@intel.com Signed-off-by: Namhyung Kim commit e591c47f2c2ab11e2faf853f1646ecb9f0f61a7b Author: Jassi Brar Date: Wed Jun 21 10:36:58 2023 -0500 dt-bindings: arm: socionext: add Synquacer platforms Socionext's DeveloperBox is based on the SC2A11B SoC (Synquacer). Specify bindings for the platform and boards based on that. Signed-off-by: Jassi Brar Link: https://lore.kernel.org/r/20230621153658.60646-1-jaswinder.singh@linaro.org Signed-off-by: Rob Herring commit 876c38eb7b1e3de83ef824d34fd7ac416e350eb0 Author: Fabrice Gasnier Date: Tue Jun 20 10:56:33 2023 +0200 dt-bindings: connector: usb: allow a single HS port Allow a single HS port to be used e.g. without reg property and a unit address. OF graph allows a single port node, without 'reg' property. This removes a couple of Warnings or errors on STM32MP boards. When using single HS port currently, when doing building with W=1: arch/arm/boot/dts/stm32mp157c-dk2.dtb: stusb1600@28: connector: Unevaluated properties are not allowed ('port' was unexpected) Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20230620085633.533187-1-fabrice.gasnier@foss.st.com Signed-off-by: Rob Herring commit 6f0a92fd7db1507b203111ee53632eeeba2daca5 Author: Gustavo A. R. Silva Date: Wed Jun 21 14:27:20 2023 -0600 scsi: smartpqi: Replace one-element arrays with flexible-array members One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element arrays with flexible-array members in a couple of structures, and refactor the rest of the code, accordingly. This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy(). This results in no differences in binary output. Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/KSPP/linux/issues/204 Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/ZJNdKDkuRbFZpASS@work Reviewed-by: Kees Cook Signed-off-by: Martin K. Petersen commit 4b2e28758dafeeaa34819296821686addfddaa6a Author: Azeem Shaikh Date: Wed Jun 21 03:00:33 2023 +0000 scsi: target: tcmu: Replace strlcpy() with strscpy() strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh Link: https://lore.kernel.org/r/20230621030033.3800351-3-azeemshaikh38@gmail.com Reviewed-by: Kees Cook Signed-off-by: Martin K. Petersen commit d1e8a9fbb39292e6666192565b51bbda781f9f04 Author: Azeem Shaikh Date: Wed Jun 21 03:00:32 2023 +0000 scsi: ncr53c8xx: Replace strlcpy() with strscpy() strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh Link: https://lore.kernel.org/r/20230621030033.3800351-2-azeemshaikh38@gmail.com Reviewed-by: Kees Cook Signed-off-by: Martin K. Petersen commit 00c2cae6b66a913e8d9a39073988e4aa5baff0d8 Author: Arnd Bergmann Date: Fri Jun 16 11:06:56 2023 +0200 scsi: lpfc: Fix lpfc_name struct packing clang points out that the lpfc_name structure has an 8-byte alignment requirement on most architectures, but is embedded in a number of other structures that are forced to be only 1-byte aligned: drivers/scsi/lpfc/lpfc_hw.h:1516:30: error: field pe within 'struct lpfc_fdmi_reg_port_list' is less aligned than 'struct lpfc_fdmi_port_entry' and is usually due to 'struct lpfc_fdmi_reg_port_list' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] struct lpfc_fdmi_port_entry pe; drivers/scsi/lpfc/lpfc_hw.h:850:19: error: field portName within 'struct _ADISC' is less aligned than 'struct lpfc_name' and is usually due to 'struct _ADISC' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] drivers/scsi/lpfc/lpfc_hw.h:851:19: error: field nodeName within 'struct _ADISC' is less aligned than 'struct lpfc_name' and is usually due to 'struct _ADISC' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] drivers/scsi/lpfc/lpfc_hw.h:922:19: error: field portName within 'struct _RNID' is less aligned than 'struct lpfc_name' and is usually due to 'struct _RNID' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] drivers/scsi/lpfc/lpfc_hw.h:923:19: error: field nodeName within 'struct _RNID' is less aligned than 'struct lpfc_name' and is usually due to 'struct _RNID' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] From the git history, I can see that all the __packed annotations were done specifically to avoid introducing implicit padding around the lpfc_name instances, though this was probably the wrong approach. To improve this, only annotate the one uint64_t field inside of lpfc_name as packed, with an explicit 4-byte alignment, as is the default already on the 32-bit x86 ABI but not on most others. With this, the other __packed annotations can be removed again, as this avoids the incorrect padding. Two other structures change their layout as a result of this change: - struct _LOGO never gained a __packed annotation even though it has the same alignment problem as the others but is not used anywhere in the driver today. - struct serv_param similarly has this issue, and it is used, my guess is that this is only an internal structure rather than part of a binary interface, so the padding has no negative effect here. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230616090705.2623408-1-arnd@kernel.org Reviewed-by: Justin Tee Signed-off-by: Martin K. Petersen commit 53bf91641ae19fe51fb24422de6d07565a3536d0 Author: Abel Wu Date: Tue Jun 20 17:27:11 2023 +0800 inet: Cleanup on charging memory for newly accepted sockets If there is no net-memcg associated with the sock, don't bother calculating its memory usage for charge. Signed-off-by: Abel Wu Link: https://lore.kernel.org/r/20230620092712.16217-1-wuyun.abel@bytedance.com Signed-off-by: Jakub Kicinski commit ca4fa87435370747cac535cecfd08672bb679487 Author: renmingshuai Date: Tue Jun 20 09:49:39 2023 +0800 selftests: tc-testing: add one test for flushing explicitly created chain Add the test for additional reference to chains that are explicitly created by RTM_NEWCHAIN message. The test result: 1..1 ok 1 c2b4 - soft lockup alarm will be not generated after delete the prio 0 filter of the chain This is a follow up to commit c9a82bec02c3 ("net/sched: cls_api: Fix lockup on flushing explicitly created chain"). Signed-off-by: Mingshuai Ren Acked-by: Pedro Tammela Acked-by: Victor Nogueira Link: https://lore.kernel.org/r/20230620014939.2034054-1-renmingshuai@huawei.com Signed-off-by: Jakub Kicinski commit 1ca09f5746edd5e483d144118497f622af9dbe60 Author: Krzysztof Kozlowski Date: Mon Jun 19 19:01:34 2023 +0200 dt-bindings: net: micrel,ks8851: allow SPI device properties The Micrel KS8851 can be attached to SPI or parallel bus and the difference is expressed in compatibles. Allow common SPI properties when this is a SPI variant and narrow the parallel memory bus properties to the second case. This fixes dtbs_check warning: qcom-msm8960-cdp.dtb: ethernet@0: Unevaluated properties are not allowed ('spi-max-frequency' was unexpected) Signed-off-by: Krzysztof Kozlowski Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230619170134.65395-1-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski commit 6a0a6dd8df9b6e9c0ed8d99bbfb4e5e2f8c9834f Author: Krzysztof Kozlowski Date: Sat Jun 17 18:57:16 2023 +0200 dt-bindings: net: bluetooth: qualcomm: document VDD_CH1 WCN3990 comes with two chains - CH0 and CH1 - where each takes VDD regulator. It seems VDD_CH1 is optional (Linux driver does not care about it), so document it to fix dtbs_check warnings like: sdm850-lenovo-yoga-c630.dtb: bluetooth: 'vddch1-supply' does not match any of the regexes: 'pinctrl-[0-9]+' Signed-off-by: Krzysztof Kozlowski Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20230617165716.279857-1-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski commit e748d0fd66abc4b1c136022e4e053004fce2b792 Author: Ravi Gunasekaran Date: Wed Jun 14 17:17:10 2023 +0530 net: hsr: Disable promiscuous mode in offload mode When port-to-port forwarding for interfaces in HSR node is enabled, disable promiscuous mode since L2 frame forward happens at the offloaded hardware. Signed-off-by: Ravi Gunasekaran Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/20230614114710.31400-1-r-gunasekaran@ti.com Signed-off-by: Jakub Kicinski commit 3d5786ea472c3aff14e931d52ba05627c075d432 Author: Gilad Sever Date: Wed Jun 21 13:42:11 2023 +0300 selftests/bpf: Add vrf_socket_lookup tests Verify that socket lookup via TC/XDP with all BPF APIs is VRF aware. Signed-off-by: Gilad Sever Signed-off-by: Daniel Borkmann Reviewed-by: Eyal Birger Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/bpf/20230621104211.301902-5-gilad9366@gmail.com commit 9a5cb79762e0eda17ca15c2a6eaca4622383c21c Author: Gilad Sever Date: Wed Jun 21 13:42:10 2023 +0300 bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings When calling bpf_sk_lookup_tcp(), bpf_sk_lookup_udp() or bpf_skc_lookup_tcp() from tc/xdp ingress, VRF socket bindings aren't respoected, i.e. unbound sockets are returned, and bound sockets aren't found. VRF binding is determined by the sdif argument to sk_lookup(), however when called from tc the IP SKB control block isn't initialized and thus inet{,6}_sdif() always returns 0. Fix by calculating sdif for the tc/xdp flows by observing the device's l3 enslaved state. The cg/sk_skb hooking points which are expected to support inet{,6}_sdif() pass sdif=-1 which makes __bpf_skc_lookup() use the existing logic. Fixes: 6acc9b432e67 ("bpf: Add helper to retrieve socket in BPF") Signed-off-by: Gilad Sever Signed-off-by: Daniel Borkmann Reviewed-by: Shmulik Ladkani Reviewed-by: Eyal Birger Acked-by: Stanislav Fomichev Cc: David Ahern Link: https://lore.kernel.org/bpf/20230621104211.301902-4-gilad9366@gmail.com commit 97fbfeb86917bdbe9c41d5143e335a929147f405 Author: Gilad Sever Date: Wed Jun 21 13:42:09 2023 +0300 bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC hookpoint skb->dev always exists in the tc flow. There is no need to use bpf_skc_lookup(), bpf_sk_lookup() from this code path. This change facilitates fixing the tc flow to be VRF aware. Signed-off-by: Gilad Sever Signed-off-by: Daniel Borkmann Reviewed-by: Shmulik Ladkani Reviewed-by: Eyal Birger Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/bpf/20230621104211.301902-3-gilad9366@gmail.com commit 6e98730bc0b44acaf86eccc75f823128aa9c9e79 Author: Gilad Sever Date: Wed Jun 21 13:42:08 2023 +0300 bpf: Factor out socket lookup functions for the TC hookpoint. Change BPF helper socket lookup functions to use TC specific variants: bpf_tc_sk_lookup_tcp() / bpf_tc_sk_lookup_udp() / bpf_tc_skc_lookup_tcp() instead of sharing implementation with the cg / sk_skb hooking points. This allows introducing a separate logic for the TC flow. The tc functions are identical to the original code. Signed-off-by: Gilad Sever Signed-off-by: Daniel Borkmann Reviewed-by: Shmulik Ladkani Reviewed-by: Eyal Birger Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/bpf/20230621104211.301902-2-gilad9366@gmail.com commit ff9b63c80b087bac495b337882a5880b130401c0 Merge: 7ad7b7023fcb1 b655892ffd6d8 Author: Jakub Kicinski Date: Wed Jun 21 14:30:48 2023 -0700 Merge branch 'leds-trigger-netdev-add-additional-modes' Christian Marangi says: ==================== leds: trigger: netdev: add additional modes This is a continue of [1]. It was decided to take a more gradual approach to implement LEDs support for switch and phy starting with basic support and then implementing the hw control part when we have all the prereq done. This should be the final part for the netdev trigger. I added net-next tag and added netdev mailing list since I was informed that this should be merged with netdev branch. We collect some info around and we found a good set of modes that are common in almost all the PHY and Switch. These modes are: - Modes for dedicated link speed(10, 100, 1000 mbps). Additional mode can be added later following this example. - Modes for half and full duplex. The original idea was to add hw control only modes. While the concept makes sense in practice it would results in lots of additional code and extra check to make sure we are setting correct modes. With the suggestion from Andrew it was pointed out that using the ethtool APIs we can actually get the current link speed and duplex and this effectively removed the problem of having hw control only modes since we can fallback to software. Since these modes are supported by software, we can skip providing an user for this in the LED driver to support hw control for these new modes (that will come right after this is merged) and prevent this to be another multi subsystem series. For link speed and duplex we use ethtool APIs. To call ethtool APIs, rtnl lock is needed but this can be skipped on handling netdev events as the lock is already held. [1] https://lore.kernel.org/lkml/20230216013230.22978-1-ansuelsmth@gmail.com/ ==================== Link: https://lore.kernel.org/r/20230619204700.6665-1-ansuelsmth@gmail.com Signed-off-by: Jakub Kicinski commit b655892ffd6d89b0c7407e099c40dbde82ee3f03 Author: Christian Marangi Date: Mon Jun 19 22:47:00 2023 +0200 leds: trigger: netdev: expose hw_control status via sysfs Expose hw_control status via sysfs for the netdev trigger to give userspace better understanding of the current state of the trigger and the LED. Signed-off-by: Christian Marangi Reviewed-by: Andrew Lunn Reviewed-by: Kalesh AP Acked-by: Lee Jones Signed-off-by: Jakub Kicinski commit f22f95b9ff1551c9bab13104131929f33d51f23f Author: Christian Marangi Date: Mon Jun 19 22:46:59 2023 +0200 leds: trigger: netdev: add additional specific link duplex mode Add additional modes for specific link duplex. Use ethtool APIs to get the current link duplex and enable the LED accordingly. Under netdev event handler the rtnl lock is already held and is not needed to be set to access ethtool APIs. This is especially useful for PHY and Switch that supports LEDs hw control for specific link duplex. Add additional modes: - half_duplex: Turn on LED when link is half duplex - full_duplex: Turn on LED when link is full duplex Signed-off-by: Christian Marangi Reviewed-by: Andrew Lunn Acked-by: Lee Jones Signed-off-by: Jakub Kicinski commit d5e01266e7f5fa12400d4c8aa4e86fe89dcc61e9 Author: Christian Marangi Date: Mon Jun 19 22:46:58 2023 +0200 leds: trigger: netdev: add additional specific link speed mode Add additional modes for specific link speed. Use ethtool APIs to get the current link speed and enable the LED accordingly. Under netdev event handler the rtnl lock is already held and is not needed to be set to access ethtool APIs. This is especially useful for PHY and Switch that supports LEDs hw control for specific link speed. (example scenario a PHY that have 2 LED connected one green and one orange where the green is turned on with 1000mbps speed and orange is turned on with 10mpbs speed) On mode set from sysfs we check if we have enabled split link speed mode and reject enabling generic link mode to prevent wrong and redundant configuration. Rework logic on the set baseline state to support these new modes to select if we need to turn on or off the LED. Add additional modes: - link_10: Turn on LED when link speed is 10mbps - link_100: Turn on LED when link speed is 100mbps - link_1000: Turn on LED when link speed is 1000mbps Signed-off-by: Christian Marangi Reviewed-by: Andrew Lunn Acked-by: Lee Jones Signed-off-by: Jakub Kicinski commit 7ad7b7023fcb1efdd71406ff7670ef6130de65a6 Author: Ivan Vecera Date: Tue Jun 20 16:48:55 2023 +0200 bnxt_en: Link representors to PCI device Link VF representors to parent PCI device to benefit from systemd defined naming scheme. Without this change the representor is visible as ethN. Signed-off-by: Ivan Vecera Reviewed-by: Simon Horman Reviewed-by: Michael Chan Link: https://lore.kernel.org/r/20230620144855.288443-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit f31b6c649ef34b3636d74484bf4c4cd77f23aeeb Merge: cc75549548482 664bc72dd2007 Author: Jakub Kicinski Date: Wed Jun 21 14:02:57 2023 -0700 Merge branch 'selftests-preparations-for-out-of-order-operations-patches-in-mlxsw' Petr Machata says: ==================== selftests: Preparations for out-of-order-operations patches in mlxsw The mlxsw driver currently makes the assumption that the user applies configuration in a bottom-up manner. Thus netdevices need to be added to the bridge before IP addresses are configured on that bridge or SVI added on top of it. Enslaving a netdevice to another netdevice that already has uppers is in fact forbidden by mlxsw for this reason. Despite this safety, it is rather easy to get into situations where the offloaded configuration is just plain wrong. Over the course of the following several patchsets, mlxsw code is going to be adjusted to diminish the space of wrongly offloaded configurations. Ideally the offload state will reflect the actual state, regardless of the sequence of operation used to construct that state. Several selftests build configurations that will not be offloadable in the future on some systems. The reason is that what will get offloaded is the actual configuration, not the configuration steps. For example, when a port is added to a bridge that has an IP address, that bridge will get a RIF, which it would not have with the current code. But on Nvidia Spectrum-1 machines, MAC addresses of all RIFs need to have the same prefix, which the bridge will violate. The RIF thus couldn't be created, and the enslavement is therefore canceled, because it would lead to an unoffloadable configuration. This breaks some selftests. In this patchset, adjust selftests to avoid the configurations that mlxsw would be incapable of offloading, while maintaining relevance with regards to the feature that is being tested. There are generally two cases of fixes: - Disabling IPv6 autogen on bridges that do not participate in routing, either because of the abovementioned requirement to keep the same MAC prefix on all in-HW router interfaces, or, on 802.1ad bridges, because in-HW router interfaces are not supported at all. - Setting the bridge MAC address to what it will become after the first member port is attached, so that the in-HW router interface is created with a supported MAC address. The patchset is then split thus: - Patches #1-#7 adjust generic selftests - Patches #8-#16 adjust mlxsw-specific selftests ==================== Link: https://lore.kernel.org/r/cover.1687265905.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 664bc72dd20073be227f9e68b3db75313c6926f8 Author: Petr Machata Date: Tue Jun 20 15:56:02 2023 +0200 selftests: mlxsw: one_armed_router: Use port MAC for bridge address In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. At the time that the front panel port is enslaved to the bridge, the bridge MAC address does not have the same prefix as other interfaces in the system. On Nvidia Spectrum-1 machines all the RIFs have to have the same 38-bit MAC address prefix. Since the bridge does not obey this limitation, the RIF cannot be created, and the enslavement attempt is vetoed on the grounds of the configuration not being offloadable. The bridge eventually inherits MAC address from its first member, after the enslavement is acked. A number of (mainly VXLAN) selftests already work around the problem by setting the MAC address to whatever it will eventually be anyway. Do the same for this selftest. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Signed-off-by: Jakub Kicinski commit 5541577521cc2e22bc84ba92be24959671006283 Author: Petr Machata Date: Tue Jun 20 15:56:01 2023 +0200 selftests: mlxsw: vxlan: Disable IPv6 autogen on bridges In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. At the time that the front panel port is enslaved to the bridge (this holds for all bridges used here), the bridge MAC address does not have the same prefix as other interfaces in the system. On Nvidia Spectrum-1 machines all the RIFs have to have the same 38-bit MAC address prefix. Since the bridge does not obey this limitation, the RIF cannot be created, and the enslavement attempt is vetoed on the grounds of the configuration not being offloadable. The selftest itself however checks various aspects of VXLAN offloading and the bridges do not need to participate in routing traffic. The IP addresses or the RIFs are irrelevant. Fix by disabling automatic IPv6 address generation for the HW-offloaded bridges in this selftest, thus exempting them from mlxsw router attention. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Signed-off-by: Jakub Kicinski commit 08035d8e354d9fc652c9d12668e89d83edc8f974 Author: Petr Machata Date: Tue Jun 20 15:56:00 2023 +0200 selftests: mlxsw: spectrum: q_in_vni_veto: Disable IPv6 autogen on a bridge In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. At the time that the front panel port is enslaved to the bridge, the bridge MAC address does not have the same prefix as other interfaces in the system. On Nvidia Spectrum-1 machines all the RIFs have to have the same 38-bit MAC address prefix. Since the bridge does not obey this limitation, the RIF cannot be created, and the enslavement attempt is vetoed on the grounds of the configuration not being offloadable. The selftest itself however checks vetoing of a different aspect of the configuration and the bridge does not need to participate in routing traffic. The IP address or the RIF are irrelevant. Fix by disabling automatic IPv6 address generation for the HW-offloaded bridge in this selftest, thus exempting it from mlxsw router attention. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Signed-off-by: Jakub Kicinski commit ea2d5f757e914fa0f82949e130ee9da0ee931e59 Author: Petr Machata Date: Tue Jun 20 15:55:59 2023 +0200 selftests: mlxsw: qos_mc_aware: Disable IPv6 autogen on bridges In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. At the time that the front panel port is enslaved to the bridge (this holds for both bridges used here), the bridge MAC address does not have the same prefix as other interfaces in the system. On Nvidia Spectrum-1 machines all the RIFs have to have the same 38-bit MAC address prefix. Since the bridge does not obey this limitation, the RIF cannot be created, and the enslavement attempt is vetoed on the grounds of the configuration not being offloadable. The selftest itself however checks traffic prioritization and scheduling, and the bridges serve for their L2 forwarding capabilities, and do not need to participate in routing traffic. The IP addresses or the RIFs are irrelevant. Fix by disabling automatic IPv6 address generation for the HW-offloaded bridges in this selftest, thus exempting them from mlxsw router attention. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Signed-off-by: Jakub Kicinski commit ec7023e6745e6fb34cd855522cb8f995194bdbf1 Author: Petr Machata Date: Tue Jun 20 15:55:58 2023 +0200 selftests: mlxsw: qos_ets_strict: Disable IPv6 autogen on bridges In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. At the time that the front panel port is enslaved to the bridge (this holds for both bridges used here), the bridge MAC address does not have the same prefix as other interfaces in the system. On Nvidia Spectrum-1 machines all the RIFs have to have the same 38-bit MAC address prefix. Since the bridge does not obey this limitation, the RIF cannot be created, and the enslavement attempt is vetoed on the grounds of the configuration not being offloadable. The selftest itself however checks traffic prioritization and scheduling, and the bridges serve for their L2 forwarding capabilities, and do not need to participate in routing traffic. The IP addresses or the RIFs are irrelevant. Fix by disabling automatic IPv6 address generation for the HW-offloaded bridges in this selftest, thus exempting them from mlxsw router attention. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Signed-off-by: Jakub Kicinski commit 6349f9bbbfb2bda12c0a633965d03435d18d930f Author: Petr Machata Date: Tue Jun 20 15:55:57 2023 +0200 selftests: mlxsw: qos_dscp_bridge: Disable IPv6 autogen on a bridge In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. At the time that the front panel port is enslaved to the bridge, the bridge MAC address does not have the same prefix as other interfaces in the system. On Nvidia Spectrum-1 machines all the RIFs have to have the same 38-bit MAC address prefix. Since the bridge does not obey this limitation, the RIF cannot be created, and the enslavement attempt is vetoed on the grounds of the configuration not being offloadable. The selftest itself however checks DCB DSCP-based prioritization, and the bridge serves for its L2 forwarding capabilities, and does not need to participate in routing traffic. The IP address or the RIF are irrelevant. Fix by disabling automatic IPv6 address generation for the HW-offloaded bridge in this selftest, thus exempting it from mlxsw router attention. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Signed-off-by: Jakub Kicinski commit 32b3a7bf8570d24b30d1961fb3eaddb9f1c3250a Author: Petr Machata Date: Tue Jun 20 15:55:56 2023 +0200 selftests: mlxsw: mirror_gre_scale: Disable IPv6 autogen on a bridge In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. At the time that the front panel port is enslaved to the bridge, the bridge MAC address does not have the same prefix as other interfaces in the system. On Nvidia Spectrum-1 machines all the RIFs have to have the same 38-bit MAC address prefix. Since the bridge does not obey this limitation, the RIF cannot be created, and the enslavement attempt is vetoed on the grounds of the configuration not being offloadable. The selftest itself however checks how many mirroring sessions a machine is capable of offloading. The IP address or the RIF are irrelevant. Fix by disabling automatic IPv6 address generation for the HW-offloaded bridge in this selftest, thus exempting it from mlxsw router attention. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Signed-off-by: Jakub Kicinski commit a758dc469a9caf958c0f02426aa76162c89faa97 Author: Petr Machata Date: Tue Jun 20 15:55:55 2023 +0200 selftests: mlxsw: extack: Disable IPv6 autogen on bridges In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. At the time that the front panel port is enslaved to the bridge (this holds for all bridges used here), the bridge MAC address does not have the same prefix as other interfaces in the system. On Nvidia Spectrum-1 machines all the RIFs have to have the same 38-bit MAC address prefix. Since the bridge does not obey this limitation, the RIF cannot be created, and the enslavement attempt is vetoed on the grounds of the configuration not being offloadable. The selftest itself however checks whether a different vetoed aspect of the configuration provides an extack. The IP address or the RIF are irrelevant. Fix by disabling automatic IPv6 address generation for the HW-offloaded bridges in this selftest, thus exempting them from mlxsw router attention. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Signed-off-by: Jakub Kicinski commit 8cfdd300a5e95fea14050cd86259bafb35244a2f Author: Petr Machata Date: Tue Jun 20 15:55:54 2023 +0200 selftests: mlxsw: q_in_q_veto: Disable IPv6 autogen on bridges In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. The swp enslavement to the 802.1ad bridge is not allowed, because RIFs are not allowed to be created for 802.1ad bridges, but the address indicates one needs to be created. Thus the veto selftests fail already during the port enslavement. Then the attempt to create a VLAN on top of the same bridge is not vetoed, because the bridge is not related to mlxsw, and the selftest fails. Fix by disabling automatic IPv6 address generation for the bridges in this selftest, thus exempting them from the mlxsw router attention. Signed-off-by: Petr Machata Reviewed-by: Amit Cohen Signed-off-by: Jakub Kicinski commit 5e71bf50c2e284e4b287d55336a1b2f47027624c Author: Petr Machata Date: Tue Jun 20 15:55:53 2023 +0200 selftests: forwarding: router_bridge: Use port MAC for bridge address In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. At the time that the front panel port is enslaved to the bridge, the bridge MAC address does not have the same prefix as other interfaces in the system. On Nvidia Spectrum-1 machines all the RIFs have to have the same 38-bit MAC address prefix. Since the bridge does not obey this limitation, the RIF cannot be created, and the enslavement attempt is vetoed on the grounds of the configuration not being offloadable. The bridge eventually inherits MAC address from its first member, after the enslavement is acked. A number of (mainly VXLAN) selftests already work around the problem by setting the MAC address to whatever it will eventually be anyway. Do the same here. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Signed-off-by: Jakub Kicinski commit 8fd32576e650efe88e396febd494f12adf18262a Author: Petr Machata Date: Tue Jun 20 15:55:52 2023 +0200 selftests: forwarding: mirror_gre_*: Use port MAC for bridge address In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. At the time that the front panel port is enslaved to the bridge, the bridge MAC address does not have the same prefix as other interfaces in the system. On Nvidia Spectrum-1 machines all the RIFs have to have the same 38-bit MAC address prefix. Since the bridge does not obey this limitation, the RIF cannot be created, and the enslavement attempt is vetoed on the grounds of the configuration not being offloadable. The bridge eventually inherits MAC address from its first member, after the enslavement is acked. A number of (mainly VXLAN) selftests already work around the problem by setting the MAC address to whatever it will eventually be anyway. Do the same for several mirror_gre selftests. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Signed-off-by: Jakub Kicinski commit 92c3bb5393db2f36e6a23ba7bb50b34c18c523f5 Author: Petr Machata Date: Tue Jun 20 15:55:51 2023 +0200 selftests: forwarding: mirror_gre_*: Disable IPv6 autogen on bridges In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. At the time that the front panel port is enslaved to the bridge, the bridge MAC address does not have the same prefix as other interfaces in the system. On Nvidia Spectrum-1 machines all the RIFs have to have the same 38-bit MAC address prefix. Since the bridge does not obey this limitation, the RIF cannot be created, and the enslavement attempt is vetoed on the grounds of the configuration not being offloadable. These two selftests however check mirroring traffic to a gretap netdevice. The bridge here does not participate in routing traffic and the IP address or the RIF are irrelevant. Fix by disabling automatic IPv6 address generation for the HW-offloaded bridges in these selftests, thus exempting them from mlxsw router attention. Since the bridges are only used for L2 forwarding, this change should not hinder usefulness of this selftest for testing SW datapath or HW datapaths in other devices. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Signed-off-by: Jakub Kicinski commit f61018dc3e21ba0bee9caadf3015a65a7b4ce09f Author: Petr Machata Date: Tue Jun 20 15:55:50 2023 +0200 selftests: forwarding: pedit_dsfield: Disable IPv6 autogen on a bridge In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. At the time that the front panel port is enslaved to the bridge, the bridge MAC address does not have the same prefix as other interfaces in the system. On Nvidia Spectrum-1 machines all the RIFs have to have the same 38-bit MAC address prefix. Since the bridge does not obey this limitation, the RIF cannot be created, and the enslavement attempt is vetoed on the grounds of the configuration not being offloadable. The selftest itself however checks whether skbedit changes packet priority as appropriate. The bridge thus does not need to participate in routing traffic and the IP address or the RIF are irrelevant. Fix by disabling automatic IPv6 address generation for the HW-offloaded bridge in this selftest, thus exempting it from mlxsw router attention. Since the bridge is only used for L2 forwarding, this change should not hinder usefulness of this selftest for testing SW datapath or HW datapaths in other devices. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Signed-off-by: Jakub Kicinski commit d7442b7d288e8a00290808623f77bc5ed87ba8e6 Author: Petr Machata Date: Tue Jun 20 15:55:49 2023 +0200 selftests: forwarding: skbedit_priority: Disable IPv6 autogen on a bridge In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. At the time that the front panel port is enslaved to the bridge, the bridge MAC address does not have the same prefix as other interfaces in the system. On Nvidia Spectrum-1 machines all the RIFs have to have the same 38-bit MAC address prefix. Since the bridge does not obey this limitation, the RIF cannot be created, and the enslavement attempt is vetoed on the grounds of the configuration not being offloadable. The selftest itself however checks operation of pedit on IPv4 and IPv6 dsfield and its parts. The bridge thus does not need to participate in routing traffic and the IP address or the RIF are irrelevant. Fix by disabling automatic IPv6 address generation for the HW-offloaded bridge in this selftest, thus exempting it from mlxsw router attention. Since the bridge is only used for L2 forwarding, this change should not hinder usefulness of this selftest for testing SW datapath or HW datapaths in other devices. Signed-off-by: Petr Machata Reviewed-by: Danielle Ratson Signed-off-by: Jakub Kicinski commit c801533304ca87e314ecc6fc43b9a7822f159f18 Author: Petr Machata Date: Tue Jun 20 15:55:48 2023 +0200 selftests: forwarding: dual_vxlan_bridge: Disable IPv6 autogen on bridges In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. This will cause this selftest to fail spuriously. The swp enslavement to the 802.1ad bridge is not allowed, because RIFs are not allowed to be created for 802.1ad bridges, but the address indicates one needs to be created. Fix by disabling automatic IPv6 address generation for the HW-offloaded bridge in this selftest, thus exempting it from mlxsw router attention. Signed-off-by: Petr Machata Reviewed-by: Amit Cohen Signed-off-by: Jakub Kicinski commit 8c3736ce595bccb6322c44a1f853216e278aa635 Author: Petr Machata Date: Tue Jun 20 15:55:47 2023 +0200 selftests: forwarding: q_in_vni: Disable IPv6 autogen on bridges In a future patch, mlxsw will start adding RIFs to uppers of front panel port netdevices, if they have an IP address. This will cause this selftest to fail spuriously. The swp enslavement to the 802.1ad bridge is not allowed, because RIFs are not allowed to be created for 802.1ad bridges, but the address indicates one needs to be created. Fix by disabling automatic IPv6 address generation for the HW-offloaded bridge in this selftest, thus exempting it from mlxsw router attention. Signed-off-by: Petr Machata Reviewed-by: Amit Cohen Signed-off-by: Jakub Kicinski commit e973dfe9299441ad263efedf094897fbb31e6a87 Author: LeiZhou-97 Date: Tue Jun 13 18:59:29 2023 +0800 cgroup/misc: Expose misc.current on cgroup v2 root Hello, This patch is to expose misc.current on cgroup v2 root for tracking how much of the resource has been consumed in total on the system. Most of the cloud infrastucture use cgroup to fetch the host information for scheduling purpose. Currently, the misc controller can be used by Intel TDX HKIDs and AMD SEV ASIDs, which are both used for creating encrypted VMs. Intel TDX and AMD SEV are mostly be used by the cloud providers for providing confidential VMs. In actual use of a server, these confidential VMs may be launched in different ways. For the cloud solution, there are kubvirt and coco (tracked by kubepods.slice); on host, they can be booted directly through qemu by end user (tracked by user.slice), etc. In this complex environment, when wanting to know how many resource is used in total it has to iterate through all existing slices to get the value of each misc.current and add them up to calculate the total number of consumed keys. So exposing misc.current to root cgroup tends to give much easier when calculates how much resource has been used in total, which helps to schedule and count resources for the cloud infrastucture. Signed-off-by: LeiZhou-97 Signed-off-by: Tejun Heo commit 36de5f303ca1bd6fce74815ef17ef3d8ff8737b5 Author: Gustavo A. R. Silva Date: Wed Jun 14 19:18:22 2023 -0600 cgroup: Avoid -Wstringop-overflow warnings Address the following -Wstringop-overflow warnings seen when built with ARM architecture and aspeed_g4_defconfig configuration (notice that under this configuration CGROUP_SUBSYS_COUNT == 0): kernel/cgroup/cgroup.c:1208:16: warning: 'find_existing_css_set' accessing 4 bytes in a region of size 0 [-Wstringop-overflow=] kernel/cgroup/cgroup.c:1258:15: warning: 'css_set_hash' accessing 4 bytes in a region of size 0 [-Wstringop-overflow=] kernel/cgroup/cgroup.c:6089:18: warning: 'css_set_hash' accessing 4 bytes in a region of size 0 [-Wstringop-overflow=] kernel/cgroup/cgroup.c:6153:18: warning: 'css_set_hash' accessing 4 bytes in a region of size 0 [-Wstringop-overflow=] These changes are based on commit d20d30ebb199 ("cgroup: Avoid compiler warnings with no subsystems"). Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Signed-off-by: Tejun Heo commit 0feedcaa0a2723da191a2aad8526de92442448fc Merge: 37d1fc51dd20e b11403c93b7cd Author: Arnd Bergmann Date: Wed Jun 21 22:17:54 2023 +0200 Merge tag 'ti-driver-soc-for-v6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/drivers TI SoC driver updates for v6.5 * pruss: Add helper functions for ethernet client driver usage, add compile-testing, fixup function pointer casts * smartreflex: Cosmetic optimization for using devm_ioremap_resource * wkup_m3_ipc: Fix error checking around debugfs_create_dir * tag 'ti-driver-soc-for-v6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: wkup_m3_ipc.c: Fix error checking for debugfs_create_dir soc: ti: pruss: Add helper functions to set GPI mode, MII_RT_event and XFR soc: ti: pruss: Add pruss_cfg_read()/update(), pruss_cfg_get_gpmux()/set_gpmux() APIs soc: ti: pruss: Add pruss_{request,release}_mem_region() API soc: ti: pruss: Add pruss_get()/put() API soc: ti: pruss: Allow compile-testing soc: ti: pruss: Avoid cast to incompatible function type soc: ti: smartreflex: Use devm_platform_ioremap_resource() Link: https://lore.kernel.org/r/20230615164134.6sd5hudyadq3fvk4@garage Signed-off-by: Arnd Bergmann commit e8b4858b158eb31c0c3699280af78f34cdc9d993 Author: Mans Rullgard Date: Tue Jun 20 21:09:17 2023 +0100 dt-bindings: bus: ti-sysc: fix typo Fix typo (period vs comma) in list of valid clock names. Signed-off-by: Mans Rullgard Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230620200917.24958-1-mans@mansr.com Signed-off-by: Rob Herring commit 37d1fc51dd20e92263f35a63adbdd6da0cc7e4ca Merge: aaeb1b6367632 5d85ea2c87978 Author: Arnd Bergmann Date: Wed Jun 21 22:15:10 2023 +0200 Merge tag 'qcom-drivers-for-6.5-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers More Qualcomm driver updates for v6.5 The detection of split/non-split firmware files in the MDT loader is corrected. The Geni driver is updated to not enable unused interrupts, in some configurations. The count unit for MSM8998 in BWMON is corrected. RPM master stats driver is corrected to check for the right return value of devm_ioremap(). Support for socinfo version 18 and 19 are aded, and IPQ5300 is added to the list of platforms. * tag 'qcom-drivers-for-6.5-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: soc: qcom: geni-se: Do not bother about enable/disable of interrupts in secondary sequencer dt-bindings: sram: qcom,imem: document qdu1000 soc: qcom: icc-bwmon: Fix MSM8998 count unit dt-bindings: soc: qcom,rpmh-rsc: Require power-domains soc: qcom: socinfo: Add Soc ID for IPQ5300 dt-bindings: arm: qcom,ids: add SoC ID for IPQ5300 soc: qcom: Fix a IS_ERR() vs NULL bug in probe soc: qcom: socinfo: Add support for new fields in revision 19 soc: qcom: socinfo: Add support for new fields in revision 18 dt-bindings: firmware: scm: Add compatible for SDX75 soc: qcom: mdt_loader: Fix split image detection Link: https://lore.kernel.org/r/20230615163104.1461905-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit aaeb1b63676324168f7e854bb327512a94bea833 Merge: a08000d5e04d7 21d4631eedb13 Author: Arnd Bergmann Date: Wed Jun 21 22:13:29 2023 +0200 Merge tag 'v6.4-next-soc' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux into soc/drivers PMIC wrapper - support companion device - add support for MT6795 SPMI: - add support for MT8186 SVS: - change gpu node name to match binding * tag 'v6.4-next-soc' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux: soc: mediatek: remove DDP_DOMPONENT_DITHER from enum soc: mediatek: SVS: Fix MT8192 GPU node name soc: mediatek: mtk-mutex: Remove unnecessary .owner dt-bindings: phy: mediatek,dsi-phy: Add compatible for MT6795 Helio X10 dt-bindings: pwm: Add compatible for MediaTek MT6795 dt-bindings: spmi: spmi-mtk-pmif: Document mediatek,mt8195-spmi as fallback of mediatek,mt8186-spmi soc: mediatek: pwrap: Add support for MT6795 Helio X10 soc: mediatek: mtk-pmic-wrap: Add support for MT6331 w/ MT6332 companion soc: mediatek: mtk-pmic-wrap: Add support for companion PMICs soc: mediatek: pwrap: Add kerneldoc for struct pwrap_slv_type soc: mediatek: pwrap: Move PMIC read test sequence in function dt-bindings: soc: mediatek: pwrap: Add compatible for MT6795 Helio X10 Link: https://lore.kernel.org/r/1ed1e5ae-6305-e63a-84a0-3c43f69c8f8b@gmail.com Signed-off-by: Arnd Bergmann commit a08000d5e04d7a56bfdd864c145ba0f04765cb38 Merge: 09f4406a02ba5 e81a16e772592 Author: Arnd Bergmann Date: Wed Jun 21 21:58:32 2023 +0200 Merge tag 'qcom-drivers-for-6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers Qualcomm driver updates for v6.5 Konrad Dybcio is promoted, from reviewer, to co-maintainer. The mdt_loader gets a fix to the detection of split binaries, where the previous logic sometimes concluded that the first segments was not split, in a split image. The unconditional calling of scm_pas_mem_setup() turns out to cause a regression and is reverted. The altmode subfunction of pmic_glink is enabled for SM8450. A new driver for exposing power statistics from the RPM, for debugging purposes, is introduced. OCMEM gets a debug prints of the hardware version, QMI helpers are transitioned to alloc_ordered_workqueue() and an error message in ramp_controller is improved. An API is introduced to the SMEM driver to allow other drivers to query the SoC id, rather than open-coding the parsing of the relevant SMEM item. This is then used to clean up the Qualcomm NVMEM-based cpufreq driver. Socinfo is extended with knowledge about IPQ5018, IPQ5312 and IPQ5302. * tag 'qcom-drivers-for-6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (23 commits) soc: qcom: ocmem: Add OCMEM hardware version print cpufreq: qcom-nvmem: use helper to get SMEM SoC ID cpufreq: qcom-nvmem: use SoC ID-s from bindings soc: qcom: smem: introduce qcom_smem_get_soc_id() soc: qcom: smem: Switch to EXPORT_SYMBOL_GPL() soc: qcom: socinfo: move SMEM item struct and defines to a header soc: qcom: mdt_loader: Fix unconditional call to scm_pas_mem_setup MAINTAINERS: Add Konrad Dybcio as linux-arm-msm co-maintainer dt-bindings: sram: qcom,imem: Document MSM8226 soc: qcom: socinfo: Add Soc ID for IPQ5312 and IPQ5302 dt-bindings: arm: qcom,ids: add SoC ID for IPQ5312 and IPQ5302 soc: qcom: socinfo: Add IDs for IPQ5018 family dt-bindings: arm: qcom,ids: Add IDs for IPQ5018 family soc: qcom: Introduce RPM master stats driver dt-bindings: soc: qcom: Add RPM Master stats soc: qcom: qmi: Use alloc_ordered_workqueue() to create ordered workqueues soc: qcom: ramp_controller: Improve error message for failure in .remove() dt-bindings: soc: qcom: smd-rpm: allow MSM8226 over SMD soc: qcom: rpmpd: use correct __le32 type dt-bindings: soc: qcom: eud: Fix compatible string in the example ... Link: https://lore.kernel.org/r/20230611010044.2481875-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 09f4406a02ba57361e64825fac53e91e260a61b7 Merge: 095ee35a336de 9365bf006f53d Author: Arnd Bergmann Date: Wed Jun 21 21:49:59 2023 +0200 Merge tag 'tegra-for-6.5-pci' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers PCI: tegra: Changes for v6.5-rc1 This contains updates to the PCI driver for Tegra194 and later devices that depend on the memory controller interconnect changes. * tag 'tegra-for-6.5-pci' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: PCI: tegra194: Add interconnect support in Tegra234 PCI: tegra194: Fix possible array out of bounds access Link: https://lore.kernel.org/r/20230609193620.2275240-5-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit 095ee35a336de61c96790d7dd0cb083e0b35cb6f Merge: b161ec3d3820f e852af72a7f21 Author: Arnd Bergmann Date: Wed Jun 21 21:49:00 2023 +0200 Merge tag 'tegra-for-6.5-memory' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers memory: tegra: Changes for v6.5-rc1 This introduces an interconnect provider for the memory controller and external memory controller found on Tegra234 chips that will eventually be used to dynamically scale the EMC frequency based on a device's bandwidth needs. * tag 'tegra-for-6.5-memory' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: memory: tegra: Make CPU cluster BW request a multiple of MC channels memory: tegra: Add software memory clients in Tegra234 memory: tegra: Add memory clients for Tegra234 memory: tegra: Add interconnect support for DRAM scaling in Tegra234 dt-bindings: tegra: Add ICC IDs for dummy memory clients dt-bindings: tegra: Document compatible for IGX Link: https://lore.kernel.org/r/20230609193620.2275240-4-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit b161ec3d3820f4b79fa12a02451295a70ded13fa Merge: bc889e870e62c 2abd484ca48f2 Author: Arnd Bergmann Date: Wed Jun 21 21:47:02 2023 +0200 Merge tag 'tegra-for-6.5-firmware' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers firmware: tegra: Changes for v6.5-rc1 This adds support for using system memory as shared memory between the CPU and the BPMP, which will be needed for Tegra264 support. * tag 'tegra-for-6.5-firmware' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: firmware: tegra: bpmp: Add support for DRAM MRQ GSCs Link: https://lore.kernel.org/r/20230609193620.2275240-2-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit bc889e870e62c13ddbbd363e30c854d358b90c4d Merge: b79dec951a5ed c954cd7ad0412 Author: Arnd Bergmann Date: Wed Jun 21 21:39:18 2023 +0200 Merge tag 'tegra-for-6.5-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers soc/tegra: Changes for v6.5-rc1 This adds initial support for identifying the Tegra264 SoC family and fixes potential issues when reading from the FUSE block. A new software wake event for the AON cluster is added on Tegra234 and the debugfs initialization is drastically simplified. * tag 'tegra-for-6.5-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: soc/tegra: pmc: Use devm_clk_notifier_register() soc/tegra: pmc: Simplify debugfs initialization soc/tegra: fuse: Fix Tegra234 fuse size soc/tegra: pmc: Add AON SW Wake support for Tegra234 soc/tegra: fuse: Add support for Tegra264 Link: https://lore.kernel.org/r/20230609193620.2275240-1-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit 017fb83ee0612595ec70c65ddd83472706b02a50 Author: Bart Van Assche Date: Wed Jun 21 09:50:54 2023 -0700 block: Improve kernel-doc headers Fix the documentation of the devt_from_partuuid() return value. Fix the following two recently introduced kernel-doc warnings: block/bdev.c:570: warning: Function parameter or member 'hops' not described in 'bd_finish_claiming' block/early-lookup.c:46: warning: Function parameter or member 'devt' not described in 'devt_from_partuuid' Cc: Christoph Hellwig Fixes: 0718afd47f70 ("block: introduce holder ops") Fixes: cf056a431215 ("init: improve the name_to_dev_t interface") Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20230621165054.743815-1-bvanassche@acm.org Signed-off-by: Jens Axboe commit fa50d6b8a5f762c62dc0049d3ede9f1e47cc47d3 Merge: 92852219a397b 6c50384ef8b94 Author: Greg Kroah-Hartman Date: Wed Jun 21 21:15:06 2023 +0200 Merge tag 'coresight-next-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/coresight/linux into char-misc-next Suzuki writes: coresight: Updates for v6.5 CoreSight and hwtracing subsystem updates for v6.5 includes: - Fixes to the CTI module reference leaks. This involves, redesign of how the helper devices are tracked and CTI devices have been converted to helper devices. - Fix removal of the trctraceidr file from sysfs for ETMs. - Match all ETMv4 instances based on the ETMv4 architected registers and the CoreSight Component ID (CID), than having to add individual PIDs for CPUs. - Add support for Dummy CoreSight source and sink drivers. - Add James Clark as Reviewer for the CoreSight kernel drivers - Fixes to HiSilicon PCIe Tune and Trace Device driver Signed-off-by: Suzuki K Poulose * tag 'coresight-next-v6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/coresight/linux: (27 commits) hwtracing: hisi_ptt: Fix potential sleep in atomic context hwtracing: hisi_ptt: Advertise PERF_PMU_CAP_NO_EXCLUDE for PTT PMU hwtracing: hisi_ptt: Export available filters through sysfs hwtracing: hisi_ptt: Add support for dynamically updating the filter list hwtracing: hisi_ptt: Factor out filter allocation and release operation coresight: dummy: Update type of mode parameter in dummy_{sink,source}_enable() Documentation: trace: Add documentation for Coresight Dummy Trace dt-bindings: arm: Add support for Coresight dummy trace Coresight: Add coresight dummy driver MAINTAINERS: coresight: Add James Clark as Reviewer coresight: etm4x: Match all ETM4 instances based on DEVARCH and DEVTYPE coresight: etm4x: Make etm4_remove_dev() return void coresight: etm4x: Fix missing trctraceidr file in sysfs coresight: Fix CTI module refcount leak by making it a helper device coresight: Enable and disable helper devices adjacent to the path coresight: Refactor out buffer allocation function for ETR coresight: Make refcount a property of the connection coresight: Store in-connections as well as out-connections coresight: Simplify connection fixup mechanism coresight: Store pointers to connections rather than an array of them ... commit 92852219a397b894255a91868d2cc7fd80e318ff Merge: a5052c85b9def 1400725e45152 Author: Greg Kroah-Hartman Date: Wed Jun 21 21:12:43 2023 +0200 Merge tag 'icc-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next Georgi writes: interconnect changes for 6.5 This pull request contains the interconnect changes for the 6.5-rc1 merge window which is a mix of core and driver changes with the following highlights: - Support for configuring QoS on the Qualcomm's RPM-based platforms, that required special handling of some interface (non-scaling) clocks. - Support for clock-based interconnect providers for cases when clock corresponds to bus bandwidth. This is used to enable CPU cluster bandwidth scaling on MSM8996 platforms. One patch is touching a file in the clock subsystem that has been acked by the maintainer. Core changes: interconnect: add clk-based icc provider support interconnect: icc-clk: fix modular build interconnect: drop unused icc_get() interface Driver changes: interconnect: qcom: rpm: Rename icc desc clocks to bus_blocks interconnect: qcom: rpm: Rename icc provider num_clocks to num_bus_clocks interconnect: qcom: rpm: Drop unused parameters interconnect: qcom: rpm: Set QoS registers only once interconnect: qcom: rpm: Handle interface clocks interconnect: qcom: icc-rpm: Enforce 2 or 0 bus clocks interconnect: qcom: rpm: Don't use clk_get_optional for bus clocks anymore interconnect: qcom: msm8996: Promote to core_initcall interconnect: qcom: rpm: allocate enough data in probe() dt-bindings: interconnect/msm8996-cbf: add defines to be used by CBF clk: qcom: cbf-msm8996: scale CBF clock according to the CPUfreq dt-bindings: interconnect: fsl,imx8m-noc: drop unneeded quotes Signed-off-by: Georgi Djakov * tag 'icc-6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc: dt-bindings: interconnect: fsl,imx8m-noc: drop unneeded quotes interconnect: icc-clk: fix modular build clk: qcom: cbf-msm8996: scale CBF clock according to the CPUfreq interconnect: drop unused icc_get() interface interconnect: qcom: rpm: allocate enough data in probe() interconnect: qcom: msm8996: Promote to core_initcall interconnect: qcom: rpm: Don't use clk_get_optional for bus clocks anymore interconnect: qcom: icc-rpm: Enforce 2 or 0 bus clocks interconnect: qcom: rpm: Handle interface clocks interconnect: add clk-based icc provider support dt-bindings: interconnect/msm8996-cbf: add defines to be used by CBF interconnect: qcom: rpm: Set QoS registers only once interconnect: qcom: rpm: Drop unused parameters interconnect: qcom: rpm: Rename icc provider num_clocks to num_bus_clocks interconnect: qcom: rpm: Rename icc desc clocks to bus_blocks commit a4bd03e7cb78ff743d811a09273b40d31e861def Merge: ee44484c12edc 724ba67515320 Author: Arnd Bergmann Date: Wed Jun 21 21:07:01 2023 +0200 Merge tag 'arm-dts-mv-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux into soc/dt ARM: dts: Move .dts files to vendor sub-directories The arm dts directory has grown to 1559 boards which makes it a bit unwieldy to maintain and use. Past attempts stalled out due to plans to move .dts files out of the kernel tree. Doing that is no longer planned (any time soon at least), so let's go ahead and group .dts files by vendors. This move aligns arm with arm64 .dts file structure. * tag 'arm-dts-mv-for-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: ARM: dts: Move .dts files to vendor sub-directories kbuild: Support flat DTBs install ARM: dts: Add .dts files missing from the build ARM: dts: allwinner: Use quoted #include Link: https://lore.kernel.org/r/20230621185025.GA3197738-robh@kernel.org Signed-off-by: Arnd Bergmann commit 75bfb70457a4c4c9f0095e39885382fc5049c5ce Author: Colin Ian King Date: Wed Jun 21 15:52:05 2023 +0100 nfsd: remove redundant assignments to variable len There are a few assignments to variable len where the value is not being read and so the assignments are redundant and can be removed. In one case, the variable len can be removed completely. Cleans up 4 clang scan warnings of the form: fs/nfsd/export.c:100:7: warning: Although the value stored to 'len' is used in the enclosing expression, the value is never actually read from 'len' [deadcode.DeadStores] Signed-off-by: Colin Ian King Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit a04de42460e271e532b43ad40e9fb07a9a09fe5c Author: Miaohe Lin Date: Sat Jun 17 15:48:09 2023 +0800 cgroup: remove obsolete comment on cgroup_on_dfl() The debug feature is supported since commit 8cc38fa7fa31 ("cgroup: make debug an implicit controller on cgroup2"), update corresponding comment. Signed-off-by: Miaohe Lin Signed-off-by: Tejun Heo commit 5f743f576d3f9ac08ed28fe8e65bdbc8d49b8034 Author: Dmitry Antipov Date: Wed Jun 14 09:18:32 2023 +0300 wifi: rtlwifi: cleanup USB interface Drop unused '_usb_writen_sync()' and relevant pointer from 'struct rtl_io', handle possible write error in '_usb_write_async()', adjust related code. Signed-off-by: Dmitry Antipov Acked-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230614061832.40882-2-dmantipov@yandex.ru commit 084f1f552f8dd8e8b993d14a30720b7484d77020 Author: Dmitry Antipov Date: Wed Jun 14 09:18:31 2023 +0300 wifi: rtlwifi: simplify LED management Introduce 'rtl_init_sw_leds()' to replace per-chip LED initialization code (and so drop 'struct rtl_led' as no longer used), drop 'init_sw_leds' and 'deinit_sw_leds' fields from 'struct rtl_hal_ops', adjust related code. Signed-off-by: Dmitry Antipov Acked-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230614061832.40882-1-dmantipov@yandex.ru commit 9b53a13422162feac7c7ee58e5bc0e0a80a41963 Author: William Breathitt Gray Date: Tue Jun 20 13:01:59 2023 -0400 counter: Fix menuconfig "Counter support" submenu entries disappearance The current placement of the I8254 Kconfig entry results in the disappearance of the "Counter support" submenu items in menuconfig. Move the I8254 above the menuconfig COUNTER entry to restore the intended submenu behavior. Fixes: d428487471ba ("counter: i8254: Introduce the Intel 8254 interface library module") Reported-by: Jarkko Nikula Closes: https://lore.kernel.org/all/32ddaa7b-53a8-d61f-d526-b545bd561337@linux.intel.com/ Reviewed-by: Randy Dunlap Tested-by: Jarkko Nikula Reviewed-by: Jarkko Nikula Link: https://lore.kernel.org/r/20230620170159.556788-1-william.gray@linaro.org/ Signed-off-by: William Breathitt Gray commit d8aa21235d0342e6d0cc99f37d0771749e742e5a Merge: 04f78e242fffe 12ec37be3faf9 Author: Kalle Valo Date: Wed Jun 21 21:18:08 2023 +0300 Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git ath.git patches for v6.5. Major changes: ath11k * factory test mode support commit 7bd932d9adbcc5c5370d968bdb0b00385606bf3a Author: Raymond Hackley Date: Fri Jun 2 13:11:14 2023 +0000 leds: sgm3140: Add richtek,rt5033-led compatible Richtek's rt5033-led has pin configurations similar to sgm3140. Add it to the compatible list. Signed-off-by: Raymond Hackley Link: https://lore.kernel.org/r/20230602131024.260297-1-raymondhackley@protonmail.com Signed-off-by: Lee Jones commit 2a5724a0a7c6374905b26f2f24caeab038608953 Author: Raymond Hackley Date: Fri Jun 2 13:11:02 2023 +0000 dt-bindings: leds: sgm3140: Document richtek,rt5033 compatible Add devicetree binding for Richtek RT5033 Flash LED charge pump used for camera flash LEDs. Signed-off-by: Raymond Hackley Link: https://lore.kernel.org/r/20230602131009.260239-1-raymondhackley@protonmail.com Signed-off-by: Lee Jones commit 12ec37be3faf9df7831ce210947f111b3417baf3 Author: Arnd Bergmann Date: Fri Jun 16 11:04:21 2023 +0200 wifi: ath10k: improve structure padding Including an aligned structure inside of a packed one is ambiguous and can lead to misaligned data, as pointed out by this clang warning: drivers/net/wireless/ath/ath10k/htt.h:715:34: error: field prefix within 'struct htt_rx_indication' is less aligned than 'struct htt_rx_indication_prefix' and is usually due to 'struct htt_rx_indication' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] struct htt_rx_indication_prefix prefix; ^ drivers/net/wireless/ath/ath10k/htt.h:736:34: error: field prefix within 'struct htt_rx_indication_hl' is less aligned than 'struct htt_rx_indication_prefix' and is usually due to 'struct htt_rx_indication_hl' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] struct htt_rx_indication_prefix prefix; ^ drivers/net/wireless/ath/ath10k/htt.h:1564:2: error: field within 'struct htt_tx_fetch_ind' is less aligned than 'union htt_tx_fetch_ind::(anonymous at drivers/net/wireless/ath/ath10k/htt.h:1564:2)' and is usually due to 'struct htt_tx_fetch_ind' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] union { ^ drivers/net/wireless/ath/ath10k/htt.h:1702:2: error: field within 'struct htt_resp' is less aligned than 'union htt_resp::(anonymous at drivers/net/wireless/ath/ath10k/htt.h:1702:2)' and is usually due to 'struct htt_resp' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access] These structures appear to actually need the packing since they are embedded at misaligned offsets. Add even more such annotations here to enforce bytewise access throughout the driver. Signed-off-by: Arnd Bergmann Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230616090439.2484857-1-arnd@kernel.org commit 2aa083acea9f61be3280184384551178f510ff51 Author: Dmitry Antipov Date: Tue Jun 13 16:46:55 2023 +0300 wifi: ath9k: convert msecs to jiffies where needed Since 'ieee80211_queue_delayed_work()' expects timeout in jiffies and not milliseconds, 'msecs_to_jiffies()' should be used in 'ath_restart_work()' and '__ath9k_flush()'. Fixes: d63ffc45c5d3 ("ath9k: rename tx_complete_work to hw_check_work") Signed-off-by: Dmitry Antipov Acked-by: Toke Høiland-Jørgensen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230613134655.248728-1-dmantipov@yandex.ru commit cb60fdf6e23068e0954b2a66855b7dc5d6019a87 Author: Alexander Stein Date: Fri Jun 9 09:15:38 2023 +0200 dt-bindings: phy: mixel,mipi-dsi-phy: Remove assigned-clock* properties With dt-schema v2021.02 these properties are added by default. Some SoC (e.g. imx8mq) configure more than just one clock using these properties. Fixes: f9b0593dd4fc6 ("dt-bindings: phy: Convert mixel,mipi-dsi-phy to json-schema") Signed-off-by: Alexander Stein Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230609071538.149712-1-alexander.stein@ew.tq-group.com Signed-off-by: Vinod Koul commit 0eac9e977283d1573aa8c1f614afbe807aae62d1 Author: Krzysztof Kozlowski Date: Tue May 30 16:48:45 2023 +0200 dt-bindings: phy: intel,combo-phy: restrict node name suffixes Make the pattern matching node names a bit stricter to improve DTS consistency. The pattern is restricted to: 1. Only one unit address or one -N suffix, 2. -N suffixes to decimal numbers. Suggested-by: Rob Herring Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring Reviewed-by: Tony Lindgren Reviewed-by: Conor Dooley Acked-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20230530144851.92059-2-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul commit bc958b3adf9f83fd80e81fa723de955bb90c8eca Author: Rudraksha Gupta Date: Wed Jun 7 01:00:21 2023 -0400 dt-bindings: phy: qcom,usb-hs-phy: Add compatible Adds qcom,usb-hs-phy-msm8960 compatible Signed-off-by: Rudraksha Gupta Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230607050025.86636-3-guptarud@gmail.com Signed-off-by: Vinod Koul commit 44faada0f38fc333d392af04c343b0e23f8f5d81 Author: Claudiu Beznea Date: Wed May 31 10:39:50 2023 +0300 phy: tegra: xusb: check return value of devm_kzalloc() devm_kzalloc() returns a pointer to dynamically allocated memory. Pointer could be NULL in case allocation fails. Check pointer validity. Identified with coccinelle (kmerr.cocci script). Fixes: f67213cee2b3 ("phy: tegra: xusb: Add usb-role-switch support") Signed-off-by: Claudiu Beznea Acked-by: Thierry Reding Link: https://lore.kernel.org/r/20230531073950.145339-1-claudiu.beznea@microchip.com Signed-off-by: Vinod Koul commit b360cbd254fde61cb500a4a3ca2e65dff3dfa039 Author: YueHaibing Date: Tue Jun 20 17:45:19 2023 +0800 x86/acpi: Remove unused extern declaration acpi_copy_wakeup_routine() This is now unused, so can be removed. Signed-off-by: YueHaibing Signed-off-by: Dave Hansen Acked-by: Rafael J. Wysocki Link: https://lore.kernel.org/all/20230620094519.15300-1-yuehaibing%40huawei.com commit 7c8cb341fd6667bf2a3dc19c801500af2c92f3f0 Author: Krzysztof Kozlowski Date: Mon Jun 19 12:14:24 2023 +0200 dt-bindings: mfd: samsung,s5m8767: Simplify excluding properties Mutually exclusive s5m8767,pmic-buck[234]-uses-gpio-dvs properties can be written simpler, with half of the lines of code. Signed-off-by: Krzysztof Kozlowski Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20230619101424.25897-1-krzysztof.kozlowski@linaro.org Signed-off-by: Lee Jones commit 0fac214bb75ee64d7b9e6521d53f8251a4d324ea Author: Arjan van de Ven Date: Tue Jun 20 18:03:54 2023 +0000 intel_idle: Add a "Long HLT" C1 state for the VM guest mode intel_idle will, for the bare metal case, usually have one or more deep power states that have the CPUIDLE_FLAG_TLB_FLUSHED flag set. When a state with this flag is selected by the cpuidle framework, it will also flush the TLBs as part of entering this state. The benefit of doing this is that the kernel does not need to wake the cpu out of this deep power state just to flush the TLBs... for which the latency can be very high due to the exit latency of deep power states. In a VM guest currently, this benefit of avoiding the wakeup does not exist, while the problem (long exit latency) is even more severe. Linux will need to wake up a vCPU (causing the host to either come out of a deep C state, or the VMM to have to deschedule something else to schedule the vCPU) which can take a very long time.. adding a lot of latency to tlb flush operations (including munmap and others). To solve this, add a "Long HLT" C state to the state table for the VM guest case that has the CPUIDLE_FLAG_TLB_FLUSHED flag set. The result of that is that for long idle periods (where the VMM is likely to do things that cause large latency) the cpuidle framework will flush the TLBs (and avoid the wakeups), while for short/quick idle durations, the existing behavior is retained. Now, there is still only "hlt" available in the guest, but for long idle, the host can go to a deeper state (say C6). There is a reasonable debate one can have to what to set for the exit_latency and break even point for this "Long HLT" state. The good news is that intel_idle has these values available for the underlying CPU (even when mwait is not exposed). The solution thus is to just use the latency and break even of the deepest state from the bare metal CPU. This is under the assumption that this is a pretty reasonable estimate of what the VMM would do to cause latency. Signed-off-by: Arjan van de Ven Signed-off-by: Rafael J. Wysocki commit 104d32bd81f620bb9f67fbf7d1159c414e89f05f Author: Christophe JAILLET Date: Sat Jun 17 12:43:16 2023 +0200 mfd: stmpe: Only disable the regulators if they are enabled In stmpe_probe(), if some regulator_enable() calls fail, probing continues and there is only a dev_warn(). So, if stmpe_probe() is called the regulator may not be enabled. It is cleaner to test it before calling regulator_disable() in the remove function. Fixes: 9c9e321455fb ("mfd: stmpe: add optional regulators") Signed-off-by: Christophe JAILLET Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/8de3aaf297931d655b9ad6aed548f4de8b85425a.1686998575.git.christophe.jaillet@wanadoo.fr Signed-off-by: Lee Jones commit 03f44ffb3d5be2fceda375d92c70ab6de4df7081 Author: Tero Kristo Date: Wed Jun 21 09:58:39 2023 +0300 cpufreq: intel_pstate: Fix energy_performance_preference for passive If the intel_pstate driver is set to passive mode, then writing the same value to the energy_performance_preference sysfs twice will fail. This is caused by the wrong return value used (index of the matched energy_perf_string), instead of the length of the passed in parameter. Fix by forcing the internal return value to zero when the same preference is passed in by user. This same issue is not present when active mode is used for the driver. Fixes: f6ebbcf08f37 ("cpufreq: intel_pstate: Implement passive mode with HWP enabled") Reported-by: Niklas Neronin Signed-off-by: Tero Kristo Signed-off-by: Rafael J. Wysocki commit 724ba6751532055db75992fc6ae21c3e322e94a7 Author: Rob Herring Date: Thu May 4 18:38:52 2023 -0500 ARM: dts: Move .dts files to vendor sub-directories The arm dts directory has grown to 1559 boards which makes it a bit unwieldy to maintain and use. Past attempts stalled out due to plans to move .dts files out of the kernel tree. Doing that is no longer planned (any time soon at least), so let's go ahead and group .dts files by vendors. This move aligns arm with arm64 .dts file structure. There's no change to dtbs_install as the flat structure is maintained on install. The naming of vendor directories is roughly in this order of preference: - Matching original and current SoC vendor prefix/name (e.g. ti, qcom) - Current vendor prefix/name if still actively sold (SoCs which have been aquired) (e.g. nxp/imx) - Existing platform name for older platforms not sold/maintained by any company (e.g. gemini, nspire) The whole move was scripted with the exception of MAINTAINERS and a few makefile fixups. Acked-by: Viresh Kumar Acked-by: Michal Simek #Xilinx Acked-by: Krzysztof Kozlowski Acked-by: Neil Armstrong Acked-by: Paul Barker Acked-by: Tony Lindgren Acked-by: Gregory CLEMENT Acked-by: Heiko Stuebner Acked-by: Wei Xu #hisilicon Acked-by: Geert Uytterhoeven Acked-by: Nick Hawkins Acked-by: Baruch Siach Reviewed-by: Linus Walleij Reviewed-by: Andre Przywara Acked-by: Andre Przywara Reviewed-by: Claudiu Beznea Acked-by: Peter Rosin Acked-by: Jesper Nilsson Acked-by: Sudeep Holla Acked-by: Florian Fainelli #broadcom Acked-by: Manivannan Sadhasivam Reviewed-by: Jisheng Zhang Acked-by: Patrice Chotard Acked-by: Romain Perier Acked-by: Alexandre TORGUE Acked-by: Shawn Guo Acked-by: Kunihiko Hayashi Acked-by: Enric Balletbo i Serra Signed-off-by: Rob Herring commit f0fb7651ba847df52638f5d47cb98b379dca58a2 Author: Rob Herring Date: Tue Jun 13 14:10:22 2023 -0600 dt-bindings: backlight: kinetic,ktz8866: Add missing type for "current-num-sinks" "current-num-sinks" is missing a type, add it. Signed-off-by: Rob Herring Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20230613201022.2823392-1-robh@kernel.org Signed-off-by: Lee Jones commit e0cbc202388af454eb771043b20db6dfe68199ec Author: Okan Sahin Date: Wed Apr 12 14:12:46 2023 +0300 mfd: max77541: Add ADI MAX77541/MAX77540 PMIC Support MFD driver for MAX77541/MAX77540 to enable its sub devices. The MAX77541 is a multi-function devices. It includes buck converter and ADC. The MAX77540 is a high-efficiency buck converter with two 3A switching phases. They have same regmap except for ADC part of MAX77541. Signed-off-by: Okan Sahin Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230412111256.40013-6-okan.sahin@analog.com Signed-off-by: Lee Jones commit 360da60d6c6edb9740de7a8e6d8969d62ceff956 Author: Selvin Xavier Date: Tue Jun 13 11:12:23 2023 -0700 RDMA/bnxt_re: Enable low latency push Introduce driver specific uapi functionalites. Added a alloc_page functionality for user library to allocate specific pages. Currently added support for allocating write combine pages for push functinality. This interface shall be extended for other page allocations. Allocate a WC page using the uapi hook for enabling the low latency push in Gen P5 adapters for small packets. This is supported only for the user space QPs. Link: https://lore.kernel.org/r/1686679943-17117-8-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 0ac20faf5d837b59fb4c041ea320932ed47fd67f Author: Selvin Xavier Date: Tue Jun 13 11:12:22 2023 -0700 RDMA/bnxt_re: Reorg the bar mapping Reorganize the code for allocation and mapping of Doorbell pages. Implements new HW command to get the BAR length used by L2 driver. These changes are used by the future patch which maps the WC Doorbell pages. Also, introduced a new lock dpi_tbl_lock for synchronize the DB page allocation from users. Link: https://lore.kernel.org/r/1686679943-17117-7-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 3fe9882fbb50eeb724504df5979e9140f8842f76 Author: Selvin Xavier Date: Tue Jun 13 11:12:21 2023 -0700 RDMA/bnxt_re: Move the interface version to chip context structure FW interface version check is required for multiple features. Moving the interface version to chip context structure. Link: https://lore.kernel.org/r/1686679943-17117-6-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit ba75fe7b500e71aff8bc3b7096c4ce1dcc649eb3 Author: Selvin Xavier Date: Tue Jun 13 11:12:20 2023 -0700 RDMA/bnxt_re: Query function capabilities from firmware Query Function capabilities to enable advanced features. Link: https://lore.kernel.org/r/1686679943-17117-5-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 7d3115eba3e3eef6e0cbe65f05285c5ab28360d7 Author: Selvin Xavier Date: Tue Jun 13 11:12:19 2023 -0700 RDMA/bnxt_re: Optimize the bnxt_re_init_hwrm_hdr usage As of now bnxt_re_init_hwrm_hdr is taking only the opcode from the caller. compl_ring and target_id field is always -1. These fields might be changed when newer features are added. For now, removing these parameters as they are hard coded. Also, remove the rdev field which is not used. Also, initialize the structure bnxt_fw_msg during declaration itself. Link: https://lore.kernel.org/r/1686679943-17117-4-git-send-email-selvin.xavier@broadcom.com Suggested-by: Leon Romanovsky Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 390bf429cc6ce6844f834b1d9ddfbc1125aff1fc Author: Selvin Xavier Date: Tue Jun 13 11:12:18 2023 -0700 RDMA/bnxt_re: Add disassociate ucontext support Add driver disassociation support. Driver uses the APIs rdma_user_mmap_io api while mapping the IO pages to user space. Add empty stub for disassociate ucontext. Link: https://lore.kernel.org/r/1686679943-17117-3-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 24ce94782c4878fe25ff15d8c08088a6ca5810e1 Author: Selvin Xavier Date: Tue Jun 13 11:12:17 2023 -0700 RDMA/bnxt_re: Use the common mmap helper functions Replace the mmap handling function with common code in IB core. Create rdma_user_mmap_entry for each mmap resource and add to the ib_core mmap list. Add mmap_free verb support. Also, use rdma_user_mmap_io while mapping Doorbell pages. Link: https://lore.kernel.org/r/1686679943-17117-2-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe commit 147394dbe1237ef1f2da528c238633215f7193e1 Author: Leon Romanovsky Date: Tue Jun 13 11:15:57 2023 +0300 RDMA/bnxt_re: Initialize opcode while sending message Fix compilation warning: drivers/infiniband/hw/bnxt_re/qplib_rcfw.c:325:18: error: variable 'opcode' is uninitialized when used here [-Werror,-Wuninitialized] crsqe->opcode = opcode; ^~~~~~ drivers/infiniband/hw/bnxt_re/qplib_rcfw.c:291:11: note: initialize the variable 'opcode' to silence this warning u8 opcode; ^ = '\0' Fixes: bcfee4ce3e01 ("RDMA/bnxt_re: remove redundant cmdq_bitmap") Link: https://lore.kernel.org/r/6ad1e44be2b560986da6fdc6b68da606413e9026.1686644105.git.leonro@nvidia.com Acked-by: Selvin Xavier Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit c88ad30e3f861c7be4e3b4995554e2b0754059b7 Author: Mario Limonciello Date: Tue Jun 20 12:24:33 2023 -0500 cpufreq: amd-pstate: Add a kernel config option to set default mode Users are having more success with amd-pstate since the introduction of EPP and Guided modes. To expose the driver to more users by default introduce a kernel configuration option for setting the default mode. Users can use an integer to map out which default mode they want to use in lieu of a kernel command line option. This will default to EPP, but only if: 1) The CPU supports an MSR. 2) The system profile is identified 3) The system profile is identified as a non-server by the FADT. Link: https://gitlab.freedesktop.org/hadess/power-profiles-daemon/-/merge_requests/121 Acked-by: Huang Rui Reviewed-by: Gautham R. Shenoy Co-developed-by: Perry Yuan Signed-off-by: Perry Yuan Signed-off-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki commit 32f80b9adfdb43f8af248596724f59dde938a190 Author: Mario Limonciello Date: Tue Jun 20 12:24:32 2023 -0500 cpufreq: amd-pstate: Set a fallback policy based on preferred_profile If a user's configuration doesn't explicitly specify the cpufreq scaling governor then the code currently explicitly falls back to 'powersave'. This default is fine for notebooks and desktops, but servers and undefined machines should default to 'performance'. Look at the 'preferred_profile' field from the FADT to set this policy accordingly. Link: https://uefi.org/htmlspecs/ACPI_Spec_6_4_html/05_ACPI_Software_Programming_Model/ACPI_Software_Programming_Model.html#fixed-acpi-description-table-fadt Acked-by: Huang Rui Suggested-by: Wyes Karny Reviewed-by: Gautham R. Shenoy Signed-off-by: Mario Limonciello Reviewed-by: Perry Yuan Signed-off-by: Rafael J. Wysocki commit 965262ef71c475857d0984a5eee57694b207a113 Author: Mario Limonciello Date: Tue Jun 20 12:24:31 2023 -0500 ACPI: CPPC: Add definition for undefined FADT preferred PM profile value In the event a new preferred PM profile value is introduced it's best for code to be able to defensively guard against it so that the wrong settings don't get applied on a new system that uses this profile but ancient kernels. Acked-by: Huang Rui Suggested-by: Gautham Ranjal Shenoy Link: https://uefi.org/htmlspecs/ACPI_Spec_6_4_html/05_ACPI_Software_Programming_Model/ACPI_Software_Programming_Model.html#fixed-acpi-description-table-fadt Signed-off-by: Mario Limonciello Reviewed-by: Perry Yuan Signed-off-by: Rafael J. Wysocki commit 9d16d264775b9a10f3f5b5db768d7f51294b2a63 Author: Christophe JAILLET Date: Thu Apr 27 21:47:45 2023 +0200 nvmet: Reorder fields in 'struct nvmet_ns' Group some variables based on their sizes to reduce holes. On x86_64, this shrinks the size of 'struct nvmet_ns' from 520 to 512 bytes. When such a structure is allocated in nvmet_ns_alloc(), because of the way memory allocation works, when 520 bytes were requested, 1024 bytes were allocated. So, on x86_64, this change saves 512 bytes per allocation. Signed-off-by: Christophe JAILLET Reviewed-by: Chaitanya Kulkarni Reviewed-by: Sagi Grimberg Reviewed-by: Jens Axboe Signed-off-by: Keith Busch commit d0dd594bedc57f9be2af2af170bf56f9c3f2376e Author: Breno Leitao Date: Thu Jun 15 02:49:03 2023 -0700 nvme: Print capabilities changes just once This current dev_info() could be very verbose and being printed very frequently depending on some userspace application sending some specific commands. Just print this message once and skip it until the controller resets. Use a controller flag (NVME_CTRL_DIRTY_CAPABILITY) to track if the capability needs a reset. Signed-off-by: Breno Leitao Reviewed-by: Sagi Grimberg Reviewed-by: Chaitanya Kulkarni Signed-off-by: Keith Busch commit 724418b84e6248cd27599607b7e5fac365b8e3f5 Author: Matthew Anderson Date: Wed Jun 21 11:17:14 2023 -0500 ALSA: hda/realtek: Add quirks for ROG ALLY CS35l41 audio This requires a patched ACPI table or a firmware from ASUS to work because the system does not come with the _DSD field for the CSC3551. Link: https://bugzilla.kernel.org/show_bug.cgi?id=217550 Signed-off-by: Matthew Anderson Tested-by: Philip Mueller Link: https://lore.kernel.org/r/20230621161714.9442-1-ruinairas1992@gmail.com Signed-off-by: Takashi Iwai commit ff399bab86382c896c3922a570884bba287eb465 Author: Wei Chen Date: Wed Jun 21 12:43:23 2023 +0000 usb: gadget: legacy: fix error return code in gfs_bind We must return negative error code -ENOMEM if function 'usb_otg_descriptor_alloc()' fails. Signed-off-by: Wei Chen Link: https://lore.kernel.org/r/20230621124323.47183-1-harperchen1110@gmail.com Signed-off-by: Greg Kroah-Hartman commit ef1e29c6f6ad1e327d07b078e37a1eddd832e8e4 Author: Neil Armstrong Date: Wed Jun 14 15:10:41 2023 +0200 usb: typec: fsa4480: add support for Audio Accessory Mode The FSA4480 Type-C switch supports switching the Audio R/L, AGND and MIC signals to the USB-C DP/DM and SBU1/2 to support the Audio Accessory Mode. The FSA4480 has an integrated Audio jack detection mechanism to automatically mux the AGND, MIX and Sense to the correct SBU lines to support 3 pole and both 4 pole TRRS pinouts. Signed-off-by: Neil Armstrong Tested-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230614-topic-sm8550-upstream-type-c-audio-v1-3-15a92565146b@linaro.org Signed-off-by: Greg Kroah-Hartman commit c7054c31c1c94dbfe0ddf7c327f72f020d47c6c9 Author: Neil Armstrong Date: Wed Jun 14 15:10:40 2023 +0200 usb: typec: fsa4480: rework mux & switch setup to handle more states In order to handle the Audio Accessory mode, refactor the mux and switch setup in a single function. The refactor will help add new states and make the process simpler to understand. Signed-off-by: Neil Armstrong Tested-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230614-topic-sm8550-upstream-type-c-audio-v1-2-15a92565146b@linaro.org Signed-off-by: Greg Kroah-Hartman commit 25a2bc21c86392223142dcbd5bc92e598a950678 Author: Neil Armstrong Date: Wed Jun 14 15:10:39 2023 +0200 usb: typec: ucsi: call typec_set_mode on non-altmode partner change Add support for calling typec_set_mode() for the DEBUG, AUDIO accessory modes. Let's also call typec_set_mode() for USB as default and SAFE when partner is disconnected. The USB state is only called when ALT mode is specifically not specified by the partner status flags in order to leave the altmode handlers setup the proper mode to switches, muxes and retimers. Signed-off-by: Neil Armstrong Tested-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230614-topic-sm8550-upstream-type-c-audio-v1-1-15a92565146b@linaro.org Signed-off-by: Greg Kroah-Hartman commit aed1a2a5a6a2aa67095c103b497d05cd322c8713 Merge: 99f2d956e1fa3 481012b479fe6 Author: Greg Kroah-Hartman Date: Wed Jun 21 18:02:00 2023 +0200 Merge tag 'thunderbolt-for-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-next Mika writes: thunderbolt: Changes for v6.5 merge window This includes following Thunderbolt/USB4 changes for the v6.5 merge window: - Improve debug logging - Rework for TMU and CL states handling - Retimer access improvements - Initial support for USB4 v2 features: * 80G symmetric link support * New notifications * PCIe extended encapsulation * enhanced uni-directional TMU mode * CL2 link low power state * DisplayPort 2.x tunneling - Support for Intel Barlow Ridge Thunderbolt/USB4 controller - Minor fixes and improvements. All these have been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.5-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: (55 commits) thunderbolt: Add test case for 3 DisplayPort tunnels thunderbolt: Add DisplayPort 2.x tunneling support thunderbolt: Make bandwidth allocation mode function names consistent thunderbolt: Enable CL2 low power state thunderbolt: Add support for enhanced uni-directional TMU mode thunderbolt: Increase NVM_MAX_SIZE to support Intel Barlow Ridge controller thunderbolt: Move constants related to NVM into nvm.c thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth thunderbolt: Add Intel Barlow Ridge PCI ID thunderbolt: Fix PCIe adapter capability length for USB4 v2 routers thunderbolt: Fix DisplayPort IN adapter capability length for USB4 v2 routers thunderbolt: Add two additional double words for adapters TMU for USB4 v2 routers thunderbolt: Enable USB4 v2 PCIe TLP/DLLP extended encapsulation thunderbolt: Announce USB4 v2 connection manager support thunderbolt: Reset USB4 v2 host router thunderbolt: Add the new USB4 v2 notification types thunderbolt: Add support for USB4 v2 80 Gb/s link thunderbolt: Identify USB4 v2 routers thunderbolt: Do not touch lane 1 adapter path config space thunderbolt: Ignore data CRC mismatch for USB4 routers ... commit e534755c9412be07f579acd2947401a9f87a33c8 Author: Jiri Slaby Date: Wed Jun 21 12:16:11 2023 +0200 tty_audit: make data of tty_audit_log() const 'data' are only read (passed down to audit_log_n_hex()), so they can be const -- the same what is expected in audit_log_n_hex(). Only a minor cleanup to be consistent. Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20230621101611.10580-7-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit e64ed44bce43e003dd154c0bc418a431c15bdf77 Author: Jiri Slaby Date: Wed Jun 21 12:16:10 2023 +0200 tty_audit: make tty pointers in exposed functions const Both tty_audit_add_data() and tty_audit_tiocsti() need only to read from the tty struct, so make the tty parameters of them both const. This aids the compiler a bit. Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20230621101611.10580-6-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3e540a7bad8534a9b8845defa051834c9694d86c Author: Jiri Slaby Date: Wed Jun 21 12:16:09 2023 +0200 tty_audit: make icanon a bool Use bool for tty_audit_buf::icanon in favor of ugly bitfields. And get rid of "!!" as that is completely unnecessary. Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20230621101611.10580-5-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 94f94810efc4b4b337c9f2abc8b0188cef5ccb9b Author: Jiri Slaby Date: Wed Jun 21 12:16:08 2023 +0200 tty_audit: invert the condition in tty_audit_log() If we cannot obtain an audit buffer in tty_audit_log(), simply return from the function. Apart this is mostly preferred in the kernel, it allows to merge the split audit string while still keeping it readable. Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20230621101611.10580-4-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit e1488513abee9f34a7d0f3bd57ee65d2a7e13426 Author: Jiri Slaby Date: Wed Jun 21 12:16:07 2023 +0200 tty_audit: use kzalloc() in tty_audit_buf_alloc() tty_audit_buf_alloc() manually erases most of the entries after kmalloc(). So use kzalloc() and remove the manual sets to zero. That way, we are sure that we do not omit anything. Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20230621101611.10580-3-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 777e456852f729fa2942187a43a8eafbaecc6876 Author: Jiri Slaby Date: Wed Jun 21 12:16:06 2023 +0200 tty_audit: use TASK_COMM_LEN for task comm This is the preferred way of declaring an array for get_task_comm(). Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20230621101611.10580-2-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit a82d62f708545d22859584e0e0620da8e3759bbc Author: Jiaqing Zhao Date: Mon Jun 19 15:57:44 2023 +0000 Revert "8250: add support for ASIX devices with a FIFO bug" This reverts commit eb26dfe8aa7eeb5a5aa0b7574550125f8aa4c3b3. Commit eb26dfe8aa7e ("8250: add support for ASIX devices with a FIFO bug") merged on Jul 13, 2012 adds a quirk for PCI_VENDOR_ID_ASIX (0x9710). But that ID is the same as PCI_VENDOR_ID_NETMOS defined in 1f8b061050c7 ("[PATCH] Netmos parallel/serial/combo support") merged on Mar 28, 2005. In pci_serial_quirks array, the NetMos entry always takes precedence over the ASIX entry even since it was initially merged, code in that commit is always unreachable. In my tests, adding the FIFO workaround to pci_netmos_init() makes no difference, and the vendor driver also does not have such workaround. Given that the code was never used for over a decade, it's safe to revert it. Also, the real PCI_VENDOR_ID_ASIX should be 0x125b, which is used on their newer AX99100 PCIe serial controllers released on 2016. The FIFO workaround should not be intended for these newer controllers, and it was never implemented in vendor driver. Fixes: eb26dfe8aa7e ("8250: add support for ASIX devices with a FIFO bug") Cc: stable Signed-off-by: Jiaqing Zhao Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20230619155743.827859-1-jiaqing.zhao@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 27a826837ec9a3e94cc44bd9328b8289b0fcecd7 Author: Dan Carpenter Date: Mon Jun 19 12:45:17 2023 +0300 serial: atmel: don't enable IRQs prematurely The atmel_complete_tx_dma() function disables IRQs at the start of the function by calling spin_lock_irqsave(&port->lock, flags); There is no need to disable them a second time using the spin_lock_irq() function and, in fact, doing so is a bug because it will enable IRQs prematurely when we call spin_unlock_irq(). Just use spin_lock/unlock() instead without disabling or enabling IRQs. Fixes: 08f738be88bb ("serial: at91: add tx dma support") Signed-off-by: Dan Carpenter Reviewed-by: Jiri Slaby Acked-by: Richard Genoud Link: https://lore.kernel.org/r/cb7c39a9-c004-4673-92e1-be4e34b85368@moroto.mountain Cc: stable Signed-off-by: Greg Kroah-Hartman commit a1e72bb00a48687a1dc1c2e549eaf4ba09e802be Author: Costa Shulyupin Date: Sun Jun 18 09:29:37 2023 +0300 docs: consolidate storage interfaces to make the page more organized as requested Signed-off-by: Costa Shulyupin Acked-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20230618062937.481280-1-costa.shul@redhat.com commit 944ee77dc6ec7b0afd8ec70ffc418b238c92f12b Author: Ludvig Michaelsson Date: Wed Jun 21 13:17:43 2023 +0200 HID: hidraw: fix data race on device refcount The hidraw_open() function increments the hidraw device reference counter. The counter has no dedicated synchronization mechanism, resulting in a potential data race when concurrently opening a device. The race is a regression introduced by commit 8590222e4b02 ("HID: hidraw: Replace hidraw device table mutex with a rwsem"). While minors_rwsem is intended to protect the hidraw_table itself, by instead acquiring the lock for writing, the reference counter is also protected. This is symmetrical to hidraw_release(). Link: https://github.com/systemd/systemd/issues/27947 Fixes: 8590222e4b02 ("HID: hidraw: Replace hidraw device table mutex with a rwsem") Cc: stable@vger.kernel.org Signed-off-by: Ludvig Michaelsson Link: https://lore.kernel.org/r/20230621-hidraw-race-v1-1-a58e6ac69bab@yubico.com Signed-off-by: Benjamin Tissoires commit 2bb19e740e9b3eb42e5effcb0ad52a85433c1258 Author: Johannes Berg Date: Mon Jun 19 11:55:34 2023 +0200 Documentation: update git configuration for Link: tag The latest version of git (2.41.0) changed the spelling of Message-Id to Message-ID. Adjust the perl script here to accept both spellings. Signed-off-by: Johannes Berg Tested-by: Greg Kroah-Hartman Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20230619115533.981f6abaca01.I1960c39b1d61e8514afcef4806a450a209133187@changeid commit 9a096a813ac29ea6a92f21b8519e36e15fe5843f Author: Tim Harvey Date: Mon Jun 12 09:24:44 2023 -0700 dt-bindings: mfd: gateworks-gsc: Remove unnecessary fan-controller nodes Remove the unnecessary #address-cells and #size-cells nodes from the fan-controller. These are not needed as the fan controller does not have any children. Signed-off-by: Tim Harvey Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230612162444.3936302-1-tharvey@gateworks.com Signed-off-by: Lee Jones commit 39138093f139c5d03e852c49cc52339543922308 Author: Mark Rutland Date: Fri Jun 16 11:31:50 2023 +0100 arm64: alternatives: make clean_dcache_range_nopatch() noinstr-safe When patching kernel alternatives, we need to be careful not to execute kernel code which is itself subject to patching. In general, if code is executed after the instructions in memory have been patched but prior to the cache maintenance and barriers completing, it could lead to UNPREDICTABLE results. As our regular cache maintenance routines are patched with alternatives, we have a clean_dcache_range_nopatch() function which is *intended* to avoid patchable code and therefore supposed to be safe in the middle of patching alternatives. Unfortunately, it's not marked as 'noinstr', and so can be instrumented with patchable code. Additionally, it calls read_sanitised_ftr_reg() (which may be instrumented with patchable code) to find the sanitized value of CTR_EL0.DminLine, and is therefore not safe to call during patching. Luckily, since commit: 675b0563d6b26aa9 ("arm64: cpufeature: expose arm64_ftr_reg struct for CTR_EL0") ... we can read the sanitised CTR_EL0 value directly, and avoid the call to read_sanitised_ftr_reg(). This patch marks clean_dcache_range_nopatch() as noinstr, and has it read the sanitized CTR_EL0 value directly, avoiding the issues above. As a bonus, this is also an optimization. As read_sanitised_ftr_reg() performs a binary search to find the CTR_EL0 value, reading the value directly avoids this binary search per applied alternative, avoiding some unnecessary work. Signed-off-by: Mark Rutland Cc: Will Deacon Link: https://lore.kernel.org/r/20230616103150.1238132-1-mark.rutland@arm.com Signed-off-by: Catalin Marinas commit f40f97aaf7fa6222f4ec073c24fb14f04ffb6f80 Author: Jonathan Corbet Date: Mon Jun 12 06:13:47 2023 -0600 perf arm-spe: Fix a dangling Documentation/arm64 reference The arm64 documentation has moved under Documentation/arch/. Fix up a dangling reference to match. Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Mark Rutland Cc: Alexander Shishkin Cc: Jiri Olsa Acked-by: Catalin Marinas Acked-by: Arnaldo Carvalho de Melo Signed-off-by: Jonathan Corbet commit c30034054a1ad394273f3fffe14752f83251600a Author: Jonathan Corbet Date: Mon Jun 12 06:12:24 2023 -0600 mm: Fix a dangling Documentation/arm64 reference The arm64 documentation has moved under Documentation/arch/. Fix up a reference in mm/mremap.c to match. Cc: Andrew Morton Cc: linux-mm@kvack.org Acked-by: Mike Rapoport (IBM) Acked-by: Catalin Marinas Signed-off-by: Jonathan Corbet commit 6e4596c4038adfcf52d0dc37ba9cb505c4afaa65 Author: Jonathan Corbet Date: Mon Jun 12 06:10:53 2023 -0600 arm64: Fix dangling references to Documentation/arm64 The arm64 documentation has moved under Documentation/arch/; fix up references in the arm64 subtree to match. Cc: Will Deacon Cc: Ard Biesheuvel Cc: linux-efi@vger.kernel.org Acked-by: Catalin Marinas Signed-off-by: Jonathan Corbet commit a0468d4efc0e9f268e362d6840c84107703bd24e Author: Jonathan Corbet Date: Mon Jun 12 06:08:41 2023 -0600 dt-bindings: fix dangling Documentation/arm64 reference The arm64 documentation has move under Documentation/arch/ fix a reference to match. Cc: Krzysztof Kozlowski Cc: Conor Dooley Cc: devicetree@vger.kernel.org Acked-by: Catalin Marinas Acked-by: Rob Herring Signed-off-by: Jonathan Corbet commit e4624435f38b34e7ce827070aa0f8b533a37c07e Author: Jonathan Corbet Date: Mon Jun 12 06:06:39 2023 -0600 docs: arm64: Move arm64 documentation under Documentation/arch/ Architecture-specific documentation is being moved into Documentation/arch/ as a way of cleaning up the top-level documentation directory and making the docs hierarchy more closely match the source hierarchy. Move Documentation/arm64 into arch/ (along with the Chinese equvalent translations) and fix up documentation references. Cc: Will Deacon Cc: Alex Shi Cc: Hu Haowen Cc: Paolo Bonzini Acked-by: Catalin Marinas Reviewed-by: Yantengsi Signed-off-by: Jonathan Corbet commit 07edc32779e3dfe164970fc254291258277219c9 Author: Conor Dooley Date: Wed Jun 7 21:28:31 2023 +0100 RISC-V: always report presence of extensions formerly part of the base ISA Of these four extensions, two were part of the base ISA when the port was written and are required by the kernel. The other two are implied when `i` is in riscv,isa on DT systems. There's not much that userspace can do with this extra information, but there is no harm in reporting an ISA string that closer resembles the current versions of the specifications either. Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20230607-nest-collision-5796b6be8be6@spud Signed-off-by: Palmer Dabbelt commit 1e5cae98e46d15f4dc7c675e1bd0ed2172ea181c Author: Conor Dooley Date: Wed Jun 7 21:28:30 2023 +0100 dt-bindings: riscv: explicitly mention assumption of Zicntr & Zihpm support Similar to commit 41ebfc91f785 ("dt-bindings: riscv: explicitly mention assumption of Zicsr & Zifencei support"), the Zicntr and Zihpm extensions also used to be part of the base ISA but were removed after the bindings were merged. Document the assumption of their presence in the base ISA. Suggested-by: Palmer Dabbelt Signed-off-by: Conor Dooley Acked-by: Rob Herring Link: https://lore.kernel.org/r/20230607-rerun-retinal-5e8ba89e98f1@spud Signed-off-by: Palmer Dabbelt commit 7816ebc1ddd16b5cc95febb75f778bf88411a365 Author: Conor Dooley Date: Wed Jun 7 21:28:29 2023 +0100 RISC-V: remove decrement/increment dance in ISA string parser While expanding on the comments in the ISA string parsing code, I noticed that the conditional decrement of `isa` at the end of the loop was a bit odd. The parsing code expects that at the start of the for loop, `isa` will point to the first character of the next unparsed extension. However, depending on what the next extension is, this may not be true. Unless the next extension is a multi-letter extension preceded by an underscore, `isa` will either point to the string's null-terminator or to the first character of the next extension, once the switch statement has been evaluated. Obviously incrementing `isa` at the end of the loop could cause it to increment past the null terminator or miss a single letter extension, so `isa` is conditionally decremented, just so that the loop can increment it again. It's easier to understand the code if, instead of this decrement + increment dance, we instead use a while loop & rely on the handling of individual extension types to leave `isa` pointing to the first character of the next extension. As already mentioned, this won't be the case where the following extension is multi-letter & preceded by an underscore. To handle that, invert the check and increment rather than decrement. Hopefully this eliminates a "huh?!?" moment the next time somebody tries to understand this code. Reviewed-by: Andrew Jones Signed-off-by: Conor Dooley Reviewed-by: Sunil V L Link: https://lore.kernel.org/r/20230607-estate-left-f20faabefb89@spud Signed-off-by: Palmer Dabbelt commit 6b913e3da87da1be57096c068b4d2e7d4b31f457 Author: Conor Dooley Date: Wed Jun 7 21:28:28 2023 +0100 RISC-V: rework comments in ISA string parser I have found these comments to not be at all helpful whenever I look at the parser. Further, the comments in the default case (single letter parser) are not quite right either. Group the comments into a larger one at the start of each case, that attempts to explain things at a higher level. Reviewed-by: Andrew Jones Signed-off-by: Conor Dooley Link: https://lore.kernel.org/r/20230607-headpiece-tannery-83ed5cc4856a@spud Signed-off-by: Palmer Dabbelt commit 069b0d51707721d5ab2001df866b66b82e4c1c35 Author: Conor Dooley Date: Wed Jun 7 21:28:27 2023 +0100 RISC-V: validate riscv,isa at boot, not during ISA string parsing Since riscv_fill_hwcap() now only iterates over possible cpus, the basic validation of whether riscv,isa contains "rv" can be moved to riscv_early_of_processor_hartid(). Further, "ima" support is required by the kernel, so reject any CPU not fitting the bill. Reviewed-by: Andrew Jones Signed-off-by: Conor Dooley Reviewed-by: Sunil V L Link: https://lore.kernel.org/r/20230607-guts-blurry-67e711acf328@spud Signed-off-by: Palmer Dabbelt commit 2ac874343749b76e069cff5fea09c49e0bd365a0 Author: Conor Dooley Date: Wed Jun 7 21:28:26 2023 +0100 RISC-V: split early & late of_node to hartid mapping Some back and forth with Drew [1] about riscv_fill_hwcap() resulted in the realisation that it is not very useful to parse the DT & perform validation of riscv,isa every time we would like to get the id for a hart. Although it is no longer called in riscv_fill_hwcap(), riscv_of_processor_hartid() is called in several other places. Notably in setup_smp() it forms part of the logic for filling the mask of possible CPUs. Since a possible CPU must have passed this basic validation of riscv,isa, a repeat validation is not required. Rename riscv_of_processor_id() to riscv_early_of_processor_id(), which will be called from setup_smp() & introduce a new riscv_of_processor_id() which makes use of the pre-populated mask of possible cpus. Link: https://lore.kernel.org/linux-riscv/xvdswl3iyikwvamny7ikrxo2ncuixshtg3f6uucjahpe3xpc5c@ud4cz4fkg5dj/ [1] Reviewed-by: Andrew Jones Signed-off-by: Conor Dooley Reviewed-by: Sunil V L Link: https://lore.kernel.org/r/20230607-glade-pastel-d8cbd9d9f3c6@spud Signed-off-by: Palmer Dabbelt commit fed14be476f075a523fd4addfee07cb2f8dc1971 Author: Conor Dooley Date: Wed Jun 7 21:28:25 2023 +0100 RISC-V: simplify register width check in ISA string parsing Saving off the `isa` pointer to a temp variable, followed by checking if it has been incremented is a bit of an odd pattern. Perhaps it was done to avoid a funky looking if statement mixed with the ifdeffery. Now that we use IS_ENABLED() here just return from the parser as soon as we detect a mismatch between the string and the currently running kernel. Reviewed-by: Andrew Jones Signed-off-by: Conor Dooley Reviewed-by: Sunil V L Link: https://lore.kernel.org/r/20230607-splatter-bacterium-a75bb9f0d0b7@spud Signed-off-by: Palmer Dabbelt commit cc75549548482ed653c23f212544e58cb38ea980 Author: Horatiu Vultur Date: Thu Jun 15 11:47:40 2023 +0200 net: micrel: Change to receive timestamp in the frame for lan8841 Currently for each timestamp frame, the SW needs to go and read the received timestamp over the MDIO bus. But the HW has the capability to store the received nanoseconds part and the least significant two bits of the seconds in the reserved field of the PTP header. In this way we could save few MDIO transactions (actually a little more transactions because the access to the PTP registers are indirect) for each received frame. Instead of reading the rest of seconds part of the timestamp of the frame using MDIO transactions schedule PTP worker thread to read the seconds part every 500ms and then for each of the received frames use this information. Because if for example running with 512 frames per second, there is no point to read 512 times the second part. Doing all these changes will give a great CPU usage performance. Running ptp4l with logSyncInterval of -9 will give a ~60% CPU improvement. Signed-off-by: Horatiu Vultur Acked-by: Richard Cochran Signed-off-by: David S. Miller commit 6a1d798feb65d2a67e6e2cafb0b0e4f430603226 Author: Rob Herring Date: Thu Dec 6 10:29:51 2018 -0600 kbuild: Support flat DTBs install In preparation to move Arm .dts files into sub-directories grouped by vendor/family, the current flat tree of DTBs generated by dtbs_install needs to be maintained. Moving the installed DTBs to sub-directories would break various consumers using 'make dtbs_install'. This is a NOP until sub-directories are introduced. Signed-off-by: Rob Herring commit 86684c2481b6e6a46c2282acee13554e34e66071 Author: Rob Herring Date: Tue May 2 12:25:29 2023 -0500 ARM: dts: Add .dts files missing from the build Comparing .dts files to built .dtb files yielded a few .dts files which are never built. Add them to the build. Signed-off-by: Rob Herring commit ca2fb05cb7e41d7f8b7399adbc2e71016483efad Author: Rob Herring Date: Tue May 2 12:02:42 2023 -0500 ARM: dts: allwinner: Use quoted #include In preparation to move .dts files into subdirectories, include sunxi-h3-h5-emlid-neutis.dtsi from the current directory rather than the symlinked include path. Reviewed-by: Andre Przywara Signed-off-by: Rob Herring commit 2293cae703cda162684ae966db6b1b4a11b5e88f Author: Ming Lei Date: Wed Jun 21 21:22:08 2023 +0800 blk-mq: don't insert passthrough request into sw queue In case of real io scheduler, q->elevator is set, so blk_mq_run_hw_queue() may just check if scheduler queue has request to dispatch, see __blk_mq_sched_dispatch_requests(). Then IO hang may be caused because all passthorugh requests may stay in sw queue. And any passthrough request should have been inserted to hctx->dispatch always. Reported-by: Guangwu Zhang Fixes: d97217e7f024 ("blk-mq: don't queue plugged passthrough requests into scheduler") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20230621132208.1142318-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 72ef02b8dfa009029fa713e8a731a92d27d14e35 Author: Ivan Orlov Date: Tue Jun 20 20:01:33 2023 +0200 bsg: make bsg_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the bsg_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at boot time. Cc: FUJITA Tomonori Cc: Jens Axboe Cc: linux-scsi@vger.kernel.org Cc: linux-block@vger.kernel.org Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20230620180129.645646-8-gregkh@linuxfoundation.org Signed-off-by: Jens Axboe commit 2eefd399d28a52739fdbeebe84775275f016171c Author: Ivan Orlov Date: Tue Jun 20 20:01:32 2023 +0200 ublk: make ublk_chr_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the ublk_chr_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at boot time. Cc: Ming Lei Cc: Jens Axboe Cc: linux-block@vger.kernel.org Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20230620180129.645646-7-gregkh@linuxfoundation.org Signed-off-by: Jens Axboe commit 65d7a37d4e3e226bb4a4ddf73a827d0dbc77f530 Author: Ivan Orlov Date: Tue Jun 20 20:01:31 2023 +0200 aoe: make aoe_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the aoe_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at boot time. Cc: Justin Sanders Cc: Jens Axboe Cc: linux-block@vger.kernel.org Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20230620180129.645646-6-gregkh@linuxfoundation.org Signed-off-by: Jens Axboe commit 137380c0ec40710cbaf57c7878726c41a6da81cd Author: Ivan Orlov Date: Tue Jun 20 20:01:30 2023 +0200 block/rnbd: make all 'class' structures const Now that the driver core allows for struct class to be in read-only memory, making all 'class' structures to be declared at build time placing them into read-only memory, instead of having to be dynamically allocated at load time. Cc: "Md. Haris Iqbal" Cc: Jack Wang Cc: Jens Axboe Cc: linux-block@vger.kernel.org Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Signed-off-by: Greg Kroah-Hartman Acked-by: Jack Wang Link: https://lore.kernel.org/r/20230620180129.645646-5-gregkh@linuxfoundation.org Signed-off-by: Jens Axboe commit 56e71bdf324d6ab263eba1fc3fa1f3fd8bb5678e Author: Christoph Hellwig Date: Wed Jun 21 14:49:14 2023 +0200 block: fix the exclusive open mask in disk_scan_partitions FMODE_EXEC has nothing to do with exclusive opens, and even is of the wrong type. We need to check for BLK_OPEN_EXCL here. Fixes: 985958b8584c ("block: fix wrong mode for blkdev_get_by_dev() from disk_scan_partitions()") Reported-by: kernel test robot Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230621124914.185992-1-hch@lst.de Signed-off-by: Jens Axboe commit 4be22f16a4a1a1667e79b52b56cca2c64b3747e2 Author: Gaosheng Cui Date: Wed Jun 21 15:44:18 2023 +0800 device_cgroup: Fix kernel-doc warnings in device_cgroup Fix kernel-doc warnings in device_cgroup: security/device_cgroup.c:835: warning: Excess function parameter 'dev_cgroup' description in 'devcgroup_legacy_check_permission'. Signed-off-by: Gaosheng Cui Signed-off-by: Paul Moore commit a0238ada560fce7fa1b5fb3ace60c0a575d3131a Author: Chaitanya S Prakash Date: Mon Jun 19 14:08:02 2023 +0530 Documentation/arm64: Add ptdump documentation ptdump is a debugfs interface used to dump the kernel page tables. It provides a comprehensive overview about the kernel's virtual memory layout, page table entries and associated page attributes. A document detailing how to enable ptdump in the kernel and analyse its output has been added. Changes in V2: - Corrected command to cat /sys/kernel/debug/kernel_page_tables Changes in V1: https://lore.kernel.org/all/20230613064845.1882177-1-chaitanyas.prakash@arm.com/ Cc: Will Deacon Cc: Jonathan Corbet CC: linux-arm-kernel@lists.infradead.org Cc: linux-doc@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Chaitanya S Prakash Link: https://lore.kernel.org/r/20230619083802.76092-1-chaitanyas.prakash@arm.com [catalin.marinas@arm.com: various minor fixups; sorted index.rst in alphabetical order] Signed-off-by: Catalin Marinas commit ee44484c12edcf9ad81c816d383f28b63c712fdb Merge: d8ece8b832276 33c01ff3b1003 Author: Arnd Bergmann Date: Wed Jun 21 15:15:10 2023 +0200 Merge tag 'at91-dt-6.5-2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/dt AT91 DT for 6.5 #2 It contains: - generic names for shutdown controller nodes - enablement of DT overlay support for some AT91 boards - fix reset and SPI CS for lan966x-kontron-kswitch-d10-mmt based boards - addition of PHY interrupts for lan966x-kontron-kswitch-d10-mmt-8g board * tag 'at91-dt-6.5-2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: lan966x: kontron-d10: add PHY interrupts ARM: dts: lan966x: kontron-d10: fix SPI CS ARM: dts: lan966x: kontron-d10: fix board reset ARM: dts: at91: Enable device-tree overlay support for AT91 boards ARM: dts: at91: use generic name for shutdown controller Link: https://lore.kernel.org/r/20230621093853.1575312-1-claudiu.beznea@microchip.com Signed-off-by: Arnd Bergmann commit 2b24391767ae6897dff6eeb521f01d495bc27b55 Author: Cristian Ciocaltea Date: Thu May 4 23:19:16 2023 +0300 arm64: defconfig: Enable Rockchip I2S TDM and ES8316 drivers The Rockchip I2S TDM driver and the Everest Semi ES8316 codec are used to provide analog audio support on the RK3588 SoC based Rock 5B board. Enable both of them as modules. Signed-off-by: Cristian Ciocaltea Signed-off-by: Arnd Bergmann commit ffd791349859c47c50e1e423295b4f8912c45ee0 Author: Sebastian Reichel Date: Thu May 18 06:05:40 2023 +0200 arm64: defconfig: update RK8XX MFD config Update the defconfig for the new RK8XX MFD config name, which got split to add SPI support. Reported-by: Marek Szyprowski Fixes: c20e8c5b1203a ("mfd: rk808: Split into core and i2c") Signed-off-by: Sebastian Reichel Signed-off-by: Arnd Bergmann commit cf971df2cb464efcb27b943e9caa53a8097c72e4 Author: Sebastian Reichel Date: Thu May 18 06:05:41 2023 +0200 ARM: multi_v7_defconfig: update MFD_RK808 name MFD_RK808 got split into an I2C and SPI part named MFD_RK8XX_I2C and MFD_RK8XX_SPI. Since there are no known ARMv7 boards using the SPI connected RK8XX chips (which are new), it is enough to just enable the I2C option. Reported-by: Marek Szyprowski Fixes: c20e8c5b1203a ("mfd: rk808: Split into core and i2c") Signed-off-by: Sebastian Reichel Signed-off-by: Arnd Bergmann commit fd99ac5055d4705e91c73d1adba18bc71c8511a8 Author: Shiji Yang Date: Tue Jun 20 19:44:32 2023 +0800 mips: ralink: introduce commonly used remap node function The ralink_of_remap() function is repeated several times on SoC specific source files. They have the same structure, but just differ in compatible strings. In order to make commonly use of these codes, this patch introduces a newly designed mtmips_of_remap_node() function to match and remap all supported system controller and memory controller nodes. Build and run tested on MT7620 and MT7628. Signed-off-by: Shiji Yang Reviewed-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 89ec9bbe60b61cc6ae3eddd6d4f43e128f8a88de Author: Shiji Yang Date: Tue Jun 20 18:43:23 2023 +0800 mips: pci-mt7620: use dev_info() to log PCIe device detection result Usually, We only need to print the error log when there is a PCIe card but initialization fails. Whether the driver finds the PCIe card or not is the expected behavior. So it's better to log these information with dev_info(). Tested on MT7628AN router Motorola MWR03. Signed-off-by: Shiji Yang Reviewed-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit a82f3119d543406ed5b242deabf83cdecb9fe523 Merge: e0b78e9fa3410 d93c221999666 Author: Marc Zyngier Date: Wed Jun 21 13:53:41 2023 +0100 Merge branch irq/misc-6.5 into irq/irqchip-next * irq/misc-6.5: : . : Misc cleanups: : : - Add a number of missing prototypes : - Mark global symbol as static where needed : - Drop some now useless non-DT code paths : - Add a missing interrupt mapping to the STM32 irqchip : - Silence another STM32 warning when building with W=1 : - Fix the jcore-aic driver that actually never worked... : . Revert "irqchip/mxs: Include linux/irqchip/mxs.h" irqchip/jcore-aic: Fix missing allocation of IRQ descriptors irqchip/stm32-exti: Fix warning on initialized field overwritten irqchip/stm32-exti: Add STM32MP15xx IWDG2 EXTI to GIC map irqchip/gicv3: Add a iort_pmsi_get_dev_id() prototype irqchip/mxs: Include linux/irqchip/mxs.h irqchip/clps711x: Remove unused clps711x_intc_init() function irqchip/mmp: Remove non-DT codepath irqchip/ftintc010: Mark all function static irqdomain: Include internals.h for function prototypes Signed-off-by: Marc Zyngier commit 9f9a035e6156a57d9da062b26d2a48d031744a1e Author: Shiji Yang Date: Tue Jun 20 18:43:22 2023 +0800 mips: pci-mt7620: do not print NFTS register value as error log These codes are used to read NFTS_TIMEOUT_DELAY register value and write it into kernel log after writing the register. they are only used for debugging during driver development, so there is no need to keep them now. Tested on MT7628AN router Motorola MWR03. Signed-off-by: Shiji Yang Reviewed-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit fc15a7193a4d37d79e873fa06cc423180ddd2ddf Author: Sergio Paracuellos Date: Mon Jun 19 06:09:41 2023 +0200 MAINTAINERS: add Mediatek MTMIPS Clock maintainer Adding myself as maintainer for Mediatek MTMIPS clock driver. Signed-off-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit d93c22199966696cfb76c6942797de2fbb22da24 Author: Marc Zyngier Date: Wed Jun 21 13:46:25 2023 +0100 Revert "irqchip/mxs: Include linux/irqchip/mxs.h" This reverts commit 5b7e5676209120814dbb9fec8bc3769f0f7a7958. Although including linux/irqchip/mxs.h is technically correct, this clashes with the parallel removal of this include file with 32bit ARM modernizing the low level irq handling as part of 5bb578a0c1b8 ("ARM: 9298/1: Drop custom mdesc->handle_irq()"). As such, this patch is not only unnecessary, it also breaks compilation in -next. Revert it. Signed-off-by: Marc Zyngier Cc: Arnd Bergmann Cc: Shawn Guo commit ad38c17b0c26ae2108b50ac1eb0281a2e1ce08e9 Author: Sergio Paracuellos Date: Mon Jun 19 06:09:40 2023 +0200 mips: ralink: get cpu rate from new driver code At very early stage on boot, there is a need to set 'mips_hpt_frequency'. This timer frequency is a half of the CPU frequency. To get clocks properly set we need to call to 'of_clk_init()' and properly get cpu clock frequency afterwards. Depending on the SoC, CPU clock index and compatible differs, so use them to get the proper clock frm the clock provider. Hence, adapt code to be aligned with new clock driver. Signed-off-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 201ddc05777cd8e084b508bcdda22214bfe2895e Author: Sergio Paracuellos Date: Mon Jun 19 06:09:39 2023 +0200 mips: ralink: remove reset related code A proper clock driver for ralink SoCs has been added. This driver is also a reset provider for the SoC. Hence there is no need to have reset related code in 'arch/mips/ralink' folder anymore. The only code that remains is the one related with mips_reboot_setup where a PCI reset is performed. We maintain this because I cannot test old ralink board with PCI to be sure all works if we remove also this code. Signed-off-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 04b153abdfcbaba70ceef5a846067d4447fd0078 Author: Sergio Paracuellos Date: Mon Jun 19 06:09:38 2023 +0200 mips: ralink: mt7620: remove clock related code A proper clock driver for ralink SoCs has been added. Hence there is no need to have clock related code in 'arch/mips/ralink' folder anymore. Since this is the last clock related code removal, remove also remaining prototypes in 'common.h' header file. Signed-off-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 7cd1bb48885449a9323c7ff0f10012925e93b4e1 Author: Sergio Paracuellos Date: Mon Jun 19 06:09:37 2023 +0200 mips: ralink: rt3883: remove clock related code A properly clock driver for ralink SoCs has been added. Hence there is no need to have clock related code in 'arch/mips/ralink' folder anymore. Signed-off-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit daf73c70f69386fb15960526772ef584a4efcaf2 Author: Sergio Paracuellos Date: Mon Jun 19 06:09:36 2023 +0200 mips: ralink: rt305x: remove clock related code A properly clock driver for ralink SoCs has been added. Hence there is no need to have clock related code in 'arch/mips/ralink' folder anymore. Signed-off-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit ffcdf47379eae86dc8f8f02c62994dacf2c9038e Author: Sergio Paracuellos Date: Mon Jun 19 06:09:35 2023 +0200 mips: ralink: rt288x: remove clock related code A properly clock driver for ralink SoCs has been added. Hence there is no need to have clock related code in 'arch/mips/ralink' folder anymore. Signed-off-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 6f3b15586eef736831abe6a14f2a6906bc0dc074 Author: Sergio Paracuellos Date: Mon Jun 19 06:09:34 2023 +0200 clk: ralink: add clock and reset driver for MTMIPS SoCs Until now, clock related code for old ralink SoCs was based in fixed clocks using 'clk_register_fixed_rate' and 'clkdev_create' directly doing in code and not using device tree at all for their definition. Including this driver is an effort to be able to define proper clocks using device tree and also cleaning all the clock and reset related code from 'arch/mips/ralink' dir. This clock and reset driver covers all the ralink SoCs but MT7621 which is the newest and provides gating and some differences that make it different from its predecesors. It has its own driver since some time ago. The ralink SoCs we are taking about are RT2880, RT3050, RT3052, RT3350, RT3352, RT3883, RT5350, MT7620, MT7628 and MT7688. Mostly the code in this new driver has been extracted from 'arch/mips/ralink' and cleanly put using kernel clock driver APIs. The clock plans for this SoCs only talks about relation between CPU frequency and BUS frequency. This relation is different depending on the particular SoC. CPU clock is derived from XTAL frequencies. Depending on the SoC we have the following frequencies: * RT2880 SoC: - XTAL: 40 MHz. - CPU: 250, 266, 280 or 300 MHz. - BUS: CPU / 2 MHz. * RT3050, RT3052, RT3350: - XTAL: 40 MHz. - CPU: 320 or 384 MHz. - BUS: CPU / 3 MHz. * RT3352: - XTAL: 40 MHz. - CPU: 384 or 400 MHz. - BUS: CPU / 3 MHz. - PERIPH: 40 MHz. * RT3383: - XTAL: 40 MHz. - CPU: 250, 384, 480 or 500 MHz. - BUS: Depends on RAM Type and CPU: + RAM DDR2: 125. ELSE 83 MHz. + RAM DDR2: 128. ELSE 96 MHz. + RAM DDR2: 160. ELSE 120 MHz. + RAM DDR2: 166. ELSE 125 MHz. * RT5350: - XTAL: 40 MHz. - CPU: 300, 320 or 360 MHz. - BUS: CPU / 3, CPU / 4, CPU / 3 MHz. - PERIPH: 40 MHz. * MT7628 and MT7688: - XTAL: 20 MHz or 40 MHz. - CPU: 575 or 580 MHz. - BUS: CPU / 3. - PCMI2S: 480 MHz. - PERIPH: 40 MHz. * MT7620: - XTAL: 20 MHz or 40 MHz. - PLL: XTAL, 480, 600 MHz. - CPU: depends on PLL and some mult and dividers. - BUS: depends on PLL and some mult and dividers. - PERIPH: 40 or XTAL MHz. MT7620 is a bit more complex deriving CPU clock from a PLL and an bunch of register reads and predividers. To derive CPU and BUS frequencies in the MT7620 SoC 'mt7620_calc_rate()' helper is used. In the case XTAL can have different frequencies and we need a different clock frequency for peripherals 'periph' clock in introduced. The rest of the peripherals present in the SoC just follow their parent frequencies. With this information the clk driver will provide all the clock and reset functionality from a set of hardcoded clocks allowing to define a nice device tree without fixed clocks. Acked-by: Stephen Boyd Signed-off-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 612616e6381929e7f9e303f8b8ad3655cc101516 Author: Sergio Paracuellos Date: Mon Jun 19 06:09:33 2023 +0200 dt-bindings: clock: add mtmips SoCs system controller Adds device tree binding documentation for system controller node present in Mediatek MIPS and Ralink SOCs. This node is a clock and reset provider for the rest of the world. This covers RT2880, RT3050, RT3052, RT3350, RT3883, RT5350, MT7620, MT7628 and MT7688 SoCs. Reviewed-by: Rob Herring Acked-by: Stephen Boyd Signed-off-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 6ab11462c68499933bd9b5d52a710f4e18a9e43e Author: Fabio Estevam Date: Fri Jun 16 17:39:13 2023 -0300 ASoC: fsl-asoc-card: Allow passing the number of slots in use Currently, fsl-asoc-card supports passing the width of the TDM slot, but not the number of slots in use, as it harcodes it as two slots. Add support for passing the number of slots in use. Signed-off-by: Fabio Estevam Link: https://lore.kernel.org/r/20230616203913.551183-1-festevam@gmail.com Signed-off-by: Mark Brown commit aa21a7d4f68a0a5067578cbb93c136ab5ac09cfa Author: Krzysztof Kozlowski Date: Fri Jun 16 13:57:51 2023 +0200 ASoC: codecs: wsa884x: Add WSA884x family of speakers Add drivers for Qualcomm WSA8840/WSA8845/WSA8845H smart speaker amplifiers. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230616115751.392886-2-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit 97ae6f4e5dd3bc7873ee70c864ab2ba2e8bff0c3 Author: Krzysztof Kozlowski Date: Fri Jun 16 13:57:50 2023 +0200 ASoC: dt-bindings: qcom,wsa8840: Add WSA884x family of speakers Add binding for WSA8840/WSA8845/WSA8845H smart speaker amplifiers used in Qualcomm QRD8550 board with SM8550 SoC. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20230616115751.392886-1-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit b20c81371a96b87478d2430d80615df189d17cd8 Author: Mac Chiang Date: Fri Jun 16 02:36:17 2023 -0400 ASoC: Intel: sof_rt5682: Add mtl support RT1019P speaker This patch support below hardware configuration: SSP2: 10EC5682/RTL5682 codec SSP0: RTL1019 amplifier Signed-off-by: Mac Chiang Signed-off-by: Rui Zhou Link: https://lore.kernel.org/r/20230616063617.25900-2-mac.chiang@intel.com Signed-off-by: Mark Brown commit 1f583cbdc342e15bfbde61ba142480c70e7694b4 Author: Terry Cheong Date: Fri Jun 16 02:36:16 2023 -0400 ASoC: Intel: sof_rt5682: reorder quirk table Reorder the entries in quirk table to group entries with same platform. Signed-off-by: Terry Cheong Signed-off-by: Mac Chiang Link: https://lore.kernel.org/r/20230616063617.25900-1-mac.chiang@intel.com Signed-off-by: Mark Brown commit 615af0021a612ea66312a5deddd39cc0d8b70e78 Author: Song Shuai Date: Fri Jun 9 15:50:47 2023 +0800 arm64: hibernate: remove WARN_ON in save_processor_state During hibernation or restoration, freeze_secondary_cpus checks num_online_cpus via BUG_ON, and the subsequent save_processor_state also does the checking with WARN_ON. In the case of CONFIG_PM_SLEEP_SMP=n, freeze_secondary_cpus is not defined, but the sole possible condition to disable CONFIG_PM_SLEEP_SMP is !SMP where num_online_cpus is always 1. We also don't have to check it in save_processor_state. So remove the unnecessary checking in save_processor_state. Signed-off-by: Song Shuai Acked-by: Will Deacon Link: https://lore.kernel.org/r/20230609075049.2651723-3-songshuaishuai@tinylab.org Signed-off-by: Catalin Marinas commit 6cd52a2a06774c6c454ffef084c3d9b17618ca23 Author: Neil Armstrong Date: Thu Jun 1 11:39:58 2023 +0200 phy: qcom: qmp-combo: fix Display Port PHY configuration for SM8550 The SM8550 PHY also uses a different offset for the CMN_STATUS reg, use the right one for the v6 Display Port configuration. Fixes: 49742e9edab3 ("phy: qcom-qmp-combo: Add support for SM8550") Signed-off-by: Neil Armstrong Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230601-topic-sm8550-upstream-dp-phy-init-fix-v1-1-4e9da9f97991@linaro.org Signed-off-by: Vinod Koul commit 601d06277007e850615b86358bf9c0a143d20faa Author: Bartosz Golaszewski Date: Mon Jun 19 11:13:36 2023 +0200 phy: qcom: add the SGMII SerDes PHY driver Implement support for the SGMII/SerDes PHY present on various Qualcomm platforms. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20230619091336.194914-4-brgl@bgdev.pl Signed-off-by: Vinod Koul commit 97b795125704046e0c6708f1079d9c5ca3f2ecfd Author: Bartosz Golaszewski Date: Mon Jun 19 11:13:35 2023 +0200 dt-bindings: phy: describe the Qualcomm SGMII PHY Describe the SGMII/SerDes PHY present on the sa8775p platforms. Signed-off-by: Bartosz Golaszewski Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230619091336.194914-3-brgl@bgdev.pl Signed-off-by: Vinod Koul commit 37bd215fc48ef2a399f836d62d2e4a166efb31be Author: Bartosz Golaszewski Date: Mon Jun 19 11:13:34 2023 +0200 phy: qualcomm: fix indentation in Makefile Align all entries in Makefile. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andrew Halaney Link: https://lore.kernel.org/r/20230619091336.194914-2-brgl@bgdev.pl Signed-off-by: Vinod Koul commit 04f78e242fffe6994f7662fb00aaa398dda41d3a Author: Yedidya Benshimol Date: Wed Jun 21 14:49:52 2023 +0300 wifi: iwlwifi: mvm: Add support for IGTK in D3 resume flow As part of the new security API in the FW, all security keys are to be removed before station removal. Until now IGTK rekey wasn't supported in the D3 resume flow, and thus the driver might not know the right key to remove. If an IGTK was rekeyed during D3 the old IGTK is removed and the new key is updated. If not, the old key's IPN is updated. As opposed to GTK, which both the FW and the driver hold it's two most recent keys, only one IGTK is held. Signed-off-by: Yedidya Benshimol Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621144844.b53c301c07e6.I375277a10a1f756b93d4a343f6664351a80189c5@changeid Signed-off-by: Johannes Berg commit fa4e48fb3ee5757d8e0ed1c5079e472687e2c667 Author: Yedidya Benshimol Date: Wed Jun 21 14:49:51 2023 +0300 wifi: iwlwifi: mvm: update two most recent GTKs on D3 resume flow When resuming from D3 the two most recent GTKs are passed from the FW with wowlan_info_notif. Both keys should be updated as they both might be needed upon FW restart and they both should be removed upon station removal. Signed-off-by: Yedidya Benshimol Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621144844.3ea3a9f52ec2.I7cedfa2bb0eafb83e7c77363673560acf05bff74@changeid Signed-off-by: Johannes Berg commit 60555ea4085a956adaa58bcd24f418a631b575a2 Author: Yedidya Benshimol Date: Wed Jun 21 14:49:50 2023 +0300 wifi: iwlwifi: mvm: Refactor security key update after D3 In the D3 resume flow, use two different iterating functions to go over the old keys and update the new ones Signed-off-by: Yedidya Benshimol Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621144844.a2442844c224.I598ed742c7aaa5414702f03f694f2dc0874bc077@changeid Signed-off-by: Johannes Berg commit f52a0b408ed144afa42b45f078a28542e711551b Author: Yedidya Benshimol Date: Wed Jun 21 14:44:36 2023 +0300 wifi: mac80211: mark keys as uploaded when added by the driver When the driver has some form of GTK rekeying offload, e.g. during WoWLAN, mac80211 can assume that keys that the driver adds for that are already present in the hardware acceleration. Mark them accordingly. Signed-off-by: Yedidya Benshimol Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621144414.bc78c7ff2a3d.I5e313d69e2b6a7a4766ef82d0faa122dd4c1c46d@changeid Signed-off-by: Johannes Berg commit 4536fe9640b6a4ef07b1ec77c5dd7bbc62dc0d3d Author: Justin Chen Date: Thu Jun 15 13:06:17 2023 -0700 phy: usb: suppress OC condition for 7439b2 We hit a false positive OC for 7439b2 in DRD/device mode for the second port. So disable the OC check for this use case. Add capability to suppress OC condition for specific ports. Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/1686859578-45242-3-git-send-email-justin.chen@broadcom.com Signed-off-by: Vinod Koul commit 5095d045a96235687199015ca94a03c00d68234f Author: Justin Chen Date: Thu Jun 15 13:06:16 2023 -0700 phy: usb: Turn off phy when port is in suspend The COMMONONN bit turns off the PHY when the host controller puts it into suspend state. This can happen during the following... - Nothing is connected to the port - The host controller goes into low power mode whatever due to auto suspend or system suspend. With COMMONONN we also must unset U2_FREECLK_EXISTS since the UTMI clock is fed by the PHY. With these changes we see a power savings of ~12mW when port is in suspend. Reviewed-by: Florian Fainelli Signed-off-by: Justin Chen Link: https://lore.kernel.org/r/1686859578-45242-2-git-send-email-justin.chen@broadcom.com Signed-off-by: Vinod Koul commit fd006d60e83389f806d8a215c78ae608b9070bbb Author: Mukesh Sisodiya Date: Wed Jun 21 13:12:22 2023 +0300 wifi: iwlwifi: remove support of A0 version of FM RF Remove the support for A0 step of latest wifi-7 FM RF as it is no longer supported. Signed-off-by: Mukesh Sisodiya Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130444.269d55ffbc8e.I4740f32c3d95d4474a82cc153891c92b9bc465db@changeid Signed-off-by: Johannes Berg commit a701177bd4bc37b9775da8daf255864da3fecaf9 Author: Johannes Berg Date: Wed Jun 21 13:12:21 2023 +0300 wifi: iwlwifi: cfg: clean up Bz module firmware lines Remove module firmware lines for images that don't exist as well as some unused macros, and add gl-a-fm-a that (still) exists. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130444.b399b0072d72.Ie7ca1b3dcdebc929ce96a739e0d557fac2c8aeeb@changeid Signed-off-by: Johannes Berg commit f4daceae4087bbb3e9a56044b44601d520d009d2 Author: Yi Kuo Date: Wed Jun 21 13:12:20 2023 +0300 wifi: iwlwifi: pcie: add device id 51F1 for killer 1675 Intel Killer AX1675i/s with device id 51f1 would show "No config found for PCI dev 51f1/1672" in dmesg and refuse to work. Add the new device id 51F1 for 1675i/s to fix the issue. Signed-off-by: Yi Kuo Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130444.ee224675380b.I921c905e21e8d041ad808def8f454f27b5ebcd8b@changeid Signed-off-by: Johannes Berg commit 399762de769c4ec7d82220feb83de9bca30e5ef0 Author: Gregory Greenman Date: Wed Jun 21 13:12:19 2023 +0300 wifi: iwlwifi: bump FW API to 83 for AX/BZ/SC devices Start supporting API version 83 for new devices. Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130444.267a136ea57f.Iaef9f04b9655c5c1b8bdee3b89cc3361ab621bcf@changeid Signed-off-by: Johannes Berg commit 31aeae2446d50665b6ec51d564f5e7fe751d53d4 Author: Johannes Berg Date: Wed Jun 21 13:12:18 2023 +0300 wifi: iwlwifi: cfg: remove trailing dash from FW_PRE constants We have the trailing dash here, but that complicates all the code. Simplify this by removing the dashes, adding them to the *_MODULE_FIRMWARE macros, and adjusting the code using this accordingly. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130443.72240ca13b83.I1f4ed547f0964719ed98a3ef928080462d594491@changeid Signed-off-by: Johannes Berg commit ecf11f4e4950defa89ca9d813ba9684c19d85f6e Author: Johannes Berg Date: Wed Jun 21 13:12:17 2023 +0300 wifi: iwlwifi: also unify Ma device configurations Again, they're all the same except for the radio and steps, so use the new logic to unify them. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130443.676887cc8180.I29994dec43bfb29aad5e4ab0126c06a9ea4670cb@changeid Signed-off-by: Johannes Berg commit bfed356b4fc4e24d0cc73a81d51d193353629e73 Author: Johannes Berg Date: Wed Jun 21 13:12:16 2023 +0300 wifi: iwlwifi: also unify Sc device configurations Again, they're all the same except for the radio and steps, so use the new logic to unify them. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130443.3bc1191f883f.If1e6f73a164b0794ac65372b72673ce8ddf9e571@changeid Signed-off-by: Johannes Berg commit 3fd31289d5de8392c914db4f8cb36e0999afdac2 Author: Johannes Berg Date: Wed Jun 21 13:12:15 2023 +0300 wifi: iwlwifi: unify Bz/Gl device configurations All the configurations for the various Bz/Gl devices are basically identical, except for Gl A-step and the firmware filename prefixes. Add some infrastructure to auto-generate the firmware filename prefix based on the detected MAC step and RF name/step, and remove all the unneeded configs. This reduces the size of the iwlwifi module by ~9k: 517582 27111 560 545253 851e5 drivers/net/wireless/intel/iwlwifi/iwlwifi.ko 526885 27083 560 554528 87620 drivers/net/wireless/intel/iwlwifi/iwlwifi.ko Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130443.1dc121ba338f.I07d651516eb82cbaded4724ef30558a50f2fa866@changeid Signed-off-by: Johannes Berg commit e3597e28a2fab5e260dcbfde20c12025ee250b72 Author: Johannes Berg Date: Wed Jun 21 13:12:14 2023 +0300 wifi: iwlwifi: pcie: also drop jacket from info macro We don't need this here anymore, ANY is just fine. Still keep the rest of the infrastructure so we can more easily add back support for testing. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130443.168c714cbb83.I0721ce86a042c4d8004914129bab46d7ccc8cb00@changeid Signed-off-by: Johannes Berg commit 0f21d7d56083f7069ff1180b40235228f3ce5b1e Author: Johannes Berg Date: Wed Jun 21 13:12:13 2023 +0300 wifi: iwlwifi: remove support for *nJ devices These are test chips that will never reach anyone outside of Intel, so remove support for them. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130443.d9f4e0356ae4.If9eccc22eb500dfff8973a70a649d94af7a60841@changeid Signed-off-by: Johannes Berg commit c648e926d021f9c6bdeef782df06f5111904fe7e Author: Johannes Berg Date: Wed Jun 21 13:12:12 2023 +0300 wifi: iwlwifi: don't load old firmware for 22000 The earliest firmware released for these products is with API version 50, so there's no point in trying to load any versions before that. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130443.768186c0475d.I7de717072221712176a3085d71c8018ae0348db8@changeid Signed-off-by: Johannes Berg commit a7de384c93996f8cdf8e7b5304bf7963161241a6 Author: Johannes Berg Date: Wed Jun 21 13:12:11 2023 +0300 wifi: iwlwifi: don't load old firmware for ax210 The earliest firmware released for these products is with API version 59 (for 'ty' only), so no point trying to go back in time even further than that. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130443.ebe02b5dbddb.I51484ebb6c89256b0e6e7f9bb24f597c4ebead67@changeid Signed-off-by: Johannes Berg commit a13707f7c8456022d9b4b764d1ad3f2252db2154 Author: Johannes Berg Date: Wed Jun 21 13:12:10 2023 +0300 wifi: iwlwifi: don't load old firmware for Bz This is a future product, don't try to load ancient firmware images for it, they don't exist anyway. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130443.a6961592f258.Ib7afecd46b1963164481c2acf35d2582691ef0bc@changeid Signed-off-by: Johannes Berg commit 508b4a1baeb3da3f0bcf3ab4c94dd2c21cc5d395 Author: Johannes Berg Date: Wed Jun 21 13:12:09 2023 +0300 wifi: iwlwifi: don't load old firmware for Sc This is a future product, don't try to load ancient firmware images for it, they don't exist anyway. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130443.a15e7bf936cb.I68c3c71fda62c837e4da885a42471bf772ac1202@changeid Signed-off-by: Johannes Berg commit 5afe98b2e2995aa17ef77a29e57b1d98ccd6cd25 Author: Johannes Berg Date: Wed Jun 21 13:12:08 2023 +0300 wifi: iwlwifi: give Sc devices their own family They're not the same as Bz or any prior ones, and there's already one place in the driver that would erroneously assign a workaround to A-step Sc devices if they're just treated as a version of Bz. Fix that. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130443.e98272ddb808.If18577b2393f631d1bfaa931287cae106fa32438@changeid Signed-off-by: Johannes Berg commit 19898ce9cf8a33e0ac35cb4c7f68de297cc93cb2 Author: Johannes Berg Date: Wed Jun 21 13:12:07 2023 +0300 wifi: iwlwifi: split 22000.c into multiple files Split the configuration list in 22000.c into four new files, per new device family, so we don't have this huge unusable file. Yes, this duplicates a few small things, but that's still much better than what we have now. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130443.7543603b2ee7.Ia8dd54216d341ef1ddc0531f2c9aa30d30536a5d@changeid Signed-off-by: Johannes Berg commit e1374ed25324e87d675bda735841d8424d83c81d Author: Mukesh Sisodiya Date: Wed Jun 21 13:12:06 2023 +0300 wifi: iwlwifi: Add support for new CNVi (SC) Add support for the new Integrated Connectivity (CNVi) and Companion RF (CRF) versions and their combinations to handle new devices. Signed-off-by: Mukesh Sisodiya Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130443.716fd707e847.I34f6ffd61e3210c926868a3e961b16d1742bba29@changeid Signed-off-by: Johannes Berg commit 8a18d46b7507553bdf40f48d3cd7d2be5f6aa7b8 Author: Mukesh Sisodiya Date: Wed Jun 21 13:12:05 2023 +0300 wifi: iwlwifi: Add support for new Bz version Add support for the new version of the Bz CNVI device. Signed-off-by: Mukesh Sisodiya Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230621130443.82d436d5f346.I0154c202c5d895cb002a2b7c827b9536e81a84b5@changeid Signed-off-by: Johannes Berg commit 69f778271f3ea4bd3d8b523c985aeea10d6b6f1a Author: Ilan Peer Date: Tue Jun 20 13:04:05 2023 +0300 wifi: iwlwifi: mvm: Add support for scan version 17 Add support for scan request command version 17, which supports specifying the maximal EIRP PSD value that can be used for probe request transmission on a given channel. Signed-off-by: Ilan Peer Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.0a41c847d450.I0c9b45cc3eb39d44c75d3bdca84f0a91fdad1fa1@changeid Signed-off-by: Johannes Berg commit 4eca0fd5da06c084a60f9a6626df6343293bfecb Author: Johannes Berg Date: Tue Jun 20 13:04:04 2023 +0300 wifi: iwlwifi: mvm: adjust skip-over-dtim in D3 The current formula can skip both too much and not enough time, given the +1 (where the comment about firmware is wrong). Adjust the formula accordingly. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.32406b6828ae.I88c315b85f7c56ac6109f84580b95a3dd104ff6c@changeid Signed-off-by: Johannes Berg commit de1076008148460fe273e6d39158faffcc954991 Author: Johannes Berg Date: Tue Jun 20 13:04:03 2023 +0300 wifi: iwlwifi: mvm: check only affected links When hostapd starts up, it may start up with only one link while the other is still scanning for overlapping BSSes. A station might start to connect at this point, but we run into this warning instead. Since there's no need to check for _all_ links, restrict the check to just the affected links that the STA will be using. Fixes: 57974a55d995 ("wifi: iwlwifi: mvm: refactor iwl_mvm_mac_sta_state_common()") Reported-by: Miri Korenblit Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.c3d5a006ec21.Ib4715381f598f4c18d67cd9598ebd5cdbe7d2b09@changeid Signed-off-by: Johannes Berg commit 1a528ab1da324d078ec60283c34c17848580df24 Author: Johannes Berg Date: Tue Jun 20 13:04:02 2023 +0300 wifi: iwlwifi: mvm: avoid baid size integer overflow Roee reported various hard-to-debug crashes with pings in EHT aggregation scenarios. Enabling KASAN showed that we access the BAID allocation out of bounds, and looking at the code a bit shows that since the reorder buffer entry (struct iwl_mvm_reorder_buf_entry) is 128 bytes if debug such as lockdep is enabled, then staring from an agg size 512 we overflow the size calculation, and allocate a much smaller structure than we should, causing slab corruption once we initialize this. Fix this by simply using u32 instead of u16. Reported-by: Roee Goldfiner Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.f428c856030d.I2c2bb808e945adb71bc15f5b2bac2d8957ea90eb@changeid Signed-off-by: Johannes Berg commit 2db72b8a700943aa54dce0aabe6ff1b72b615162 Author: Johannes Berg Date: Tue Jun 20 13:04:01 2023 +0300 wifi: iwlwifi: mvm: indicate HW decrypt for beacon protection We've already done the 'decryption' here, so tell mac80211 it need not do it again. Fixes: b1fdc2505abc ("iwlwifi: mvm: advertise BIGTK client support if available") Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.a50cf68fbf2e.Ieceacbe3789d81ea02ae085ad8d1f8813a33c31b@changeid Signed-off-by: Johannes Berg commit a6cc6ccb1c8ae9cbabd3dc4cf98c2b835bed2f6d Author: Johannes Berg Date: Tue Jun 20 13:04:00 2023 +0300 wifi: iwlwifi: mvm: support new flush_sta method For iwlwifi this is simple to implement, and on newer hardware it's an improvement since we have per-station queues. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.a1f8ec20b727.I48594b708b41aa55dc2b8c3d346b4412ad3a5ba3@changeid Signed-off-by: Johannes Berg commit 35bd6f1d043d089fcb60450e1287cc65f0095787 Author: Mukesh Sisodiya Date: Tue Jun 20 13:03:59 2023 +0300 wifi: iwlwifi: Add support for new PCI Id Add support for the PCI Id 51F1 without IMR support. Signed-off-by: Mukesh Sisodiya Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.9800e652e789.Ic06a085832ac3f988c8ef07d856c8e281563295d@changeid Signed-off-by: Johannes Berg commit c0a2f8194456af2759050a10f6d3111ad2b321da Author: Benjamin Berg Date: Tue Jun 20 13:03:58 2023 +0300 wifi: iwlwifi: mvm: send LARI configuration earlier Sending the LARI configuration may trigger calibration, which can have undesired side effects. Move the command to be send earlier (before the phy contexts are registered) to avoid unintended side effects. Signed-off-by: Benjamin Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.80742497eb3f.I3e599a796290082e6d331ea495a5591d55de4726@changeid Signed-off-by: Johannes Berg commit c6b9d5664bc41f187b3c5327613569743e006154 Author: Johannes Berg Date: Tue Jun 20 13:03:57 2023 +0300 wifi: iwlwifi: remove disable_dummy_notification This struct member is read-only, so can never change away from the default value of zero. Remove the code that's in an if on the value, since it's effectively dead code. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.e7c96d0aa805.I5b158ce15e48393d2896c0bff9f644d983f0e92d@changeid Signed-off-by: Johannes Berg commit 3a9690d030d8572736e07b912deea5547dd94db3 Author: Johannes Berg Date: Tue Jun 20 13:03:56 2023 +0300 wifi: iwlwifi: limit EHT capabilities based on PCIe link speed If a discrete NIC is connected to a PCIe link hat isn't at least Gen3 (8.0 GT/s), then we cannot sustain 320 MHz traffic, so remove that from EHT capabilities in that case. While at it, also move setting 320 MHz beamformee to the right place in the code so it's not set while not supporting 320 MHz. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.b77a1574a0a7.Id4120c161fb7df6dedc70d5f3e3829e9117b8cb1@changeid Signed-off-by: Johannes Berg commit 00e482010dfb5879fc9e8601d5819641fe4ae925 Author: Johannes Berg Date: Tue Jun 20 13:03:55 2023 +0300 wifi: iwlwifi: mvm: add EHT A-MPDU size exponent support Add support for reading the EHT MAC capabilities A-MPDU size exponent field, as indicated by the draft spec. Also clarify the existing code a bit and add comments so it's clearer to understand what's going on here. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.c5e00045d90f.I7520787fca8f8430a564adedf975d069ad8c5417@changeid Signed-off-by: Johannes Berg commit d51173c13b24925553489dff77c8cee136c7bfb1 Author: Johannes Berg Date: Tue Jun 20 13:03:54 2023 +0300 wifi: iwlwifi: mvm: use min_t() for agg_size We can use min_t() for the agg_size and avoid spelling out the (firmware) limit twice. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.211768036c1f.I78b7eea32eaae20cc9f32869aa3f42814634ce9a@changeid Signed-off-by: Johannes Berg commit c7fa5e682842dc55a0885c67edd289018a64fffd Author: Johannes Berg Date: Tue Jun 20 13:03:53 2023 +0300 wifi: iwlwifi: mvm: use EHT maximum MPDU length on 2.4 GHz On 2.4 GHz there's no VHT, so EHT defines its own bits for the maximum MPDU length. Use them when telling firmware about the maximum. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.fd5322bb48a4.Ic471045f83229ceaacce25edcf992d3ce2c75de5@changeid Signed-off-by: Johannes Berg commit 592fef3eb6a576eb453c94b5ee1801cfb13c8dc8 Author: Johannes Berg Date: Tue Jun 20 13:03:52 2023 +0300 wifi: iwlwifi: nvm: handle EHT/320 MHz regulatory flag Handle the regulatory EHT/320 MHz flags from firmware just like any other flags before it. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.2c5e886c08f3.Ibc5c27d973d0590e2dea1f50435f9cf3ba8c2c09@changeid Signed-off-by: Johannes Berg commit e119e740b1899169a19cf3cd43993a7d88c63bc6 Author: Emmanuel Grumbach Date: Tue Jun 20 13:03:51 2023 +0300 wifi: iwlwifi: mvm: make iwl_mvm_set_fw_mu_edca_params mld aware We need to work on the right link there. Signed-off-by: Emmanuel Grumbach Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.8762a90e8857.Ic5b8e96140a449fd1ed7008907d67fc36fe98506@changeid Signed-off-by: Johannes Berg commit eeef0168e3255732650ee81771e0d7e26e06a534 Author: Miri Korenblit Date: Tue Jun 20 13:03:50 2023 +0300 wifi: iwlwifi: fw: send marker cmd before suspend cmd This is needed to sync the times in the FW and driver logs Signed-off-by: Miri Korenblit Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.9c84322c41b5.Id13816b3ece103f88514a7523b22bb2b9dcc8ab7@changeid Signed-off-by: Johannes Berg commit 26aa35e2c5a1cbb05e939c92464437e205dd0087 Author: Emmanuel Grumbach Date: Tue Jun 20 13:03:49 2023 +0300 wifi: iwlwifi: mvm: check the right csa_active When the firmware says that the channel switch is happening, we check that we know about that switch by checking the csa_active bit. Until now, we checked the bss_conf from the vif instead of taking the bss_conf of the link. Fix that. Signed-off-by: Emmanuel Grumbach Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.63f835a4f578.I0bb2a231e4da506b7c751dc23a428558f9ecfa75@changeid Signed-off-by: Johannes Berg commit 1caa3a5e921c146cc82a674e7ef01633a142c475 Author: Johannes Berg Date: Tue Jun 20 13:03:48 2023 +0300 wifi: iwlwifi: pcie: add size assertions Ensure that the TX command scratch fits into the buffer provided by the first TB. It does, of course, but add some build-time validations in case we touch this code. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.8f54f2990b92.If19a038dfd633d4601e3d44dd0ff678bc0a851e9@changeid Signed-off-by: Johannes Berg commit 4742c732624bd2609aeb0acee38c0a126e61ed47 Author: Johannes Berg Date: Tue Jun 20 13:03:47 2023 +0300 wifi: iwlwifi: pcie: refactor RB status size calculation We have three places doing this check, and even in slightly different ways (with/without an intermediate). Refactor that to a new small inline function. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230620125813.f3e87ddd5bce.Ifefba753043b68c394590a35bc6914a0f6497fd3@changeid Signed-off-by: Johannes Berg commit c0c2fcb1325d0d4f3b322b5ee49385f8eca2560d Author: EJ Hsu Date: Fri Jun 9 14:29:32 2023 +0800 phy: tegra: xusb: Clear the driver reference in usb-phy dev For the dual-role port, it will assign the phy dev to usb-phy dev and use the port dev driver as the dev driver of usb-phy. When we try to destroy the port dev, it will destroy its dev driver as well. But we did not remove the reference from usb-phy dev. This might cause the use-after-free issue in KASAN. Fixes: e8f7d2f409a1 ("phy: tegra: xusb: Add usb-phy support") Cc: stable@vger.kernel.org Signed-off-by: EJ Hsu Signed-off-by: Haotien Hsu Acked-by: Thierry Reding Acked-by: Jon Hunter Link: https://lore.kernel.org/r/20230609062932.3276509-1-haotienh@nvidia.com Signed-off-by: Vinod Koul commit 6c5b9a3296e146cc74b1d006c6a546ea92534ade Author: Johannes Berg Date: Mon Jun 19 16:26:53 2023 +0300 wifi: nl80211/reg: add no-EHT regulatory flag This just propagates to the channel flags, like no-HE and similar other flags before it. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230619161906.74ce2983aed8.Ifa343ba89c11760491daad5aee5a81209d5735a7@changeid Signed-off-by: Johannes Berg commit 4ef2f53e50cba9780057b51357ef45cb5f49859d Author: Ilan Peer Date: Mon Jun 19 16:26:52 2023 +0300 wifi: cfg80211: Retrieve PSD information from RNR AP information Retrieve the Power Spectral Density (PSD) value from RNR AP information entry and store it so it could be used by the drivers. PSD value is explained in Section 9.4.2.170 of Draft P802.11Revme_D2.0. Signed-off-by: Ilan Peer Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230619161906.067ded2b8fc3.I9f407ab5800cbb07045a0537a513012960ced740@changeid Signed-off-by: Johannes Berg commit 2829b2fc8910984daa89be8005adbd9fb6205024 Author: Johannes Berg Date: Mon Jun 19 16:26:51 2023 +0300 wifi: mac80211: fix CRC calculation for extended elems For extended elements, we currently only calculate the CRC for some of them, but really we should do it also for the rest that we care about, such as EHT operation and multi- link. Also, while at it, it seems we should do it even if they aren't well-formed, so we notice if that changes. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230619161906.93235d5c8651.I6615cb3c1244bc9618066baa2bdad7982e9abd1f@changeid Signed-off-by: Johannes Berg commit b8b80770b26c4591f20f1cde3328e5f1489c4488 Author: Benjamin Berg Date: Mon Jun 19 16:26:50 2023 +0300 wifi: mac80211: avoid lockdep checking when removing deflink struct sta_info may be removed without holding sta_mtx if it has not yet been inserted. To support this, only assert that the lock is held for links other than the deflink. This fixes lockdep issues that may be triggered in error cases. Signed-off-by: Benjamin Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230619161906.cdd81377dea0.If5a6734b4b85608a2275a09b4f99b5564d82997f@changeid Signed-off-by: Johannes Berg commit 4484de23ba22e3023e9cbe4246a927ffb00db56f Author: Johannes Berg Date: Mon Jun 19 16:26:49 2023 +0300 wifi: mac80211: always hold sdata lock in chanctx assign/unassign Due to all the multi-link handling, we now expose the fact that the sdata/vif is locked to drivers, e.g. when the driver uses ieee80211_set_monitor_channel(). This was true when a chanctx is added to or removed from a link, _except_ in monitor mode with the virtual sdata/vif. Change that, so that drivers can make that assumption. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230619161906.a5cf7534beda.I5b51664231abee27e02f222083df7ccf88722929@changeid Signed-off-by: Johannes Berg commit 5c1f97537bfb9f358e0ecc88c3c8a913c51944cb Author: Johannes Berg Date: Mon Jun 19 16:26:48 2023 +0300 wifi: mac80211: store BSS param change count from assoc response When receiving a multi-link association response, make sure to track the BSS parameter change count for each link, including the assoc link. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230619161906.1799c164e7e9.I8e2c1f5eec6eec3fab525ae2dead9f6f099a2427@changeid Signed-off-by: Johannes Berg commit 76a3059cf1246a71f242822c6d605e5baa8924a3 Author: Johannes Berg Date: Mon Jun 19 16:26:47 2023 +0300 wifi: mac80211: drop some unprotected action frames We should not receive/handle unicast protected dual or public action frames that aren't protected, so drop them - in the latter case of course only if MFP is used. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230619161906.eb4461108129.I3c2223cf29d8a3586dfc74b2dda3f6fa2a4eea7c@changeid Signed-off-by: Johannes Berg commit 2cc7add345ea0e3d28a2fae29b93884909753c63 Author: Johannes Berg Date: Mon Jun 19 16:26:46 2023 +0300 wifi: mac80211: move action length check up We'd like to add more checks to the function here for action frames, so move up the length check from the action processing. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230619161906.e799254e923f.I0a1de5f6bbdc1b2ef5efaa0ac80c7c3f39415538@changeid Signed-off-by: Johannes Berg commit 7339e0f2e1bcb732b922a1c40a01b6002bec1ee5 Author: Alon Giladi Date: Mon Jun 19 18:37:38 2023 +0300 wifi: mac80211: drop unprotected robust mgmt before 4-way-HS When MFP is used, drop unprotected robust management frames also before the 4-way handshake has been completed, i.e. no key has been installed yet. Signed-off-by: Alon Giladi Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230619183718.cfbefddccd0c.Ife369dbb61c87e311ce15739d5b2b4763bfdfbae@changeid Signed-off-by: Johannes Berg commit 1abd3127bde7b67d3e57c02a10b8d77a67decc84 Author: Xu Yang Date: Tue Jun 13 16:34:45 2023 +0800 dt-bindings: phy: mxs-usb-phy: add imx8ulp and imx8qm compatible The imx8ulp and imx8qm are compatible with imx8dxl. This will add such compatible. Signed-off-by: Xu Yang Acked-by: Rob Herring Link: https://lore.kernel.org/r/20230613083445.1129137-2-xu.yang_2@nxp.com Signed-off-by: Vinod Koul commit bbbfd0329014e61ccce1161fafb858da2901b49e Author: Xu Yang Date: Tue Jun 13 16:34:44 2023 +0800 dt-bindings: phy: mxs-usb-phy: convert to DT schema format Convert the binding to DT schema format. Besides, this also add clocks, '#phy-cells', phy-3p0-supply and power-domains properties which are not contained in txt file due to txt file lack updates. Signed-off-by: Xu Yang Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230613083445.1129137-1-xu.yang_2@nxp.com Signed-off-by: Vinod Koul commit 833b0f07b915f40db352063df0e13bc91fb0f42f Author: Mark Brown Date: Wed Jun 21 02:36:06 2023 +0100 kselftest/arm64: Log signal code and address for unexpected signals If we get an unexpected signal during a signal test log a bit more data to aid diagnostics. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20230620-arm64-selftest-log-wrong-signal-v1-1-3fe29bdaaf38@kernel.org Signed-off-by: Catalin Marinas commit 6b164eaecd154930532afe8dce0d0562f629d23d Merge: 8d0cf150d2991 4dce2f076b7d0 Author: Takashi Iwai Date: Wed Jun 21 13:06:39 2023 +0200 Merge branch 'topic/midi20' into for-next This is a small patch set to change the UMP core for the upcoming gadget driver support. Basically exporting a couple of helper functions and adding a flag to suppress the internal UMP handling. No functional changes by those alone. Link: https://lore.kernel.org/r/20230621110241.4751-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 4dce2f076b7d0a0a99867b58eea7c212ff4e2be5 Author: Takashi Iwai Date: Wed Jun 21 13:02:41 2023 +0200 ALSA: ump: Export snd_ump_receive_ump_val() This is another preliminary patch for USB MIDI 2.0 gadget driver. Export the currently local snd_ump_receive_ump_val(). It can be used by the gadget driver for processing the UMP data. Link: https://lore.kernel.org/r/20230621110241.4751-4-tiwai@suse.de Signed-off-by: Takashi Iwai commit eacd9c7f1d3ab8381a99b98b36652b5cf6ae8387 Author: Takashi Iwai Date: Wed Jun 21 13:02:40 2023 +0200 ALSA: ump: Add no_process_stream flag This is another preliminary patch for USB MIDI 2.0 gadget driver. Add a new flag, no_process_stream, to snd_ump for suppressing the UMP Stream message handling in UMP core. Link: https://lore.kernel.org/r/20230621110241.4751-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit a79807683781d3f215e9d958494e52ed70f4ad27 Author: Takashi Iwai Date: Wed Jun 21 13:02:39 2023 +0200 ALSA: ump: Add helper to change MIDI protocol This is a preliminary patch for MIDI 2.0 USB gadget driver. Export a new helper to allow changing the current MIDI protocol from the outside. Link: https://lore.kernel.org/r/20230621110241.4751-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit a4857d1afdd1fa7ff763e1d07b1c2db521a5f9b1 Author: Richard Fitzgerald Date: Thu Jun 15 15:12:08 2023 +0100 soundwire: stream: Make master_list ordered to prevent deadlocks Always add buses to the stream->master_list in a fixed order. The unique bus->id is used to order the adding of buses to the list. This prevents lockdep asserts and possible deadlocks on streams that have multiple buses. sdw_acquire_bus_lock() takes bus_lock in the order that buses are listed in stream->master_list. do_bank_switch() takes all the msg_lock in the same order. To prevent a lockdep assert, and a possible real deadlock, the relative order of taking these mutexes must always be the same. For example, if a stream takes the mutexes in the order (bus0, bus1) lockdep will assert if another stream takes them in the order (bus1, bus0). More complex relative ordering will also assert, for example if two streams take (bus0, bus1) and (bus1, bus2), then a third stream takes (bus2, bus0). Previously sdw_stream_add_master() simply added the given bus to the end of the list, requiring the caller to guarantee that buses are added in a fixed order. This isn't reasonable or necessary - it's an internal implementation detail that should not be exposed by the API. It doesn't really make sense when there could be multiple independent calling drivers, to say "you must add your buses in the same order as a different driver, that you don't know about, added them". Signed-off-by: Richard Fitzgerald Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20230615141208.679011-2-rf@opensource.cirrus.com Signed-off-by: Vinod Koul commit 256a9978eb2be53d9d17705707a69ce0b65b4727 Author: Richard Fitzgerald Date: Thu Jun 15 15:12:07 2023 +0100 soundwire: bus: Prevent lockdep asserts when stream has multiple buses Give the bus_lock and msg_lock of each bus a different unique key so that it is possible to acquire the locks of multiple buses without lockdep asserting a possible deadlock. Using mutex_init() to initialize a mutex gives all those mutexes the same lock class. Lockdep checking treats it as an error to attempt to take a mutex while already holding a mutex of the same class. This causes a lockdep assert when sdw_acquire_bus_lock() attempts to lock multiple buses, and when do_bank_switch() takes multiple msg_lock. [ 138.697350] WARNING: possible recursive locking detected [ 138.697366] 6.3.0-test #1 Tainted: G E [ 138.697380] -------------------------------------------- [ 138.697394] play/903 is trying to acquire lock: [ 138.697409] ffff99b8c41aa8c8 (&bus->bus_lock){+.+.}-{3:3}, at: sdw_prepare_stream+0x52/0x2e0 [ 138.697443] but task is already holding lock: [ 138.697468] ffff99b8c41af8c8 (&bus->bus_lock){+.+.}-{3:3}, at: sdw_prepare_stream+0x52/0x2e0 [ 138.697493] other info that might help us debug this: [ 138.697521] Possible unsafe locking scenario: [ 138.697540] CPU0 [ 138.697550] ---- [ 138.697559] lock(&bus->bus_lock); [ 138.697570] lock(&bus->bus_lock); [ 138.697581] *** DEADLOCK *** Giving each mutex a unique key allows multiple to be held without triggering a lockdep assert. But note that it does not allow them to be taken in one order then a different order. If two mutexes are taken in the order A, B then they must always be taken in that order otherwise they could deadlock. Signed-off-by: Richard Fitzgerald Reviewed-by: Pierre-Louis Bossart Link: https://lore.kernel.org/r/20230615141208.679011-1-rf@opensource.cirrus.com Signed-off-by: Vinod Koul commit 490937d479abe5f6584e69b96df066bc87be92e9 Author: Krzysztof Kozlowski Date: Thu Jun 1 12:25:25 2023 +0200 soundwire: qcom: fix storing port config out-of-bounds The 'qcom_swrm_ctrl->pconfig' has size of QCOM_SDW_MAX_PORTS (14), however we index it starting from 1, not 0, to match real port numbers. This can lead to writing port config past 'pconfig' bounds and overwriting next member of 'qcom_swrm_ctrl' struct. Reported also by smatch: drivers/soundwire/qcom.c:1269 qcom_swrm_get_port_config() error: buffer overflow 'ctrl->pconfig' 14 <= 14 Fixes: 9916c02ccd74 ("soundwire: qcom: cleanup internal port config indexing") Cc: Reported-by: kernel test robot Reported-by: Dan Carpenter Link: https://lore.kernel.org/r/202305201301.sCJ8UDKV-lkp@intel.com/ Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230601102525.609627-1-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul commit 6c50384ef8b94a527445e3694ae6549e1f15d859 Author: Yicong Yang Date: Wed Jun 21 17:28:04 2023 +0800 hwtracing: hisi_ptt: Fix potential sleep in atomic context We're using pci_irq_vector() to obtain the interrupt number and then bind it to the CPU start perf under the protection of spinlock in pmu::start(). pci_irq_vector() might sleep since [1] because it will call msi_domain_get_virq() to get the MSI interrupt number and it needs to acquire dev->msi.data->mutex. Getting a mutex will sleep on contention. So use pci_irq_vector() in an atomic context is problematic. This patch cached the interrupt number in the probe() and uses the cached data instead to avoid potential sleep. [1] commit 82ff8e6b78fc ("PCI/MSI: Use msi_get_virq() in pci_get_vector()") Fixes: ff0de066b463 ("hwtracing: hisi_ptt: Add trace function support for HiSilicon PCIe Tune and Trace device") Reviewed-by: Jonathan Cameron Signed-off-by: Yicong Yang Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20230621092804.15120-6-yangyicong@huawei.com commit 45c90292ad0e275ef4b870838b3b5273b3ef8ade Author: Yicong Yang Date: Wed Jun 21 17:28:03 2023 +0800 hwtracing: hisi_ptt: Advertise PERF_PMU_CAP_NO_EXCLUDE for PTT PMU The PTT trace collects PCIe TLP headers from the PCIe link and don't have the ability to exclude certain context. It doesn't support itrace as well. So replace PERF_PMU_CAP_ITRACE with PERF_PMU_CAP_NO_EXCLUDE. This will greatly save the storage of final data. Tested tracing idle link for ~15s, without this patch we'll collect ~28.682MB data for additional information and with this patch it reduced to ~0.226MB. Reviewed-by: Jonathan Cameron Signed-off-by: Yicong Yang Tested-by: Junhao He Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20230621092804.15120-5-yangyicong@huawei.com commit 6373c463ac894e41cab24469d1947ff91aaea486 Author: Yicong Yang Date: Wed Jun 21 17:28:02 2023 +0800 hwtracing: hisi_ptt: Export available filters through sysfs The PTT can only filter the traced TLP headers by the Root Ports or the Requester ID of the Endpoint, which are located on the same PCIe core of the PTT device. The filter value used is derived from the BDF number of the supported Root Port or the Endpoint. It's not friendly enough for the users since it requires the user to be familiar enough with the platform and calculate the filter value manually. This patch export the available filters through sysfs. Each available filters is presented as an individual file with the name of the BDF number of the related PCIe device. The files are created under $(PTT PMU dir)/available_root_port_filters and $(PTT PMU dir)/available_requester_filters respectively. The filter value can be known by reading the related file. Then the users can easily know the available filters for trace and get the filter values without calculating. Reviewed-by: Jonathan Cameron Signed-off-by: Yicong Yang Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20230621092804.15120-4-yangyicong@huawei.com commit 556ef09392dbc2d0b9aad5fd880d5d11addfc40d Author: Yicong Yang Date: Wed Jun 21 17:28:01 2023 +0800 hwtracing: hisi_ptt: Add support for dynamically updating the filter list The PCIe devices supported by the PTT trace can be removed/rescanned by hotplug or through sysfs. Add support for dynamically updating the available filter list by registering a PCI bus notifier block. Then user can always get latest information about available tracing filters and driver can block the invalid filters of which related devices no longer exist in the system. Reviewed-by: Jonathan Cameron Signed-off-by: Yicong Yang Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20230621092804.15120-3-yangyicong@huawei.com commit a3ecaba7017f5d02d1ad60229cc14d5f0cda0c20 Author: Yicong Yang Date: Wed Jun 21 17:28:00 2023 +0800 hwtracing: hisi_ptt: Factor out filter allocation and release operation Factor out the allocation and release of filters. This will make it easier to extend and manage the function of the filter. Reviewed-by: Jonathan Cameron Signed-off-by: Yicong Yang Signed-off-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20230621092804.15120-2-yangyicong@huawei.com commit a1b828f202ae45b4fce4d21e83679605feb87862 Author: Arnd Bergmann Date: Fri Jun 16 11:09:24 2023 +0200 soundwire: intel_ace2x: fix SND_SOC_SOF_HDA_MLINK dependency The ace2x driver can be build with or without mlink support, but when SND_SOC_SOF_HDA_MLINK is set to =m and soundwire is built-in, it fails with a link error: ld.lld: error: undefined symbol: hdac_bus_eml_sdw_wait_syncpu_unlocked >>> referenced by intel_ace2x.c >>> drivers/soundwire/intel_ace2x.o:(intel_link_power_up) in archive vmlinux.a ld.lld: error: undefined symbol: hdac_bus_eml_sdw_sync_arm_unlocked >>> referenced by intel_ace2x.c >>> drivers/soundwire/intel_ace2x.o:(intel_sync_arm) in archive vmlinux.a Add a Kconfig dependency that prevents that broken configuration but still allows soundwire to be a loadable module instead. Fixes: 4d1e2464a1104 ("soundwire: intel_ace2x: add sync_arm/sync_go helpers") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230616090932.2714714-1-arnd@kernel.org Signed-off-by: Vinod Koul commit 8d0c7e1901d6083756b7530d348cb0af6b25ded8 Author: Juerg Haefliger Date: Fri Jun 16 14:19:17 2023 +0200 wifi: p54: Add missing MODULE_FIRMWARE macro Add the missing MODULE_FIRMWARE macro for "3826.eeprom". Signed-off-by: Juerg Haefliger Acked-by: Christian Lamparter Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230616121917.1034761-1-juerg.haefliger@canonical.com commit 028f6055c912588e6f72722d89c30b401bbcf013 Author: Jan Kara Date: Wed Jun 21 11:32:35 2023 +0200 udf: Fix uninitialized array access for some pathnames For filenames that begin with . and are between 2 and 5 characters long, UDF charset conversion code would read uninitialized memory in the output buffer. The only practical impact is that the name may be prepended a "unification hash" when it is not actually needed but still it is good to fix this. Reported-by: syzbot+cd311b1e43cc25f90d18@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/000000000000e2638a05fe9dc8f9@google.com Signed-off-by: Jan Kara commit d5b9a2102075923f5f74e890661421f94a9e6177 Author: Kalle Valo Date: Wed Jun 14 17:47:04 2023 +0300 MAINTAINERS: ath11k: add wiki and bugreport page ath11k has a wiki and a separate page about reporting bugs, add those so hopefully people find them easier. Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230614144704.505553-3-kvalo@kernel.org commit 30e67ed6e1d7686b215ec521cfdb9274101c8ece Author: Kalle Valo Date: Wed Jun 14 17:47:03 2023 +0300 MAINTAINERS: ath9k: add git tree ath9k patches go to my ath.git tree, document that. Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230614144704.505553-2-kvalo@kernel.org commit 5fdaeca73eb2bc944bb509b3cdd1520188ed2285 Author: Kalle Valo Date: Wed Jun 14 17:47:02 2023 +0300 MAINTAINERS: mt76: add git tree Felix has a git tree for mt76 patches, document that. Signed-off-by: Kalle Valo Acked-by: Lorenzo Bianconi Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230614144704.505553-1-kvalo@kernel.org commit f072eb39e4f2c1df60d8641f6260f11a42366abc Author: Ping-Ke Shih Date: Fri Jun 16 14:06:01 2023 +0800 wifi: rtw89: use struct to parse firmware header A firmware contains basic header, sections and optional dynamic header. Define them by a struct, so it will be easier to understand the layout, and also simply access these elements. Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230616060601.28460-1-pkshih@realtek.com commit b4a283fb6227fa01cdfb4bec891ded3e32b4a287 Author: Zong-Zhe Yang Date: Fri Jun 16 14:05:23 2023 +0800 wifi: rtw89: TX power stuffs replace confusing naming of _max with _num Some old declarations about TX power stuffs were named with confusing `_max`. But, they mean "the number of". So we change them to be named with `_num`. (No logic is changed.) Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230616060523.28396-1-pkshih@realtek.com commit 076031a09ae9e9394a56805aab92973612763d7e Author: Ping-Ke Shih Date: Thu Jun 15 21:04:42 2023 +0800 wifi: rtw89: 8851b: configure to force 1 TX power value RTL8851B is a chip with only single RF path, and it must use 1 TX power value for transmission, so force 1 TX power value to prevent hardware logic gets wrong TX power values randomly in certain samples. Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230615130442.18116-6-pkshih@realtek.com commit 76a7c7acaa78b1a4ab59868808fadbeb7a939b81 Author: Ping-Ke Shih Date: Thu Jun 15 21:04:41 2023 +0800 wifi: rtw89: 8851b: rfk: update IQK to version 0x8 The main change is to adjust RX calibration groups from {0,1,2,3} to {0,2} in 5 GHz, so reduce elements from 4 to 2, and use index to iterate them. Meanwhile, always do RX narrowband calibration (ID_NBRXK) for each group. NCTL is used to assist IQK, so also update NCTL to 0x6 along with internal tag HALRF_029_00_103. Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230615130442.18116-5-pkshih@realtek.com commit b686bc67e0437eb5791bca6ec89479470ef40513 Author: Ping-Ke Shih Date: Thu Jun 15 21:04:40 2023 +0800 wifi: rtw89: 8851b: rfk: add LCK track LCK is short for LC Tank calibration. To keep RF performance, do this calibration if difference of thermal value is over a threshold. Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230615130442.18116-4-pkshih@realtek.com commit b067acb1325abe06159768c351f149b8b621392c Author: Zong-Zhe Yang Date: Thu Jun 15 21:04:39 2023 +0800 wifi: rtw89: 8851b: update TX power tables to R28 Update 8851B TX power tables to RF version R28. TX power tables' changes: * TX power limit and TX power shape: update 5 GHz configurations for FCC and IC Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230615130442.18116-3-pkshih@realtek.com commit f5993f39f3a734ba8e84913dfd69d56d997e0aa1 Author: Ping-Ke Shih Date: Thu Jun 15 21:04:38 2023 +0800 wifi: rtw89: 8851b: update RF radio A parameters to R28 Update 8851b radio A parameters to R28 along with internal HALRF_029_00_103 Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230615130442.18116-2-pkshih@realtek.com commit 28c11c29494f1b34e39641eead9c60a8bd26170d Author: Po-Hao Huang Date: Fri Jun 16 20:55:40 2023 +0800 wifi: rtw88: fix not entering PS mode after AP stops Without this patch, firmware only track beacons for port 0 and since we will always start AP on port 0, this results in misbehavior of power saving mode on other ports after AP stops. The "default port" H2C command is used to notify which port should firmware track. Update the correct settings to firmware so power saving mode can work properly. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230616125540.36877-7-pkshih@realtek.com commit 455afa45edb3f1dbc1371201c5ee486bb9a8cd1a Author: Po-Hao Huang Date: Fri Jun 16 20:55:39 2023 +0800 wifi: rtw88: refine register based H2C command Since register based H2C commands don't need endian conversion. Introduce a new API that don't do conversion and send it directly. New caller are expected to encode with cpu order and gradually replace the old ones. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230616125540.36877-6-pkshih@realtek.com commit ad6741b1e0449ba8f4eb41dc28e269dc20ab9219 Author: Po-Hao Huang Date: Fri Jun 16 20:55:38 2023 +0800 wifi: rtw88: Stop high queue during scan When traversing channel list, TX in high queue should be disabled along with beacon function, so packets won't be sent to incorrect channels. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230616125540.36877-5-pkshih@realtek.com commit 9e09fbc5e90247fc6e77fb6ba72dcbf8088cf59a Author: Po-Hao Huang Date: Fri Jun 16 20:55:37 2023 +0800 wifi: rtw88: Skip high queue in hci_flush The flush period may not always intersect with DTIM and when that happens, an error log "timed out to flush pci TX ring[6]" is shown. Bypass this since hardware will do proper transmission on the next DTIM period for broadcast/multicast packets in high queue. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230616125540.36877-4-pkshih@realtek.com commit 076f786a0ae14a81f40314b96a2d815e264bc213 Author: Po-Hao Huang Date: Fri Jun 16 20:55:36 2023 +0800 wifi: rtw88: Fix AP mode incorrect DTIM behavior Broadcast and multicast packets in high queue should be transmitted all at once during DTIM. But without proper settings, hardware fails to recognize that there are multiple packets and fetches only one. Fix this by signaling hardware with more data bit set when there are packets in the high queue. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230616125540.36877-3-pkshih@realtek.com commit 88b9d8e6cf9cf89be50ca2ee6cb9b3180b432172 Author: Po-Hao Huang Date: Fri Jun 16 20:55:35 2023 +0800 wifi: rtw88: use struct instead of macros to set TX desc Remove macros that set TX descriptors. Use struct and le32_encode_bits() with mask definitions. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230616125540.36877-2-pkshih@realtek.com commit 67d7f24b194e6e8e82540aa4fe97580f6cfa0902 Author: Chih-Kang Chang Date: Fri Jun 16 11:17:13 2023 +0800 wifi: rtw88: process VO packets without workqueue to avoid PTK rekey failed In the wpa_supplicant rekey flow, it sends an EAPOL packet 4/4 through nl80211_tx_control_port() and triggers wake_tx_queue() in the driver. Then, it sends nl80211_new_key() to configure a new key in mac80211. However, in wake_tx_queue(), a workqueue is used to process the tx packet, which might cause the driver to process the EAPOL packet later than nl80211_new_key(). As a result, the EAPOL 4/4 packet is dropped by mac80211 due to the rekey configuration being finished. The EAPOL packets belongs to VO packets that need high priority. Therefore, we process VO packets directly without workqueue to ensure that packets can process immediately. VO is normally used by voice application that is low traffic load and low latency, that doesn't affect user experience. We test iperf with VO packets(iperf3 -P4 -u -b 10000M -S 0xdf) before after TX throughput 162M 162M ping RTT 3.8ms 3.7ms Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230616031713.16769-1-pkshih@realtek.com commit 2ce9a91fe8bfb0c8e647a6b7b88055881faf7502 Author: Po-Hao Huang Date: Thu Jun 15 19:43:48 2023 +0800 wifi: rtw88: Fix action frame transmission fail before association For combo chips, antennas were controlled by bluetooth only during power on. If WiFi wish to do transmission, notification to the coexistence module are required. Previously we only do this before authentication. To allow transmission before auth, such as management TX, now we start the initiation of coexistence earlier so antennas are shared between WiFi and bluetooth after set_channel(), and frames could then be sent. Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20230615114348.7193-1-pkshih@realtek.com commit 6a567e920fd0451bf29abc418df96c3365925770 Author: Miklos Szeredi Date: Wed Jun 7 17:49:21 2023 +0200 fuse: ioctl: translate ENOSYS in outarg Fuse shouldn't return ENOSYS from its ioctl implementation. If userspace responds with ENOSYS it should be translated to ENOTTY. There are two ways to return an error from the IOCTL request: - fuse_out_header.error - fuse_ioctl_out.result Commit 02c0cab8e734 ("fuse: ioctl: translate ENOSYS") already fixed this issue for the first case, but missed the second case. This patch fixes the second case. Reported-by: Jonathan Katz Closes: https://lore.kernel.org/all/CALKgVmcC1VUV_gJVq70n--omMJZUb4HSh_FqvLTHgNBc+HCLFQ@mail.gmail.com/ Fixes: 02c0cab8e734 ("fuse: ioctl: translate ENOSYS") Cc: Signed-off-by: Miklos Szeredi commit 94a599c8ee7bd14895a060dcb3837bd6b185e240 Merge: 3e1a7433fed25 b17f3a3ef5ee2 Author: Arnd Bergmann Date: Wed Jun 21 11:05:15 2023 +0200 Merge tag 'v6.4-next-defconfig' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux into soc/defconfig - Enable mt6357 PMIC needed for mt8365 EVK - Enable device for power button on several PMICs * tag 'v6.4-next-defconfig' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux: arm64: defconfig: enable Mediatek PMIC key arm64: defconfig: enable MT6357 regulator Link: https://lore.kernel.org/r/92e336ca-bbbb-6d6c-297a-13deaae4138b@gmail.com Signed-off-by: Arnd Bergmann commit 3e1a7433fed25c6a493bc36b2c317c626d7a37f0 Merge: 168269abf5394 95b4d23907f29 Author: Arnd Bergmann Date: Wed Jun 21 11:04:48 2023 +0200 Merge tag 'ti-k3-config-for-v6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/defconfig TI K3 defconfig updates Enable AM62 Verdin board peripherals Enable UBIFS support for OSPI NOR/NAND Filesystem on K3 platforms * tag 'ti-k3-config-for-v6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: arm64: defconfig: Enable UBIFS arm64: defconfig: enable drivers for Verdin AM62 Link: https://lore.kernel.org/r/97a49740-32e7-f899-d153-743b5a57eba7@ti.com Signed-off-by: Arnd Bergmann commit 168269abf5394bf0eca334e1c2478bc51cec3077 Merge: c0ab597fa2060 a19a3dcb0d190 Author: Arnd Bergmann Date: Wed Jun 21 11:04:00 2023 +0200 Merge tag 'qcom-arm64-defconfig-for-6.5-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/defconfig More Qualcomm ARM64 defconfig updates for v6.5 This enables various clock drivers for QCM2290, SM6115 and SC8280XP. Furhter, the interconnect and the MSM power manageer (MPM) drivers are enabled to allow QCM2290 to boot. * tag 'qcom-arm64-defconfig-for-6.5-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: Build SM6115 display and GPU clock controller drivers arm64: defconfig: Build display clock controller driver for QCM2290 arm64: defconfig: Build interconnect driver for QCM2290 arm64: defconfig: Build Global Clock Controller driver for QCM2290 arm64: defconfig: Build MSM power manager driver arm64: defconfig: Enable sc828x0xp lpasscc clock controller Link: https://lore.kernel.org/r/20230615154119.1460952-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit c0ab597fa2060823cf727dd56bf8a3a0efba88ef Merge: 6d34aab3b59b9 3098f34977480 Author: Arnd Bergmann Date: Wed Jun 21 11:03:08 2023 +0200 Merge tag 'qcom-arm64-defconfig-for-6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/defconfig Qualcomm ARM64 defconfig updates for v6.5 Enable the FSA4480 driver to enable USB Type-C altmode on devices such as SM8350 and SM8450 HDK. Enable the IPQ6018 APSS clock and PLL controller for CPU scaling, and enable GPU clock river for SA8775P. * tag 'qcom-arm64-defconfig-for-6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: Enable ipq6018 apss clock and PLL controller arm64: defconfig: enable FSA4480 driver as module arm64: defconfig: enable the SA8775P GPUCC driver Link: https://lore.kernel.org/r/20230610170955.2478831-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 6d34aab3b59b9b0f8e26c735532d7d1fe30129c7 Merge: 0403565132a54 773887a41b9c2 Author: Arnd Bergmann Date: Wed Jun 21 11:02:01 2023 +0200 Merge tag 'imx-defconfig-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/defconfig i.MX defconfig changes for 6.5: - Remove KERNEL_LZO and FW_LOADER_USER_HELPER from imx_v6_v7_defconfig. - Enable i.MX8M video capture drivers and TI SN65DSI83 driver for arm64 defconfig. * tag 'imx-defconfig-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: defconfig: Enable the TI SN65DSI83 driver ARM: imx_v6_v7_defconfig: Remove KERNEL_LZO config arm64: defconfig: Enable video capture drivers on imx8mm/imx8mn ARM: imx_v6_v7_defconfig: Remove firmware loader helper Link: https://lore.kernel.org/r/20230610072530.418847-4-shawnguo@kernel.org Signed-off-by: Arnd Bergmann commit 5619c2ddaf3ff77ce393716a6fed3267cb906344 Author: Claudiu Beznea Date: Thu Jun 15 12:32:27 2023 +0300 clk: at91: sama7g5: s/ep_chg_chg_id/ep_chg_id s/ep_chg_chg_id/ep_chg_id in documentation of master clock structure. Signed-off-by: Claudiu Beznea Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20230615093227.576102-12-claudiu.beznea@microchip.com commit de3383e993a588acdb5b276adbd32cc7e21fd38b Author: Claudiu Beznea Date: Thu Jun 15 12:32:26 2023 +0300 clk: at91: sama7g5: switch to parent_hw and parent_data Switch SAMA7G5 clocks to use parent_hw and parent_data. Having parent_hw instead of parent names improves to clock registration speed and re-parenting. Extra time saved on registration is ~250us when running at 800MHz. Signed-off-by: Claudiu Beznea Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20230615093227.576102-11-claudiu.beznea@microchip.com commit 8aa1db9ccee0edc5c48e460329ac725b6e337a4e Author: Claudiu Beznea Date: Thu Jun 15 12:32:25 2023 +0300 clk: at91: sckc: switch to parent_data/parent_hw Switch slow clock drivers to use parent_data and parent_hw. With this parent-child relation is described with pointers rather than strings. Signed-off-by: Claudiu Beznea Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20230615093227.576102-10-claudiu.beznea@microchip.com commit a673dae8c4ad9ee02a80617c6569ac66991c6c82 Author: Claudiu Beznea Date: Thu Jun 15 12:32:24 2023 +0300 clk: at91: clk-sam9x60-pll: add support for parent_hw Add support for parent_hw in SAM9X60 PLL clock drivers. With this parent-child relation is described with pointers rather than strings making registration a bit faster. All the SoC based drivers that rely on clk-sam9x60-pll were adapted to the new API change. The switch itself for SoCs will be done in subsequent patches. Signed-off-by: Claudiu Beznea Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20230615093227.576102-9-claudiu.beznea@microchip.com commit 077782e3f2f34003fb8d13f8becfeab69c4f6570 Author: Claudiu Beznea Date: Thu Jun 15 12:32:23 2023 +0300 clk: at91: clk-utmi: add support for parent_hw Add support for parent_hw in utmi clock drivers. With this parent-child relation is described with pointers rather than strings making registration a bit faster. All the SoC based drivers that rely on clk-utmi were adapted to the new API change. The switch itself for SoCs will be done in subsequent patches. Signed-off-by: Claudiu Beznea Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20230615093227.576102-8-claudiu.beznea@microchip.com commit 1a537f625773fe3e5f124a933b2dffdfc947f9e0 Author: Claudiu Beznea Date: Thu Jun 15 12:32:22 2023 +0300 clk: at91: clk-system: add support for parent_hw Add support for parent_hw in system clock drivers. With this parent-child relation is described with pointers rather than strings making registration a bit faster. All the SoC based drivers that rely on clk-system were adapted to the new API change. The switch itself for SoCs will be done in subsequent patches. Signed-off-by: Claudiu Beznea Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20230615093227.576102-7-claudiu.beznea@microchip.com commit 1a2669df3c1fcef1e212fc9fe39b37b0b67a97f0 Author: Claudiu Beznea Date: Thu Jun 15 12:32:21 2023 +0300 clk: at91: clk-programmable: add support for parent_hw Add support for parent_hw in programmable clock driver. With this parent-child relation is described with pointers rather than strings making registration a bit faster. All the SoC based drivers that rely on clk-programmable were adapted to the new API change. The switch itself for SoCs will be done in subsequent patches. Signed-off-by: Claudiu Beznea Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20230615093227.576102-6-claudiu.beznea@microchip.com commit c2f2ca0be8a62ce61a6878cd3dddd8fc6d622999 Author: Claudiu Beznea Date: Thu Jun 15 12:32:20 2023 +0300 clk: at91: clk-peripheral: add support for parent_hw Add support for parent_hw in peripheral clock drivers. With this parent-child relation is described with pointers rather than strings making registration a bit faster. All the SoC based drivers that rely on clk-peripheral were adapted to the new API change. The switch itself for SoCs will be done in subsequent patches. Signed-off-by: Claudiu Beznea Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20230615093227.576102-5-claudiu.beznea@microchip.com commit 171e502c6a1fee63ab6f3fc685d38960398ce6d5 Author: Claudiu Beznea Date: Thu Jun 15 12:32:19 2023 +0300 clk: at91: clk-master: add support for parent_hw Add support for parent_hw in master clock drivers. With this parent-child relation is described with pointers rather than strings making registration a bit faster. All the SoC based drivers that rely on clk-master were adapted to the new API change. The switch itself for SoCs will be done in subsequent patches. Signed-off-by: Claudiu Beznea Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20230615093227.576102-4-claudiu.beznea@microchip.com commit 00bd581b52f77ea2a51846a4d43d75eccf322cb2 Author: Claudiu Beznea Date: Thu Jun 15 12:32:18 2023 +0300 clk: at91: clk-generated: add support for parent_hw Add support for parent_hw in generic clock drivers. With this parent-child relation is described with pointers rather than strings making registration a bit faster. All the SoC based drivers that rely on clk-generated were adapted to the new API change. The switch itself for SoCs will be done in subsequent patches. Signed-off-by: Claudiu Beznea Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20230615093227.576102-3-claudiu.beznea@microchip.com commit b5105e377df929dd7d96628122c13e6852f2fe80 Author: Claudiu Beznea Date: Thu Jun 15 12:32:17 2023 +0300 clk: at91: clk-main: add support for parent_data/parent_hw Add support for parent_data and parent_hw in main oscillator clock drivers. With this parent-child relations are described with pointers rather than strings making registration a bit faster. All the SoC based drivers that rely on clk-main were adapted to the new API change. The switch itself for SoCs will be done in subsequent patches. Signed-off-by: Claudiu Beznea Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20230615093227.576102-2-claudiu.beznea@microchip.com commit 9f0648f13e34a01f2e1a7a0d5801988a7bca6988 Merge: d18b2a0f1a788 9314d0530276a Author: Linus Walleij Date: Wed Jun 21 09:37:43 2023 +0200 Merge tag 'intel-pinctrl-v6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/intel into devel intel-pinctrl for v6.5-1 * Fix of OPEN DRAIN pin mode setting in a few drivers * Reduce a scope of spin lock in the Bay Trail driver * Decrease a code footprint by refactoring in a few drivers * Expand string choices and reuse that in the Bay Trail driver The following is an automated git shortlog grouped by driver: baytrail: - invert if condition - add warning for BYT_VAL_REG retrieval failure - reduce scope of spinlock in ->dbg_show() hook - Use str_hi_lo() helper - Use BIT() in BYT_PULL_ASSIGN_* definitions - Unify style of error and debug messages cherryview: - Drop goto label - Return correct value if pin in push-pull mode - Don't use IRQ core constanst for invalid IRQ intel: - refine ->irq_set_type() hook - refine ->set_mux() hook - Add Intel Meteor Lake-S pin controller support lib/string_helpers: - Add str_high_low() helper - Split out string_choices.h - Add missing header files to MAINTAINERS database merrifield: - Use BUFCFG_PINMODE_GPIO in ->pin_dbg_show() - Fix open-drain pin mode configuration moorefield: - Use BUFCFG_PINMODE_GPIO in ->pin_dbg_show() - Fix open-drain pin mode configuration commit 33c01ff3b1003aea11288f2bf7924ada5b5b8327 Author: Michael Walle Date: Fri Jun 16 15:18:41 2023 +0200 ARM: dts: lan966x: kontron-d10: add PHY interrupts With interrupt handling fixed in the MaxLinear PHY driver, see commit 97a89ed101bb ("net: phy: mxl-gpy: disable interrupts on GPY215 by default"), we can finally add the correct interrupt description to the device tree. Signed-off-by: Michael Walle Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20230616-feature-d10-dt-cleanups-v1-3-50dd0452b8fe@kernel.org commit fcb79ee3f0b15ed15f35eca5f24e952fdced9c61 Author: Michael Walle Date: Fri Jun 16 15:18:40 2023 +0200 ARM: dts: lan966x: kontron-d10: fix SPI CS The pinctrl node was missing which change the pin mux to GPIO mode. Add it so we don't have to rely on the bootloader to set the correct mode. Fixes: 79d83b3a458e ("ARM: dts: lan966x: add basic Kontron KSwitch D10 support") Signed-off-by: Michael Walle Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20230616-feature-d10-dt-cleanups-v1-2-50dd0452b8fe@kernel.org commit bfcd5714f6424c03e385e0e9296dcd69855cfea7 Author: Michael Walle Date: Fri Jun 16 15:18:39 2023 +0200 ARM: dts: lan966x: kontron-d10: fix board reset The pinctrl node was missing which change the pin mux to GPIO mode. Add it. Fixes: 79d83b3a458e ("ARM: dts: lan966x: add basic Kontron KSwitch D10 support") Signed-off-by: Michael Walle [claudiu.beznea: moved pinctrl-* bindings after compatible] Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20230616-feature-d10-dt-cleanups-v1-1-50dd0452b8fe@kernel.org commit 15e2d241d160a1a0816588d96b56e54c306fc1da Author: Cristian Birsan Date: Fri Jun 16 18:29:32 2023 +0300 ARM: dts: at91: Enable device-tree overlay support for AT91 boards Add the '-@' DTC option for AT91 boards that have device-tree overlays. This option populates the '__symbols__' node that contains all the necessary symbols for supporting device-tree overlays (from bootloader) on these devices. This change increases the size of the resulting DTB with ~30%-40%. Below are the measurements performed v6.4-rc6: at91-sam9x60_curiosity.dtb 28499 -> 36641 bytes at91-sam9x60ek.dtb 30867 -> 39609 bytes at91-sama5d27_som1_ek.dtb 26086 -> 34166 bytes at91-sama5d27_wlsom1_ek.dtb 26045 -> 33184 bytes at91-sama5d2_icp.dtb 27521 -> 36155 bytes at91-sama5d2_ptc_ek.dtb 23237 -> 29612 bytes at91-sama5d2_xplained.dtb 27262 -> 35326 bytes at91-sama5d3_eds.dtb 27924 -> 39939 bytes at91-sama5d3_xplained.dtb 28400 -> 40650 bytes at91-sama5d4_xplained.dtb 26456 -> 36107 bytes at91-sama7g5ek.dtb 29212 -> 37289 bytes Signed-off-by: Cristian Birsan [claudiu.beznea: s/arm: dts/ARM: dts: at91/ in commit title] Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20230616152932.1484154-1-cristian.birsan@microchip.com commit d33ed97dcab3efd7baebfb68cd19ff12f6211448 Author: Johannes Berg Date: Wed Jun 21 09:16:26 2023 +0200 wifi: mac80211: fix documentation config reference We shouldn't refer to CPTCFG_, that's for backports, in mainline that's just CONFIG_. Fix it. Signed-off-by: Johannes Berg commit 2507135e4ff231a368eae38000a501da0b96c662 Author: Gustavo A. R. Silva Date: Tue Jun 20 11:30:36 2023 -0600 readdir: Replace one-element arrays with flexible-array members One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element arrays with flexible-array members in multiple structures. Address the following -Wstringop-overflow warnings seen when built m68k architecture with m5307c3_defconfig configuration: In function '__put_user_fn', inlined from 'fillonedir' at fs/readdir.c:170:2: include/asm-generic/uaccess.h:49:35: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 49 | *(u8 __force *)to = *(u8 *)from; | ~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~ fs/readdir.c: In function 'fillonedir': fs/readdir.c:134:25: note: at offset 1 into destination object 'd_name' of size 1 134 | char d_name[1]; | ^~~~~~ In function '__put_user_fn', inlined from 'filldir' at fs/readdir.c:257:2: include/asm-generic/uaccess.h:49:35: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 49 | *(u8 __force *)to = *(u8 *)from; | ~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~ fs/readdir.c: In function 'filldir': fs/readdir.c:211:25: note: at offset 1 into destination object 'd_name' of size 1 211 | char d_name[1]; | ^~~~~~ This helps with the ongoing efforts to globally enable -Wstringop-overflow. This results in no differences in binary output. Link: https://github.com/KSPP/linux/issues/79 Link: https://github.com/KSPP/linux/issues/312 Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Message-Id: Signed-off-by: Christian Brauner commit 672d6ef4c775cfcd2e00172e23df34e77e495e85 Author: Eric Biggers Date: Mon Jun 19 21:19:37 2023 -0700 fsverity: improve documentation for builtin signature support fsverity builtin signatures (CONFIG_FS_VERITY_BUILTIN_SIGNATURES) aren't the only way to do signatures with fsverity, and they have some major limitations. Yet, more users have tried to use them, e.g. recently by https://github.com/ostreedev/ostree/pull/2640. In most cases this seems to be because users aren't sufficiently familiar with the limitations of this feature and what the alternatives are. Therefore, make some updates to the documentation to try to clarify the properties of this feature and nudge users in the right direction. Note that the Integrity Policy Enforcement (IPE) LSM, which is not yet upstream, is planned to use the builtin signatures. (This differs from IMA, which uses its own signature mechanism.) For that reason, my earlier patch "fsverity: mark builtin signatures as deprecated" (https://lore.kernel.org/r/20221208033548.122704-1-ebiggers@kernel.org), which marked builtin signatures as "deprecated", was controversial. This patch therefore stops short of marking the feature as deprecated. I've also revised the language to focus on better explaining the feature and what its alternatives are. Link: https://lore.kernel.org/r/20230620041937.5809-1-ebiggers@kernel.org Reviewed-by: Colin Walters Reviewed-by: Luca Boccassi Signed-off-by: Eric Biggers commit 8d0cf150d299148a97653610c256f10c42f85ce0 Author: Ivan Orlov Date: Tue Jun 20 19:56:34 2023 +0200 sound: make all 'class' structures const Now that the driver core allows for struct class to be in read-only memory, making all 'class' structures to be declared at build time placing them into read-only memory, instead of having to be dynamically allocated at load time. Cc: Jaroslav Kysela Cc: Takashi Iwai Cc: Ivan Orlov Cc: Greg Kroah-Hartman Cc: Geoff Levand Cc: Thierry Reding Cc: "Uwe Kleine-König" Cc: alsa-devel@alsa-project.org Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20230620175633.641141-2-gregkh@linuxfoundation.org Signed-off-by: Takashi Iwai commit 7ea9ee0064281ef630e038f8dd2f6e8f4030a696 Author: Srinivas Kandagatla Date: Mon Jun 19 10:28:05 2023 +0100 ALSA: compress: allow setting codec params after next track For gapless playback it is possible that each track can have different codec profile with same decoder, for example we have WMA album, we may have different tracks as WMA v9, WMA v10 and so on Or if DSP's like QDSP have abililty to switch decoders on single stream for each track, then this call could be used to set new codec parameters. Existing code does not allow to change this profile while doing gapless playback. Reuse existing SNDRV_COMPRESS_SET_PARAMS to set this new track params along some additional checks to enforce proper state machine. With this new changes now the user can call SNDRV_COMPRESS_SET_PARAMS anytime after setting next track and additional check in write should also ensure that params are set before writing new data. Signed-off-by: Srinivas Kandagatla Acked-by: Vinod Koul Link: https://lore.kernel.org/r/20230619092805.21649-1-srinivas.kandagatla@linaro.org Signed-off-by: Takashi Iwai commit 362f9c907fd8c2be3d5c5686ea787bca25443cdc Author: elisabeth Date: Fri Jun 2 14:38:15 2023 +0200 perf jit: Fix incorrect file name in DWARF line table Fixes an issue where an incorrect filename was added in the DWARF line table of an ELF object file when calling 'perf inject --jit' due to not checking the filename of a debug entry against the repeated name marker (/xff/0). The marker is mentioned in the tools/perf/util/jitdump.h header, which describes the jitdump binary format, and indicitates that the filename in a debug entry is the same as the previous enrty. In the function emit_lineno_info(), in the file tools/perf/util/genelf-debug.c, the debug entry filename gets compared to the previous entry filename. If they are not the same, a new filename is added to the DWARF line table. However, since there is no check against '\xff\0', in some cases '\xff\0' is inserted as the filename into the DWARF line table. This can be seen with `objdump --dwarf=line` on the ELF file after `perf inject --jit`. It also makes no source code information show up in 'perf annotate'. Signed-off-by: Elisabeth Panholzer Acked-by: Namhyung Kim Link: https://lore.kernel.org/r/20230602123815.255001-1-paniii94@gmail.com [ Fixed a trailing white space, removed a subject prefix ] Signed-off-by: Namhyung Kim commit bfd8d989210cb6bb1c8e87b7c525831dceb91418 Author: Timothy Pearson Date: Mon Jun 5 13:48:56 2023 -0500 powerpc/iommu: Only build sPAPR access functions on pSeries and PowerNV A build failure with CONFIG_HAVE_PCI=y set without PSERIES or POWERNV set was caught by the random configuration checker. Guard the sPAPR specific IOMMU functions on CONFIG_PPC_PSERIES || CONFIG_PPC_POWERNV. Signed-off-by: Timothy Pearson Signed-off-by: Michael Ellerman Link: https://msgid.link/2015925968.3546872.1685990936823.JavaMail.zimbra@raptorengineeringinc.com commit 331e2cad6d168ac5ccb25ae34bdc305b8b731bc0 Author: Rohan McLure Date: Wed May 10 13:31:15 2023 +1000 powerpc: powernv: Annotate data races in opal events The kopald thread handles opal events as they appear, but by polling a static bit-vector in last_outstanding_events. Annotate these data races accordingly. We are not at risk of missing events, but use of READ_ONCE, WRITE_ONCE will assist readers in seeing that kopald only consumes the events it is aware of when it is scheduled. Also removes extraneous KCSAN warnings. Signed-off-by: Rohan McLure Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230510033117.1395895-10-rmclure@linux.ibm.com commit 86dacd967b80114c0c6cf0648ed1dcaea8853937 Author: Rohan McLure Date: Wed May 10 13:31:14 2023 +1000 powerpc: Mark writes registering ipi to host cpu through kvm and polling Mark writes to hypervisor ipi state so that KCSAN recognises these asynchronous issue of kvmppc_{set,clear}_host_ipi to be intended, with atomic writes. Mark asynchronous polls to this variable in kvm_ppc_read_one_intr(). Signed-off-by: Rohan McLure Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230510033117.1395895-9-rmclure@linux.ibm.com commit 8608f14b49a0a3f8644a326d32dc1bf7ed78836a Author: Rohan McLure Date: Wed May 10 13:31:13 2023 +1000 powerpc: Annotate accesses to ipi message flags IPI message flags are observed and consequently consumed in the smp_ipi_demux_relaxed function, which handles these message sources until it observes none more arriving. Mark the checked loop guard with READ_ONCE, to signal to KCSAN that the read is known to be volatile, and that non-determinism is expected. Mark write for message source in smp_muxed_ipi_set_message(). Signed-off-by: Rohan McLure Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230510033117.1395895-8-rmclure@linux.ibm.com commit b0c5b4f1ee3687c57dab65ac0729a4d61967f032 Author: Rohan McLure Date: Wed May 10 13:31:12 2023 +1000 powerpc: powernv: Fix KCSAN datarace warnings on idle_state contention The idle_state entry in the PACA on PowerNV features a bit which is atomically tested and set through ldarx/stdcx. to be used as a spinlock. This lock then guards access to other bit fields of idle_state. KCSAN cannot differentiate between any of these bitfield accesses as they all are implemented by 8-byte store/load instructions, thus cores contending on the bit-lock appear to data race with modifications to idle_state. Separate the bit-lock entry from the data guarded by the lock to avoid the possibility of data races being detected by KCSAN. Suggested-by: Nicholas Piggin Signed-off-by: Rohan McLure Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230510033117.1395895-7-rmclure@linux.ibm.com commit be286b8637d417a7d7eb25dc3a509c10d0afef66 Author: Rohan McLure Date: Wed May 10 13:31:10 2023 +1000 powerpc: Mark [h]ssr_valid accesses in check_return_regs_valid Checks to see if the [H]SRR registers have been clobbered by (soft) NMI interrupts imply the possibility for a data race on the [h]srr_valid entries in the PACA. Annotate accesses to these fields with READ_ONCE, removing the need for the barrier. The diagnostic can use plain-access reads and writes, but annotate with data_race. Signed-off-by: Rohan McLure Reported-by: Michael Ellerman Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230510033117.1395895-5-rmclure@linux.ibm.com commit 6f3136326ee47ae2dd5dac9306c9b08ccbc7e81e Author: Rohan McLure Date: Wed May 10 13:31:08 2023 +1000 powerpc: qspinlock: Enforce qnode writes prior to publishing to queue Annotate the release barrier and memory clobber (in effect, producing a compiler barrier) in the publish_tail_cpu call. These barriers have the effect of ensuring that qnode attributes are all written to prior to publish the node to the waitqueue. Even while the initial write to the 'locked' attribute is guaranteed to terminate prior to the node being visible, KCSAN still complains that the write is reorderable by the compiler. Issue a kcsan_release() to inform KCSAN of the release barrier contained in publish_tail_cpu(). Signed-off-by: Rohan McLure Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230510033117.1395895-3-rmclure@linux.ibm.com commit 03d44ee80eac980a869ed3d5637ed85de6fb957f Author: Rohan McLure Date: Wed May 10 13:31:07 2023 +1000 powerpc: qspinlock: Mark accesses to qnode lock checks The powerpc implementation of qspinlocks will both poll and spin on the bitlock guarding a qnode. Mark these accesses with READ_ONCE to convey to KCSAN that polling is intentional here. Signed-off-by: Rohan McLure Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman Link: https://msgid.link/20230510033117.1395895-2-rmclure@linux.ibm.com commit 98e61df570f06e8a2a2152bb3485c60fe1b148cb Author: Joel Stanley Date: Tue Jun 13 14:22:02 2023 +0930 powerpc/powernv/pci: Remove last IODA1 defines Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman Link: https://msgid.link/20230613045202.294451-4-joel@jms.id.au commit 326b3f8c6efca7ddc95f164bc0c8fa1c57d7a84f Author: Joel Stanley Date: Tue Jun 13 14:22:01 2023 +0930 powerpc/powernv/pci: Remove MVE code With IODA1 support gone the OPAL calls to set MVE are dead code. Remove them. Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman Link: https://msgid.link/20230613045202.294451-3-joel@jms.id.au commit 5ac129cdb50b4efda59ee5ea7c711996a3637b34 Author: Joel Stanley Date: Tue Jun 13 14:22:00 2023 +0930 powerpc/powernv/pci: Remove ioda1 support The final "VPL" Power7 boxes that were used for powernv bringup have been scrapped, meaning there are no machines with ioda1 left. This patch removes the obvious unused code. Signed-off-by: Joel Stanley Signed-off-by: Michael Ellerman Link: https://msgid.link/20230613045202.294451-2-joel@jms.id.au commit d65305bfa6f797712b928bd8f4781380726b70a0 Author: Rob Herring Date: Wed Jun 14 11:17:23 2023 -0600 powerpc: 52xx: Make immr_id DT match tables static In some builds, the mpc52xx_pm_prepare()/lite5200_pm_prepare() functions generate stack size warnings. The addition of 'struct resource' in commit 2500763dd3db ("powerpc: Use of_address_to_resource()") grew the stack size and is blamed for the warnings. However, the real issue is there's no reason the 'struct of_device_id immr_ids' DT match tables need to be on the stack as they are constant. Declare them as static to move them off the stack. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202306130405.uTv5yOZD-lkp@intel.com/ Signed-off-by: Rob Herring Signed-off-by: Michael Ellerman Link: https://msgid.link/20230614171724.2403982-1-robh@kernel.org commit ef8e341075330b3d0e06d4b026d971e7e4ce378b Author: Rob Herring Date: Fri Jun 9 12:32:32 2023 -0600 powerpc: mpc512x: Remove open coded "ranges" parsing "ranges" is a standard property, and we have common helper functions for parsing it, so let's use the for_each_of_range() iterator. Signed-off-by: Rob Herring Signed-off-by: Michael Ellerman Link: https://msgid.link/20230609183232.1767050-1-robh@kernel.org commit be0f9ca024b3ae17fac6b15c04519840f3418269 Author: Rob Herring Date: Fri Jun 9 12:32:38 2023 -0600 powerpc: fsl_soc: Use of_range_to_resource() for "ranges" parsing "ranges" is a standard property with common parsing functions. Users shouldn't be implementing their own parsing of it. Refactor the FSL RapidIO "ranges" parsing to use of_range_to_resource() instead. Signed-off-by: Rob Herring Signed-off-by: Michael Ellerman Link: https://msgid.link/20230609183238.1767186-1-robh@kernel.org commit f892ac774b34a769318030f5febe5ce41d6e122e Author: Rob Herring Date: Fri Jun 9 12:31:50 2023 -0600 powerpc: fsl: Use of_property_read_reg() to parse "reg" Use the recently added of_property_read_reg() helper to get the untranslated "reg" address value. Signed-off-by: Rob Herring [mpe: Add required include of of_address.h] Signed-off-by: Michael Ellerman Link: https://msgid.link/20230609183151.1766261-1-robh@kernel.org commit c4ae1799a5a358388acb610512c68666f8758364 Author: Rob Herring Date: Fri Jun 9 12:32:44 2023 -0600 powerpc: fsl_rio: Use of_range_to_resource() for "ranges" parsing "ranges" is a standard property with common parsing functions. Users shouldn't be implementing their own parsing of it. Refactor the FSL RapidIO "ranges" parsing to use of_range_to_resource() instead. One change is the original code would look for "#size-cells" and "#address-cells" in the parent node if not found in the port child nodes. That is non-standard behavior and not necessary AFAICT. In 2011 in commit 54986964c13c ("powerpc/85xx: Update SRIO device tree nodes") there was an ABI break. The upstream .dts files have been correct since at least that point. Signed-off-by: Rob Herring [mpe: Remove now unused "cell" variable] Signed-off-by: Michael Ellerman Link: https://msgid.link/20230609183244.1767325-1-robh@kernel.org "ranges" is a standard property with common parsing functions. Users shouldn't be implementing their own parsing of it. Refactor the FSL RapidIO "ranges" parsing to use of_range_to_resource() instead. One change is the original code would look for "#size-cells" and "#address-cells" in the parent node if not found in the port child nodes. That is non-standard behavior and not necessary AFAICT. In 2011 in commit 54986964c13c ("powerpc/85xx: Update SRIO device tree nodes") there was an ABI break. The upstream .dts files have been correct since at least that point. Signed-off-by: Rob Herring Signed-off-by: Michael Ellerman Link: https://msgid.link/20230609183244.1767325-1-robh@kernel.org commit 4ca0d340ce206985d9b9956993d7c81eeb1d3198 Author: WANG Rui Date: Tue Jun 20 21:20:25 2023 +0800 perf annotate: Fix instruction association and parsing for LoongArch In the perf annotate view for LoongArch, there is no arrowed line pointing to the target from the branch instruction. This issue is caused by incorrect instruction association and parsing. $ perf record alloc-6276705c94ad1398 # rust benchmark $ perf report 0.28 │ ori $a1, $zero, 0x63 │ move $a2, $zero 10.55 │ addi.d $a3, $a2, 1(0x1) │ sltu $a4, $a3, $s7 9.53 │ masknez $a4, $s7, $a4 │ sub.d $a3, $a3, $a4 12.12 │ st.d $a1, $fp, 24(0x18) │ st.d $a3, $fp, 16(0x10) 16.29 │ slli.d $a2, $a2, 0x2 │ ldx.w $a2, $s8, $a2 12.77 │ st.w $a2, $sp, 724(0x2d4) │ st.w $s0, $sp, 720(0x2d0) 7.03 │ addi.d $a2, $sp, 720(0x2d0) │ addi.d $a1, $a1, -1(0xfff) 12.03 │ move $a2, $a3 │ → bne $a1, $s3, -52(0x3ffcc) # 82ce8 2.50 │ addi.d $a0, $a0, 1(0x1) This patch fixes instruction association issues, such as associating branch instructions with jump_ops instead of call_ops, and corrects false instruction matches. It also implements branch instruction parsing specifically for LoongArch. With this patch, we will be able to see the arrowed line. 0.79 │3ec: ori $a1, $zero, 0x63 │ move $a2, $zero 10.32 │3f4:┌─→addi.d $a3, $a2, 1(0x1) │ │ sltu $a4, $a3, $s7 10.44 │ │ masknez $a4, $s7, $a4 │ │ sub.d $a3, $a3, $a4 14.17 │ │ st.d $a1, $fp, 24(0x18) │ │ st.d $a3, $fp, 16(0x10) 13.15 │ │ slli.d $a2, $a2, 0x2 │ │ ldx.w $a2, $s8, $a2 11.00 │ │ st.w $a2, $sp, 724(0x2d4) │ │ st.w $s0, $sp, 720(0x2d0) 8.00 │ │ addi.d $a2, $sp, 720(0x2d0) │ │ addi.d $a1, $a1, -1(0xfff) 11.99 │ │ move $a2, $a3 │ └──bne $a1, $s3, 3f4 3.17 │ addi.d $a0, $a0, 1(0x1) Signed-off-by: WANG Rui Acked-by: Namhyung Kim Cc: Mark Rutland Cc: Peter Zijlstra Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Alexander Shishkin Cc: loongarch@lists.linux.dev Cc: loongson-kernel@lists.loongnix.cn Cc: Huacai Chen Cc: Tiezhu Yang Cc: Ingo Molnar Cc: WANG Xuerui Link: https://lore.kernel.org/r/20230620132025.105563-1-wangrui@loongson.cn Signed-off-by: Namhyung Kim commit 6f3bdbbeafbbcb1a6540307e4eaee10ecae4f9a5 Author: Rob Herring Date: Fri Jun 9 12:29:25 2023 -0600 macintosh: Use of_property_read_reg() to parse "reg" Use the recently added of_property_read_reg() helper to get the untranslated "reg" address value. Signed-off-by: Rob Herring Signed-off-by: Michael Ellerman Link: https://msgid.link/20230609182926.1763589-1-robh@kernel.org commit 93cfa6fb9f78f472862240208ef6e5a65f58f775 Author: Rob Herring Date: Sun Mar 19 11:32:26 2023 -0500 macintosh: Use of_address_to_resource() Replace open coded reading of "reg" and of_translate_address() calls with single call to of_address_to_resource(). Signed-off-by: Rob Herring Signed-off-by: Michael Ellerman Link: https://msgid.link/20230319163226.226583-1-robh@kernel.org commit bc1cf75027585f8d87f94e464ee5909acf885a8c Author: Rob Herring Date: Sun Mar 19 09:59:31 2023 -0500 powerpc: powermac: Use of_get_cpu_hwid() to read CPU node 'reg' Replace open coded reading of CPU nodes' "reg" properties with of_get_cpu_hwid() dedicated for this purpose. Signed-off-by: Rob Herring Signed-off-by: Michael Ellerman Link: https://msgid.link/20230319145931.65499-1-robh@kernel.org commit b751ed04bc5e1b76f2885b846ea8289792a37166 Author: Paul Gortmaker Date: Tue Jun 20 00:33:00 2023 -0400 powerpc: drop MPC85xx_CDS platform support The MPC8541/8548/8555 Configurable Development System (CDS) were the vehicle used to provide evaluation of the 1st e500-v2 CPUs around 2007. Similar to the earlier MPC83xx-MDS systems we removed, the "brains" exist on a PCI-X card, but additional connectors exist to the right of the PCI-X slot, two structural metal pins are used to provide stability in a vertical ATX mounting, and the CPU is now on a daughter-card vs. a clamped down BGA. Given the extra complexity and risk of connector damage, the 8548CDS I had access to came pre-assembled in a basic white Antec case common for that era, and I'm inclined to assume that was the default. Power was typical "Pentium4" 2005 ATX - the main 20 pin connector went to the PCI ATX form factor backplane, and the 4 pin black/yellow went to the CPU card. Like previous evaluation boards, they attempted to provide break-out connectors for as many features as possible, and that made for a fairly complex looking system. In any case, these are over 15 years old, and fairly complex systems, originally made for a small group of industry related people, and made for use where quiet fan operation wasn't important. Given that, it makes sense to remove support from them in 2023. Signed-off-by: Paul Gortmaker Signed-off-by: Michael Ellerman Link: https://msgid.link/20230620043300.197546-3-paul.gortmaker@windriver.com commit 384e338a9187e479349c97c9cfb36f6060708db8 Author: Paul Gortmaker Date: Tue Jun 20 00:32:59 2023 -0400 powerpc: drop MPC8540_ADS and MPC8560_ADS platform support Based on the revision history in the manual(s), these e500-v1 platforms were first available around 2002. Like a lot of evaluation boards, they attempted to provide break-out connectors for all possible features, and that combined with four PCI-X slots (and the age/era) meant for a considerably large board. As I recall it, from a Linux point of view, the biggest difference between 8540 and 8560 was in the UART implementation, and that is reflected in a diff of the defconfigs. In any case, these are over 20 years old, and by today's standards only have a small amount of DDR1 memory, and were not widely available. Given that, it makes sense to remove support from them in 2023. Signed-off-by: Paul Gortmaker Signed-off-by: Michael Ellerman Link: https://msgid.link/20230620043300.197546-2-paul.gortmaker@windriver.com commit e66effaf61ffb1dc6088492ca3a0e98dcbf1c10d Author: Nayna Jain Date: Thu Jun 8 08:04:44 2023 -0400 security/integrity: fix pointer to ESL data and its size on pseries On PowerVM guest, variable data is prefixed with 8 bytes of timestamp. Extract ESL by stripping off the timestamp before passing to ESL parser. Fixes: 4b3e71e9a34c ("integrity/powerpc: Support loading keys from PLPKS") Cc: stable@vger.kenrnel.org # v6.3 Signed-off-by: Nayna Jain Tested-by: Nageswara R Sastry Acked-by: Jarkko Sakkinen Signed-off-by: Michael Ellerman Link: https://msgid.link/20230608120444.382527-1-nayna@linux.ibm.com commit c8eebc4a99f15280654f23e914e746c40a516e50 Author: Aneesh Kumar K.V Date: Fri Jun 16 16:38:15 2023 +0530 powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary Without this fix, the last subsection vmemmap can end up in memory even if the namespace is created with -M mem and has sufficient space in the altmap area. Fixes: cf387d9644d8 ("libnvdimm/altmap: Track namespace boundaries in altmap") Signed-off-by: Aneesh Kumar K.V Tested-by: Sachin Sant > Signed-off-by: Michael Ellerman Link: https://msgid.link/20230616110826.344417-6-aneesh.kumar@linux.ibm.com commit d933557b858f78d7b702e70614b469a84b72e56c Author: Aneesh Kumar K.V Date: Fri Jun 16 16:38:14 2023 +0530 powerpc/book3s64/mm: Use PAGE_KERNEL instead of opencoding No functional change in this patch. Signed-off-by: Aneesh Kumar K.V Tested-by: Sachin Sant > Signed-off-by: Michael Ellerman Link: https://msgid.link/20230616110826.344417-5-aneesh.kumar@linux.ibm.com commit 0da90af431abc3f497a38ec9ef6e43b0d0dabe80 Author: Aneesh Kumar K.V Date: Fri Jun 16 16:38:13 2023 +0530 powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo On memory unplug reduce DirectMap page count correctly. root@ubuntu-guest:# grep Direct /proc/meminfo DirectMap4k: 0 kB DirectMap64k: 0 kB DirectMap2M: 115343360 kB DirectMap1G: 0 kB Before fix: root@ubuntu-guest:# ndctl disable-namespace all disabled 1 namespace root@ubuntu-guest:# grep Direct /proc/meminfo DirectMap4k: 0 kB DirectMap64k: 0 kB DirectMap2M: 115343360 kB DirectMap1G: 0 kB After fix: root@ubuntu-guest:# ndctl disable-namespace all disabled 1 namespace root@ubuntu-guest:# grep Direct /proc/meminfo DirectMap4k: 0 kB DirectMap64k: 0 kB DirectMap2M: 104857600 kB DirectMap1G: 0 kB Fixes: a2dc009afa9a ("powerpc/mm/book3s/radix: Add mapping statistics") Signed-off-by: Aneesh Kumar K.V Tested-by: Sachin Sant > Signed-off-by: Michael Ellerman Link: https://msgid.link/20230616110826.344417-4-aneesh.kumar@linux.ibm.com commit f0b6a834a8f0d267a112b150827bb65d4fdc471c Author: Paulo Alcantara Date: Mon Jun 19 19:23:13 2023 -0300 smb: client: fix warning in generic_ip_connect() This fixes the following warning reported by kernel test robot fs/smb/client/connect.c:2974 generic_ip_connect() error: we previously assumed 'socket' could be null (see line 2962) Link: https://lore.kernel.org/all/202306170124.CtQqzf0I-lkp@intel.com/ Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 215533f888dcf18f7cfbbf520bdd52e67ac6265a Author: Paulo Alcantara Date: Mon Jun 19 18:41:00 2023 -0300 smb: client: fix warning in CIFSFindNext() This fixes the following warning reported by kernel test robot fs/smb/client/cifssmb.c:4216 CIFSFindNext() warn: missing error code? 'rc' Link: https://lore.kernel.org/all/202306170124.CtQqzf0I-lkp@intel.com/ Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 032137fe136a6073dcc699ee15fa3fd05fd77f21 Author: Paulo Alcantara Date: Mon Jun 19 17:58:52 2023 -0300 smb: client: fix warning in CIFSFindFirst() This fixes the following warning reported by kernel test robot fs/smb/client/cifssmb.c:4089 CIFSFindFirst() warn: missing error code? 'rc' Link: https://lore.kernel.org/all/202306170124.CtQqzf0I-lkp@intel.com/ Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit e8eeca0bf4466ee1b196346d3a247535990cf44d Author: Steve French Date: Mon Jun 19 22:32:38 2023 -0500 smb3: do not reserve too many oplock credits There were cases reported where servers will sometimes return more credits than requested on oplock break responses, which can lead to most of the credits being allocated for oplock breaks (instead of for normal operations like read and write) if number of SMB3 requests in flight always stays above 0 (the oplock and echo credits are rebalanced when in flight requests goes down to zero). If oplock credits gets unexpectedly large (e.g. three is more than it would ever be expected to be) and in flight requests are greater than zero, then rebalance the oplock credits and regular credits (go back to reserving just one oplock credit). Signed-off-by: Steve French commit acf35d79ee8c1cce0f879efe6446cf81e5491c36 Author: Steve French Date: Mon Jun 19 20:45:33 2023 -0500 cifs: print more detail when invalidate_inode_mapping fails We had seen cases where cifs_invalidate_mapping was logging: "Could not invalidate inode ..." if invalidate_inode_pages2 fails but this message does not show what the rc is. Update the logged message to also log the return code. Suggested-by: Shyam Prasad N Reviewed-by: Shyam Prasad N Signed-off-by: Steve French commit 12c30f33cc6769bf411088a2872843c4f9ea32f9 Author: Paulo Alcantara Date: Mon Jun 19 16:24:37 2023 -0300 smb: client: fix warning in cifs_smb3_do_mount() This fixes the following warning reported by kernel test robot fs/smb/client/cifsfs.c:982 cifs_smb3_do_mount() warn: possible memory leak of 'cifs_sb' Link: https://lore.kernel.org/all/202306170124.CtQqzf0I-lkp@intel.com/ Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French commit 4cb13ff1437e21a698cae15154e75f1825f9394b Merge: f61d2d5cf1424 8c4d92e82d500 Author: Jakub Kicinski Date: Tue Jun 20 20:44:39 2023 -0700 Merge branch 'net-stmmac-dwmac-qcom-ethqos-add-support-for-emac4' Bartosz Golaszewski says: ==================== net: stmmac: dwmac-qcom-ethqos: add support for EMAC4 Extend the dwmac-qcom-ethqos driver to support EMAC4. While at it: rework the code somewhat. The bindings have been reviewed by DT maintainers. This is a sub-series of [1] with only the patches targetting the net subsystem as they can go in independently. [1] https://lore.kernel.org/lkml/20230617001644.4e093326@kernel.org/T/ ==================== Link: https://lore.kernel.org/r/20230619092402.195578-1-brgl@bgdev.pl Signed-off-by: Jakub Kicinski commit 8c4d92e82d500a65e7dba101ea38e4f3499dc428 Author: Bartosz Golaszewski Date: Mon Jun 19 11:24:02 2023 +0200 net: stmmac: dwmac-qcom-ethqos: add support for emac4 on sa8775p platforms sa8775p uses EMAC version 4, add the relevant defines, rename the has_emac3 switch to has_emac_ge_3 (has emac greater-or-equal than 3) and add the new compatible. Signed-off-by: Bartosz Golaszewski Signed-off-by: Jakub Kicinski commit d0e3d29f8771068a6f8df2a148080c449bc5b046 Author: Bartosz Golaszewski Date: Mon Jun 19 11:24:01 2023 +0200 dt-bindings: net: qcom,ethqos: add description for sa8775p Add the compatible for the MAC controller on sa8775p platforms. This MAC works with a single interrupt so add minItems to the interrupts property. The fourth clock's name is different here so change it. Enable relevant PHY properties. Add the relevant compatibles to the binding document for snps,dwmac as well. Signed-off-by: Bartosz Golaszewski Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jakub Kicinski commit aa571b6275fb60da443c490ebeef021a6897d332 Author: Bartosz Golaszewski Date: Mon Jun 19 11:24:00 2023 +0200 net: stmmac: add new switch to struct plat_stmmacenet_data On some platforms, the PCS can be integrated in the MAC so the driver will not see any PCS link activity. Add a switch that allows the platform drivers to let the core code know. Signed-off-by: Bartosz Golaszewski Reviewed-by: Jose Abreu Signed-off-by: Jakub Kicinski commit 463120c31c58bbca0237dd6ae73d20f77609c749 Author: Bartosz Golaszewski Date: Mon Jun 19 11:23:59 2023 +0200 net: stmmac: dwmac-qcom-ethqos: add support for SGMII On sa8775p the MAC is connected to the external PHY over SGMII so add support for it to the driver. Signed-off-by: Bartosz Golaszewski Signed-off-by: Jakub Kicinski commit 25c4a0769443d77c74fe73c80a978e28b08dc976 Author: Bartosz Golaszewski Date: Mon Jun 19 11:23:58 2023 +0200 net: stmmac: dwmac-qcom-ethqos: prepare the driver for more PHY modes In preparation for supporting SGMII, let's make the code a bit more generic. Add a new callback for MAC configuration so that we can assign a different variant of it in the future. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andrew Halaney Signed-off-by: Jakub Kicinski commit feeb27165c46c1956c9ee002d306a2ed196fa5f0 Author: Bartosz Golaszewski Date: Mon Jun 19 11:23:57 2023 +0200 net: stmmac: dwmac-qcom-ethqos: add support for the phyaux clock On sa8775p, the EMAC revision is 4 and we use SGMII instead of RGMII. There's no "rgmii" clock but there's a fourth clock under a different name: "phyaux". Add a new field to the chip data struct that specifies the link clock name. Default to "rgmii" for backward compatibility. Signed-off-by: Bartosz Golaszewski Signed-off-by: Jakub Kicinski commit 0dec3b48aa4edb653ba8ed8a62970bc0698f5bc1 Author: Bartosz Golaszewski Date: Mon Jun 19 11:23:56 2023 +0200 net: stmmac: dwmac-qcom-ethqos: add support for the optional serdes phy On sa8775p platforms, there's a SGMII SerDes PHY between the MAC and external PHY that we need to enable and configure. Signed-off-by: Bartosz Golaszewski Signed-off-by: Jakub Kicinski commit f2b1758554eb026939407ed03e38dd5d43978cb4 Author: Bartosz Golaszewski Date: Mon Jun 19 11:23:55 2023 +0200 net: stmmac: dwmac-qcom-ethqos: remove stray space There's an unnecessary space in the rgmii_updatel() function, remove it. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andrew Halaney Signed-off-by: Jakub Kicinski commit 97f73bc59e1620c70635be68ab7ee91779bdf03e Author: Bartosz Golaszewski Date: Mon Jun 19 11:23:54 2023 +0200 net: stmmac: dwmac-qcom-ethqos: add a newline between headers Typically we use a newline between global and local headers so add it here as well. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andrew Halaney Signed-off-by: Jakub Kicinski commit ee8dacca2fd3ff437b787f83fb569197a89894fd Author: Bartosz Golaszewski Date: Mon Jun 19 11:23:53 2023 +0200 net: stmmac: dwmac-qcom-ethqos: add missing include device_get_phy_mode() is declared in linux/property.h but this header is not included. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andrew Halaney Signed-off-by: Jakub Kicinski commit 302555a0ae3362b38eddd1df9b8d4b176050fc92 Author: Bartosz Golaszewski Date: Mon Jun 19 11:23:52 2023 +0200 net: stmmac: dwmac-qcom-ethqos: use a helper variable for &pdev->dev Shrink code and avoid line breaks by using a helper variable for &pdev->dev. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andrew Halaney Signed-off-by: Jakub Kicinski commit 7b5e64a9382528d5e3db0fe714b03090a4b1433b Author: Bartosz Golaszewski Date: Mon Jun 19 11:23:51 2023 +0200 net: stmmac: dwmac-qcom-ethqos: tweak the order of local variables Make sure we follow the reverse-xmas tree convention. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andrew Halaney Signed-off-by: Jakub Kicinski commit 9bc580609139cfc1f559cdc4bfb2f4862b38503d Author: Bartosz Golaszewski Date: Mon Jun 19 11:23:50 2023 +0200 net: stmmac: dwmac-qcom-ethqos: rename a label in probe() The err_mem label's name is unclear. It actually should be reached on any error after stmmac_probe_config_dt() succeeds. Name it after the cleanup action that needs to be called before exiting. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andrew Halaney Signed-off-by: Jakub Kicinski commit 9fc68f23a6d3729ccbeb6ca7da6de0bc399f9ddb Author: Bartosz Golaszewski Date: Mon Jun 19 11:23:49 2023 +0200 net: stmmac: dwmac-qcom-ethqos: shrink clock code with devres We can use a devm action to completely drop the remove callback and use stmmac_pltfr_remove() directly for remove. We can also drop one of the goto labels. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andrew Halaney Signed-off-by: Jakub Kicinski commit f61d2d5cf142436cd1a02ddc78425e91116b8b0d Author: Arnd Bergmann Date: Mon Jun 19 11:12:10 2023 +0200 sfc: fix uninitialized variable use The new efx_bind_neigh() function contains a broken code path when IPV6 is disabled: drivers/net/ethernet/sfc/tc_encap_actions.c:144:7: error: variable 'n' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized] if (encap->type & EFX_ENCAP_FLAG_IPV6) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/sfc/tc_encap_actions.c:184:8: note: uninitialized use occurs here if (!n) { ^ drivers/net/ethernet/sfc/tc_encap_actions.c:144:3: note: remove the 'if' if its condition is always false if (encap->type & EFX_ENCAP_FLAG_IPV6) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/net/ethernet/sfc/tc_encap_actions.c:141:22: note: initialize the variable 'n' to silence this warning struct neighbour *n; ^ = NULL Change it to use the existing error handling path here. Fixes: 7e5e7d800011a ("sfc: neighbour lookup for TC encap action offload") Suggested-by: Edward Cree Signed-off-by: Arnd Bergmann Reviewed-by: Edward Cree Link: https://lore.kernel.org/r/20230619091215.2731541-2-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 40cba83370c2c97fd970cb0e273e76f99f0f2db6 Author: Arnd Bergmann Date: Mon Jun 19 11:12:09 2023 +0200 sfc: add CONFIG_INET dependency for TC offload The driver now fails to link when CONFIG_INET is disabled, so add an explicit Kconfig dependency: ld.lld: error: undefined symbol: ip_route_output_flow >>> referenced by tc_encap_actions.c >>> drivers/net/ethernet/sfc/tc_encap_actions.o:(efx_tc_flower_create_encap_md) in archive vmlinux.a ld.lld: error: undefined symbol: ip_send_check >>> referenced by tc_encap_actions.c >>> drivers/net/ethernet/sfc/tc_encap_actions.o:(efx_gen_encap_header) in archive vmlinux.a >>> referenced by tc_encap_actions.c >>> drivers/net/ethernet/sfc/tc_encap_actions.o:(efx_gen_encap_header) in archive vmlinux.a ld.lld: error: undefined symbol: arp_tbl >>> referenced by tc_encap_actions.c >>> drivers/net/ethernet/sfc/tc_encap_actions.o:(efx_tc_netevent_event) in archive vmlinux.a >>> referenced by tc_encap_actions.c >>> drivers/net/ethernet/sfc/tc_encap_actions.o:(efx_tc_netevent_event) in archive vmlinux.a Fixes: a1e82162af0b8 ("sfc: generate encap headers for TC offload") Reviewed-by: Edward Cree Reviewed-by: Simon Horman Closes: https://lore.kernel.org/oe-kbuild-all/202306151656.yttECVTP-lkp@intel.com/ Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20230619091215.2731541-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit b7c31ccd60d1df4634670e3eb9902baa19b9517b Author: Andrew Lunn Date: Tue Jun 20 00:03:32 2023 +0200 net: phy-c45: Fix genphy_c45_ethtool_set_eee description The text has been cut/paste from genphy_c45_ethtool_get_eee but not changed to reflect it performs set. Additionally, extend the comment. This function implements the logic that eee_enabled has global control over EEE. When eee_enabled is false, no link modes will be advertised, and as a result, the MAC should not transmit LPI. Signed-off-by: Andrew Lunn Link: https://lore.kernel.org/r/20230619220332.4038924-1-andrew@lunn.ch Signed-off-by: Jakub Kicinski commit 634236b34d7a8c9e11c12b0746b83b8942fc8f2e Author: Eric Dumazet Date: Mon Jun 19 12:43:35 2023 +0000 net: remove sk_is_ipmr() and sk_is_icmpv6() helpers Blamed commit added these helpers for sake of detecting RAW sockets specific ioctl. syzbot complained about it [1]. Issue here is that RAW sockets could pretend there was no need to call ipmr_sk_ioctl() Regardless of inet_sk(sk)->inet_num, we must be prepared for ipmr_ioctl() being called later. This must happen from ipmr_sk_ioctl() context only. We could add a safety check in ipmr_ioctl() at the risk of breaking applications. Instead, remove sk_is_ipmr() and sk_is_icmpv6() because their name would be misleading, once we change their implementation. [1] BUG: KASAN: stack-out-of-bounds in ipmr_ioctl+0xb12/0xbd0 net/ipv4/ipmr.c:1654 Read of size 4 at addr ffffc90003aefae4 by task syz-executor105/5004 CPU: 0 PID: 5004 Comm: syz-executor105 Not tainted 6.4.0-rc6-syzkaller-01304-gc08afcdcf952 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351 print_report mm/kasan/report.c:462 [inline] kasan_report+0x11c/0x130 mm/kasan/report.c:572 ipmr_ioctl+0xb12/0xbd0 net/ipv4/ipmr.c:1654 raw_ioctl+0x4e/0x1e0 net/ipv4/raw.c:881 sock_ioctl_out net/core/sock.c:4186 [inline] sk_ioctl+0x151/0x440 net/core/sock.c:4214 inet_ioctl+0x18c/0x380 net/ipv4/af_inet.c:1001 sock_do_ioctl+0xcc/0x230 net/socket.c:1189 sock_ioctl+0x1f8/0x680 net/socket.c:1306 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f2944bf6ad9 Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd8897a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2944bf6ad9 RDX: 0000000000000000 RSI: 00000000000089e1 RDI: 0000000000000003 RBP: 00007f2944bbac80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f2944bbad10 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 The buggy address belongs to stack of task syz-executor105/5004 and is located at offset 36 in frame: sk_ioctl+0x0/0x440 net/core/sock.c:4172 This frame has 2 objects: [32, 36) 'karg' [48, 88) 'buffer' Fixes: e1d001fa5b47 ("net: ioctl: Use kernel memory on protocol ioctl callbacks") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Breno Leitao Cc: Kuniyuki Iwashima Reviewed-by: Jiri Pirko Reviewed-by: David Ahern Reviewed-by: Willem de Bruijn Link: https://lore.kernel.org/r/20230619124336.651528-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3a4f0edbb7939a16abb54668642ceed1decdbf4a Author: Eric Dumazet Date: Mon Jun 19 07:27:40 2023 +0000 ipv6: fix a typo in ip6mr_sk_ioctl() SIOCGETSGCNT_IN6 uses a "struct sioc_sg_req6 buffer". Unfortunately the blamed commit made hard to ensure type safety. syzbot reported: BUG: KASAN: stack-out-of-bounds in ip6mr_ioctl+0xba3/0xcb0 net/ipv6/ip6mr.c:1917 Read of size 16 at addr ffffc900039afb68 by task syz-executor937/5008 CPU: 1 PID: 5008 Comm: syz-executor937 Not tainted 6.4.0-rc6-syzkaller-01304-gc08afcdcf952 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351 print_report mm/kasan/report.c:462 [inline] kasan_report+0x11c/0x130 mm/kasan/report.c:572 ip6mr_ioctl+0xba3/0xcb0 net/ipv6/ip6mr.c:1917 rawv6_ioctl+0x4e/0x1e0 net/ipv6/raw.c:1143 sock_ioctl_out net/core/sock.c:4186 [inline] sk_ioctl+0x151/0x440 net/core/sock.c:4214 inet6_ioctl+0x1b8/0x290 net/ipv6/af_inet6.c:582 sock_do_ioctl+0xcc/0x230 net/socket.c:1189 sock_ioctl+0x1f8/0x680 net/socket.c:1306 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f255849bad9 Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd06792778 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f255849bad9 RDX: 0000000000000000 RSI: 00000000000089e1 RDI: 0000000000000003 RBP: 00007f255845fc80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f255845fd10 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 The buggy address belongs to stack of task syz-executor937/5008 and is located at offset 40 in frame: sk_ioctl+0x0/0x440 net/core/sock.c:4172 This frame has 2 objects: [32, 36) 'karg' [48, 88) 'buffer' Fixes: e1d001fa5b47 ("net: ioctl: Use kernel memory on protocol ioctl callbacks") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Cc: David Ahern Cc: Kuniyuki Iwashima Reviewed-by: Breno Leitao Link: https://lore.kernel.org/r/20230619072740.464528-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 365eb32e4b456064aea4db61adc0a65b8a09bc80 Author: Ratheesh Kannoth Date: Mon Jun 19 11:36:38 2023 +0530 octeontx2-pf: TC flower offload support for rxqueue mapping TC rule support to offload rx queue mapping rules. Eg: tc filter add dev eth2 ingress protocol ip flower \ dst_ip 192.168.8.100 \ action skbedit queue_mapping 4 skip_sw action mirred ingress redirect dev eth5 Packets destined to 192.168.8.100 will be forwarded to rx queue 4 of eth5 interface. tc filter add dev eth2 ingress protocol ip flower \ dst_ip 192.168.8.100 \ action skbedit queue_mapping 9 skip_sw Packets destined to 192.168.8.100 will be forwarded to rx queue 4 of eth2 interface. Signed-off-by: Ratheesh Kannoth Link: https://lore.kernel.org/r/20230619060638.1032304-1-rkannoth@marvell.com Signed-off-by: Jakub Kicinski commit f0d952646bcf186d6d1bea6ec89f96b7e57f3b83 Author: Christophe JAILLET Date: Sun Jun 18 12:16:41 2023 +0200 netlabel: Reorder fields in 'struct netlbl_domaddr6_map' Group some variables based on their sizes to reduce hole and avoid padding. On x86_64, this shrinks the size of 'struct netlbl_domaddr6_map' from 72 to 64 bytes. It saves a few bytes of memory and is more cache-line friendly. Signed-off-by: Christophe JAILLET Reviewed-by: Simon Horman Reviewed-by: Jiri Pirko Acked-by: Paul Moore Link: https://lore.kernel.org/r/aa109847260e51e174c823b6d1441f75be370f01.1687083361.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit 92b08290859b09a2ead2dc553aaaadb015748536 Author: Christophe JAILLET Date: Sun Jun 18 11:46:46 2023 +0200 mptcp: Reorder fields in 'struct mptcp_pm_add_entry' Group some variables based on their sizes to reduce hole and avoid padding. On x86_64, this shrinks the size of 'struct mptcp_pm_add_entry' from 136 to 128 bytes. It saves a few bytes of memory and is more cache-line friendly. Signed-off-by: Christophe JAILLET Reviewed-by: Matthieu Baerts Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/e47b71de54fd3e580544be56fc1bb2985c77b0f4.1687081558.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit 066768b7305b1524d261fdc543d25fd60d955254 Author: Christophe JAILLET Date: Sun Jun 18 11:33:55 2023 +0200 mctp: Reorder fields in 'struct mctp_route' Group some variables based on their sizes to reduce hole and avoid padding. On x86_64, this shrinks the size of 'struct mctp_route' from 72 to 64 bytes. It saves a few bytes of memory and is more cache-line friendly. Signed-off-by: Christophe JAILLET Reviewed-by: Simon Horman Acked-by: Jeremy Kerr Reviewed-by: Jiri Pirko Link: https://lore.kernel.org/r/393ad1a5aef0aa28d839eeb3d7477da0e0eeb0b0.1687080803.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit 1afc383a17001b93fd1e5c749b0f6a668412b85b Merge: 9bd1f9dbbf9b3 1f1ef7e5bbe2d Author: Mark Brown Date: Wed Jun 21 01:32:31 2023 +0100 ASoC: Merge up fixes for CI Some of the fixes merged should be relevant for my CI stability. commit 970ebb8a26a120340dcbb4e6c2fb4ecfbad0d190 Author: Alexander Mikhalitsyn Date: Wed May 3 08:43:44 2023 +0200 SafeSetID: fix UID printed instead of GID pr_warn message clearly says that GID should be printed, but we have UID there. Let's fix that. Found accidentally during the work on isolated user namespaces. Signed-off-by: Alexander Mikhalitsyn [PM: fix spelling errors in description, subject tweak] Signed-off-by: Paul Moore commit 2e9f9d4a729f12b4bc3fa60406374327b1809abe Author: Ian Rogers Date: Wed Jun 14 21:07:15 2023 -0700 perf annotation: Switch lock from a mutex to a sharded_mutex Remove the "struct mutex lock" variable from annotation that is allocated per symbol. This removes in the region of 40 bytes per symbol allocation. Use a sharded mutex where the number of shards is set to the number of CPUs. Assuming good hashing of the annotation (done based on the pointer), this means in order to contend there needs to be more threads than CPUs, which is not currently true in any perf command. Were contention an issue it is straightforward to increase the number of shards in the mutex. On my Debian/glibc based machine, this reduces the size of struct annotation from 136 bytes to 96 bytes, or nearly 30%. Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Andres Freund Cc: Mark Rutland Cc: Yuan Can Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Huacai Chen Cc: Jiri Olsa Cc: Masami Hiramatsu Cc: Alexander Shishkin Cc: Kan Liang Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230615040715.2064350-2-irogers@google.com Signed-off-by: Namhyung Kim commit 0650b2b2e62edfa9510ba0c80f42d98c4a748b12 Author: Ian Rogers Date: Wed Jun 14 21:07:14 2023 -0700 perf sharded_mutex: Introduce sharded_mutex Per object mutexes may come with significant memory cost while a global mutex can suffer from unnecessary contention. A sharded mutex is a compromise where objects are hashed and then a particular mutex for the hash of the object used. Contention can be controlled by the number of shards. v2. Use hashmap.h's hash_bits in case of contention from alignment of objects. Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Andres Freund Cc: Mark Rutland Cc: Yuan Can Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Huacai Chen Cc: Jiri Olsa Cc: Masami Hiramatsu Cc: Alexander Shishkin Cc: Kan Liang Cc: Ingo Molnar Link: https://lore.kernel.org/r/20230615040715.2064350-1-irogers@google.com Signed-off-by: Namhyung Kim commit 5e37ef5c2a5303d41842b8277770064632533318 Author: Li Dong Date: Mon Jun 19 16:20:10 2023 +0800 tools: Fix incorrect calculation of object size by sizeof What we need to calculate is the size of the object, not the size of the pointer. Fixed: 51cfe7a3e87e ("perf python: Avoid 2 leak sanitizer issues") Signed-off-by: Li Dong Acked-by: Namhyung Kim Cc: Mark Rutland Cc: Ian Rogers Cc: Sean Christopherson Cc: Peter Zijlstra Cc: Adrian Hunter Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Alexander Shishkin Cc: Ingo Molnar Cc: opensource.kernel@vivo.com Link: https://lore.kernel.org/r/20230619082036.410-1-lidong@vivo.com Signed-off-by: Namhyung Kim commit 9bd1f9dbbf9b395e0f18661850fc923d129729af Merge: 3067e020d361e 198c93e2fc0b7 Author: Mark Brown Date: Wed Jun 21 00:56:07 2023 +0100 ASoC: amd: ps: add SoundWire support Merge series from Vijendar Mukunda : This patch series add support for - Platform device creation for SoundWire Manager instances and PDM controller. - SoundWire DMA driver. - Interrupt handling for SoundWire manager related interrupts, SoundWire DMA interrupts and ACP error interrupts. - ACP PCI driver PM ops modification with respect to SoundWire Power modes. commit 3067e020d361ed346957eb5e253911f7a3e18f59 Merge: 0a08778126284 0baa2c3abc525 Author: Mark Brown Date: Wed Jun 21 00:56:00 2023 +0100 add snd_soc_{of_}get_dlc() Merge series from Kuninori Morimoto : Current soc-core.c has snd_soc_{of_}get_dai_name() to get DAI name for dlc (snd_soc_dai_link_component). It gets .dai_name, but we need .of_node too. Therefor user need to arrange. It will be more useful if it gets both .dai_name and .of_node. This patch adds snd_soc_{of_}get_dlc() for it, and convert to use it. commit 53fc25b7f557089aff101235152ae4bff15c428a Author: Chenyuan Mi Date: Wed Jun 14 08:01:18 2023 -0700 perf subcmd: Fix missing check for return value of malloc() in add_cmdname() The malloc() function may return NULL when it fails, which may cause null pointer deference in add_cmdname(), add Null check for return value of malloc(). Found by our static analysis tool. Signed-off-by: Chenyuan Mi Acked-by: Ian Rogers Cc: Leo Yan Cc: Arnaldo Carvalho de Melo Cc: linux-kernel@vger.kernel.org Link: https://lore.kernel.org/r/20230614150118.115208-1-cymi20@fudan.edu.cn Signed-off-by: Namhyung Kim commit 240de691dd6684d15f63613aa7fbc64e6098d6c9 Author: baomingtong001@208suo.com Date: Wed Jun 14 16:13:53 2023 +0800 perf parse-events: Remove unneeded semicolon ./tools/perf/util/parse-events.c:1466:2-3: Unneeded semicolon Signed-off-by: Mingtong Bao Link: https://lore.kernel.org/r/2c733a91717eae93119ba2226420fd8f@208suo.com Signed-off-by: Namhyung Kim commit bc06026d1420e006503c69dc6829cc45590db106 Author: Yang Jihong Date: Fri Jun 16 02:45:15 2023 +0000 perf parse: Add missing newline to pr_debug message in evsel__compute_group_pmu_name() The newline is missing for pr_debug message in evsel__compute_group_pmu_name(), fix it. Before: # perf --debug verbose=2 record -e cpu-clock true No PMU found for 'cycles:u'No PMU found for 'instructions:u'------------------------------------------------------------ perf_event_attr: type 1 size 136 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|PERIOD read_format ID|LOST disabled 1 inherit 1 mmap 1 comm 1 freq 1 enable_on_exec 1 task 1 sample_id_all 1 exclude_guest 1 mmap2 1 comm_exec 1 ksymbol 1 bpf_event 1 ------------------------------------------------------------ After: # perf --debug verbose=2 record -e cpu-clock true No PMU found for 'cycles:u' No PMU found for 'instructions:u' ------------------------------------------------------------ perf_event_attr: type 1 size 136 { sample_period, sample_freq } 4000 sample_type IP|TID|TIME|PERIOD read_format ID|LOST disabled 1 inherit 1 mmap 1 comm 1 freq 1 enable_on_exec 1 task 1 sample_id_all 1 exclude_guest 1 mmap2 1 comm_exec 1 ksymbol 1 bpf_event 1 ------------------------------------------------------------ Signed-off-by: Yang Jihong Acked-by: Namhyung Kim Cc: mark.rutland@arm.com Cc: irogers@google.com Cc: peterz@infradead.org Cc: adrian.hunter@intel.com Cc: acme@kernel.org Cc: jolsa@kernel.org Cc: alexander.shishkin@linux.intel.com Cc: kan.liang@linux.intel.com Cc: mingo@redhat.com Cc: linux-kernel@vger.kernel.org Cc: linux-perf-users@vger.kernel.org Link: https://lore.kernel.org/r/20230616024515.80814-1-yangjihong1@huawei.com Signed-off-by: Namhyung Kim commit 2a541abd98370f9931c889c187eef7458720b57b Author: Konrad Dybcio Date: Mon Jun 19 18:13:18 2023 +0200 clk: qcom: gcc-sc8280xp: Add runtime PM The GCC block on SC8280XP is powered by the CX rail. We need to ensure that it's enabled to prevent unwanted power collapse. Enable runtime PM to keep the power flowing only when necessary. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230619-topic-sc8280xp-clk-rpm-v1-2-1e5e1064cdb2@linaro.org Signed-off-by: Bjorn Andersson commit 9bbcb892a7cd06c8156e6de211a8d7d45ee48086 Author: Konrad Dybcio Date: Mon Jun 19 18:13:17 2023 +0200 clk: qcom: gpucc-sc8280xp: Add runtime PM The GPU_CC block on SC8280XP is powered by the GFX rail. We need to ensure that it's enabled to prevent unwanted power collapse. Enable runtime PM to keep the power flowing only when necessary. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20230619-topic-sc8280xp-clk-rpm-v1-1-1e5e1064cdb2@linaro.org Signed-off-by: Bjorn Andersson commit db1f5f1038a2df67f549e2657f56327e28127c27 Author: Yang Jihong Date: Wed Jun 14 02:15:05 2023 +0000 perf stat: Add missing newline in pr_err messages The newline is missing for error messages in add_default_attributes() Before: # perf stat --topdown Topdown requested but the topdown metric groups aren't present. (See perf list the metric groups have names like TopdownL1)# After: # perf stat --topdown Topdown requested but the topdown metric groups aren't present. (See perf list the metric groups have names like TopdownL1) # In addition, perf_stat_init_aggr_mode() and perf_stat_init_aggr_mode_file() have the same problem, fixed by the way. Signed-off-by: Yang Jihong Acked-by: Ian Rogers Reviewed-by: James Clark Link: https://lore.kernel.org/r/20230614021505.59856-1-yangjihong1@huawei.com Signed-off-by: Namhyung Kim commit 6009177fd9ec7b5ca9b93ecdbadd4bc7e9c48141 Author: Donglin Peng Date: Sat Apr 8 05:42:22 2023 -0700 selftests/ftrace: Add funcgraph-retval test case Add a test case for the funcgraph-retval and funcgraph-retval-hex trace options. Link: https://lkml.kernel.org/r/9fedbd25e63f012cade5dad13be21225fec2fb5d.1680954589.git.pengdonglin@sangfor.com.cn Signed-off-by: Donglin Peng Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 5779e3c0f5aed8a3239839ad55ad017e1278ecd7 Author: Donglin Peng Date: Sat Apr 8 05:42:21 2023 -0700 LoongArch: ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL The previous patch ("function_graph: Support recording and printing the return value of function") has laid the groundwork for the for the funcgraph-retval, and this modification makes it available on the LoongArch platform. We introduce a new structure called fgraph_ret_regs for the LoongArch platform to hold return registers and the frame pointer. We then fill its content in the return_to_handler and pass its address to the function ftrace_return_to_handler to record the return value. Link: https://lkml.kernel.org/r/c5462255e435fab363895c2d7433bc0f5a140411.1680954589.git.pengdonglin@sangfor.com.cn Reviewed-by: Huacai Chen Signed-off-by: Donglin Peng Signed-off-by: Steven Rostedt (Google) commit d938ba17683effd95b44400d30df16fe541f40fd Author: Donglin Peng Date: Sat Apr 8 05:42:20 2023 -0700 x86/ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL The previous patch ("function_graph: Support recording and printing the return value of function") has laid the groundwork for the for the funcgraph-retval, and this modification makes it available on the x86 platform. We introduce a new structure called fgraph_ret_regs for the x86 platform to hold return registers and the frame pointer. We then fill its content in the return_to_handler and pass its address to the function ftrace_return_to_handler to record the return value. Link: https://lkml.kernel.org/r/53a506f0f18ff4b7aeb0feb762f1c9a5e9b83ee9.1680954589.git.pengdonglin@sangfor.com.cn Signed-off-by: Donglin Peng Signed-off-by: Steven Rostedt (Google) commit 3646970322464c21e69dcb9a2e37d461c5834bf5 Author: Donglin Peng Date: Sat Apr 8 05:42:18 2023 -0700 arm64: ftrace: Enable HAVE_FUNCTION_GRAPH_RETVAL The previous patch ("function_graph: Support recording and printing the return value of function") has laid the groundwork for the for the funcgraph-retval, and this modification makes it available on the ARM64 platform. We introduce a new structure called fgraph_ret_regs for the ARM64 platform to hold return registers and the frame pointer. We then fill its content in the return_to_handler and pass its address to the function ftrace_return_to_handler to record the return value. Link: https://lkml.kernel.org/r/c78366416ce93f704ae7000c4ee60eb4258c38f7.1680954589.git.pengdonglin@sangfor.com.cn Reviewed-by: Mark Rutland Tested-by: Mark Rutland Acked-by: Catalin Marinas Signed-off-by: Donglin Peng Signed-off-by: Steven Rostedt (Google) commit 21c094d3f8a6c88dedbd9831631a263d5c49775f Author: Donglin Peng Date: Sat Apr 8 05:42:16 2023 -0700 tracing: Add documentation for funcgraph-retval and funcgraph-retval-hex Add documentation for the two newly introduced options for the function_graph tracer. The funcgraph-retval option is used to control whether or not to display the return value, while the funcgraph-retval-hex option is used to control the display format of the return value. Link: https://lkml.kernel.org/r/2b5635f05146161b54c9ea6307e25efe5ccebdad.1680954589.git.pengdonglin@sangfor.com.cn Acked-by: Masami Hiramatsu (Google) Signed-off-by: Donglin Peng Signed-off-by: Steven Rostedt (Google) commit a1be9ccc57f07d54278be34eed6bd679bc941c97 Author: Donglin Peng Date: Sat Apr 8 05:42:15 2023 -0700 function_graph: Support recording and printing the return value of function Analyzing system call failures with the function_graph tracer can be a time-consuming process, particularly when locating the kernel function that first returns an error in the trace logs. This change aims to simplify the process by recording the function return value to the 'retval' member of 'ftrace_graph_ret' and printing it when outputting the trace log. We have introduced new trace options: funcgraph-retval and funcgraph-retval-hex. The former controls whether to display the return value, while the latter controls the display format. Please note that even if a function's return type is void, a return value will still be printed. You can simply ignore it. This patch only establishes the fundamental infrastructure. Subsequent patches will make this feature available on some commonly used processor architectures. Here is an example: I attempted to attach the demo process to a cpu cgroup, but it failed: echo `pidof demo` > /sys/fs/cgroup/cpu/test/tasks -bash: echo: write error: Invalid argument The strace logs indicate that the write system call returned -EINVAL(-22): ... write(1, "273\n", 4) = -1 EINVAL (Invalid argument) ... To capture trace logs during a write system call, use the following commands: cd /sys/kernel/debug/tracing/ echo 0 > tracing_on echo > trace echo *sys_write > set_graph_function echo *spin* > set_graph_notrace echo *rcu* >> set_graph_notrace echo *alloc* >> set_graph_notrace echo preempt* >> set_graph_notrace echo kfree* >> set_graph_notrace echo $$ > set_ftrace_pid echo function_graph > current_tracer echo 1 > options/funcgraph-retval echo 0 > options/funcgraph-retval-hex echo 1 > tracing_on echo `pidof demo` > /sys/fs/cgroup/cpu/test/tasks echo 0 > tracing_on cat trace > ~/trace.log To locate the root cause, search for error code -22 directly in the file trace.log and identify the first function that returned -22. Once you have identified this function, examine its code to determine the root cause. For example, in the trace log below, cpu_cgroup_can_attach returned -22 first, so we can focus our analysis on this function to identify the root cause. ... 1) | cgroup_migrate() { 1) 0.651 us | cgroup_migrate_add_task(); /* = 0xffff93fcfd346c00 */ 1) | cgroup_migrate_execute() { 1) | cpu_cgroup_can_attach() { 1) | cgroup_taskset_first() { 1) 0.732 us | cgroup_taskset_next(); /* = 0xffff93fc8fb20000 */ 1) 1.232 us | } /* cgroup_taskset_first = 0xffff93fc8fb20000 */ 1) 0.380 us | sched_rt_can_attach(); /* = 0x0 */ 1) 2.335 us | } /* cpu_cgroup_can_attach = -22 */ 1) 4.369 us | } /* cgroup_migrate_execute = -22 */ 1) 7.143 us | } /* cgroup_migrate = -22 */ ... Link: https://lkml.kernel.org/r/1fc502712c981e0e6742185ba242992170ac9da8.1680954589.git.pengdonglin@sangfor.com.cn Tested-by: Florian Kauer Acked-by: Masami Hiramatsu (Google) Signed-off-by: Donglin Peng Signed-off-by: Steven Rostedt (Google) commit f3d40e6545594c22733d091c5ec6b8ff345cbd57 Author: Steven Rostedt (Google) Date: Tue Jun 20 18:34:55 2023 -0400 fgraph: Add declaration of "struct fgraph_ret_regs" In final testing of: https://patchwork.kernel.org/project/linux-trace-kernel/patch/1fc502712c981e0e6742185ba242992170ac9da8.1680954589.git.pengdonglin@sangfor.com.cn/ "function_graph: Support recording and printing the return value of function" The test failed due to a new warning found in the build: kernel/trace/fgraph.c:243:56: warning: ‘struct fgraph_ret_regs’ declared inside parameter list will not be visible outside of this definition or declaration Instead of asking to send another patch series, just add it and then apply the updates. Signed-off-by: Steven Rostedt (Google) commit 198c93e2fc0b74ae520393118d7cb02762c04bf3 Author: Vijendar Mukunda Date: Mon Jun 12 15:29:03 2023 +0530 ASoC: amd: ps: add acp_reset flag check in acp pci driver pm ops. AMD SoundWire manager supports different power modes. acp_reset flag will be set to false only when SoundWire manager power mode is selected as ClockStop Mode. For rest of the combinations (ACP PDM + SDW), acp_reset flag will be set to true. When acp_reset flag is set, acp de-init and acp init sequence should be invoked during suspend/resume callbacks. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230612095903.2113464-10-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 6e8f7cb4cbae8e2b03190d26674a14be22d7df53 Author: Vijendar Mukunda Date: Mon Jun 12 15:29:02 2023 +0530 ASoC: amd: update comments in Kconfig file Update comments in Kconfig file for Pink Sardine platform. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230612095903.2113464-9-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 7b33594130405cbcfdef2a4c582f9c67aef8d292 Author: Vijendar Mukunda Date: Mon Jun 12 15:29:01 2023 +0530 ASoC: amd: ps: enable SoundWire dma driver build Enable SoundWire dma driver build for PS platform. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230612095903.2113464-8-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 5a06c3ac4cf9a8ca5edf99a07a1129ae25ab581e Author: Vijendar Mukunda Date: Mon Jun 12 15:29:00 2023 +0530 ASoC: amd: ps: add pm ops support for SoundWire dma driver Add support pm ops support for SoundWire dma driver. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230612095903.2113464-7-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 298d4f7b176538d41356d145c044442b8456a14e Author: Vijendar Mukunda Date: Mon Jun 12 15:28:59 2023 +0530 ASoC: amd: ps: add support for SoundWire DMA interrupts Move to request_threaded_irq and use thread for handling SoundWire DMA interrupts. Whenever audio data equal to the SoundWire FIFO watermark level are produced/consumed, interrupt is generated. Acknowledge the interrupt and wake up the irq thread. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230612095903.2113464-6-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit f722917350ee0b802a62d888f4e8b23bd5f1f641 Author: Vijendar Mukunda Date: Mon Jun 12 15:28:58 2023 +0530 ASoC: amd: ps: add SoundWire dma driver dma ops Add SoundWire DMA driver dma ops for Pink Sardine platform. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230612095903.2113464-5-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 665dd181a97ff9588060f76887c3b61fd4ccb8b0 Author: Vijendar Mukunda Date: Mon Jun 12 15:28:57 2023 +0530 ASoC: amd: ps: add SoundWire dma driver SoundWire DMA platform driver binds to the platform device created by ACP PCI device. SoundWire DMA driver registers ALSA DMA component with ASoC framework. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230612095903.2113464-4-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit e1cb350610ce88d9995b8b287930d3ba821d9f2b Author: Vijendar Mukunda Date: Mon Jun 12 15:28:56 2023 +0530 ASoC: amd: ps: handle SoundWire interrupts in acp pci driver Handle SoundWire manager related interrupts in ACP PCI driver interrupt handler and schedule SoundWire manager work queue for further processing. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230612095903.2113464-3-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit d1351c30ac8a6cf61b0bbe9fcbc8d2851cd44f3c Author: Vijendar Mukunda Date: Mon Jun 12 15:28:55 2023 +0530 ASoC: amd: ps: create platform devices based on acp config Based on ACP pin configuration and scanning child devices under ACP pci device ACPI scope, platform device configuration (pdev_config) and platform device count(pdev_count) will be calculated. Using pdev_config and pdev_count values, ACP PCI driver will create platform devices for Pink Sardine platform. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20230612095903.2113464-2-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit d8ece8b832276756d32c310fdd76835f8046071a Merge: d704f1fe9f4a4 2bd9e07140ae7 Author: Arnd Bergmann Date: Tue Jun 20 23:06:54 2023 +0200 Merge tag 'riscv-dt-for-v6.5-pt2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/dt RISC-V Devicetrees for v6.5 Part 2 T-Head: Add a basic dtsi, Kconfig bits & trivial binding additions for the T-Head 1520 SoC (codename "light"). This SoC can be found on the Lichee Pi 4a, for which a minimal dts is added. Misc: Re-sort the dts Makefile to be in alphanumerical order by directory. Signed-off-by: Conor Dooley * tag 'riscv-dt-for-v6.5-pt2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: sort makefile entries by directory riscv: defconfig: enable T-HEAD SoC MAINTAINERS: add entry for T-HEAD RISC-V SoC riscv: dts: thead: add sipeed Lichee Pi 4A board device tree riscv: dts: add initial T-HEAD TH1520 SoC device tree riscv: Add the T-HEAD SoC family Kconfig option dt-bindings: riscv: Add T-HEAD TH1520 board compatibles dt-bindings: timer: Add T-HEAD TH1520 clint dt-bindings: interrupt-controller: Add T-HEAD's TH1520 PLIC Link: https://lore.kernel.org/r/20230620-fidelity-variety-60b47c889e31@spud Signed-off-by: Arnd Bergmann commit d704f1fe9f4a4ae9c9f1f9fac1e4194c34dd035b Merge: 313c22bb31953 3cdba279c5e92 Author: Arnd Bergmann Date: Tue Jun 20 23:05:56 2023 +0200 Merge tag 'arm-soc/for-6.5/devicetree-arm64' of https://github.com/Broadcom/stblinux into soc/dt This pull request contains Broadcom ARM64-based SoCs changes for 6.5, please pull the following: - Krzysztof fixes the BCMBCA DTS files to have correct cache properties - Tony unifies the pinctrl-single pin group(s) for the Stingray SoCs - Aurelien enables the BCM283x DTS files to be built with relocation information to make them usable with DT overlays * tag 'arm-soc/for-6.5/devicetree-arm64' of https://github.com/Broadcom/stblinux: arm64: dts: broadcom: Enable device-tree overlay support for RPi devices arm64: dts: broadcom: Unify pinctrl-single pin group nodes for stingray arm64: dts: broadcom: add missing cache properties Link: https://lore.kernel.org/r/20230619134920.3384844-2-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann commit 313c22bb31953c5ac7f3be94279126307dd5865c Merge: 11d5441cde740 b67cad33176e4 Author: Arnd Bergmann Date: Tue Jun 20 23:04:37 2023 +0200 Merge tag 'arm-soc/for-6.5/devicetree' of https://github.com/Broadcom/stblinux into soc/dt This pull request contains Broadcom ARM-based SoCs Device Tree changes for 6.5, please pull the following: - Krzysztof adds missing cache properties for the BCM63xx DSL routers - Rafal relicenses a number of the BCM5301X DTS files to the GPL 2.0+ / MIT license, and he fixes a number of Device Tree nodes warnings, adds MAC address for all Luxul routers and adds Netgear R8000 Wi-Fi regulatory information to the DTS - Stanislav updates the "BCM mobile" SoCs DTS files to fix various warnings - Aurelien enables the BCM283x DTS files to be built with relocation information to make them usable with DT overlays - Christian fixes the Meraki DTS to have correct NAND ECC properties, correct partition numbers and fixed-link node(s) properties * tag 'arm-soc/for-6.5/devicetree' of https://github.com/Broadcom/stblinux: (33 commits) ARM: dts: BCM5301X: Add cells sizes to PCIe nodes dt-bindings: firmware: brcm,kona-smc: convert to YAML ARM: dts: BCM5301X: Add Netgear R8000 WiFi regulator mappings dt-bindings: net: wireless: brcm,bcm4329-fmac: allow generic properties dt-bindings: net: wireless: brcm,bcm4329-fmac: add BCM4366 binding ARM: dts: BCM5301X: fix duplex-full => full-duplex ARM: dts: BCM5301X: MR32: remove partition index numbers ARM: dts: BCM5301X: MR26: MR32: remove bogus nand-ecc-algo property dt-bindings: power: reset: bcm21664-resetmgr: convert to YAML ARM: dts: bcm21664-garnet: use node labels ARM: dts: bcm11351/21664: add UART, I2C node labels ARM: dts: bcm-mobile: move status properties to the end of nodes ARM: dts: bcm21664/23550: use CCU compatibles directly ARM: dts: bcm-mobile: change "" includes to <> where applicable ARM: dts: BCM5301X: Describe switch ports in the main DTS ARM: dts: BCM5301X: Relicense Christian's code to the GPL 2.0+ / MIT ARM: dts: BCM5301X: Drop invalid properties from Meraki MR32 keys ARM: dts: BCM5301X: Drop invalid #usb-cells dt-bindings: arm: bcm: Add bindings for Buffalo WZR-1166DHP(2) ARM: dts: BCM5301X: Use updated "spi-gpio" binding properties ... Link: https://lore.kernel.org/r/20230619134920.3384844-1-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann commit 11d5441cde740c89252290e04ad79f133c366bdb Author: Cristian Birsan Date: Fri Jun 16 18:29:32 2023 +0300 arm: dts: Enable device-tree overlay support for AT91 boards Add the '-@' DTC option for AT91 boards that have device-tree overlays. This option populates the '__symbols__' node that contains all the necessary symbols for supporting device-tree overlays (from bootloader) on these devices. This change increases the size of the resulting DTB with ~30%-40%. Below are the measurements performed v6.4-rc6: at91-sam9x60_curiosity.dtb 28499 -> 36641 bytes at91-sam9x60ek.dtb 30867 -> 39609 bytes at91-sama5d27_som1_ek.dtb 26086 -> 34166 bytes at91-sama5d27_wlsom1_ek.dtb 26045 -> 33184 bytes at91-sama5d2_icp.dtb 27521 -> 36155 bytes at91-sama5d2_ptc_ek.dtb 23237 -> 29612 bytes at91-sama5d2_xplained.dtb 27262 -> 35326 bytes at91-sama5d3_eds.dtb 27924 -> 39939 bytes at91-sama5d3_xplained.dtb 28400 -> 40650 bytes at91-sama5d4_xplained.dtb 26456 -> 36107 bytes at91-sama7g5ek.dtb 29212 -> 37289 bytes Signed-off-by: Cristian Birsan Link: https://lore.kernel.org/r/20230616152932.1484154-1-cristian.birsan@microchip.com Signed-off-by: Arnd Bergmann commit 982e6e1966ace3aa70cbe45822eb848eace78ade Merge: e86147a28a152 0ee03b8c8576b Author: Arnd Bergmann Date: Tue Jun 20 23:01:57 2023 +0200 Merge tag 'mvebu-dt64-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/dt mvebu dt64 for 6.5 (part 1) Few improvements following the dt bindings: - add missing cache properties - fix nand_controller node name according to YAML - fix pca954x i2c-mux node names Fix espressobin-ultra boot failure and wifi for EspressoBIN Ultra (Armada 3720) * tag 'mvebu-dt64-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: arm64: dts: marvell: Fix espressobin-ultra boot failure and wifi arm64: dts: marvell: Fix pca954x i2c-mux node names arm64: dts: marvell: cp11x: Fix nand_controller node name according to YAML arm64: dts: marvell: add missing cache properties Link: https://lore.kernel.org/r/877cs3h87m.fsf@BL-laptop Signed-off-by: Arnd Bergmann commit e86147a28a152cf683538a98653a126754bf8d8b Merge: 5bfea833dd8f9 dc393f1fdf22e Author: Arnd Bergmann Date: Tue Jun 20 23:00:37 2023 +0200 Merge tag 'mvebu-dt-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/dt mvebu dt for 6.5 (part 1) Add Endian 4i Edge 200 board (kirkwood based) Add missing phy-modes on Armada 388 clearfog board Replace deprecated spi-gpio properties on Armada XP Align MTD partition nodes to dtschema for all mvebu boards * tag 'mvebu-dt-6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: ARM: dts: mvebu: align MTD partition nodes to dtschema ARM: dts: armada-xp: Replace deprecated spi-gpio properties ARM: dts: armada388-clearfog: add missing phy-modes ARM: dts: kirkwood: Add Endian 4i Edge 200 board Link: https://lore.kernel.org/r/87a5wzh8b1.fsf@BL-laptop Signed-off-by: Arnd Bergmann commit 5bfea833dd8f972ce3435359f12f61bdbf01b147 Merge: ce207be3e2949 3bfbff9b461e3 Author: Arnd Bergmann Date: Tue Jun 20 22:59:05 2023 +0200 Merge tag 'v6.4-next-dts64' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux into soc/dt MT6795: - add GCE, MMSYS, IOMMU and PMIC wrapper nodes - Enable PMIC combo, eMMC and SDIO support to the Sony Xperia M5 MT7622: - add SPI-NAND chip and interrupt support for switch node to the BPI-R64 MT7986: - add PWM, thermal, efuse, auxadc and thermal zone nodes - BPI-R3 enable WiFi leds and enable PWM - BPI-R3 reserve more space on NOR and NOR flash to be able to store bl2 uncompressed - BPI-R3 add PWM fan for cpu cooling MT8173: - fine tune the regulator of the eDP pannel - use EDID for eDP panel instead of hard coded type MT8183: - add quirk for GIC problem for Kukui based boards to make "pseudo NMIs" work - provide fimrware name to SCP MT8186: - add USB, SPMI, ADSP, Global Command Engine (GCE) nodes - add nodes to enable display support - add cache coherent interconnect - add dynamic voltage scaling for CPU and GPU MT8192: - enable Bluetooth on the Hayato board - add quirk for GIC problem for Kukui based boards to make "pseudo NMIs" work - add cpufreq node and video decoder - add dma-ranges needed by the IOMMU rework - Fine tune capacity-dmips-mhz MT8195: - add thermal zones and video decoder - enable PCI ports on cherry (e.g. Acer Chromebook Spin 513 CP513-2H) to enable WiFi and Bluetooth combo. - add quirk for GIC problem for Kukui based boards to make "pseudo NMIs" work MT8365: - add watchdog, PMIC, MMC, USB OTG, ethernet nodes - add Operation Performance Points - PSCI node and CPU idle support Several SoCs: - advertise L2 and L3 cache as unified - add chasss-type * tag 'v6.4-next-dts64' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux: (51 commits) arm64: dts: mt7986: increase bl2 partition on NAND of Bananapi R3 arm64: dts: mediatek: mt8186: Wire up GPU voltage/frequency scaling arm64: dts: mediatek: mt8186: Add GPU speed bin NVMEM cells arm64: dts: mediatek: mt8186: Wire up CPU frequency/voltage scaling arm64: dts: mediatek: mt8186: Add CCI node and CCI OPP table arm64: dts: mt7986: add pwm-fan and cooling-maps to BPI-R3 dts arm64: dts: mt7986: add thermal-zones arm64: dts: mt7986: add thermal and efuse arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz arm64: dts: mediatek: mt8192: Add missing dma-ranges to soc node arm64: dts: mediatek: mt8183: kukui: Add scp firmware-name arm64: dts: mt8195: Add video decoder node arm64: dts: mt8192: Add video-codec nodes arm64: dts: mediatek: Add cpufreq nodes for MT8192 arm64: dts: mediatek: mt8173-elm: remove panel model number in DT arm64: dts: mt7986: use size of reserved partition for bl2 arm64: dts: mt8173: Power on panel regulator on boot arm64: dts: mt7986: set Wifi Leds low-active for BPI-R3 arm64: dts: mt7986: add PWM to BPI-R3 arm64: dts: mt7986: add PWM ... Link: https://lore.kernel.org/r/27843c96-142e-930e-33b2-b634182e7cfa@gmail.com Signed-off-by: Arnd Bergmann commit ce207be3e2949925a89f57f7b3f1ac546a3dbbfa Merge: d09d747ee5cb0 2d62aab57d2ac Author: Arnd Bergmann Date: Tue Jun 20 22:58:19 2023 +0200 Merge tag 'ti-keystone-dt-for-v6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt Keystone2 device tree updates for v6.5 Cosmetic cleanups: * Do not capitalize hex digits * Unify pinctrl-single pin group nodes for keystone * Fix eeprom node names * tag 'ti-keystone-dt-for-v6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: ARM: dts: keystone: Do not capitalize hex digits ARM: dts: keystone: Remove ti,keystone from soc node compatible ARM: dts: keystone: Fix EEPROM node names ARM: dts: Unify pinctrl-single pin group nodes for keystone Link: https://lore.kernel.org/r/20230615164127.qcgwrbwpmclx5wlm@landscape Signed-off-by: Arnd Bergmann commit d09d747ee5cb0727a9f0588bc166c3a79fa3bc3d Merge: f07c96511d001 831b802a7727b Author: Arnd Bergmann Date: Tue Jun 20 22:57:29 2023 +0200 Merge tag 'qcom-dts-for-6.5-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt More Qualcomm ARM32 DeviceTree updates for v6.5 On MSM8960, support for USB is added and the Samsung Galaxy Express is added. GPIO keys and on-board LEDs are described for the APQ8074 Dragonboard. On MSM8226, QFPROM, tsens and thermal zones are defined, and the description of the clock hierarchy is improved. The PCIe endpoint controller on SDX55 gains a interconnect path to DDR defined. Sony Xperia X2 Tablet and Samsung Galaxy Tab 4 are updated following changes in the LP855X DeviceTree binding. * tag 'qcom-dts-for-6.5-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm: dts: qcom: sdx55: Add interconnect path ARM: dts: qcom: msm8226: Add thermal zones node ARM: dts: qcom: msm8226: Add tsens node and related nvmem cells ARM: dts: qcom: msm8226: Add qfprom node ARM: dts: qcom: pm8941: Add thermal zone config ARM: dts: qcom: pm8841: Add thermal zone config ARM: dts: qcom: pm8226: Add thermal sensor and thermal zone config ARM: dts: qcom: msm8974: rename labels for DSI nodes ARM: dts: qcom: apq8074-dragonboard: add gpio keys ARM: dts: qcom: apq8074-dragonboard: add onboard leds ARM: dts: qcom: Add Samsung Galaxy Express support ARM: dts: qcom: msm8960: Add USB node ARM: dts: qcom: adapt to LP855X bindings changes ARM: dts: qcom: msm8226: Provide clocks to mmcc node ARM: dts: qcom: msm8226: Use XO from rpmcc where possible Link: https://lore.kernel.org/r/20230615163926.1462225-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit f07c96511d00138171130d43a50a377489cd87de Merge: 055fdcac930b1 115ee470e5d24 Author: Arnd Bergmann Date: Tue Jun 20 22:56:19 2023 +0200 Merge tag 'v6.4-next-dts32' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux into soc/dt MT7530 (e.g. BPI R2): - several DT clean-ups - add port5 as CPU port * tag 'v6.4-next-dts32' of https://git.kernel.org/pub/scm/linux/kernel/git/matthias.bgg/linux: arm: dts: mt7623: add port@5 as CPU port arm: dts: mt7623: enable flow control on port@6 arm: dts: mt7623: change mt7530 switch address arm: dts: mt7623: add mt7530 switch to mt7623a.dtsi arm: dts: mt7623: add gmacs to mt7623.dtsi Link: https://lore.kernel.org/r/98e21acb-d792-6a8c-2de6-12d5af8a8111@gmail.com Signed-off-by: Arnd Bergmann commit 055fdcac930b103372ea19a25de6c406fc245be2 Merge: af3c684721cf6 c2951581e69c8 Author: Arnd Bergmann Date: Tue Jun 20 22:54:14 2023 +0200 Merge tag 'qcom-arm64-for-6.5-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt More Qualcomm ARM64 DTS changes for v6.5 This introduces support for the Qualcomm SDX75 platform, with the IDP reference board. On IPQ5332 the RDP474 board is added and on IPQ9574 the RDP454 is introduced. On SC8280XP, and hence Lenovo ThinkPad X13s, GPU support is added. For QDU1000, SDM845, SM670, SC8180X, SM6350 and SM8550 the RSC is added to the CPU cluster power-domain to flush sleep & wake votes as the cluster goes down. On IPQ5332 additional reserved-memory regions to improve post mortem debugging. UART1 is added. The MI01.2 board is renamed RDP441 and the RDP474 is added. On IPQ8074 critical thermal trip points are defined. As with IPQ5332 additional reserved-memory regions are used to improve post mortem debugging. Thermal sensors (tsens) are added and zones defined. The crypto engine is added, and support for the RDP454 board is added. Across MSM8916 and MSM8939 pinctrl state definitions are cleaned up and the purpose of msm8939-pm8916 is documented. MSM8939 has regulator definitions cleaned up, following to the previous effort on MSM8916. CPU Bus Fabric scaling support is added to MSM8996 Pro. On QCM2290 CPU idle states are added. For QDU1000 SDHCI is introduced and enabled on the IDP to gain eMMC support. IMEM and PIL information regions are defined for improved post mortem debugging. The Qualcomm Robotics RB2 kit gets its on-board buttons described. A few fixes are introduced for the newly merged SC8180X, in particluar the DisplayPort blocks are moved to the MMCX power domain to avoid power being reduced prematurely during boot. The SC8280XP GPU is added and enabled for the Lenovo Thinkpad X13s, and resets for the soundwire controllers are added. The OUI is specified for ethernet phys on SA8540P Ride platform, to avoid reset issues. Charger description is added to the PMI8998 PMIC and enabled across OnePlus 6/6T, SHIFT SHIFT6mq and Xiaomi Pocophone F1. On SM6350 CPU idle states and UART1 are added. And SM6375 gains GPU clock controller and IOMMU definitions. The Fairphone FP4 gains Bluetooth support. SM8150 is transitioned to use 2 interconnect-cells, and the USB interconnect path is described to ensure buses are adequately voted for. The same changes are done for SM8250, and the resolution of the static framebuffer on Sony Xperia 1 II and 5 II are corrected. The USB bus paths are also added to SM8350, SM8450 and SM8550. On SM8550 DisplayPort nodes are added, as is the PWM controller for driving the notification LED and the RTC is enabled. For the MTP and QRD boards, the soundcard and audio codecs are defined. A Tegra change, related to LP855X binding changes, was accidentally picked up and dropped again later. A number of DeviceTree fixes identified through validation was introduced as well. Additionally a few nodes got their default status changed to avoid unnecessarily having to enable them (e.g. the mdp/dpu node). * tag 'qcom-arm64-for-6.5-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (94 commits) Revert "arm64: dts: adapt to LP855X bindings changes" arm64: dts: qcom: sc8280xp: Enable GPU related nodes arm64: dts: qcom: sc8280xp: Add GPU related nodes arm64: dts: qcom: msm8939-pm8916: Mark always-on regulators arm64: dts: qcom: msm8939: Define regulator constraints next to usage arm64: dts: qcom: msm8939-pm8916: Clarify purpose arm64: dts: qcom: msm8939: Fix regulator constraints arm64: dts: qcom: msm8939-sony-tulip: Allow disabling pm8916_l6 arm64: dts: qcom: msm8939-sony-tulip: Fix l10-l12 regulator voltages arm64: dts: qcom: msm8939: Disable lpass_codec by default arm64: dts: qcom: msm8939-pm8916: Add missing pm8916_codec supplies arm64: dts: qcom: qrb4210-rb2: Enable on-board buttons arm64: dts: qcom: msm8916: Drop msm8916-pins.dtsi arm64: dts: qcom: msm8916/39: Rename wcnss pinctrl arm64: dts: qcom: msm8916/39: Cleanup audio pinctrl arm64: dts: qcom: apq8016-sbc: Drop unneeded MCLK pinctrl arm64: dts: qcom: msm8916/39: Consolidate SDC pinctrl arm64: dts: qcom: msm8916/39: Fix SD card detect pinctrl arm64: dts: qcom: msm8996: rename labels for HDMI nodes arm64: dts: qcom: sm8250: rename labels for DSI nodes ... Link: https://lore.kernel.org/r/20230615162043.1461624-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit af3c684721cf69ff662c53a58f02261fa2f8efbe Merge: 5e64ee4204479 a495681151434 Author: Arnd Bergmann Date: Tue Jun 20 22:51:55 2023 +0200 Merge tag 'ti-k3-dt-for-v6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt TI K3 device tree updates for v6.5 New Boards: phyBOARD-Lyra-AM625 Board support Toradex Verdin AM62 COM, carrier and dev boards New features: Across K3 SoCs: - Error Signaling Module(ESM) and Secproxy IPC modules - On board I2C EEPROM - Voltage Temp Monitoring (VTM) module - DM timers (GP Timers) J784s4: - R5 and C7x DSP remoteproc, ADC, QSPI AM69: - Addition of more peripherals: CPSW, eMMC, UARTs, I2C et al J721s2: - USB, Serdes, OSPI, PCIe AM62a: - Watchdog J721e: - HyperFlash/HyperBus AM62: - Type-C USB0 port Cleanups and non-urgent fixes Particularly large set of cleanups to get rid of dtbs_check errors and dtc warnings: - Addition of missing pinmux and uart nodes for AM64, AM62x, AM62A, J721e, J7200 that are used by bootloader - Split Pinmux regions/range to avoid holes for J721s2, J7200, J784s4 - Drop bootargs and unneeded aliases across all K3 SoCs - Move aliases to board dts files from SoC dtsi files - Move to generic node name for can, rtc nodes on am65 - s/-pins-default/default-pins/ to match upcoming pinctrl.yaml update - Fix pinctrl phandle references to use <> as separator where multiple entries are present * tag 'ti-k3-dt-for-v6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: (153 commits) arm64: dts: ti: Unify pin group node names for make dtbs checks arm64: dts: ti: add verdin am62 yavia arm64: dts: ti: add verdin am62 dahlia arm64: dts: ti: add verdin am62 dt-bindings: arm: ti: add toradex,verdin-am62 et al. arm64: dts: ti: Add basic support for phyBOARD-Lyra-AM625 dt-bindings: arm: ti: Add bindings for PHYTEC AM62x based hardware arm64: dts: ti: k3-j7200-mcu-wakeup: Remove 0x unit address prefix from nodename arm64: dts: ti: k3-j721e-som-p0: Enable wakeup_i2c0 and eeprom arm64: dts: ti: k3-am64: Add ESM support arm64: dts: ti: k3-am62: Add ESM support arm64: dts: ti: k3-j7200: Add ESM support arm64: dts: ti: k3-j721e: Add ESM support dt-bindings: misc: esm: Add ESM support for TI K3 devices arm64: dts: ti: k3-j721s2-som-p0: Enable wakeup_i2c0 and eeprom arm64: dts: ti: k3-j721s2-common-proc-board: Add uart pinmux arm64: dts: ti: k3-am68-sk-som: Enable wakeup_i2c0 and eeprom arm64: dts: ti: k3-am68-sk-base-board: Add uart pinmux arm64: dts: ti: k3-am68-sk-base-board: Add pinmux for RPi Header arm64: dts: ti: k3-j721s2: Fix wkup pinmux range ... Link: https://lore.kernel.org/r/7fe0c6de-cb99-9c89-8583-b3855fde16f8@ti.com Signed-off-by: Arnd Bergmann commit 5e64ee4204479ed2bf2abd7d6095686288ea008f Merge: c9a5aa0e53d07 067bf44de11ce Author: Arnd Bergmann Date: Tue Jun 20 22:50:16 2023 +0200 Merge tag 'zynqmp-dt-for-v6.5' of https://github.com/Xilinx/linux-xlnx into soc/dt arm64: ZynqMP DT changes for v6.5 Various small fixes and cleanups to be aligned with the latest dt-schema. Other major changes are: - Wire mali-400 gpu - Change board name for zcu1275 - Use ethernet-phy-id to handle ETH phy reset properly - Switch to amd.com emails - Update people in DT bindings * tag 'zynqmp-dt-for-v6.5' of https://github.com/Xilinx/linux-xlnx: (33 commits) dt-bindings: usb: xilinx: Replace Manish by Piyush dt-bindings: xilinx: Remove Rajan, Jolly and Manish arm64: zynqmp: Used fixed-partitions for QSPI in k26 arm64: zynqmp: Add pmu interrupt-affinity arm64: zynqmp: Set qspi tx-buswidth to 4 arm64: zynqmp: Fix usb node drive strength and slew rate arm64: zynqmp: Describe TI phy as ethernet-phy-id arm64: zynqmp: Switch to amd.com emails arm64: zynqmp: Convert kv260-revA overlay to ASCII text dt-bindings: xilinx: Switch xilinx.com emails to amd.com arm64: xilinx: Use zynqmp prefix for SOM dt overlays arm64: zynqmp: Add phase tags marking arm64: zynqmp: Describe bus-width for SD card on KV260 arm64: zynqmp: Enable AMS on SOM and other zcu10x boards arm64: zynqmp: Enable DP driver for SOMs arm64: zynqmp: Setup clock for DP and DPDMA arm64: zynqmp: Switch to ethernet-phy-id in kv260 arm64: zynqmp: Disable USB3.0 for zc1751-xm016-dc2 arm64: zynqmp: Add pinctrl emmc description to SM-K26 arm64: zynqmp: Add gpio labels for modepin gpio ... Link: https://lore.kernel.org/r/CAHTX3d+2s_KmCnd=x5hydGb+LYoznAzYGTizvqqN2NFmrBurfw@mail.gmail.com Signed-off-by: Arnd Bergmann commit c9a5aa0e53d073d99559aedba9725c4220aafe11 Merge: 12109610a5ce5 e2c510d6d630f Author: Arnd Bergmann Date: Tue Jun 20 22:49:35 2023 +0200 Merge tag 'riscv-dt-for-v6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/dt RISC-V Devicetrees for v6.5 StarFive: Watchdog nodes for both the JH7110 & its forerunner, the JH7100. PMU, P being power, support for the JH7110. PMIC and frequency scaling support for the JH7110 equipped VisionFive 2. Most of the DT bits for the JH7110, and the SBCs using it, are pending support for one of the clock controllers, so it's a smaller set of changes than I would have hoped for. Misc: Pick up some dt-binding cleanup that Palmer assigned to me & had no uptake from the respective maintainers. My powers of estimation failed me again, with part of my motivation for picking them up being the addition of new platforms that ended up not making it. Hopefully next window for those, as they were relatively close. Exclude the Allwinner and Renesas subdirectories from the Misc. MAINTAINERS entry, since I do not take care of those. Signed-off-by: Conor Dooley * tag 'riscv-dt-for-v6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: starfive: Add cpu scaling for JH7110 SoC riscv: dts: starfive: Enable axp15060 pmic for cpufreq dt-bindings: interrupt-controller: sifive,plic: Sort compatible values dt-bindings: timer: sifive,clint: Clean up compatible value section riscv: dts: starfive: jh7110: Add watchdog node riscv: dts: starfive: jh7100: Add watchdog node riscv: dts: starfive: Add PMU controller node MAINTAINERS: exclude maintained subdirs in RISC-V misc DT entry Link: https://lore.kernel.org/r/20230612-fasting-floss-0bc05a08bc7a@spud Signed-off-by: Arnd Bergmann commit 12109610a5ce5fe257a1ab6132234d6c9346044d Author: Sam Protsenko Date: Mon Jun 12 20:01:02 2023 +0200 arm64: dts: exynos: Remove clock from Exynos850 pmu_system_controller As described in the corresponding binding documentation for "samsung,exynos850-pmu", the "clocks" property should be used for specifying CLKOUT mux inputs. Therefore, the clock provided to exynos850 pmu_system_controller is incorrect and should be removed. Instead of making syscon regmap keep that clock running for PMU accesses, it should be made always running in the clock driver, because the kernel is not the only software accessing PMU registers on Exynos850 platform. Signed-off-by: Sam Protsenko Link: https://lore.kernel.org/r/20230308233822.31180-8-semen.protsenko@linaro.org Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230612180102.289745-1-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit d0b5886bee4bee72bad40523d04a800db0a0a02b Merge: 6db92533d6a39 a68e1aec587a7 Author: Arnd Bergmann Date: Tue Jun 20 22:46:45 2023 +0200 Merge tag 'v6.5-rockchip-dts64-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt New boards are - Indiedroid Nova (rk3588) - Add Edgeble Neural Compute Module 6B (rk3588) - FriendlyARM NanoPi R2C Plus (rk3328) - Anbernic RG353PS (rk3566) - Lunzn Fastrhino R66S / R68S (rk3568) The rk3588 got a lot of attention and gained support for the GIC ITS (needed an errata from Rockchip), timers, otp memory, saradc and sdio. The rk356x got support for its RGA block With all the core improvements to rk3588 support, the Rock5b got a lot improvements from that too, namely support for its PMIC, sd-card and saradc, as well as a clock-rate fix for its es8316 codec. Similarly the rk3588-evb1 also got support for its PMIC. The Anberic RGxx3 series got a better bluetooth compatible and updates to its LEDs to make them use the PWM blocks they're connected to. * tag 'v6.5-rockchip-dts64-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (29 commits) arm64: dts: rockchip: Add saradc node to rock5b arm64: dts: rockchip: Fix compatible for Bluetooth on rk3566-anbernic arm64: dts: rockchip: Add SD card support to rock-5b arm64: dts: rockchip: add PMIC to rock-5b arm64: dts: rockchip: Assign ES8316 MCLK rate on rk3588-rock-5b arm64: dts: rockchip: Add Indiedroid Nova board dt-bindings: arm: rockchip: Add Indiedroid Nova dt-bindings: vendor-prefixes: add Indiedroid arm64: dts: rockchip: Add sdio node to rk3588 arm64: dts: rockchip: add default pinctrl for rk3588 emmc arm64: dts: rockchip: Add DT node for ADC support in RK3588 arm64: dts: rockchip: add PMIC to rk3588-evb1 arm64: dts: rockchip: Add rk3588 Edgeble Neu6 Model B IO arm64: dts: rockchip: Add rk3588 Edgeble Neu6 Model B SoM arm64: dts: rockchip: Add Rockchip RK3588J dt-bindings: arm: rockchip: Add Edgeble Neural Compute Module 6B arm64: dts: rockchip: Add RGA2 support to rk356x media: dt-bindings: media: rockchip-rga: add rockchip,rk3568-rga arm64: dts: rockchip: Add rk3588 OTP node arm64: dts: rockchip: Add FriendlyARM NanoPi R2C Plus ... Link: https://lore.kernel.org/r/3239799.44csPzL39Z@phil Signed-off-by: Arnd Bergmann commit 6db92533d6a392cdddcc7291865d02d94fe56956 Merge: 60c2f542a7ada 925bac3caa46c Author: Arnd Bergmann Date: Tue Jun 20 22:45:40 2023 +0200 Merge tag 'qcom-dts-for-6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm ARM32 DeviceTree updates for v6.5 NAND support on IPQ4019 boards is restored, after a faulty node rename. On MSM8226 IMEM, PMU and RPM stats are introduced. The Huawei Watch gains vibrator support. On MSM8974, the LGE Nexus 5 gains vibrator support. The APQ8074 Dragonboard marks BLSP2 BAM controlled remotely, DSI panel, audio and modem DSPs are enabled. On SDX65 PCIe controller and PHY are introduced, to provide endpoint functionality. This is enabled on the related MTP. A range of DeviceTree cleanups are also included. * tag 'qcom-dts-for-6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (27 commits) ARM: dts: qcom: apq8074-dragonboard: enable DSI panel ARM: dts: qcom: apq8074-dragonboard: enable adsp and MSS ARM: dts: qcom: apq8074-dragonboard: Set DMA as remotely controlled ARM: dts: qcom: apq8026-huawei-sturgeon: Add vibrator ARM: dts: qcom: msm8226: Add IMEM node ARM: dts: qcom: msm8226: Add rpm-stats device node ARM: dts: qcom: msm8226: Add PMU node ARM: dts: qcom: sdx65-mtp: Enable PCIe EP ARM: dts: qcom: sdx65-mtp: Enable PCIe PHY ARM: dts: qcom: sdx65: Add support for PCIe EP ARM: dts: qcom: sdx65: Add support for PCIe PHY ARM: dts: qcom: msm8974: align WCNSS Bluetooth node name with bindings ARM: dts: qcom: apq8084: correct thermal sensor unit-address ARM: dts: qcom: msm8960-cdp: move regulator out of simple-bus ARM: dts: qcom: apq8060-dragonboard: move regulators out of simple-bus ARM: dts: qcom: ipq8064: align USB node names with bindings ARM: dts: qcom: ipq8064: correct LED node names ARM: dts: qcom: ipq8064: drop invalid GCC thermal-sensor unit-address ARM: dts: qcom: ipq8064: drop leading 0 from unit-address ARM: dts: qcom: msm8974: correct pronto unit-address ... Link: https://lore.kernel.org/r/20230611010843.2482142-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 60c2f542a7ada6bce82ce8e9d50e05eea74fe472 Merge: 70cdf5e28c080 20dea72a393c6 Author: Arnd Bergmann Date: Tue Jun 20 22:43:04 2023 +0200 Merge tag 'qcom-arm64-for-6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm ARM64 DeviceTree updates for v6.5 This introduces the RDP442 and RDP433 reference devices on IPQ5332 and IPQ9574, respectively. RDP418, RDP433, RDP449 and RDP453 on the IPQ9574 are added. On MSM8939 the Square T2 board and the Sony Xperia M4 Aqua is added. Support for Acer Apire 1, built on the Snapdragon 7c platform is introduced. Fxtec Pro1X on SM6115 is added. Lastly long floating support for SC8180X and the Lenovo Flex 5G, and the Primus reference device, has been added. On IPQ5332 and IPQ6018 QFPROM support is introduced, and as described above the RDP442 board on the prior. Download mode support and various reserved-memory regions are also introduced on IPQ6018. IPQ8074 gains another SPI controller. On IPQ9574 CPU frequency scaling, low speed busses, RNG, Watchdog, qfprom, SMEM and RPM are introduced. As are support for four new board, mentioned above. MSM8916 gains a range of structural improvements, to better suite the various boards supported. Regulator constraints are corrected and their states are adjusted to match reality (e.g. always-on regulators marked as always-on). BQ Aquaris X5 gains support for front flash LED. As mentioned above, MSM8939 support is introduced with support for boards from Sony and Square. MSM8953 gains DMA support in I2C masters. MSM8996-based Sony Xperia boards gains description of their RGB notification LED. On SA8775P support for UFS, USB, GPU clock and iommu controllers, PMU, AOSS, watchdog and missing low-speed controllers are added. On the Ride platform UFS, USB and an i2c bus are enabled. iommu properties are added to QSPI on both SC7180 and SC7280. LPASS clocks are adjusted and MDP node cleaned up slightly, on SC7180. As mentioned above, support for Acer Aspire 1 is introduced. Long lingering patches introducing SC8180X, the Lenovo Flex 5G and the Primus reference device has been merged. On SC8280XP ethernet is added and enabled on the automotive ride platform. An SDC controller is introduced and enabled on the SC8280XP CRD. On the Lenovo Thinkpad X13s and the CRD reference device the USB SuperSpeed phy is added to the Type-C graph, to enable support for orientation switching. Fairphone 3 gains support for its notification LED. On SDM845 the iommu stream for QSPI is defined, SHIFT SHIFT6mq gains support for flash LED and the RB3 (DB845c) board gains support for bonded/dual DSI-mode, to allow 4k output. On SM6115 CPU idle-states, crypto engine support and SuperSpeed USB PHY are introduced. As mentioned above Fxtec Pro1X is introduced. On the QRB4210 Robotics Platform RB2 USB, Audio and Compute DSPs, display, CAN-bus and GPIO LEDs are introduced, fixed regulators are described and the SD-card description is corrected. Support for crypto engine is added to SM8150, while Sony Xperia 1 and 5 gains SD-card support, camera regulators and GPIO line names sorted out. SM8250 also gets support for crypto engine, and Sony Xperia 1 II and 5 II gains support for hardware video accelerator. Crypto engine is introduced for SM8350 as well. The HDK gets the USB Type-C graph described for Superspeed orientation switching and DisplayPort output. On SM8450 video clock controller and crypto engine are added, missing opp levels are introduced and the USB Type-C graph is defined for orientation switching and altmode. SM8550 gains GPU and video clock controllers and missing opp levels are added. The WCD9385 audio codec is added for the SM8550 MTP and on the QRD PCIe, USB, audio display and flash LED are added. * tag 'qcom-arm64-for-6.5' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (195 commits) arm64: dts: qcom: sc8180x: Introduce Lenovo Flex 5G arm64: dts: qcom: sc8180x: Introduce Primus arm64: dts: qcom: sc8180x: Add pmics arm64: dts: qcom: sc8180x: Add display and gpu nodes arm64: dts: qcom: sc8180x: Add remoteprocs, wifi and usb nodes arm64: dts: qcom: sc8180x: Add PCIe instances arm64: dts: qcom: sc8180x: Add QUPs arm64: dts: qcom: sc8180x: Add thermal zones arm64: dts: qcom: sc8180x: Add interconnects and lmh arm64: dts: qcom: Introduce the SC8180x platform arm64: dts: qcom: msm8916: Move aliases to boards arm64: dts: qcom: pm8916: Rename &wcd_codec -> &pm8916_codec arm64: dts: qcom: msm8916/39: Clean up MDSS labels arm64: dts: qcom: msm8916/39: Use consistent name for I2C/SPI pinctrl arm64: dts: qcom: msm8916/39: Rename &blsp1_uartN -> &blsp_uartN arm64: dts: qcom: msm8916: Rename &msmgpio -> &tlmm arm64: dts: qcom: qrb4210-rb2: Enable USB node arm64: dts: qcom: sm6115: Add USB SS qmp phy node arm64: dts: qcom: ipq5332: add support for the RDP442 variant dt-bindings: arm: qcom: document MI01.3 board based on IPQ5332 family ... Link: https://lore.kernel.org/r/20230611004944.2481596-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 70cdf5e28c08020caf1e6f97ca2b1e03de424917 Merge: f50a4e594db87 8e2facfe904a2 Author: Arnd Bergmann Date: Tue Jun 20 22:40:43 2023 +0200 Merge tag 'imx-dt64-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/dt i.MX arm64 device tree for 6.5: - New board support: i.MX8MM based Emtop SoM & Baseboard, NXP i.MX8MM EVKB board, i.MX8MP based Gateworks Venice gw7905-2x device. - A series from Adam Ford to add Camera and Audio support for i.MX8M based Beacon boards. - Add Audio output support for i.MX8MP TQMa8MPxL/MBa8MPxL board. - Add HDMI and display support for imx8mm-evk and imx8mm-phg board. - Add coresight trace devices support for i.MX8MP SoC. - A couple of changes from Krzysztof Kozlowski to add missing cache properties. - A couple of changes from Laurent Pinchart to add CSIS and ISI devices for i.MX8MP SoC. - A series from Marek Vasut to add more devices for i.MX8MP, and enable SAI audio on i.MX8MP DHCOM PDK2 and PDK3. - Correct GSC vdd_bat data size for Gateworks Venice devices. - Add more device support for i.MX93, Watchdog, OCOTP, idle states, DDR performance monitor, etc. - Small and random clean-ups and device node additions. * tag 'imx-dt64-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (47 commits) arm64: dts: imx8mq: Pass address-cells/size-cells to mipi_dsi arm64: dts: imx8mq: Use 'dsi' as node name arm64: dts: imx8mp-venice-gw702x: fix GSC vdd_bat data size arm64: dts: imx8mq-tqma8mq-mba8mx: Remove invalid properties arm64: dts: imx8mq: Add missing pci property arm64: dts: imx8mq: Fix lcdif clocks arm64: dts: imx8mq: Fix lcdif compatible arm64: dts: imx8mp: don't initialize audio clocks from CCM node arm64: dts: imx8mm-venice: Fix GSC vdd_bat data size. arm64: dts: imx8mp: Add coresight trace components arm64: dts: imx93: add ddr performance monitor node arm64: dts: imx8mm-phg: Add display support arm64: dts: tqma8mqml: Add vcc supply to i2c eeproms arm64: dts: imx8mm-evk: Add HDMI support arm64: dts: imx8mn-var-som-symphony: adapt FEC pinctrl for SOMs with onboard PHY arm64: dts: imx8mn-var-som: add 20ms delay to ethernet regulator enable arm64: dts: imx8mp-msc-sm2s: Add sound card arm64: dts: imx8mn-beacon: Migrate sound card to simple-audio-card arm64: dts: imx8mp-beacon-kit: Enable WM8962 Audio CODEC arm64: dts: imx93: add fsl,stop-mode property to support WOL ... Link: https://lore.kernel.org/r/20230610072530.418847-3-shawnguo@kernel.org Signed-off-by: Arnd Bergmann commit f50a4e594db87ad8beed9bb42a067224724d07de Merge: 3230271930ad9 5ef0f31fb9285 Author: Arnd Bergmann Date: Tue Jun 20 22:38:10 2023 +0200 Merge tag 'imx-dt-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/dt i.MX ARM device tree for 6.5: - New board support: Marantec Maveo Box. - Add HDMI support for TQMa6x/MBa6 board. - A series from Andrew Lunn to add phy-mode and fixed links for Ethernet devices on imx51, imx6qdl and vf610. - A bunch of changes from Fabio Estevam to clean up deprecated and invalid properies, fix up node names to remove dt-schema warnings. - A series of maintenance updates for Protonic Holland boards, mostly on the USB subsystem configuration, thermal zones, and the naming of GPIO keys. - Update dma-apbh device node name to remove dtbs_check warnings. - Remove invalid nodes from fan-controller for a couple of Gateworks boards. - Small random updates and clean-ups on various boards. * tag 'imx-dt-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (53 commits) ARM: dts: imx6qdl: vicut1: rename power to power-button ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings ARM: dts: imx6dl: plybas: fix USB over-current detection on USB OTG port ARM: dts: imx6ul: prti6g: fix USB over-current detection on USB OTG port ARM: dts: imx6qp: prtwd3: Enable USB over current detection on USB OTG port ARM: dts: imx6dl: prtmvt: fix different USB related warnings ARM: dts: imx6dl: alti6p: fix different USB related warnings ARM: dts: imx6dl: vicut1: Address USB related warnings ARM: dts: imx6dl: Add trip points to thermal zones on several devices ARM: dts: imx6dl: lanmcu: Configure over-current polarity for USB OTG node ARM: dts: imx6dl: lanmcu: Disable unused USB PHY nodes ARM: dts: imx6q: prtwd2: Correct iomux configuration for ENET MDIO and MDC ARM: dts: imx6dl: prtvt7: Remove touchscreen inversion ARM: dts: imx6dl: prtvt7: Adjust default backlight brightness to 65 ARM: dts: imx6qdl: vicut1: The sgtl5000 uses i2s not ac97 ARM: dts: imx: Use 'eeprom' as node name ARM: dts: imx6ul-ccimx6ulsom: Fix the "coin" regulator name ARM: dts: imx: Use 'pmic' as node name ARM: dts: imx6: Use the mux- prefix ARM: dts: imx7d-sdb: Allow UHS modes ... Link: https://lore.kernel.org/r/20230610072530.418847-2-shawnguo@kernel.org Signed-off-by: Arnd Bergmann commit 3230271930ad9fb8c82de7b0c5cc41c87da7bc15 Merge: 52d38cff94f8d 50b1e9ece16c5 Author: Arnd Bergmann Date: Tue Jun 20 22:37:32 2023 +0200 Merge tag 'imx-bindings-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/dt i.MX dt-bindings for 6.5: - Add vendor prefix for Emtop - Compatibles for Marantec Maveo Box, i.MX8MM-EVKB and GW7905-2x board. - Replace tab indent with spaces in fsl.yaml. * tag 'imx-bindings-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: dt-bindings: arm: Add Gateworks i.MX8M GW7905-2x board dt-bindings: arm: fsl: Fix syntax error dt-bindings: vendor-prefixes: Add Emtop dt-bindings: arm: fsl: Add Emtop SoM & Baseboard dt-bindings: arm: fsl: Add i.MX8MM-EVKB dt-bindings: arm: fsl: Add Marantec maveo box as a DHCOR i.MX6ULL SoM based board Link: https://lore.kernel.org/r/20230610072530.418847-1-shawnguo@kernel.org Signed-off-by: Arnd Bergmann commit 52d38cff94f8d601493774dfe0b161de1adba7e1 Merge: a9c7f8d0cfb79 09d199b6dcb6b Author: Arnd Bergmann Date: Tue Jun 20 22:36:26 2023 +0200 Merge tag 'sunxi-dt-for-6.5-1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt - fix DCLK clock names - new board ICnova A20 ADB4006 - add D1 SPI node - add bluetooth node for chip board - add extra mmc2 pinmux to sun5i - add axp209 iio-hwmon node * tag 'sunxi-dt-for-6.5-1' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: ARM: dts: axp209: Add iio-hwmon node for internal temperature ARM: dts: sun5i: Add port E pinmux settings for mmc2 ARM: dts: sun5i: chip: Enable bluetooth riscv: dts: allwinner: d1: Add SPI controllers node arm: dts: sunxi: Add ICnova A20 ADB4006 board dt-bindings: arm: sunxi: add ICnova A20 ADB4006 binding ARM: dts: sunxi: rename tcon's clock output Link: https://lore.kernel.org/r/20230609210452.GA17638@jernej-laptop Signed-off-by: Arnd Bergmann commit acf15e07eb06507c69f92394c36052677029b0a8 Author: Azeem Shaikh Date: Tue Jun 13 00:34:37 2023 +0000 netfilter: ipset: Replace strlcpy with strscpy strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). Direct replacement is safe here since return value from all callers of STRLCPY macro were ignored. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh Acked-by: Jozsef Kadlecsik Reviewed-by: Kees Cook Reviewed-by: Simon Horman Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20230613003437.3538694-1-azeemshaikh38@gmail.com commit f0a6b5831cfb17381ada015778448b12c1c6179e Author: Azeem Shaikh Date: Wed Jun 14 00:36:04 2023 +0000 uml: Replace strlcpy with strscpy strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20230614003604.1021205-1-azeemshaikh38@gmail.com commit a9c7f8d0cfb79dd96958d6845b6f0b3c4b57dd07 Merge: 79e47607205aa 6312e57b32500 Author: Arnd Bergmann Date: Tue Jun 20 22:34:46 2023 +0200 Merge tag 'tegra-for-6.5-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt arm64: tegra: Device tree changes for v6.5-rc1 This introduces support for the IGX Orin and Jetson Orin Nano devices and enables various additional features on the Jetson AGX Orin and Jetson Orin NX. This also enables some basic thermal support to prevent the devices from overheating. Support for the GPU on the Google Pixel C is enabled and various minor issues are fixed and cleaned up. * tag 'tegra-for-6.5-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: arm64: tegra: Enable thermal support on Jetson Orin Nano arm64: tegra: Enable thermal support on Jetson Orin NX arm64: tegra: Enable thermal support on Jetson AGX Orin arm64: tegra: Add Tegra234 thermal support arm64: tegra: Add a few blank lines for better readability arm64: tegra: Sort properties more logically arm64: tegra: Enable GPU on Smaug arm64: tegra: Add GPU power rail regulator on Smaug arm64: tegra: Update USB phy-name for Jetson Orin NX arm64: tegra: Enable USB device for Jetson AGX Orin arm64: tegra: Add Tegra234 pin controllers arm64: tegra: Support Jetson Orin Nano Developer Kit arm64: tegra: Add missing cache properties on Tegra210 arm64: tegra: Fix PCIe regulator for Orin Jetson AGX arm64: tegra: Add CPU OPP tables and interconnects property arm64: tegra: Add support for IGX Orin Link: https://lore.kernel.org/r/20230609193620.2275240-6-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit 79e47607205aa5a39c6aa96a3bcf6ebeac77f042 Merge: b1062d1971ff3 5f027147e4796 Author: Arnd Bergmann Date: Tue Jun 20 22:33:45 2023 +0200 Merge tag 'tegra-for-6.5-dt-bindings' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt dt-bindings: Changes for v6.5-rc1 Several new modules and devices are documented and fixes incorporated for the Tegra234 GPIO controller pin mappings as well as the possible Tegra XUDC PHY connections. * tag 'tegra-for-6.5-dt-bindings' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: dt-bindings: tegra: Document Jetson Orin Nano Developer Kit dt-bindings: tegra: Document Jetson Orin Nano dt-bindings: gpio: Remove FSI domain ports on Tegra234 dt-bindings: usb: tegra-xudc: Remove extraneous PHYs dt-bindings: tegra: Add ICC IDs for dummy memory clients dt-bindings: tegra: Document compatible for IGX Link: https://lore.kernel.org/r/20230609193620.2275240-3-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit b1062d1971ff389e5ebc1f52334f444dd24da86c Merge: 7b87c164e179d 076c74c592cab Author: Arnd Bergmann Date: Tue Jun 20 22:31:22 2023 +0200 Merge tag 'stm32-dt-for-v6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/dt STM32 DT for v6.5, round 1 Highlights: ---------- - MCU/MPU: - Replace deprecated st,hw-flow-ctrl by uart-has-rtscts. - Fix LTDC/DSI warnings. - MPU: - STMP32MP15: - Add OTP part number and Vrefint calibration in bsec. - M4 hold management updated. As SMC call is deprecated, the service is moved on a SCMI service. - Add ADC internal channels (VREFINT/VDDCORE). - ST: - Enable ADC1&2 on STM32MP15 DKx boards. - Adopt generic IIO bindings on STM32MP157C ED1 - Add supplies for OV5640 in STM32MP157C EV1 to fix yaml validation. - Fix i2s bindings to match with the YAML validation (DKx boards). - DH: - Rearrange MAC EEPROM. - Rename AV96 sound card. - Adopt generic IIo bindings. - Fix audio routing. -PHYTEC: - Add PHYTEC STM32MP1-3 Dev board based on STM32MP15 PHYTEC SOM. This SOM embeds up to 1GB DDR3LP RAM, up to 1GB eMMC, up to 16 MB QSPI and up to 128 GB NAND flash. * tag 'stm32-dt-for-v6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32: (34 commits) ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2 ARM: dts: stm32: add required supplies of ov5640 in stm32mp157c-ev1 ARM: dts: stm32: Update to generic ADC channel binding on DHSOM systems ARM: dts: stm32: adopt generic iio bindings for adc channels on dhcor-testbench ARM: dts: stm32: adopt generic iio bindings for adc channels on dhcor-drc ARM: dts: stm32: adopt generic iio bindings for adc channels on emstamp-argon ARM: dts: stm32: adopt generic iio bindings for adc channels on stm32mp157c-ed1 ARM: dts: stm32: enable adc on stm32mp15xx-dkx boards ARM: dts: stm32: add vrefint support to adc2 on stm32mp15 ARM: dts: stm32: add vrefint calibration on stm32mp15 ARM: dts: stm32: add adc internal channels to stm32mp15 ARM: dts: stm32: fix ltdc warnings in stm32mp15 boards ARM: dts: stm32: fix dsi warnings on stm32mp15 boards dt-bindings: display: st,stm32-dsi: Remove unnecessary fields ARM: dts: stm32: fix warnings on stm32f469-disco board ARM: dts: stm32: Shorten the AV96 HDMI sound card name ARM: dts: stm32: fix m4_rproc references to use SCMI for stm32mp15 ARM: dts: stm32: Update Cortex-M4 reset declarations on stm32mp15 ARM: dts: stm32: add STM32MP1-based Phytec board ... Link: https://lore.kernel.org/r/08d711de-bb6d-a976-735b-5e18b19818ea@foss.st.com Signed-off-by: Arnd Bergmann commit 868a11b602cfa5159aab0403cc088009b59c074e Merge: 425d827ef91ec c9cb7e72e2931 Author: Arnd Bergmann Date: Tue Jun 20 22:28:39 2023 +0200 Merge tag 'stm32-mp25-for-v6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/newsoc STM32 STM32MP25 for v6.5, round 1 Highlights: ---------- STM32MP25 family is composed of 4 SoCs defined as following: -STM32MP251: common part composed of 1*Cortex-A35, common peripherals like SDMMC, UART, SPI, I2C, PCIe, USB3, parallel and DSI display, 1*ETH ... -STM32MP253: STM32MP251 + 1*Cortex-A35 (dual CPU), a second ETH, CAN-FD and LVDS display. -STM32MP255: STM32MP253 + GPU/AI and video encode/decode. -STM32MP257: STM32MP255 + ETH TSN switch (2+1 ports). A second diversity layer exists for security features/A35 frequency: -STM32MP25xY, "Y" gives information: -Y = A means A35@1.2GHz + no cryp IP and no secure boot. -Y = C means A35@1.2GHz + cryp IP and secure boot. -Y = D means A35@1.5GHz + no cryp IP and no secure boot. -Y = F means A35@1.5GHz + cryp IP and secure boot. This PR adds the STM32MP257F EV1 board support. This board embeds a STM32MP257FAI SoC, with 4GB of DDR4, TSN switch (2+1 ports), 2*USB typeA, 1*USB2 typeC, SNOR OctoSPI, mini PCIe, STPMIC2 for power distribution ... * tag 'stm32-mp25-for-v6.5-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32: (44 commits) MAINTAINERS: add entry for ARM/STM32 ARCHITECTURE arm64: defconfig: enable ARCH_STM32 and STM32 serial driver arm64: dts: st: add stm32mp257f-ev1 board support dt-bindings: stm32: document stm32mp257f-ev1 board arm64: dts: st: introduce stm32mp25 pinctrl files arm64: dts: st: introduce stm32mp25 SoCs family arm64: introduce STM32 family on Armv8 architecture dt-bindings: stm32: add st,stm32mp25-syscfg compatible for syscon pinctrl: stm32: add stm32mp257 pinctrl support dt-bindings: pinctrl: stm32: support for stm32mp257 and additional packages ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2 ARM: dts: stm32: add required supplies of ov5640 in stm32mp157c-ev1 ARM: dts: stm32: Update to generic ADC channel binding on DHSOM systems ARM: dts: stm32: adopt generic iio bindings for adc channels on dhcor-testbench ARM: dts: stm32: adopt generic iio bindings for adc channels on dhcor-drc ARM: dts: stm32: adopt generic iio bindings for adc channels on emstamp-argon ARM: dts: stm32: adopt generic iio bindings for adc channels on stm32mp157c-ed1 ARM: dts: stm32: enable adc on stm32mp15xx-dkx boards ARM: dts: stm32: add vrefint support to adc2 on stm32mp15 ... Link: https://lore.kernel.org/r/080fc303-45c1-6cc0-4c5e-694e730896a6@foss.st.com Signed-off-by: Arnd Bergmann commit b6f3f28f604ba3de4724ad82bea6adb1300c0b5f Author: Michael Schmitz Date: Wed Jun 21 08:17:25 2023 +1200 block: add overflow checks for Amiga partition support The Amiga partition parser module uses signed int for partition sector address and count, which will overflow for disks larger than 1 TB. Use u64 as type for sector address and size to allow using disks up to 2 TB without LBD support, and disks larger than 2 TB with LBD. The RBD format allows to specify disk sizes up to 2^128 bytes (though native OS limitations reduce this somewhat, to max 2^68 bytes), so check for u64 overflow carefully to protect against overflowing sector_t. Bail out if sector addresses overflow 32 bits on kernels without LBD support. This bug was reported originally in 2012, and the fix was created by the RDB author, Joanne Dow . A patch had been discussed and reviewed on linux-m68k at that time but never officially submitted (now resubmitted as patch 1 in this series). This patch adds additional error checking and warning messages. Reported-by: Martin Steigerwald Closes: https://bugzilla.kernel.org/show_bug.cgi?id=43511 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Message-ID: <201206192146.09327.Martin@lichtvoll.de> Cc: # 5.2 Signed-off-by: Michael Schmitz Reviewed-by: Geert Uytterhoeven Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230620201725.7020-4-schmitzmic@gmail.com Signed-off-by: Jens Axboe commit 95a55437dc49fb3342c82e61f5472a71c63d9ed0 Author: Michael Schmitz Date: Wed Jun 21 08:17:24 2023 +1200 block: change all __u32 annotations to __be32 in affs_hardblocks.h The Amiga partition parser module uses signed int for partition sector address and count, which will overflow for disks larger than 1 TB. Use u64 as type for sector address and size to allow using disks up to 2 TB without LBD support, and disks larger than 2 TB with LBD. The RBD format allows to specify disk sizes up to 2^128 bytes (though native OS limitations reduce this somewhat, to max 2^68 bytes), so check for u64 overflow carefully to protect against overflowing sector_t. This bug was reported originally in 2012, and the fix was created by the RDB author, Joanne Dow . A patch had been discussed and reviewed on linux-m68k at that time but never officially submitted (now resubmitted as patch 1 of this series). Patch 3 (this series) adds additional error checking and warning messages. One of the error checks now makes use of the previously unused rdb_CylBlocks field, which causes a 'sparse' warning (cast to restricted __be32). Annotate all 32 bit fields in affs_hardblocks.h as __be32, as the on-disk format of RDB and partition blocks is always big endian. Reported-by: Martin Steigerwald Closes: https://bugzilla.kernel.org/show_bug.cgi?id=43511 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Message-ID: <201206192146.09327.Martin@lichtvoll.de> Cc: # 5.2 Signed-off-by: Michael Schmitz Reviewed-by: Christoph Hellwig Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20230620201725.7020-3-schmitzmic@gmail.com Signed-off-by: Jens Axboe commit fc3d092c6bb48d5865fec15ed5b333c12f36288c Author: Michael Schmitz Date: Wed Jun 21 08:17:23 2023 +1200 block: fix signed int overflow in Amiga partition support The Amiga partition parser module uses signed int for partition sector address and count, which will overflow for disks larger than 1 TB. Use sector_t as type for sector address and size to allow using disks up to 2 TB without LBD support, and disks larger than 2 TB with LBD. This bug was reported originally in 2012, and the fix was created by the RDB author, Joanne Dow . A patch had been discussed and reviewed on linux-m68k at that time but never officially submitted. This patch differs from Joanne's patch only in its use of sector_t instead of unsigned int. No checking for overflows is done (see patch 3 of this series for that). Reported-by: Martin Steigerwald Closes: https://bugzilla.kernel.org/show_bug.cgi?id=43511 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Message-ID: <201206192146.09327.Martin@lichtvoll.de> Cc: # 5.2 Signed-off-by: Michael Schmitz Tested-by: Martin Steigerwald Reviewed-by: Geert Uytterhoeven Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230620201725.7020-2-schmitzmic@gmail.com Signed-off-by: Jens Axboe commit e7e39756363ad5bd83ddeae1063193d0f13870fd Author: Ilpo Järvinen Date: Tue May 2 11:39:23 2023 +0300 PCI/ASPM: Avoid link retraining race PCIe r6.0.1, sec 7.5.3.7, recommends setting the link control parameters, then waiting for the Link Training bit to be clear before setting the Retrain Link bit. This avoids a race where the LTSSM may not use the updated parameters if it is already in the midst of link training because of other normal link activity. Wait for the Link Training bit to be clear before toggling the Retrain Link bit to ensure that the LTSSM uses the updated link control parameters. [bhelgaas: commit log, return 0 (success)/-ETIMEDOUT instead of bool for both pcie_wait_for_retrain() and the existing pcie_retrain_link()] Suggested-by: Lukas Wunner Fixes: 7d715a6c1ae5 ("PCI: add PCI Express ASPM support") Link: https://lore.kernel.org/r/20230502083923.34562-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas Reviewed-by: Lukas Wunner Cc: stable@vger.kernel.org commit 9c7f136433d26592cb4d9cd00b4e15c33d9797c6 Author: Ilpo Järvinen Date: Tue Jun 20 14:49:33 2023 -0500 PCI/ASPM: Factor out pcie_wait_for_retrain() Factor pcie_wait_for_retrain() out from pcie_retrain_link(). No functional change intended. [bhelgaas: split out from https://lore.kernel.org/r/20230502083923.34562-1-ilpo.jarvinen@linux.intel.com] Signed-off-by: Ilpo Järvinen Signed-off-by: Bjorn Helgaas commit f5297a01ee805d7fa569d288ed65fc0f9ac9b03d Author: Bjorn Helgaas Date: Tue Jun 20 14:44:55 2023 -0500 PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link() "pcie_retrain_link" is not a question with a true/false answer, so "bool" isn't quite the right return type. Return 0 for success or -ETIMEDOUT if the retrain failed. No functional change intended. [bhelgaas: based on Ilpo's patch below] Link: https://lore.kernel.org/r/20230502083923.34562-1-ilpo.jarvinen@linux.intel.com Signed-off-by: Bjorn Helgaas commit f3fb462443a5e150599fa6692e660e25c974e7be Author: Wonguk Lee Date: Fri May 5 23:05:16 2023 +0900 fs: jfs: (trivial) Fix typo in dbInitTree function While trying to fix the jfs UBSAN problem reported in syzkaller, (https://syzkaller.appspot.com/bug?id=01abadbd6ae6a08b1f1987aa61554c6b3ac19ff2) I found the typo in the comment of dbInitTree function and fix it. Signed-off-by: Wonguk Lee Signed-off-by: Dave Kleikamp commit ee95b88d71b9cf7ac1085ebc014f161971e1be9a Author: Viacheslav Mitrofanov Date: Fri May 5 07:20:57 2023 +0000 perf: RISC-V: Limit the number of counters returned from SBI Perf gets the number of supported counters from SBI. If it happens that the number of returned counters more than RISCV_MAX_COUNTERS the code trusts it. It does not lead to an immediate problem but can potentially lead to it. Prevent getting more than RISCV_MAX_COUNTERS from SBI. Signed-off-by: Viacheslav Mitrofanov Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20230505072058.1049732-1-v.v.mitrofanov@yadro.com Signed-off-by: Palmer Dabbelt commit ebf51575c8418fcbabe489b3b4a4227c34ed256a Author: Claudiu Beznea Date: Thu Jun 15 13:19:31 2023 +0300 clk: fix typo in clk_hw_register_fixed_rate_parent_data() macro clk_hw_register_fixed_rate_parent_data() 3rd parameter is parent_data not parent_hw. Inner function (__clk_hw_register_fixed_rate()) is called with parent_data parameter as valid. To have this parameter taken into account update the name of the 3rd parameter of clk_hw_register_fixed_rate_parent_data() macro to parent_data. Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20230615101931.581060-1-claudiu.beznea@microchip.com Signed-off-by: Stephen Boyd commit 857922b16bb893d26d5ecd83acf9f20cb28eaea2 Author: Lucas Stach Date: Fri Jun 16 21:18:32 2023 +0200 net: fec: allow to build without PAGE_POOL_STATS Commit 6970ef27ff7f ("net: fec: add xdp and page pool statistics") selected CONFIG_PAGE_POOL_STATS from the FEC driver symbol, making it impossible to build without the page pool statistics when this driver is enabled. The help text of those statistics mentions increased overhead. Allow the user to choose between usefulness of the statistics and the added overhead. Signed-off-by: Lucas Stach Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20230616191832.2944130-1-l.stach@pengutronix.de Signed-off-by: Jakub Kicinski commit b6d972f6898308fbe7e693bf8d44ebfdb1cd2dc4 Author: David Howells Date: Fri Jun 16 12:10:32 2023 +0100 crypto: af_alg/hash: Fix recvmsg() after sendmsg(MSG_MORE) If an AF_ALG socket bound to a hashing algorithm is sent a zero-length message with MSG_MORE set and then recvmsg() is called without first sending another message without MSG_MORE set to end the operation, an oops will occur because the crypto context and result doesn't now get set up in advance because hash_sendmsg() now defers that as long as possible in the hope that it can use crypto_ahash_digest() - and then because the message is zero-length, it the data wrangling loop is skipped. Fix this by handling zero-length sends at the top of the hash_sendmsg() function. If we're not continuing the previous sendmsg(), then just ignore the send (hash_recvmsg() will invent something when called); if we are continuing, then we finalise the request at this point if MSG_MORE is not set to get any error here, otherwise the send is of no effect and can be ignored. Whilst we're at it, remove the code to create a kvmalloc'd scatterlist if we get more than ALG_MAX_PAGES - this shouldn't happen. Fixes: c662b043cdca ("crypto: af_alg/hash: Support MSG_SPLICE_PAGES") Reported-by: syzbot+13a08c0bf4d212766c3c@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/000000000000b928f705fdeb873a@google.com/ Reported-by: syzbot+14234ccf6d0ef629ec1a@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/000000000000c047db05fdeb8790@google.com/ Reported-by: syzbot+4e2e47f32607d0f72d43@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/000000000000bcca3205fdeb87fb@google.com/ Reported-by: syzbot+472626bb5e7c59fb768f@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/000000000000b55d8805fdeb8385@google.com/ Signed-off-by: David Howells Reported-and-tested-by: syzbot+6efc50cc1f8d718d6cb7@syzkaller.appspotmail.com cc: Jens Axboe cc: Matthew Wilcox Acked-by: Herbert Xu Link: https://lore.kernel.org/r/427646.1686913832@warthog.procyon.org.uk Signed-off-by: Jakub Kicinski commit 7fb933e56f77a57ef7cfc59fc34cbbf1b1fa31ff Author: Fei Shao Date: Mon Jun 19 11:22:53 2023 +0800 clk: Fix memory leak in devm_clk_notifier_register() devm_clk_notifier_register() allocates a devres resource for clk notifier but didn't register that to the device, so the notifier didn't get unregistered on device detach and the allocated resource was leaked. Fix the issue by registering the resource through devres_add(). This issue was found with kmemleak on a Chromebook. Fixes: 6d30d50d037d ("clk: add devm variant of clk_notifier_register") Signed-off-by: Fei Shao Link: https://lore.kernel.org/r/20230619112253.v2.1.I13f060c10549ef181603e921291bdea95f83033c@changeid Reviewed-by: Dan Carpenter Signed-off-by: Stephen Boyd commit 462a3daad679406eed5d31b6bed8a19c236e1352 Author: Arnd Bergmann Date: Fri Jun 16 11:29:54 2023 +0200 net: phy: mediatek: fix compile-test dependencies The new phy driver attempts to select a driver from another subsystem, but that fails when the NVMEM subsystem is disabled: WARNING: unmet direct dependencies detected for NVMEM_MTK_EFUSE Depends on [n]: NVMEM [=n] && (ARCH_MEDIATEK [=n] || COMPILE_TEST [=y]) && HAS_IOMEM [=y] Selected by [y]: - MEDIATEK_GE_SOC_PHY [=y] && NETDEVICES [=y] && PHYLIB [=y] && (ARM64 && ARCH_MEDIATEK [=n] || COMPILE_TEST [=y]) I could not see an actual compile time dependency, so presumably this is only needed for for working correctly but not technically a dependency on that particular nvmem driver implementation, so it would likely be safe to remove the select for compile testing. To keep the spirit of the original 'select', just replace this with a 'depends on' that ensures that the driver will work but does not get in the way of build testing. Fixes: 98c485eaf509b ("net: phy: add driver for MediaTek SoC built-in GE PHYs") Signed-off-by: Arnd Bergmann Reviewed-by: Simon Horman Acked-by: Randy Dunlap Tested-by: Randy Dunlap # build-tested Reviewed-by: Daniel Golle Link: https://lore.kernel.org/r/20230616093009.3511692-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit bd73d1fd63d4f67dc78640c9ae4f83e20a021d76 Author: Rob Herring Date: Fri Jun 9 12:13:47 2023 -0600 clk: mvebu: Iterate over possible CPUs instead of DT CPU nodes Rework iterating over DT CPU nodes to iterate over possible CPUs instead. There's no need to walk the DT CPU nodes again. Possible CPUs is equal to the number of CPUs defined in the DT. Using the "reg" value for an array index is fragile as it assumes "reg" is 0-N which often is not the case. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20230327-mvebu-clk-fixes-v2-3-8333729ee45d@kernel.org Signed-off-by: Stephen Boyd commit 1949c0ebc8d660d35ea968ed609c528076b7d44f Author: Rob Herring Date: Fri Jun 9 12:13:46 2023 -0600 clk: mvebu: Use of_get_cpu_hwid() to read CPU ID Use of_get_cpu_hwid() rather than the open coded reading of the CPU nodes "reg" property. The existing code is in fact wrong as the "reg" address cells size is 2 cells for arm64. The existing code happens to work because the DTS files are wrong as well. Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20230327-mvebu-clk-fixes-v2-2-8333729ee45d@kernel.org Signed-off-by: Stephen Boyd commit 1ab391684c9e195c05834def0d08779500b0b319 Author: Rob Herring Date: Fri Jun 9 12:13:45 2023 -0600 MAINTAINERS: Add Marvell mvebu clock drivers drivers/clk/mvebu/ is missing a maintainers entry. Add it to the existing entry for the Marvell mvebu platforms. Reviewed-by: Andrew Lunn Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20230327-mvebu-clk-fixes-v2-1-8333729ee45d@kernel.org Signed-off-by: Stephen Boyd commit 6d4e80db4ebe76c4a4b6ffb6547cb168275204ef Author: Min Li Date: Mon Jun 19 09:12:14 2023 +0000 block: add capacity validation in bdev_add_partition() In the function bdev_add_partition(),there is no check that the start and end sectors exceed the size of the disk before calling add_partition. When we call the block's ioctl interface directly to add a partition, and the capacity of the disk is set to 0 by driver,the command will continue to execute. Signed-off-by: Min Li Reviewed-by: Christoph Hellwig Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/20230619091214.31615-1-min15.li@samsung.com Signed-off-by: Jens Axboe commit 9a72a02456a839676fe8f220a44ef00951596047 Author: Jingbo Xu Date: Tue Jun 13 16:40:08 2023 +0800 block: fine-granular CAP_SYS_ADMIN for Persistent Reservation Allow of unprivileged Persistent Reservation operations on devices if the write permission check on the device node has passed. brw-rw---- 1 root disk 259, 0 Jun 13 07:09 /dev/nvme0n1 In the example above, the "disk" group of nvme0n1 is also allowed to make reservations on the device even without CAP_SYS_ADMIN. Signed-off-by: Jingbo Xu Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230613084008.93795-3-jefflexu@linux.alibaba.com Signed-off-by: Jens Axboe commit 12629621669b239445727256d1a5dab616b30deb Author: Jingbo Xu Date: Tue Jun 13 16:40:07 2023 +0800 block: disallow Persistent Reservation on partitions Refuse Persistent Reservation operations on partitions as reservation on partitions doesn't make sense. Besides, introduce blkdev_pr_allowed() helper, where more policies could be placed here later. Signed-off-by: Jingbo Xu Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230613084008.93795-2-jefflexu@linux.alibaba.com Signed-off-by: Jens Axboe commit d0d3e218d50bc93282df7bded9193e6fc9ccda48 Author: Thomas Richter Date: Wed Jun 14 09:37:42 2023 +0200 s390/cpum_cf: open access to hwctr device for CAP_PERFMON privileged process The device /dev/hwctr was introduced to access complete CPU Measurement facility counter sets via an ioctl system call. The access the to device is limited to privileged processes running as root or superuser. The capability CAP_SYS_ADMIN is required. The device permissions are read/write for the device owner root. There is no need for this restriction. Make the device access permission read/write for all and reduce the capabilities to CAP_PERFMON. Any user space program with the CAP_PERFMON capability assigned to it can now read and display the CPU Measurement facility counter sets. For more details on perf tool usage and security, see linux documentation in Documentation/admin-guide/perf-security.rst. Signed-off-by: Thomas Richter Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 11458e2b3ffa0e3798f392695d7aec210ac14efd Author: Sumanth Korikkar Date: Mon Jun 5 09:55:27 2023 +0200 s390/module: fix rela calculation for R_390_GOTENT During module load, module layout allocation occurs by initially allowing the architecture to frob the sections. This is performed via module_frob_arch_sections(). However, the size of each module memory types like text,data,rodata etc are updated correctly only after layout_sections(). After calculation of required module memory sizes for each types, move_module() is responsible for allocating the module memory for each type from modules vaddr range. Considering the sequence above, module_frob_arch_sections() updates the module mod_arch_specific got_offset before module memory text type size is fully updated in layout_sections(). Hence mod_arch_specific got_offset points to currently zero. As per s390 ABI, R_390_GOTENT : (G + O + A - P) >> 1 where G=me->mem[MOD_TEXT].base+me->arch.got_offset O=info->got_offset A=rela->r_addend P=loc fix R_390_GOTENT calculation in apply_rela(). Note: currently this doesn't break anything because me->arch.got_offset is zero. However, reordering of functions in the future could break it. Signed-off-by: Sumanth Korikkar Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit c70505434c8defb111326a143e2dd2be09778593 Author: Alexander Gordeev Date: Tue Jun 6 15:30:56 2023 +0200 s390/boot: fix physmem_info virtual vs physical address confusion Fix virtual vs physical address confusion (which currently are the same). Reviewed-by: Vasily Gorbik Signed-off-by: Alexander Gordeev commit 3e8261003bd28208986d3c42004510083c086e24 Author: Alexander Gordeev Date: Fri May 26 14:30:30 2023 +0200 s390/kasan: avoid short by one page shadow memory Kernel Address Sanitizer uses 3 bits per byte to encode memory. That is the number of bits the start and end address of a memory range is shifted right when the corresponding shadow memory is created for that memory range. The used memory mapping routine expects page-aligned addresses, while the above described 3-bit shift might turn the shadow memory range start and end boundaries into non-page-aligned in case the size of the original memory range is less than (PAGE_SIZE << 3). As result, the resulting shadow memory range could be short on one page. Align on page boundary the start and end addresses when mapping a shadow memory range and avoid the described issue in the future. Note, that does not fix a real problem, since currently no virtual regions of size less than (PAGE_SIZE << 3) exist. Reviewed-by: Vasily Gorbik Signed-off-by: Alexander Gordeev commit 2ed8b509753a0454b52b2d72e982265472c8d861 Author: Alexander Gordeev Date: Fri May 26 14:30:29 2023 +0200 s390/kasan: fix insecure W+X mapping warning Since commit 3b5c3f000c2e ("s390/kasan: move shadow mapping to decompressor") the decompressor establishes mappings for the shadow memory and sets initial protection attributes to RWX. The decompressed kernel resets protection to RW+NX later on. In case a shadow memory range is not aligned on page boundary (e.g. as result of mem= kernel command line parameter use), the "Checked W+X mappings: FAILED, 1 W+X pages found" warning hits. Reported-by: Vasily Gorbik Fixes: 557b19709da9 ("s390/kasan: move shadow mapping to decompressor") Reviewed-by: Vasily Gorbik Signed-off-by: Alexander Gordeev commit f471c6585c7f2f168b8eb2d19e2d6e5f22a6645f Author: Christophe JAILLET Date: Tue Jun 13 22:30:28 2023 +0200 s390/crash: use the correct type for memory allocation get_elfcorehdr_size() returns a size_t, so there is no real point to store it in a u32. Turn 'alloc_size' into a size_t. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/0756118c9058338f3040edb91971d0bfd100027b.1686688212.git.christophe.jaillet@wanadoo.fr Signed-off-by: Alexander Gordeev commit 4e13c7a55cf752887f2b8d8008711dbbc64ea796 Author: Dmitry Baryshkov Date: Sun May 7 20:53:35 2023 +0300 clk: qcom: mmcc-msm8974: fix MDSS_GDSC power flags Using PWRSTS_RET on msm8974's MDSS_GDSC causes display to stop working. The gdsc doesn't fully come out of retention mode. Change it's pwrsts flags to PWRSTS_OFF_ON. Fixes: d399723950c4 ("clk: qcom: gdsc: Fix the handling of PWRSTS_RET support") Signed-off-by: Dmitry Baryshkov Reviewed-by: Rajendra Nayak Tested-by: Luca Weiss Link: https://lore.kernel.org/r/20230507175335.2321503-2-dmitry.baryshkov@linaro.org Signed-off-by: Bjorn Andersson commit 11509910c599cbd04585ec35a6d5e1a0053d84c1 Author: Siddh Raman Pant Date: Tue Jun 20 22:17:00 2023 +0530 jfs: jfs_dmap: Validate db_l2nbperpage while mounting In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree(). db_l2nbperpage, which is the log2 number of blocks per page, is passed as an argument to BLKTODMAP which uses it for shifting. Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is too big. This happens because the large value is set without any validation in dbMount() at line 181. Thus, make sure that db_l2nbperpage is correct while mounting. Max number of blocks per page = Page size / Min block size => log2(Max num_block per page) = log2(Page size / Min block size) = log2(Page size) - log2(Min block size) => Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE Reported-and-tested-by: syzbot+d2cd27dcf8e04b232eb2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?id=2a70a453331db32ed491f5cbb07e81bf2d225715 Cc: stable@vger.kernel.org Suggested-by: Dave Kleikamp Signed-off-by: Siddh Raman Pant Signed-off-by: Dave Kleikamp commit 4681dacadeefa5ca6017e00736adc1d7dc963c6a Author: Fangrui Song Date: Sun Apr 23 22:32:10 2023 +0000 riscv: replace deprecated scall with ecall scall is a deprecated alias for ecall. ecall is used in several places, so there is no assembler compatibility concern. Signed-off-by: Fangrui Song Link: https://lore.kernel.org/r/20230423223210.126948-1-maskray@google.com Signed-off-by: Palmer Dabbelt commit 08e3ed12ca8615b078ea19488fb45b084e5de16b Author: Maciej W. Rozycki Date: Sun Jun 11 18:20:06 2023 +0100 PCI: Add failed link recovery for device reset events Request failed link recovery with any upstream PCIe bridge where a device has not come back after reset within PCI_RESET_WAIT time. Reset the polling interval if recovery succeeded, otherwise continue as usual. [bhelgaas: inline pcie_parent_link_retrain()] Link: https://lore.kernel.org/r/alpine.DEB.2.21.2306111631050.64925@angie.orcam.me.uk Signed-off-by: Maciej W. Rozycki Signed-off-by: Bjorn Helgaas commit a89c82249c3763780522f763dd2e615e2ea114de Author: Maciej W. Rozycki Date: Sun Jun 11 18:20:10 2023 +0100 PCI: Work around PCIe link training failures Attempt to handle cases such as with a downstream port of the ASMedia ASM2824 PCIe switch where link training never completes and the link continues switching between speeds indefinitely with the data link layer never reaching the active state. It has been observed with a downstream port of the ASMedia ASM2824 Gen 3 switch wired to the upstream port of the Pericom PI7C9X2G304 Gen 2 switch, using a Delock Riser Card PCI Express x1 > 2 x PCIe x1 device, P/N 41433, wired to a SiFive HiFive Unmatched board. In this setup the switches should negotiate a link speed of 5.0GT/s, falling back to 2.5GT/s if necessary. Instead the link continues oscillating between the two speeds, at the rate of 34-35 times per second, with link training reported repeatedly active ~84% of the time. Limiting the target link speed to 2.5GT/s with the upstream ASM2824 device makes the two switches communicate correctly. Removing the speed restriction afterwards makes the two devices switch to 5.0GT/s then. Make use of these observations and detect the inability to train the link by checking for the Data Link Layer Link Active status bit being off while the Link Bandwidth Management Status indicating that hardware has changed the link speed or width in an attempt to correct unreliable link operation. Restrict the speed to 2.5GT/s then with the Target Link Speed field, request a retrain and wait 200ms for the data link to go up. If this is successful, lift the restriction, letting the devices negotiate a higher speed. Also check for a 2.5GT/s speed restriction the firmware may have already arranged and lift it too with ports of devices known to continue working afterwards (currently only ASM2824), that already report their data link being up. [bhelgaas: reorder and squash stubs from https://lore.kernel.org/r/alpine.DEB.2.21.2306111619570.64925@angie.orcam.me.uk to avoid adding stubs that do nothing] Link: https://lore.kernel.org/r/alpine.DEB.2.21.2203022037020.56670@angie.orcam.me.uk/ Link: https://source.denx.de/u-boot/u-boot/-/commit/a398a51ccc68 Link: https://lore.kernel.org/r/alpine.DEB.2.21.2305310038540.59226@angie.orcam.me.uk Signed-off-by: Maciej W. Rozycki Signed-off-by: Bjorn Helgaas commit 7604bc294c19fe70fb7d9091731a950b16249c51 Author: Maciej W. Rozycki Date: Sun Jun 11 18:19:57 2023 +0100 PCI: Use pcie_wait_for_link_status() in pcie_wait_for_link_delay() Remove a DLLLA status bit polling loop from pcie_wait_for_link_delay() and call almost identical code in pcie_wait_for_link_status() instead. This reduces the lower bound on the polling interval from 10ms to 1ms, possibly increasing the CPU load on the system in favour to reducing the wait time. Link: https://lore.kernel.org/r/alpine.DEB.2.21.2306111611170.64925@angie.orcam.me.uk Signed-off-by: Maciej W. Rozycki Signed-off-by: Bjorn Helgaas commit 680e9c47a2293bcc6a67a6f13f3b23d4c456885b Author: Maciej W. Rozycki Date: Sun Jun 11 18:19:53 2023 +0100 PCI: Add support for polling DLLLA to pcie_retrain_link() Let the caller of pcie_retrain_link() specify whether they want to use the LT bit or the DLLLA bit of the Link Status Register to determine if link training has completed. It is up to the caller to verify whether the use of the DLLLA bit, the implementation of which is optional, is valid for the device requested. Link: https://lore.kernel.org/r/alpine.DEB.2.21.2306110310540.64925@angie.orcam.me.uk Signed-off-by: Maciej W. Rozycki Signed-off-by: Bjorn Helgaas commit 37edd87eb621a96d33ee4eefe4b54cfc5a7e03df Author: Maciej W. Rozycki Date: Sun Jun 11 18:19:41 2023 +0100 PCI: Export pcie_retrain_link() for use outside ASPM Export pcie_retrain_link() for link retrain needs outside ASPM. Struct pcie_link_state is local to ASPM and only used by pcie_retrain_link() to get at the associated PCI device, so change the operand and adjust the lone call site accordingly. Document the interface. No functional change at this point. Link: https://lore.kernel.org/r/alpine.DEB.2.21.2306110229010.64925@angie.orcam.me.uk Signed-off-by: Maciej W. Rozycki Signed-off-by: Bjorn Helgaas commit 33a176abcc4cd4ed3d65512ed96d7b73f2565ed7 Author: Maciej W. Rozycki Date: Sun Jun 11 18:19:19 2023 +0100 PCI: Export PCIe link retrain timeout Convert LINK_RETRAIN_TIMEOUT from jiffies to milliseconds, accordingly rename to PCIE_LINK_RETRAIN_TIMEOUT_MS, and make available via "pci.h" for the PCI core to use. Use in pcie_wait_for_link_delay(). Link: https://lore.kernel.org/r/alpine.DEB.2.21.2305310030280.59226@angie.orcam.me.uk Signed-off-by: Maciej W. Rozycki Signed-off-by: Bjorn Helgaas commit 07a8d698de50c4740ac6f709c43e23a6da6e4dbc Author: Maciej W. Rozycki Date: Sun Jun 11 18:19:23 2023 +0100 PCI: Execute quirk_enable_clear_retrain_link() earlier Make quirk_enable_clear_retrain_link() an early quirk so that any later fixups can rely on dev->clear_retrain_link to have been already initialised. [bhelgaas: reorder to just before it becomes possible to call pcie_retrain_link() earlier] Link: https://lore.kernel.org/r/alpine.DEB.2.21.2305310049000.59226@angie.orcam.me.uk Signed-off-by: Maciej W. Rozycki Signed-off-by: Bjorn Helgaas commit 3c0ec896a4b42bc4751c71cac5996d23d3b648ae Author: Maciej W. Rozycki Date: Sun Jun 11 18:19:49 2023 +0100 PCI/ASPM: Factor out waiting for link training to complete Move code polling for the Link Training bit to clear into a function of its own. [bhelgaas: reorder to clean up before exposing to PCI core] Link: https://lore.kernel.org/r/alpine.DEB.2.21.2306111605060.64925@angie.orcam.me.uk Signed-off-by: Maciej W. Rozycki Signed-off-by: Bjorn Helgaas commit fd6e6e38ebe5db99b8eeab0abef8cc930301a677 Author: Maciej W. Rozycki Date: Wed Jun 14 15:09:06 2023 -0500 PCI/ASPM: Avoid unnecessary pcie_link_state use [bhelgaas: extract from expose patch, reorder to clean up before exposing] Link: https://lore.kernel.org/r/alpine.DEB.2.21.2306110229010.64925@angie.orcam.me.uk Signed-off-by: Maciej W. Rozycki Signed-off-by: Bjorn Helgaas commit 6735041fd8460a94ae367830ece8ef65f191227a Author: Yang Li Date: Wed Jun 14 09:43:28 2023 +0800 RDMA/cma: Remove NULL check before dev_{put, hold} The call netdev_{put, hold} of dev_{put, hold} will check NULL, so there is no need to check before using dev_{put, hold}, remove it to silence the warning: ./drivers/infiniband/core/cma.c:4812:2-9: WARNING: NULL check before dev_{put, hold} functions is not needed. Link: https://lore.kernel.org/r/20230614014328.14007-1-yang.lee@linux.alibaba.com Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=5521 Signed-off-by: Yang Li Signed-off-by: Jason Gunthorpe commit 350b6dd4b2f876f1aa0d45a422b17b8377517762 Author: Bob Pearson Date: Mon Jun 12 11:22:45 2023 -0500 RDMA/rxe: Simplify cq->notify code The flags parameter to the request notify verb is a bitmask. But, rxe driver treats cq->notify as an int. If someone ever set both the IB_CQ_SOLICITED and the IB_CQ_NEXT_COMP bits rxe_cq_post could fail to generate a completion event. This patch treats the notify flags as a bit mask consistently and can handle the above case correctly. Link: https://lore.kernel.org/r/20230612162244.20038-1-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson Signed-off-by: Jason Gunthorpe commit 4bfb0c9af832a182a54e549123a634e0070c8d4f Author: Christoph Hellwig Date: Tue Jun 20 13:32:35 2023 +0200 io_uring: add helpers to decode the fixed file file_ptr Remove all the open coded magic on slot->file_ptr by introducing two helpers that return the file pointer and the flags instead. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230620113235.920399-9-hch@lst.de Signed-off-by: Jens Axboe commit f432c8c8c12b84c5465b1ffddb6feb7d6b19c1ca Author: Christoph Hellwig Date: Tue Jun 20 13:32:34 2023 +0200 io_uring: use io_file_from_index in io_msg_grab_file Use io_file_from_index instead of open coding it. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230620113235.920399-8-hch@lst.de Signed-off-by: Jens Axboe commit 60a666f097a8d722a3907925d21e363add289c8c Author: Christoph Hellwig Date: Tue Jun 20 13:32:33 2023 +0200 io_uring: use io_file_from_index in __io_sync_cancel Use io_file_from_index instead of open coding it. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230620113235.920399-7-hch@lst.de Signed-off-by: Jens Axboe commit 8487f083c6ff6e02b2ec14f22ef2b0079a1b6425 Author: Christoph Hellwig Date: Tue Jun 20 13:32:32 2023 +0200 io_uring: return REQ_F_ flags from io_file_get_flags Two of the three callers want them, so return the more usual format, and shift into the FFS_ form only for the fixed file table. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230620113235.920399-6-hch@lst.de Signed-off-by: Jens Axboe commit 3beed235d1a1d0a4ab093ab67ea6b2841e9d4fa2 Author: Christoph Hellwig Date: Tue Jun 20 13:32:31 2023 +0200 io_uring: remove io_req_ffs_set Just checking the flag directly makes it a lot more obvious what is going on here. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230620113235.920399-5-hch@lst.de Signed-off-by: Jens Axboe commit b57c7cd1c17616ae9db5614525ba703f384afd05 Author: Christoph Hellwig Date: Tue Jun 20 13:32:30 2023 +0200 io_uring: remove a confusing comment above io_file_get_flags The SCM inflight mechanism has nothing to do with the fact that a file might be a regular file or not and if it supports non-blocking operations. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230620113235.920399-4-hch@lst.de Signed-off-by: Jens Axboe commit 53cfd5cea7f36bac7f3d45de4fea77e0c8d57aee Author: Christoph Hellwig Date: Tue Jun 20 13:32:29 2023 +0200 io_uring: remove the mode variable in io_file_get_flags The variable is only once now, so don't bother with it. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230620113235.920399-3-hch@lst.de Signed-off-by: Jens Axboe commit b9a6c9459a5aec7bfd9b763554d15148367f1806 Author: Christoph Hellwig Date: Tue Jun 20 13:32:28 2023 +0200 io_uring: remove __io_file_supports_nowait Now that this only checks O_NONBLOCK and FMODE_NOWAIT, the helper is complete overkilļ, and the comments are confusing bordering to wrong. Just inline the check into the caller. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20230620113235.920399-2-hch@lst.de Signed-off-by: Jens Axboe commit 4cea2821882b06cd2c9c896d501f58746c16a90b Author: Stephan Gerhold Date: Wed Jun 14 21:20:43 2023 +0200 of: reserved_mem: Use stable allocation order sort() in Linux is based on heapsort which is not a stable sort algorithm - equal elements are being reordered. For reserved memory in the device tree this happens mainly for dynamic allocations: They do not have an address to sort with, so they are reordered somewhat randomly when adding/removing other unrelated reserved memory nodes. Functionally this is not a big problem, but it's confusing during development when all the addresses change after adding unrelated reserved memory nodes. Make the order stable by sorting dynamic allocations according to the node order in the device tree. Static allocations are not affected by this because they are still sorted by their (fixed) address. Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20230510-dt-resv-bottom-up-v2-2-aeb2afc8ac25@gerhold.net Signed-off-by: Rob Herring commit 83ba7361e168cd7b24aa95d2aefb4e31e3cc6cd0 Author: Stephan Gerhold Date: Wed Jun 14 21:20:42 2023 +0200 of: reserved_mem: Try to keep range allocations contiguous Right now dynamic reserved memory regions are allocated either bottom-up or top-down, depending on the memblock setting of the architecture. This is fine when the address is arbitrary. However, when using "alloc-ranges" the regions are often placed somewhere in the middle of (free) RAM, even if the range starts or ends next to another (static) reservation. Try to detect this situation, and choose explicitly between bottom-up or top-down to allocate the memory close to the other reservations: 1. If the "alloc-range" starts at the end or inside an existing reservation, use bottom-up. 2. If the "alloc-range" ends at the start or inside an existing reservation, use top-down. 3. If both or none is the case, keep the current (architecture-specific) behavior. There are plenty of edge cases where only a more complex algorithm would help, but even this simple approach helps in many cases to keep the reserved memory (and therefore also the free memory) contiguous. Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20230510-dt-resv-bottom-up-v2-1-aeb2afc8ac25@gerhold.net Signed-off-by: Rob Herring commit 62149a745eee03194f025021640c80b84353089b Author: Miklos Szeredi Date: Tue Jun 20 10:57:49 2023 +0200 ovl: add Amir as co-maintainer Amir has implemented lots of features in overlayfs and is very active in maintenance. Make this official in the MAINTAINERS file. Signed-off-by: Miklos Szeredi Signed-off-by: Amir Goldstein commit ceecc2d87f007f9fc34e847401282111c0c29786 Author: Christian Brauner Date: Tue Jun 20 13:42:38 2023 +0200 ovl: reserve ability to reconfigure mount options with new mount api Using the old mount api to remount an overlayfs superblock via mount(MS_REMOUNT) all mount options will be silently ignored. For example, if you create an overlayfs mount: mount -t overlay overlay -o lowerdir=/mnt/a:/mnt/b,upperdir=/mnt/upper,workdir=/mnt/work /mnt/merged and then issue a remount via: # force mount(8) to use mount(2) export LIBMOUNT_FORCE_MOUNT2=always mount -t overlay overlay -o remount,WOOTWOOT,lowerdir=/DOESNT-EXIST /mnt/merged with completely nonsensical mount options whatsoever it will succeed nonetheless. This prevents us from every changing any mount options we might introduce in the future that could reasonably be changed during a remount. We don't need to carry this issue into the new mount api port. Similar to FUSE we can use the fs_context::oldapi member to figure out that this is a request coming through the legacy mount api. If we detect it we continue silently ignoring all mount options. But for the new mount api we simply report that mount options cannot currently be changed. This will allow us to potentially alter mount properties for new or even old properties. It any case, silently ignoring everything is not something new apis should do. Signed-off-by: Christian Brauner Signed-off-by: Amir Goldstein commit 58b1294dd1d65bb62f08dddbf418f954210c2057 Author: Tiezhu Yang Date: Sun Apr 23 09:42:26 2023 +0800 riscv: uprobes: Restore thread.bad_cause thread.bad_cause is saved in arch_uprobe_pre_xol(), it should be restored in arch_uprobe_{post,abort}_xol() accordingly, otherwise the save operation is meaningless, this change is similar with x86 and powerpc. Signed-off-by: Tiezhu Yang Acked-by: Oleg Nesterov Reviewed-by: Guo Ren Fixes: 74784081aac8 ("riscv: Add uprobes supported") Link: https://lore.kernel.org/r/1682214146-3756-1-git-send-email-yangtiezhu@loongson.cn Signed-off-by: Palmer Dabbelt commit 648321fa0d970c04b4327ac1a053abf43d285931 Author: Jisheng Zhang Date: Wed May 24 00:59:42 2023 +0800 riscv: mm: try VMA lock-based page fault handling first Attempt VMA lock-based page fault handling first, and fall back to the existing mmap_lock-based handling if that fails. A simple running the ebizzy benchmark on Lichee Pi 4A shows that PER_VMA_LOCK can improve the ebizzy benchmark by about 32.68%. In theory, the more CPUs, the bigger improvement, but I don't have any HW platform which has more than 4 CPUs. This is the riscv variant of "x86/mm: try VMA lock-based page fault handling first". Signed-off-by: Jisheng Zhang Reviewed-by: Guo Ren Reviewed-by: Suren Baghdasaryan Link: https://lore.kernel.org/r/20230523165942.2630-1-jszhang@kernel.org Signed-off-by: Palmer Dabbelt commit 02478c98f2c2da448e2cb3fd95b209a84850e09b Author: Krzysztof Kozlowski Date: Fri Jun 9 16:07:54 2023 +0200 dt-bindings: arm: drop unneeded quotes and use absolute /schemas path Cleanup bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Also absolute path starting with /schemas is preferred. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20230609140754.65158-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 7123c05c06aa312fa25bcadf42c7c66b14e9b479 Author: Krzysztof Kozlowski Date: Fri Jun 9 16:07:49 2023 +0200 dt-bindings: firmware: arm,scmi: drop unneeded quotes and use absolute /schemas path Cleanup bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Also absolute path starting with /schemas is preferred. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230609140749.65102-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit e746c79c1881b3c8d5e160f2e3dc1537643e7edb Author: Krzysztof Kozlowski Date: Fri Jun 9 16:07:42 2023 +0200 dt-bindings: dvfs: drop unneeded quotes Cleanup bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230609140742.65018-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit a835321b3c2e822f362ee33a79e44667e98c5028 Author: Krzysztof Kozlowski Date: Fri Jun 9 16:07:38 2023 +0200 dt-bindings: gpu: drop unneeded quotes Cleanup bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230609140738.64958-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit e099083e7f8f25ae05364b3d8f6e0f1a59fd60c0 Author: Krzysztof Kozlowski Date: Fri Jun 9 16:07:35 2023 +0200 dt-bindings: i3c: silvaco,i3c-master: drop unneeded quotes Cleanup bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230609140735.64855-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit ee678e5dffc0b0d63b4a2ec6129063339435bfc5 Author: Bob Pearson Date: Tue Jun 13 12:16:55 2023 -0500 RDMA/rxe: Fixes mr access supported list A recent patch incorrectly did not include IB_ACCESS_RELAXED_ORDERING in the list of supported access flags for the rxe driver. The driver actually does nothing related to relaxed ordering but it causes no problems to include it as supported but with no effect. This change caused ib_send_bw and friends to not run correctly. The correct approach is for the driver to allow any of the optional access flags and otherwise ignore them. This patch adds IB_ACCESS_OPTIONAL to the list of rxe supported flags. Fixes: 02ed253770fb ("RDMA/rxe: Introduce rxe access supported flags") Link: https://lore.kernel.org/r/20230613171654.19334-1-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson Signed-off-by: Jason Gunthorpe commit 0d36b50ef775c42a6e58fca417d8d8ddc618fcdd Author: Krzysztof Kozlowski Date: Fri Jun 9 16:07:02 2023 +0200 dt-bindings: rockchip: grf: drop unneeded quotes Cleanup bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20230609140702.64589-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit 97cc0337dd744b46600298e1bc001729c3ce1d05 Author: Krzysztof Kozlowski Date: Fri Jun 9 16:06:54 2023 +0200 dt-bindings: spmi: mtk,spmi-mtk-pmif: drop unneeded quotes Cleanup bindings dropping unneeded quotes. Once all these are fixed, checking for this can be enabled in yamllint. Signed-off-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20230609140655.64529-1-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring commit fc4ea4229c2b2dca0bffc12eee6973e353c20086 Author: Alexander Aring Date: Tue Jun 20 10:15:57 2023 -0400 fs: dlm: remove filter local comms on close The current way how lowcomms is configured is due configfs entries. Each comms configfs entry will create a lowcomms connection. Even the local connection itself will be stored as a lowcomms connection, although most functionality for a local lowcomms connection struct is not necessary. Now in some scenarios we will see that dlm_controld reports a -EEXIST when configure a node via configfs: ... /sys/kernel/config/dlm/cluster/comms/1/addr: write failed: 17 -1 Doing a: cat /sys/kernel/config/dlm/cluster/comms/1/addr_list reported nothing. This was being seen on cluster with nodeid 1 and it's local configuration. To be sure the configfs entries are in sync with lowcomms connection structures we always call dlm_midcomms_close() to be sure the lowcomms connection gets removed when the configfs entry gets dropped. Before commit 07ee38674a0b ("fs: dlm: filter ourself midcomms calls") it was just doing this by accident and the filter by doing: if (nodeid == dlm_our_nodeid()) return 0; inside dlm_midcomms_close() was never been hit because drop_comm() sets local_comm to NULL and cause that dlm_our_nodeid() returns always the invalid nodeid 0. Fixes: 07ee38674a0b ("fs: dlm: filter ourself midcomms calls") Cc: stable@vger.kernel.org Signed-off-by: Alexander Aring Signed-off-by: David Teigland commit 0a08778126284481c300336f1ba3d7b1906851a5 Author: Colin Ian King Date: Tue Jun 20 10:56:20 2023 +0100 ASoC: tas2781: Fix spelling mistake "calibraiton" -> "calibration" There is a spelling mistake in a dev_err message. Fix it. Also fix grammar and add space between last word and (%d)". Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20230620095620.2522058-1-colin.i.king@gmail.com Signed-off-by: Mark Brown commit d4b2aee1be41adbbbe9132104620dfc70032a044 Merge: 29735f6fb0f57 c317d148a2b02 Author: Mark Brown Date: Tue Jun 20 15:24:06 2023 +0100 ASoC: qcom: audioreach: add compress offload Merge series from Srinivas Kandagatla : This patchset adds compressed offload support to Qualcomm audioreach drivers. Currently it supports AAC, MP3 and FALC along with gapless. Tested this on SM8450 and sc7280. commit 29735f6fb0f57c8010c9486216361c0f68c90226 Merge: 246c9f586c7c8 9321015a5f408 Author: Mark Brown Date: Tue Jun 20 15:23:56 2023 +0100 ASoC: Use maple tree register cache for Everest Semi Merge series from Mark Brown : Several of the Everest Semi CODECs only support single register read and write operations and therefore do not benefit from using the rbtree cache over the maple tree cache, convert them to the more modern maple tree cache. commit 246c9f586c7c840b88efc874c949706d3f7df30c Merge: 6f80197f40515 eefc27ea14ad6 Author: Mark Brown Date: Tue Jun 20 15:23:47 2023 +0100 ASoC: Convert Realtek I2C drivers to use maple tree Merge series from Mark Brown : Many of the Realtek I2C/SPI devices only support single register read and write operations so don't benefit from using the rbtree cache instead of the more modern maple tree cache, convert them to maple tree. commit 99f2d956e1fa3ead355cde4fd1a914e54cfe0a40 Author: Ivan Orlov Date: Tue Jun 20 11:44:17 2023 +0200 USB: gadget: f_hid: make hidg_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the hidg_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at load time. Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230620094412.508580-11-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 2c10e7a049dad73503da41c7754add91cb7b35d9 Author: Ivan Orlov Date: Tue Jun 20 11:44:16 2023 +0200 USB: gadget: f_printer: make usb_gadget_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the usb_gadget_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at load time. Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230620094412.508580-10-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit e571e843f0ce005503471707fa02e892ba2a6f35 Author: Ivan Orlov Date: Tue Jun 20 11:44:15 2023 +0200 USB: mon: make mon_bin_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the mon_bin_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at load time. Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230620094412.508580-9-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 8e99143649ad4838d58aeac9da43a5726b841366 Author: Ivan Orlov Date: Tue Jun 20 11:44:14 2023 +0200 USB: gadget: udc: core: make udc_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the udc_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at load time. Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230620094412.508580-8-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 044a61158b9e00ee4b69bc4fa0f3e720b5dd669a Author: Ivan Orlov Date: Tue Jun 20 11:44:13 2023 +0200 USB: roles: make role_class a static const structure Now that the driver core allows for struct class to be in read-only memory, move the role_class structure to be declared at build time placing it into read-only memory, instead of having to be dynamically allocated at load time. Suggested-by: Greg Kroah-Hartman Signed-off-by: Ivan Orlov Link: https://lore.kernel.org/r/20230620094412.508580-7-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman commit 34d401a1910dde53356fa5ac03649085fd20e5e3 Author: Piyush Mehta Date: Mon Jun 19 16:20:32 2023 +0530 dt-bindings: usb: dwc3: Add interrupt-names property support for wakeup interrupt The hibernation feature enabled for Xilinx Versal NET SoC in DWC3 IP. As the DWC3 IP supports the hibernation feature, to handle the wakeup or hibernation interrupt, add host mode "wakeup" interrupt-names optional property in the binding schema to capture remote-wakeup and connect/ disconnect event in the hibernation state and increased maxItems to 4 for the interrupts and interrupt-names property. We have a dedicated IRQ line specifically for the hibernation feature. When the "wakeup" IRQ line is triggered, it initiates a hibernation interrupt, causing the system to wake up from the hibernation state. Signed-off-by: Piyush Mehta Acked-by: Conor Dooley Reviewed-by: Rob Herring Link: https://lore.kernel.org/r/20230619105032.2888128-1-piyush.mehta@amd.com Signed-off-by: Greg Kroah-Hartman commit 32db98b92c8a204dcf3e178a1368f8320589c56e Author: Michael Straube Date: Mon Jun 19 17:52:03 2023 +0200 staging: rtl8192e: remove 5G related code In previous patches we removed 5G code since the hardware that uses this driver does not support 5G. There is still some 5G related code, remove it. All the removed defines are unused and we can safely remove "N-5G" from the rtllib_modes array. Signed-off-by: Michael Straube Tested-by: Philipp Hortmann Link: https://lore.kernel.org/r/20230619155203.6039-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 910b5ee9b33a1acf91a6e4bbcc7861a19fb9603c Author: Michael Straube Date: Mon Jun 19 17:09:53 2023 +0200 staging: rtl8192e: remove comparison to true Remove a comparison to true reported by checkpatch. CHECK: Using comparison to true is error prone Signed-off-by: Michael Straube Tested-by: Philipp Hortmann Link: https://lore.kernel.org/r/20230619150953.22484-5-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit d9902ac3a7cd3008057e8e4cde2688fcddecd68b Author: Michael Straube Date: Mon Jun 19 17:09:52 2023 +0200 staging: rtl8192e: remove return statement from void function Remove unnecessary return statement from the void function rtl92e_config_mac(). Issue found by checkpatch. WARNING: void function return statements are not generally useful Signed-off-by: Michael Straube Tested-by: Philipp Hortmann Link: https://lore.kernel.org/r/20230619150953.22484-4-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 18b89d19238242147c3d00134329bb39b4ed33d1 Author: Michael Straube Date: Mon Jun 19 17:09:51 2023 +0200 s